Abnormal behavior collaborative screening method and system based on mobile internet

Abstract

The application provides an abnormal behavior cooperative screening method and system based on a mobile internet, which comprises the following steps: receiving a first input of a user; generating a first rule in response to the first input and storing the first rule into a first database; obtaining harmful information from the mobile internet based on the first rule; extracting and cleaning based on the harmful information, generating abnormal behavior data, and storing the abnormal behavior data into a second database; receiving a second input of the user; obtaining target abnormal behavior information matched with the second input based on the first database and the second database in response to the second input; wherein the first input comprises an abnormal behavior characteristic identifier, the second input comprises the abnormal behavior characteristic identifier and a correlation, and the number of the first rule is one or more. The abnormal behavior cooperative screening method and system based on the mobile internet can improve the accuracy and comprehensiveness of the abnormal behavior data, and further improve the convenience of active retrieval.

Description

Technical Field

[0001] This invention relates to the field of mobile internet technology, and in particular to a collaborative screening method and system for abnormal behavior based on mobile internet. Background Technology

[0002] In existing technologies, internet companies and operators can automatically block harmful information to monitor abnormal behavior. However, the mobile internet carries massive amounts of abnormal behavior data. Proactively filtering and statistically analyzing this data, categorizing harmful information according to its sensitivity, is crucial for information security and is a pressing issue that the industry urgently needs to address. Summary of the Invention

[0003] This invention provides a collaborative screening method and system for abnormal behavior based on the mobile Internet, which solves the shortcomings of the existing technology in the low efficiency of active screening and statistical analysis of harmful information, and improves the accuracy, scalability and comprehensiveness of active screening of abnormal behavior data.

[0004] This invention provides a collaborative screening method for abnormal behavior based on mobile internet, comprising:

[0005] Receive the user's first input;

[0006] In response to the first input, a first rule is generated and stored in the first database;

[0007] Based on the first rule, harmful information is obtained from the mobile internet;

[0008] Based on the harmful information, it is extracted and cleaned to generate abnormal behavior data, which is then stored in the second database.

[0009] Receive the user's second input;

[0010] In response to the second input, based on the first database and the second database, target abnormal behavior information matching the second input is obtained;

[0011] The first input includes an abnormal behavior feature identifier, the second input includes the abnormal behavior feature identifier and the association relationship, and the number of the first rules is one or more.

[0012] According to the present invention, a collaborative screening method for abnormal behavior based on mobile Internet is provided, wherein the step of generating a first rule in response to the first input and storing it in a first database includes:

[0013] Based on the first input, the abnormal behavior feature identifier is extracted;

[0014] Based on the abnormal behavior feature identifiers, the first rule is obtained using a feature combination algorithm;

[0015] Based on each of the first rules, associated information is set and stored in the first database.

[0016] According to the present invention, a collaborative screening method for abnormal behavior based on mobile internet is provided, wherein the step of extracting and cleaning the harmful information to generate abnormal behavior data and storing it in a second database includes:

[0017] Based on the harmful information, the abnormal behavior data corresponding to each of the first rules is obtained using a multi-association algorithm;

[0018] The abnormal behavior data is stored in the second database according to the associated information.

[0019] According to the present invention, a collaborative screening method for abnormal behavior based on mobile Internet is provided, wherein, in response to the second input, target abnormal behavior information matching the second input is obtained based on the first database and the second database, including:

[0020] Based on the second input, the target rule is generated;

[0021] If the target rule matches the first database, obtain the target association information;

[0022] If the target association information matches the second database, the target abnormal behavior information is obtained.

[0023] According to the present invention, a collaborative screening method for abnormal behavior based on mobile internet, after extracting and cleaning the harmful information to generate abnormal behavior data and storing it in a second database, further includes:

[0024] Receive third input from the user;

[0025] In response to the third input, based on the first database and the second database, an analysis result matching the second input is obtained.

[0026] According to the present invention, a collaborative screening method for abnormal behavior based on mobile Internet is provided, wherein obtaining harmful information from mobile Internet based on the first rule includes:

[0027] Based on the first rule, a crawling instruction is generated;

[0028] Based on the crawling instructions, the harmful information is crawled using web crawling technology.

[0029] This invention also provides a collaborative screening system for abnormal behavior based on the mobile Internet, comprising:

[0030] The first receiving module is used to receive the user's first input;

[0031] The first response module is used to respond to the first input, generate a first rule, and store it in the first database;

[0032] The data acquisition module is used to acquire harmful information from the mobile Internet based on the first rule;

[0033] The extraction and cleaning module is used to extract and clean the harmful information, generate abnormal behavior data, and store it in the second database.

[0034] The second receiving module is used to receive the user's second input;

[0035] The second response module is used to respond to the second input and, based on the first database and the second database, obtain target abnormal behavior information that matches the second input;

[0036] The first input includes an abnormal behavior feature identifier, the second input includes the abnormal behavior feature identifier and the association relationship, and the number of the first rules is one or more.

[0037] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of any of the above-described mobile Internet-based collaborative screening methods for abnormal behavior.

[0038] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the mobile Internet-based collaborative screening method for abnormal behavior as described above.

[0039] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of any of the above-described mobile Internet-based collaborative screening methods for abnormal behavior.

[0040] The present invention provides a collaborative screening method and system for abnormal behavior based on the mobile internet. This method involves setting abnormal behavior feature identifiers to form a first rule, which is stored in a first database. Harmful information that matches the first rule is collected, extracted, and cleaned. The generated abnormal behavior data is then stored in a second database. Active retrieval is performed using a second input, matching the target abnormal behavior information between the first and second databases. This improves the accuracy and comprehensiveness of abnormal behavior data, thereby enhancing the convenience of active retrieval. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0042] Figure 1 This is a flowchart illustrating the collaborative screening method for abnormal behavior based on the mobile internet provided by the present invention.

[0043] Figure 2 This is a schematic diagram of the structure of the mobile Internet-based collaborative screening system for abnormal behavior provided by the present invention;

[0044] Figure 3 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0045] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0046] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and are not used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and are not limited in number; for example, a first object can be one or more.

[0047] It should be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0048] The terms “comprising” and “including” indicate the presence of the described feature, whole, step, operation, element and / or component, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or collections thereof.

[0049] Figure 1 This is a flowchart illustrating the collaborative screening method for abnormal behavior based on the mobile internet provided by this invention. Figure 1 As shown, the abnormal behavior collaborative screening method based on mobile Internet provided by the embodiment of the present invention includes: step 101, receiving the user's first input.

[0050] The first input includes an identifier of abnormal behavior characteristics.

[0051] It should be noted that the execution entity of the mobile Internet-based collaborative screening method for abnormal behavior provided in this embodiment of the invention is a mobile Internet-based collaborative screening system for abnormal behavior.

[0052] Optionally, the mobile internet-based abnormal behavior collaborative screening system can be a software system that runs on an electronic device.

[0053] The electronic device can be a mobile electronic device or a non-mobile electronic device. For example, a mobile electronic device can be a mobile phone, tablet computer, laptop computer, PDA, in-vehicle electronic device, wearable device, ultra-mobile personal computer (UMPC), netbook, or personal digital assistant (PDA), etc., while a non-mobile electronic device can be a server, network attached storage (NAS), personal computer (PC), etc. The present invention does not make specific limitations.

[0054] Optionally, the mobile internet-based collaborative screening system for abnormal behavior can also be a distributed software system. This embodiment of the invention does not impose specific limitations in this regard.

[0055] For example, one part of the mobile Internet-based collaborative screening system for abnormal behavior is a web application that runs on distributed nodes (e.g., PCs), while another part of the mobile Internet-based collaborative screening system for abnormal behavior runs on a central node (e.g., a server) to respond.

[0056] The operating system on the PC can be Windows XP, Windows 7, Windows 8, or Windows 10, and it supports browsers such as Firefox and Chrome. This embodiment of the invention does not specifically limit this.

[0057] Web applications can be compiled using open-source JavaScript technology, echarts graphical technology, and other technologies. This embodiment of the invention does not impose specific limitations on this.

[0058] Users of the mobile internet-based abnormal behavior collaborative screening system are organizations or functional departments with the authority to monitor network data running in multiple software programs or browsers on the mobile internet, such as telecom operators and government functional departments that regulate network security.

[0059] The application scenario on the PC is that users open the web application's access point in a browser on their PC, establish a communication request by setting up a filtering task in the display interface, and obtain the execution result of the filtering task.

[0060] The server-side application scenario involves receiving communication requests based on filtering tasks, responding to them to generate the execution results of the filtering tasks, and then sending them to the PC.

[0061] It should be noted that in step 101, the user can input the first input into the display interface of the mobile Internet-based abnormal behavior collaborative screening system on the PC based on the process of setting abnormal behavior feature identifiers.

[0062] The first input is used to set the abnormal behavior characteristic identifier. Users can use the first input to select several controls in the web application's display interface to complete the setting of the abnormal behavior characteristic identifier.

[0063] Among them, abnormal behavior feature identifiers refer to explicit and / or implicit feature data extracted from abnormal behaviors in network behavior data. Abnormal behavior feature identifiers are used to distinguish between normal and abnormal behaviors. Abnormal behavior feature identifiers include, but are not limited to, sensitive word fields, data submission frequency, and data source. This embodiment of the invention does not specifically limit the number of abnormal behavior feature identifiers.

[0064] Optionally, the first input can be touch input, voice input, gesture input, or key input to several controls in the aforementioned display interface. The first input can also be the first operation, which includes instructions in the process of determining and setting abnormal behavior characteristic identifiers.

[0065] Step 102: In response to the first input, generate the first rule and store it in the first database.

[0066] The number of first rules can be one or more.

[0067] It should be noted that the first input is a request message sent from the PC to the server. The server responds to the request message, performs the corresponding processing, and sends the feedback back to the PC.

[0068] Specifically, in step 102, after the server receives the first input from step 101, the mobile Internet-based abnormal behavior collaborative screening system sequentially performs the corresponding operations according to the instructions contained in the first input, identifies the abnormal behavior features contained in the first input, randomly combines them based on the explicit and implicit relationships between the identifiers, and stores the enumerated first rules into the first database.

[0069] The first rule refers to the relational expression form composed of abnormal behavior feature identifiers and their associated relationships (e.g., logical relationships, semantic relationships, etc.). The number of first rules is determined by the number of abnormal behavior feature identifiers and the number of associated relationships they have; however, this invention does not impose specific limitations on this.

[0070] For example, the abnormal behavior feature identifier may include "sensitive field A" and "sensitive field B". Based on their corresponding semantic relationship, at least the first rule corresponding to malicious rumors can be enumerated, that is, sensitive field A is sensitive field B.

[0071] For example, the abnormal behavior feature identifier may include "sensitive field A", "sensitive field B" and data submission frequency C. Based on their corresponding logical relationship, at least the first rule corresponding to malicious screen spamming can be enumerated, that is, it includes sensitive field A and sensitive field B, and the data submission frequency C is greater than a certain threshold.

[0072] The first database is used to store the first rules. This embodiment of the invention does not specifically limit the first database.

[0073] Optionally, the first database can be a relational database, such as Oracle, MySQL, Microsoft SQL Server, SQLite, PostgreSQL, IBM DB2, etc.

[0074] Optionally, the first database can be a non-relational database, such as Redis, Memcached, Riak, Bigtable, HBase, Cassandra, MongoDB, CouchDB, MarkLogic, etc.

[0075] It should be noted that setting abnormal behavior identifiers through web applications requires a stable network connection.

[0076] Step 103: Based on the first rule, obtain harmful information from the mobile Internet.

[0077] Specifically, in step 103, the mobile internet-based abnormal behavior collaborative screening system reads the first rule from the first database and extracts harmful information from the mobile internet according to the corresponding first rule.

[0078] Harmful information refers to malicious network activity that violates the first rule among the massive amounts of information available in various mobile internet applications and browsers. The sources of harmful information can be specified data provided by the companies that offer these applications and browsers, or information can be intercepted and collected within the core network of mobile operators.

[0079] Step 104: Based on harmful information, extract and clean it to generate abnormal behavior data and store it in the second database.

[0080] Specifically, in step 104, the mobile Internet-based abnormal behavior collaborative screening system extracts and cleans the harmful information obtained in step 103, structures the obtained effective key information into abnormal behavior data, and stores it in the second database.

[0081] Abnormal behavior data refers to information fragments that correspond to harmful information that hits the first rule. These information fragments contain the substantive content of abnormal behavior.

[0082] The second database is used to store abnormal behavior data. This embodiment of the invention does not specifically limit the second database.

[0083] Preferably, the second database and the first database in step 102 are of the same type and are both stored in the same path.

[0084] With existing technology, criminals can evade surveillance to a certain extent and maliciously spread harmful information by combining information fragments in a specific way.

[0085] The mobile internet-based abnormal behavior collaborative screening system of this invention first identifies abnormal behavior features and uses random sampling to enumerate various combinations of first rules. Then, it extracts various abnormal behavior data corresponding to each first rule from harmful data that conforms to the first rule, which can effectively avoid various malicious propagation methods.

[0086] Step 105: Receive the user's second input.

[0087] The second input includes abnormal behavior feature identifiers and related relationships.

[0088] Specifically, in step 105, the user can input a second input into the display interface of the mobile Internet-based abnormal behavior collaborative screening system on the PC, based on the process of creating an active retrieval of abnormal behavior information of a certain type.

[0089] The second input is used to actively retrieve information about a specific type of abnormal behavior. Users can use this second input to select several controls in the web application's display interface to actively retrieve information about a specific type of abnormal behavior.

[0090] In addition to setting abnormal behavior feature identifiers, the second input also needs to set the association between abnormal behavior feature identifiers to uniquely determine the corresponding search query.

[0091] Optionally, the second input can be touch input, voice input, gesture input, or key input to several controls in the aforementioned display interface. The second input can also be a second operation, including instructions in a process for creating an active retrieval of a certain type of abnormal behavior feature identifier.

[0092] Step 106: In response to the second input, obtain the target abnormal behavior information that matches the second input based on the first database and the second database.

[0093] Specifically, in step 106, after the server receives the second input from step 105, the mobile Internet-based abnormal behavior collaborative screening system executes the corresponding operations according to the instructions contained in the second input, and actively searches for the retrieval formula composed of the abnormal behavior feature identifiers and their associations contained in the second input. First, it matches the first rule corresponding to the retrieval formula in the first database. Then, under the condition of determining the first rule, it queries the abnormal behavior information corresponding to it from the second database and feeds it back to the display interface of the PC as the target abnormal behavior information for display.

[0094] Target abnormal behavior information refers to abnormal behavior information that users actively retrieve from the second database in step 104 based on the requirements of the filtering task.

[0095] In existing technologies, internet companies automatically screen and filter harmful information to some extent. However, when operators or relevant government departments conduct further review or supervision of all harmful information carried on the mobile internet, active searching through massive amounts of data may result in omissions.

[0096] The embodiments of the present invention, by simply setting abnormal behavior feature identifiers, enumerate the first rules under various possibilities, and collect harmful data that hit each first rule, can extract and store abnormal behavior information, thus avoiding omissions.

[0097] This invention proposes a method to create a first rule based on the combination of abnormal behavior feature identifiers and store it in a first database. Harmful information that matches the first rule is collected, extracted, and cleaned. The resulting abnormal behavior data is then stored in a second database. Active retrieval is performed using a second input to match target abnormal behavior information between the first and second databases. This improves the accuracy and comprehensiveness of abnormal behavior data, thereby enhancing the convenience of active retrieval.

[0098] Based on any of the above embodiments, in response to the first input, a first rule is generated and stored in the first database, including: extracting abnormal behavior feature identifiers based on the first input.

[0099] Specifically, in step 102, the mobile Internet-based abnormal behavior collaborative screening system extracts the abnormal behavior feature identifiers set by the user on the PC from the first input request information according to the specified data fields.

[0100] Based on the abnormal behavior feature identification, the first rule is obtained using a feature combination algorithm.

[0101] Specifically, the mobile internet-based abnormal behavior collaborative screening system will extract abnormal behavior feature identifiers, combine them according to a feature combination algorithm, and generate a first rule based on the association combination.

[0102] The feature combination algorithm is an algorithm that combines and matches abnormal behavior feature identifiers under multiple conditions to satisfy abnormal behavior rules and generate high-precision feature identifiers. Feature combination algorithms include, but are not limited to, feature cross, synthetic feature, and one-hot encoding algorithms, etc., and the embodiments of this invention do not specifically limit these algorithms.

[0103] Based on each first rule, set the associated information and store it in the first database.

[0104] It should be noted that the association information refers to the representation information that links the first database and the second database. The association information can be preset, and this embodiment of the invention does not impose specific limitations on it. For example, the association information can be a numeric ID generated according to different first rules.

[0105] Specifically, the mobile internet-based abnormal behavior collaborative screening system sets corresponding association information for different first rules, and stores the first rules and association information in the first database in the form of rows or columns.

[0106] The first database, stored independently of the second database, can continuously expand its stored rules based on new abnormal behavior feature identifiers added by users, facilitating further proactive retrieval.

[0107] This invention, based on the abnormal behavior feature identifiers included in the first input, generates a first rule according to a feature combination algorithm, and stores it in a first database in conjunction with related information. It can independently maintain the first database, thereby increasing the storage capacity of rule content and improving the convenience of proactive retrieval.

[0108] Based on any of the above embodiments, based on harmful information, extraction and cleaning are performed to generate abnormal behavior data, which is then stored in a second database. This includes: based on harmful information, using a multi-association algorithm, obtaining abnormal behavior data corresponding to each first rule.

[0109] Specifically, in step 104, the mobile Internet-based abnormal behavior collaborative screening system uses a multi-association algorithm to extract highly similar and effective data from harmful information that hits the first rule according to a multi-level association hit mechanism, thereby obtaining abnormal behavior data.

[0110] Among them, the multi-association algorithms include, but are not limited to, the Apriori algorithm, the PCY algorithm, the multi-stage algorithm, the multi-hash algorithm, the FP-Tree algorithm, the XFP-Tree algorithm, and the GPApriori algorithm, etc., and the embodiments of the present invention do not specifically limit them.

[0111] Abnormal behavior data is stored in the second database according to the associated information.

[0112] Specifically, the mobile internet-based abnormal behavior collaborative screening system extracts abnormal behavior data from harmful information that hits different first rules, sets association information corresponding to the first rules, and stores the abnormal behavior data and association information in the form of rows or columns in the second database.

[0113] The second database, stored independently of the first database, can identify new abnormal behavior characteristics added by users. Through continuously expanding the first rules, it can obtain more harmful information that matches the rules. By extracting and cleaning, it can expand the content of abnormal behavior, which is convenient for further proactive retrieval.

[0114] It is understood that a mobile internet-based collaborative screening system for abnormal behavior can centrally store feature combination algorithms and multi-association algorithms in the same path on the server side to form an algorithm library. Users can independently maintain the algorithm library to update and manage data processing methods. The engines required for using the algorithms in the algorithm library include, but are not limited to, Java, Hive, Tez, and Spark; this embodiment of the invention does not specifically limit these engines.

[0115] This invention utilizes a multi-association algorithm to process harmful information that matches the first rule, obtaining abnormal behavior data, and storing it in a second database in conjunction with association information. The second database can be maintained independently, increasing the storage capacity of abnormal behavior content and thus improving the convenience of proactive retrieval.

[0116] Based on any of the above embodiments, in response to the second input, target abnormal behavior information matching the second input is obtained based on the first database and the second database, including: generating target rules based on the second input.

[0117] Specifically, in step 106, the mobile Internet-based abnormal behavior collaborative screening system extracts the abnormal behavior feature identifiers and their associations set by the user on the PC from the request information of the second input, according to the specified data fields, and obtains the target rules corresponding to the second input.

[0118] If the target rule matches the first database, obtain the target association information.

[0119] Specifically, after acquiring the target rules, the mobile internet-based abnormal behavior collaborative screening system compares and matches them with the first database. The matching results include two types: successful matching and failed matching.

[0120] A successful match means that the target rule matches the first rule stored in the first database stored locally. This indicates that there is a first rule in the first database that is consistent with the content of the target rule. In this case, the association information corresponding to the first rule is obtained as the target association information.

[0121] A match failure occurs when the target rule does not match the first rule stored in the first database stored locally. This indicates that there is no first rule in the first database that matches the content of the target rule, and an empty value is returned to the PC.

[0122] If the target's association information matches the second database, information on the target's abnormal behavior is obtained.

[0123] Specifically, after the mobile internet-based abnormal behavior collaborative screening system matches the target-related information, it compares and matches it with a second database. The matching result includes two types: successful match and failed match.

[0124] A successful match means that the target association information matches the association information stored in the second database stored locally. This indicates that there is association information in the second database that matches the target association information. In this case, the abnormal behavior information corresponding to the association information is obtained as the target abnormal behavior information and fed back to the PC in the form of search results.

[0125] A match failure occurs when the target association information does not match the association information stored in the second database stored locally. This indicates that there is no association information in the second database that matches the target association information, and a null value is returned to the PC.

[0126] The embodiments of the present invention do not specifically limit the matching method of the first database and the second database.

[0127] Preferably, both the first and second databases utilize the Elasticsearch (ES) full-text search system. The mobile internet-based collaborative filtering system for abnormal behavior can leverage Elasticsearch to perform distributed RESTful-style fuzzy searches on both databases, quickly finding matching data.

[0128] This invention employs a second input to extract target rules for proactive retrieval and filtering. It obtains target-related information by matching the target rules with a first database, and then obtains abnormal target behavior information by matching the target-related information with a second database. This approach allows for the association of two independent databases through target-related information during proactive retrieval and filtering, expanding the search scope and thus improving the convenience of proactive retrieval.

[0129] Based on any of the above embodiments, after extracting and cleaning harmful information, generating abnormal behavior data, and storing it in the second database, the method further includes: receiving a third input from the user.

[0130] Specifically, after step 104, the user can input a third input into the PC-based display interface of the mobile internet-based collaborative screening system for abnormal behavior, based on the process of creating an active analysis of abnormal behavior information.

[0131] The third input is used to create proactive analysis of abnormal behavior information. Users can use this third input to select several controls in the web application's display interface to proactively analyze abnormal behavior information.

[0132] The active analysis of abnormal behavior information includes, but is not limited to, operations such as classification and multidimensional statistics. This embodiment of the invention does not specifically limit these operations.

[0133] For example, the third input may include category information set according to the needs of the classification task, including but not limited to network action time period, user credit level, and sensitivity level.

[0134] For example, the third input may include dimensional information and statistical method information set according to the needs of the multidimensional statistical task, and the embodiments of the present invention do not specifically limit this.

[0135] Optionally, the third input can be touch input, voice input, gesture input, or key input to several controls in the aforementioned display interface. The third input can also be a third operation, including instructions in a process for creating proactive analysis of abnormal behavior information.

[0136] In response to the third input, based on the first and second databases, the analysis results that match the second input are obtained.

[0137] Specifically, after receiving the third input on the server side, the mobile Internet-based abnormal behavior collaborative screening system executes the corresponding operations according to the instructions contained in the third input, retrieves the matching first rule from the first database based on the task information contained in the third input, and then queries the second database to find the corresponding abnormal behavior information based on the first rule. The system then processes the abnormal behavior information according to the operation indicated by the task information and obtains the corresponding analysis results to be displayed on the PC terminal.

[0138] The embodiments of the present invention do not impose specific limitations on the analysis results.

[0139] Optionally, the analysis results can be the classification results of abnormal behavior information in response to the classification task requirements set by the user.

[0140] Optionally, the analysis results can be statistical results on different dimensions of abnormal behavior information, based on the multidimensional statistical task requirements set by the user.

[0141] This invention provides an embodiment of proactive analysis based on a third input. Analysis results are obtained through correlation and matching with a first database and a second database. By combining two independent databases for correlation and matching during proactive analysis, the search scope is expanded, thereby improving the convenience of proactive analysis.

[0142] Based on any of the above embodiments, obtaining harmful information from the mobile Internet based on the first rule includes: generating a crawling instruction based on the first rule.

[0143] Specifically, in step 103, after the user sets the first input on the PC, the server of the mobile Internet-based abnormal behavior collaborative screening system responds by obtaining the first rule and automatically generates a crawling instruction based on the first rule.

[0144] Based on crawling instructions, web crawler technology is used to crawl harmful information.

[0145] Specifically, the server side of the mobile internet-based abnormal behavior collaborative screening system sets the data pattern to be crawled by the web crawler through crawling instructions, and obtains harmful information from the mobile internet that can hit the first rule.

[0146] The embodiments of the present invention generate crawling instructions according to the first rule, crawl harmful information in the mobile Internet that hits the first rule, and can provide a data foundation for extracting abnormal behavior data.

[0147] Figure 2 This is a schematic diagram of the abnormal behavior collaborative screening system based on the mobile Internet provided by the present invention. Based on any of the above embodiments, such as... Figure 2 As shown, the system includes: a first receiving module 210, a first response module 220, a data acquisition module 230, an extraction and cleaning module 240, a second receiving module 250, and a second response module 260, wherein:

[0148] The first receiving module 210 is used to receive the user's first input.

[0149] The first response module 220 is used to generate a first rule in response to a first input and store it in a first database.

[0150] The data acquisition module 230 is used to acquire harmful information from the mobile Internet based on the first rule.

[0151] The extraction and cleaning module 240 is used to extract and clean harmful information, generate abnormal behavior data, and store it in the second database.

[0152] The second receiving module 250 is used to receive the user's second input.

[0153] The second response module 260 is used to respond to the second input and, based on the first database and the second database, obtain target abnormal behavior information that matches the second input.

[0154] The first input includes an abnormal behavior feature identifier, the second input includes an abnormal behavior feature identifier and a correlation relationship, and the number of first rules is one or more.

[0155] Specifically, the first receiving module 210, the first response module 220, the data acquisition module 230, the extraction and cleaning module 240, the second receiving module 250, and the second response module 260 are electrically connected in sequence.

[0156] The first receiving module 210 receives information from the user through a process that allows setting abnormal behavior feature identifiers, and inputs the first input into the display interface of the mobile Internet-based abnormal behavior collaborative screening system on the PC.

[0157] The first response module 220 executes the corresponding operations according to the instructions contained in the first input, identifies the abnormal behavior features contained in the first input, randomly combines the explicit and implicit relationships between the identifiers, and stores the enumerated first rules into the first database.

[0158] The first rule refers to the relational expression form composed of abnormal behavior feature identifiers and their related relationships (e.g., logical relationships, semantic relationships, etc.).

[0159] The data acquisition module 230 reads the first rule from the first database and extracts harmful information from the mobile Internet according to the corresponding first rule.

[0160] Harmful information refers to malicious network action information that hits the first rule among the massive amounts of information in various mobile internet applications and browsers.

[0161] The extraction and cleaning module 240 extracts and cleans the harmful information obtained from the data acquisition module 230, and performs structured processing on the obtained effective key information into abnormal behavior data, which is then stored in the second database.

[0162] Abnormal behavior data refers to information fragments that correspond to harmful information that hits the first rule. These information fragments contain the substantive content of abnormal behavior.

[0163] The second receiving module 250 receives a process from the user who can actively search for information on a certain type of abnormal behavior based on the creation of a system, and inputs the second input into the display interface of the mobile Internet-based abnormal behavior collaborative screening system on the PC.

[0164] The second response module 260 executes the corresponding operations according to the instructions contained in the second input, and actively searches for the retrieval formula composed of the abnormal behavior feature identifiers and their associations contained in the second input. First, it matches the first rule corresponding to the retrieval formula in the first database. Then, under the condition of determining the first rule, it queries the abnormal behavior information corresponding to it in the second database and feeds it back to the display interface of the PC as the target abnormal behavior information for display.

[0165] Optionally, the first response module further includes: an identifier extraction unit, a combination unit, and a first storage unit, wherein:

[0166] The identifier extraction unit is used to extract abnormal behavior feature identifiers based on the first input.

[0167] The combination unit is used to obtain the first rule based on the abnormal behavior feature identification and the feature combination algorithm.

[0168] The first storage unit is used to set association information based on each first rule and store it in the first database.

[0169] Optionally, the extraction and cleaning module further includes an association unit and a second storage unit, wherein:

[0170] The association unit is used to obtain abnormal behavior data corresponding to each first rule based on harmful information and using a multi-association algorithm.

[0171] The second storage unit is used to store abnormal behavior data into the second database according to the associated information.

[0172] Optionally, the second response module further includes: a rule generation unit, a first matching unit, and a second matching unit, wherein:

[0173] The rule generation unit is used to generate target rules based on the second input.

[0174] The first matching unit is used to obtain target association information when the target rule matches the first database.

[0175] The second matching unit is used to obtain abnormal behavior information of the target when the target association information matches the second database.

[0176] Optionally, the mobile internet-based collaborative screening system for abnormal behavior further includes a third receiving module and a third response module, wherein:

[0177] The third receiving module is used to receive third input from the user.

[0178] The third response module is used to respond to the third input and, based on the first and second databases, obtain analysis results that match the second input.

[0179] Optionally, the data acquisition module further includes: an instruction generation unit and a crawling unit, wherein:

[0180] The instruction generation unit is used to generate crawling instructions based on the first rule.

[0181] The crawling unit is used to crawl harmful information based on crawling instructions and using web crawling technology.

[0182] This invention proposes a method to create a first rule based on the combination of abnormal behavior feature identifiers and store it in a first database. Harmful information that matches the first rule is collected, extracted, and cleaned. The resulting abnormal behavior data is then stored in a second database. Active retrieval is performed using a second input to match target abnormal behavior information between the first and second databases. This improves the accuracy and comprehensiveness of abnormal behavior data, thereby enhancing the convenience of active retrieval.

[0183] Figure 3 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 3As shown, the electronic device may include a processor 310, a communications interface 320, a memory 330, and a communication bus 340, wherein the processor 310, communications interface 320, and memory 330 communicate with each other via the communication bus 340. The processor 310 can invoke logical instructions in the memory 330 to execute a mobile internet-based collaborative screening method for abnormal behavior. This method includes: receiving a first input from a user; generating a first rule in response to the first input and storing it in a first database; obtaining harmful information from the mobile internet based on the first rule; extracting and cleaning the harmful information to generate abnormal behavior data and storing it in a second database; receiving a second input from a user; and obtaining target abnormal behavior information matching the second input based on the first and second databases in response to the second input. The first input includes an abnormal behavior feature identifier, the second input includes an abnormal behavior feature identifier and a correlation relationship, and the number of first rules is one or more.

[0184] Furthermore, the logical instructions in the aforementioned memory 330 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0185] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the mobile Internet-based collaborative screening method for abnormal behavior provided by the above methods. The method includes: receiving a first input from a user; generating a first rule in response to the first input and storing it in a first database; obtaining harmful information from the mobile Internet based on the first rule; extracting and cleaning the harmful information to generate abnormal behavior data and storing it in a second database; receiving a second input from a user; and obtaining target abnormal behavior information matching the second input based on the first and second databases in response to the second input. The first input includes an abnormal behavior feature identifier, the second input includes an abnormal behavior feature identifier and a correlation relationship, and the number of the first rules is one or more.

[0186] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the collaborative screening method for abnormal behavior based on the mobile Internet provided by the above methods. The method includes: receiving a first input from a user; generating a first rule in response to the first input and storing it in a first database; obtaining harmful information from the mobile Internet based on the first rule; extracting and cleaning the harmful information to generate abnormal behavior data and storing it in a second database; receiving a second input from a user; and obtaining target abnormal behavior information matching the second input based on the first and second databases in response to the second input. The first input includes an abnormal behavior feature identifier, the second input includes an abnormal behavior feature identifier and a correlation relationship, and the number of the first rules is one or more.

[0187] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0188] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0189] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A collaborative screening method for abnormal behavior based on mobile internet, characterized in that, include: Receive the user's first input; In response to the first input, a first rule is generated and stored in the first database; Based on the first rule, harmful information is obtained from the mobile internet; Based on the harmful information, it is extracted and cleaned to generate abnormal behavior data, which is then stored in the second database. Receive the user's second input; In response to the second input, based on the first database and the second database, target abnormal behavior information matching the second input is obtained; The first input includes an abnormal behavior feature identifier, the second input includes the abnormal behavior feature identifier and the association relationship, and the number of the first rules is one or more; The step of generating a first rule in response to the first input and storing it in a first database includes: Based on the first input, the abnormal behavior feature identifier is extracted; Based on the abnormal behavior feature identifiers, the first rule is obtained by using a feature combination algorithm, specifically including: using the feature combination algorithm to randomly combine the explicit and implicit relationships between the abnormal behavior feature identifiers, and enumerating to obtain the first rule; Based on each of the first rules, association information is set and stored in the first database; The step of extracting and cleaning the harmful information to generate abnormal behavior data and storing it in the second database includes: Based on the harmful information, the abnormal behavior data corresponding to each of the first rules is obtained by using a multi-association algorithm. Specifically, the abnormal behavior data is obtained by using a multi-association algorithm to extract similar data from the harmful information that hits each of the first rules according to a multi-level association hit mechanism. The abnormal behavior data is stored in the second database according to the associated information.

2. The collaborative screening method for abnormal behavior based on mobile internet according to claim 1, characterized in that, In response to the second input, based on the first database and the second database, the acquisition of target abnormal behavior information matching the second input includes: Based on the second input, the target rule is generated; If the target rule matches the first database, obtain the target association information; If the target association information matches the second database, the target abnormal behavior information is obtained.

3. The collaborative screening method for abnormal behavior based on mobile internet according to claim 1, characterized in that, After extracting and cleaning the harmful information to generate abnormal behavior data and storing it in the second database, the process further includes: Receive third input from the user; In response to the third input, based on the first database and the second database, an analysis result matching the second input is obtained.

4. The collaborative screening method for abnormal behavior based on mobile internet according to claim 1 or 3, characterized in that, The process of obtaining harmful information from the mobile internet based on the first rule includes: Based on the first rule, a crawling instruction is generated; Based on the crawling instructions, the harmful information is crawled using web crawling technology.

5. A collaborative screening system for abnormal behavior based on mobile internet, characterized in that, include: The first receiving module is used to receive the user's first input; The first response module is used to respond to the first input, generate a first rule, and store it in the first database; The data acquisition module is used to acquire harmful information from the mobile Internet based on the first rule; The extraction and cleaning module is used to extract and clean the harmful information, generate abnormal behavior data, and store it in the second database. The second receiving module is used to receive the user's second input; The second response module is used to respond to the second input and, based on the first database and the second database, obtain target abnormal behavior information that matches the second input; The first input includes an abnormal behavior feature identifier, the second input includes the abnormal behavior feature identifier and the association relationship, and the number of the first rules is one or more; The step of generating a first rule in response to the first input and storing it in a first database includes: Based on the first input, the abnormal behavior feature identifier is extracted; Based on the abnormal behavior feature identifiers, the first rule is obtained by using a feature combination algorithm, specifically including: using the feature combination algorithm to randomly combine the explicit and implicit relationships between the abnormal behavior feature identifiers, and enumerating to obtain the first rule; Based on each of the first rules, association information is set and stored in the first database; The step of extracting and cleaning the harmful information to generate abnormal behavior data and storing it in the second database includes: Based on the harmful information, the abnormal behavior data corresponding to each of the first rules is obtained by using a multi-association algorithm. Specifically, the abnormal behavior data is obtained by using a multi-association algorithm to extract similar data from the harmful information that hits each of the first rules according to a multi-level association hit mechanism. The abnormal behavior data is stored in the second database according to the associated information.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the mobile Internet-based collaborative screening method for abnormal behavior as described in any one of claims 1 to 4.

7. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the mobile Internet-based collaborative screening method for abnormal behavior as described in any one of claims 1 to 4.

8. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the mobile Internet-based collaborative screening method for abnormal behavior as described in any one of claims 1 to 4.

Images