Resource access anomaly detection method, device and equipment

Abstract

The present application provides a method, device and equipment for detecting abnormalities in resource access. The method of the present application determines the original time series data of the account accessing the resource in the time period to be detected according to the behavior data of the account accessing the resource in the time period to be detected, and the original time series data includes the timestamp and access frequency of each unit time period in the time period to be detected, and the start timestamp of the time period to be detected; the original time series data is input into a multi-task autoencoder for reconstruction to obtain multiple reconstructed time series data; the multiple reconstructed time series data are compared with the original time series data to determine the abnormality detection result, and the abnormality detection result includes the unit time period in which the abnormal access behavior exists in the time period to be detected, thereby improving the accuracy of abnormality detection of account access to resources and reducing the false alarm rate and missed alarm rate of abnormality detection.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, device and equipment for detecting anomalies in resource access. Background Art

[0002] In large-scale application systems, there are often multiple accounts, including accounts with different roles, multiple accounts with the same role, etc. Due to the different roles or users of different accounts, the behaviors of different accounts accessing the same resource have different characteristics. In the process of these accounts accessing resources, there may be abnormal account usage. For example, the account is stolen by others, the account is used irregularly, and the mode of accessing resources between accounts has been changed without the authorization of the account owner. If the behavior of the account accessing a resource is significantly deviated from the frequency of the account's historical access to the same resource, it is considered that the account's access to this resource is abnormal.

[0003] There are two traditional anomaly detection methods. One is based on statistical theory. It determines the detection index by counting account access resources and combines the fixed thresholds set for the detection index to achieve anomaly detection of account access resources. However, these thresholds need to be set and optimized manually. The anomaly detection effect depends heavily on the quality of the fixed thresholds, which in turn depend on the experience and ability of the person who sets them. The effect is unstable and the false alarm rate is high. The other method is to detect anomalies of account access resources based on a single-task autoencoder. The anomaly detection results are unstable and the false alarm rate is high. Summary of the invention

[0004] The present application provides a resource access anomaly detection method, device and equipment to solve the problems of unstable anomaly detection results and high false alarm rate in current resource access scenarios.

[0005] On the one hand, the present application provides a method for detecting anomalies in resource access, comprising:

[0006] Determine original time series data of the account accessing the resource within the time period to be detected according to the behavior data of the account accessing the resource within the time period to be detected;

[0007] Inputting the original time series data into a multi-task autoencoder for reconstruction to obtain a plurality of reconstructed time series data;

[0008] The multiple reconstructed time series data are compared with the original time series data to determine an anomaly detection result.

[0009] On the other hand, the present application provides a resource access anomaly detection device, comprising:

[0010] A time series determination module, used to determine original time series data of the account accessing the resource within the time period to be detected based on the behavior data of the account accessing the resource within the time period to be detected;

[0011] A time series reconstruction module, used for inputting the original time series data into a multi-task autoencoder for reconstruction to obtain a plurality of reconstructed time series data;

[0012] The detection processing module is used to compare the multiple reconstructed time series data with the original time series data to determine an abnormality detection result.

[0013] On the other hand, the present application provides an electronic device, comprising: a processor, and a memory communicatively connected to the processor;

[0014] The memory stores computer-executable instructions;

[0015] The processor executes the computer-executable instructions stored in the memory to implement the above-mentioned method.

[0016] On the other hand, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to implement the above-described method when executed by a processor.

[0017] The resource access anomaly detection method, device and equipment provided in the present application determine the original time series data of the account accessing the resources within the time period to be detected based on the behavioral data of the account accessing the resources within the time period to be detected; input the original time series data into a multi-task autoencoder for reconstruction to obtain multiple reconstructed time series data; compare the multiple reconstructed time series data with the original time series data to determine the anomaly detection result, which includes the unit time period in which the abnormal access behavior exists within the time period to be detected, thereby improving the accuracy of anomaly detection of account access to resources and reducing the false alarm rate and missed alarm rate of anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0019] Figure 1 A schematic diagram of an exemplary network architecture on which this application is based;

[0020] Figure 2 A flow chart of a method for detecting abnormality in resource access provided by an exemplary embodiment of the present application;

[0021] Figure 3A framework diagram of a multi-task autoencoder provided as an exemplary embodiment of the present application;

[0022] Figure 4 A flow chart of a method for detecting abnormality in resource access provided by an exemplary embodiment of the present application;

[0023] Figure 5 A schematic diagram of the structure of a resource access anomaly detection device provided by an exemplary embodiment of the present application;

[0024] Figure 6 A schematic diagram of the structure of an electronic device provided in an exemplary embodiment of the present application.

[0025] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0026] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0027] First, the terms involved in this application are explained:

[0028] Temporal Convolutional Network (TCN): a convolutional neural network model.

[0029] Recurrent Neural Network (RNN): One of the commonly used time series deep learning network models.

[0030] Mean Square Error (MSE): is a performance function.

[0031] Application Programming Interface (API): It is an interface pre-defined by some applications, such as functions and HTTP interfaces.

[0032] In addition, the terms "first", "second", etc. are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. In the description of the following embodiments, the meaning of "multiple" is more than two, unless otherwise clearly and specifically defined.

[0033] In large-scale application systems, there are often multiple accounts, including accounts with different roles, multiple accounts with the same role, etc. Due to the different roles or users of different accounts, the behaviors of different accounts accessing the same resource have different characteristics. In the process of these accounts accessing resources, there may be abnormal account usage. For example, the account is stolen by others, the account is used irregularly, and the mode of accessing resources between accounts has been changed without the authorization of the account owner. If the behavior of the account accessing a resource is significantly deviated from the frequency of the account's historical access to the same resource, it is considered that the account's access to this resource is abnormal.

[0034] For example, in a cloud service scenario, under the main account of different enterprise users, there are usually multiple different sub-accounts under the enterprise. Different sub-accounts have different application programming interface (API) calling behaviors. During these calling behaviors, there are abnormal account usage. For example, the account is stolen by others, the account is used irregularly, and the mode of calling APIs between accounts has changed without the authorization of the account owner. If a certain API called by the account deviates significantly from the historical calling behavior, it is considered that the API call of the account is abnormal.

[0035] For the above application scenarios, traditional anomaly detection methods have technical problems such as unstable anomaly detection results and high false alarm rate.

[0036] The present application provides a resource access anomaly detection method, which is based on a multi-task autoencoder model. At each interval, based on the behavior data of each account accessing resources in the previous interval (time period to be detected), the original time series data of the account accessing resources in the time period to be detected is determined, and the original time series data includes the timestamp and access frequency of each unit time period in the time period to be detected, and the start timestamp of the time period to be detected; the original time series data is input into the multi-task autoencoder for reconstruction to obtain multiple reconstructed time series data; the multiple reconstructed time series data are compared with the original time series data to determine the anomaly detection result, and the anomaly detection result includes the unit time period in which the abnormal access behavior exists in the time period to be detected, which can greatly improve the accuracy of anomaly detection.

[0037] For example, Figure 1is a schematic diagram of an exemplary network architecture on which this application is based. Figure 1 The network architecture shown may specifically include a server and a terminal.

[0038] The terminal may be a hardware device with network communication, computing and information display functions, including but not limited to smart phones, tablet computers, desktop computers, IoT devices, etc. Through communication and interaction with the server, users can use their own accounts to access various resources provided by the server through the terminal.

[0039] The server can be a server cluster set up in the cloud. The server provides the resources that each user account needs to access, and can record and store the behavior data of each account accessing resources. The server also stores model data related to the multi-task autoencoding model. Through the preset computing logic in the server, the server can realize various computing functions such as model training and anomaly detection.

[0040] Based on the preset anomaly detection strategy and the behavioral data of the account accessing resources during the time period to be detected, the server determines the original time series data of the account accessing resources during the time period to be detected, inputs the original time series data into the multi-task autoencoder for reconstruction, and obtains multiple reconstructed time series data; the multiple reconstructed time series data are compared with the original time series data to determine the anomaly detection result.

[0041] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0042] Figure 2 This is a flow chart of a resource access anomaly detection method provided by an exemplary embodiment of the present application. The resource access anomaly detection method provided by this embodiment can be specifically applied to the aforementioned server. Figure 2 As shown, the specific steps of this method are as follows:

[0043] Step S201: determine original time series data of the account accessing resources within the time period to be detected based on the behavior data of the account accessing resources within the time period to be detected.

[0044] The original time series data includes the timestamp and access frequency of each unit period of the time period to be detected, and the start timestamp of the time period to be detected.

[0045] In actual applications, the server can perform an anomaly detection by executing an anomaly detection method for resource access at regular intervals according to a preset anomaly detection strategy.

[0046] For example, the anomaly detection strategy can be to perform an anomaly detection every hour based on the behavior data of each account accessing each resource in the previous hour.

[0047] Among them, the anomaly detection strategy can be: periodic anomaly detection, scheduled anomaly detection, etc. Based on different anomaly detection strategies, the time period to be detected when performing anomaly detection can be different. For example, when performing anomaly detection periodically, the time period to be detected can be the previous period; when performing anomaly detection periodically, the time period to be detected can be a historical time period before the scheduled time. The anomaly detection strategy and the time period to be detected can be set and adjusted according to the needs of the actual application scenario, and are not specifically limited here.

[0048] In this embodiment, when performing anomaly detection, the behavioral data of the account's access to resources within the time period to be detected is obtained, and the frequency of the account's access to resources in each unit time period of the time period to be detected, as well as the timestamp corresponding to each unit time period and the timestamp of the starting moment of the time period to be detected (i.e., the starting timestamp) are determined based on the behavioral data. The original time series data corresponding to the behavioral data of each account's access to each resource are arranged and generated in the order of the unit time periods.

[0049] Among them, each data item in the original time series data can be arranged in a set specified order. During the model training and anomaly detection process, a unified specified order can be used. The specific order is not specifically limited here.

[0050] Exemplarily, the original time series data can be arranged in any of the following ways: {start timestamp, frequency 1, timestamp 1, frequency 2, timestamp 2, …}, or {frequency 1, frequency 2, …, timestamp 1, timestamp 2, …, start timestamp}, or {timestamp 1: frequency 1, timestamp 2: frequency 2, …, start timestamp}.

[0051] Optionally, an account set that needs to be detected for anomalies may be configured. When detecting for anomalies, anomalies are detected for target accounts in the account set and the behavior of the target accounts accessing resources.

[0052] Optionally, a resource collection that needs to be detected for anomalies may be configured. When detecting anomalies, anomalies are detected for target resources in the resource collection and for the behavior of each account accessing the target resource.

[0053] Optionally, an account set and a resource set that need to be detected for anomalies may be configured. When detecting for anomalies, anomaly detection is performed on the target account in the account set and the target resource in the resource set, and the behavior of the target account accessing the target resource is detected for anomalies.

[0054] In addition, if you do not configure account collections and resource collections, anomaly detection is performed on each account's access to each resource by default.

[0055] The process of performing anomaly detection on the behavior of any account accessing any resource is consistent. This embodiment takes the process of performing anomaly detection on the behavior of one account accessing one resource as an example to exemplarily illustrate the process of anomaly detection.

[0056] Step S202: input the original time series data into the multi-task autoencoder for reconstruction to obtain a plurality of reconstructed time series data.

[0057] In this embodiment, the multi-task autoencoder is a trained autoencoder based on multi-task learning. During the model training process, the multi-task autoencoder learns the behavioral characteristics of each account's normal access to each resource. Compared with the single-task autoencoder, the multi-task autoencoder has a relatively lower loss function during training, and the feature extraction of the time series is more accurate and richer. At the same time, the fusion of multiple single-task autoencoders with good effects to form a multi-task autoencoder can combine the abnormal detection and recognition capabilities of each single-task autoencoder, so that the multi-task autoencoder can play the maximum effect.

[0058] After determining the original time series data, the original time series data of any account accessing any resource is input into the trained multi-task autoencoder. The trained multi-task autoencoder is used to reconstruct the behavior of the account accessing the resource based on the input original time series data to obtain multiple reconstructed time series data. The multiple reconstructed time series data reflect the behavioral characteristics of the account's normal access to the resource.

[0059] Step S203: compare the multiple reconstructed time series data with the original time series data to determine the anomaly detection result.

[0060] The anomaly detection result includes the unit time period in which the abnormal access behavior exists within the time period to be detected.

[0061] After reconstructing multiple reconstructed time series data through the multi-task autoencoder, by comparing the original time series data of the account accessing the resource with the multiple reconstructed time series data, the difference between the access frequency of each unit time period in the original time series data and the access frequency of the same unit time period in the multiple reconstructed time series data is analyzed. If the difference is large, it means that the possibility of the account accessing the resource in the unit time period is abnormal access behavior is high, and the unit time period is determined as a unit time period with abnormal access behavior.

[0062] Exemplarily, assuming that the original time series data of a certain account accessing a certain resource is sequence 1, after reconstruction using a multi-task autoencoder, the following three reconstructed sequences are obtained: sequence 2, sequence 3 and sequence 4. Then, by comparing the difference value a1 of the access frequency in the first unit time period between sequence 1 and sequence 2, comparing the difference a2 of the access frequency in the first unit time period between sequence 1 and sequence 3, and comparing the difference a3 of the access frequency in the first unit time period between sequence 1 and sequence 4, according to the difference values ​​a1, a2 and a3, if one or more of the difference values ​​are large, then the first unit time period is determined to be a unit time period with abnormal access behavior, or if the average of a1, a2 and a3 is large, then the first unit time period is determined to be a unit time period with abnormal access behavior.

[0063] This embodiment determines the original time series data of the account accessing resources within the time period to be detected based on the behavioral data of the account accessing resources within the time period to be detected, the original time series data including the timestamp and access frequency of each unit time period in the time period to be detected, and the start timestamp of the time period to be detected; the original time series data is input into a multi-task autoencoder for reconstruction to obtain a plurality of reconstructed time series data; the plurality of reconstructed time series data are compared with the original time series data to determine the anomaly detection result, the anomaly detection result including the unit time period in which the abnormal access behavior exists within the time period to be detected, thereby improving the accuracy of anomaly detection of the account accessing resources and reducing the false alarm rate and missed alarm rate of the anomaly detection.

[0064] In an optional implementation, the multi-task autoencoder includes at least two autoencoder units, and different autoencoder units include convolution kernels of different sizes.

[0065] Each autoencoder unit is a single-task learning autoencoder, including an encoder and a decoder. A variety of different convolution kernel structures have different detection effects in their single-task learning autoencoder units. By combining autoencoder units with a variety of different convolution kernels to form a multi-task autoencoder, the different time series features learned by different convolution kernels can be shared, and the loss function value of the model can be reduced to a lower level, and it can still capture the time series features that a single model can capture. After the loss function drops to an appropriate level, by combining the time series features learned by three different convolution kernels, a more accurate anomaly detection effect is achieved.

[0066] In addition, the multi-task autoencoder provided in this embodiment can reduce memory usage compared to using multiple independent single-task autoencoders, and during the model training process, multiple tasks are forward calculated once to obtain results, the inference speed is increased, the training time can be reduced, and the training efficiency can be improved.

[0067] Optionally, the convolution kernel included in the autoencoder unit is a symmetric convolution kernel. Of course, the convolution kernel included in the autoencoder unit may also be an asymmetric convolution kernel.

[0068] Optionally, each autoencoder unit may be a single-task autoencoder model based on a time-domain convolutional network (TCN).

[0069] Among them, the convolution layer in the time domain convolutional network is a time series convolutional layer specially designed for time series, which consists of dilated, causal one-dimensional convolutional layers with the same input and output lengths. Compared with traditional convolutional neural networks, which are limited by the size of the convolution kernel and cannot capture long-term dependency information well, the time series convolutional layer in the time domain convolutional network can outperform the RNN model in various tasks compared with various RNN structures. The time domain convolutional network can process sequences in parallel, and can flexibly customize its receptive range (i.e., convolution kernel size) according to different tasks and different characteristics. It does not have the problem of gradient disappearance and gradient explosion, and the memory usage is also low.

[0070] Exemplarily, the multi-task autoencoder includes three autoencoder units, each of which uses symmetric convolution kernels of different sizes, and the autoencoders of the three different convolution kernels are combined together to construct an autoencoder based on multi-task learning. For example, the sizes of the three symmetric convolution kernels are: 16*8*8*16, 16*4*4*16, and 24*12*12*24.

[0071] For example, Figure 3 A framework diagram of a multi-task autoencoder provided by an exemplary embodiment of the present application, such as Figure 3 As shown in the figure, the multi-task autoencoder includes three types of symmetric convolution kernels of size 16*8*8*16, 16*4*4*16, and 24*12*12*24 autoencoder units: autoencoder 1 (including encoder 1 and decoder 1), autoencoder 2 (including encoder 2 and decoder 2), and autoencoder 3 (including encoder 3 and decoder 3). The original time series data are input into the encoders of the three autoencoder units respectively. Each encoder generates an abstract feature and inputs the corresponding decoder. The decoder decodes the abstract feature to generate the corresponding reconstructed time series data, and finally obtains three reconstructed time series data: reconstructed time series data 1, reconstructed time series data 2, and reconstructed time series data 3.

[0072] When training the model, the training data is the historical behavior data of the account's normal access to resources in the historical period. The historical period can be a longer period of time to obtain more training data. The historical period is divided into multiple time periods to be detected, and the historical behavior data in each time period to be detected is determined. The original time series sample corresponding to the time period to be detected is determined based on the historical behavior data. The specific implementation method is similar to the implementation method of determining the original time series data of the account accessing resources in the time period to be detected in step S201, and will not be repeated here.

[0073] Furthermore, based on the original time series samples corresponding to each time period to be detected in the historical period, the original time series samples are input into the multi-task autoencoder for reconstruction to obtain multiple corresponding reconstructed time series samples. The loss function value is calculated based on the difference between the original time series samples and the corresponding multiple reconstructed time series samples, and the model parameters of the multi-task autoencoder are updated according to the loss function value to minimize the loss function value.

[0074] Exemplarily, various training parameters in the model training process can be set according to actual application scenarios and experience values, and are not specifically limited here. For example, the learning rate of the model can be set to 0.001, the activation function can use a linear rectification function (Linear rectification function, referred to as ReLU function), and the loss function can be set to mean square error (MSE) or regression loss function (LogCosh). The training batch size can be set to 16. The number of training epochs can be set to 100. After so many rounds of training, the loss function will drop to a stable state in most cases, indicating that the model has learned a relatively stable and thorough state of the features.

[0075] Optionally, when calculating the loss function value based on the difference between the original time series sample and the corresponding multiple reconstructed time series samples, a loss value can be calculated based on the difference between the original time series sample and each corresponding reconstructed time series sample, and the multiple loss values ​​are weighted and averaged to obtain a comprehensive loss, and the comprehensive loss is used as the final loss function value corresponding to the original time series sample.

[0076] The trained multi-task autoencoder is used to reconstruct the behavior of the account accessing the resource based on the input original time series data to obtain multiple reconstructed time series data. The multiple reconstructed time series reflect the behavioral characteristics of the account's normal access to the resource.

[0077] Compared with single-task autoencoders, the loss function of multi-task autoencoders decreases relatively lower during training, and the feature extraction of time series is more accurate and richer. At the same time, the fusion of multiple single-task autoencoders with good effects to form a multi-task autoencoder can combine the anomaly detection and recognition capabilities of each single-task autoencoder to maximize the effect of the multi-task autoencoder. The test results on the Benchmark dataset show that the multi-task autoencoder has a lower loss value, a lower false alarm rate, and a lower false negative rate. In addition, the multi-task autoencoder has better nonlinear fitting capabilities than the statistical model.

[0078] Optionally, the multi-task autoencoder can be trained and optimized with the newly added behavior data at regular intervals, so that the multi-task autoencoder can learn more behavioral characteristics of accounts accessing resources normally, thereby improving the accuracy of anomaly detection.

[0079] In an optional embodiment, based on the historical access data before the time period to be detected, it is determined whether the account has accessed the resource before the time period to be detected; if it is determined that the account has accessed the resource before the time period to be detected, a multi-task autoencoding model is used to perform anomaly detection; if it is determined that the account has not accessed the resource before the time period to be detected, that is, the account accesses the resource for the first time during the time period to be detected, the first time an account accesses a resource can be regarded as an abnormal access, and the unit time period when the account first accesses the resource during the time period to be detected is determined as a unit time period with abnormal access behavior, to obtain an anomaly detection result.

[0080] Figure 4 A flow chart of a resource access anomaly detection method provided by an exemplary embodiment of the present application is as follows: Figure 4 As shown, the specific steps of this method are as follows:

[0081] Step S400: determining original time series data of the account accessing resources within the time period to be detected based on the behavior data of the account accessing resources within the time period to be detected.

[0082] The original time series data includes the timestamp and access frequency of each unit period of the time period to be detected, and the start timestamp of the time period to be detected.

[0083] In actual applications, the server can perform an anomaly detection by executing an anomaly detection method for resource access at regular intervals according to a preset anomaly detection strategy.

[0084] For example, the anomaly detection strategy can be to perform an anomaly detection every hour based on the behavior data of each account accessing each resource in the previous hour.

[0085] Among them, the anomaly detection strategy can be: periodic anomaly detection, scheduled anomaly detection, etc. Based on different anomaly detection strategies, the time period to be detected when performing anomaly detection can be different. For example, when performing anomaly detection periodically, the time period to be detected can be the previous period; when performing anomaly detection periodically, the time period to be detected can be a historical time period before the scheduled time. The anomaly detection strategy and the time period to be detected can be set and adjusted according to the needs of the actual application scenario, and are not specifically limited here.

[0086] In this embodiment, when performing anomaly detection, the behavioral data of the account's access to resources within the time period to be detected is obtained, and the frequency of the account's access to resources in each unit time period of the time period to be detected, as well as the timestamp corresponding to each unit time period and the timestamp of the starting moment of the time period to be detected (i.e., the starting timestamp) are determined based on the behavioral data. The original time series data corresponding to the behavioral data of each account's access to each resource are arranged and generated in the order of the unit time periods.

[0087] Among them, each data item in the original time series data can be arranged in a set specified order. During the model training and anomaly detection process, a unified specified order can be used. The specific order is not specifically limited here.

[0088] Exemplarily, the original time series data can be arranged in any of the following ways: {start timestamp, frequency 1, timestamp 1, frequency 2, timestamp 2, …}, or {frequency 1, frequency 2, …, timestamp 1, timestamp 2, …, start timestamp}, or {timestamp 1: frequency 1, timestamp 2: frequency 2, …, start timestamp}.

[0089] Optionally, an account set that needs to be detected for anomalies may be configured. When detecting for anomalies, anomalies are detected for target accounts in the account set and the behavior of the target accounts accessing resources.

[0090] Optionally, a resource collection that needs to be detected for anomalies may be configured. When detecting anomalies, anomalies are detected for target resources in the resource collection and for the behavior of each account accessing the target resource.

[0091] Optionally, an account set and a resource set that need to be detected for anomalies may be configured. When detecting for anomalies, anomaly detection is performed on the target account in the account set and the target resource in the resource set, and the behavior of the target account accessing the target resource is detected for anomalies.

[0092] In addition, if you do not configure account collections and resource collections, anomaly detection is performed on each account's access to each resource by default.

[0093] The process of performing anomaly detection on the behavior of any account accessing any resource is consistent. This embodiment takes the process of performing anomaly detection on the behavior of one account accessing one resource as an example to exemplarily illustrate the process of anomaly detection.

[0094] Step S401: Determine whether the account has accessed resources before the detection time period.

[0095] In this embodiment, when performing anomaly detection, historical access data before the time period to be detected may be obtained, and based on the historical access data before the time period to be detected, it is determined whether the account has accessed resources before the time period to be detected.

[0096] If it is determined in this step that the account has accessed the resource before the time period to be detected, steps S402-S405 are executed, and the multi-task autoencoding model is used to perform anomaly detection to determine the anomaly detection result. It can detect anomalies that are inconsistent with the account's historical access behavior to the resource and inconsistent with the historical access frequency, give anomaly results, and can also issue anomaly warnings.

[0097] If it is determined in this step that the account has not accessed the resource before the time period to be detected, step S406 is executed to determine the unit time period in which the account first accesses the resource within the time period to be detected as the unit time period with abnormal access behavior, and obtain the abnormality detection result.

[0098] For example, in a cloud service scenario, under different enterprise users' main accounts, there are multiple different sub-accounts under the enterprise, and different sub-accounts call APIs. If the sub-account has not called the API before the time period to be detected, there is no behavioral data of a sub-account calling a certain API in the training data used in the model training phase. Then, in the process of abnormal detection, when the sub-account calls the API for the first time, it is determined that there is abnormal access behavior, an abnormal detection result is given, and an abnormal warning can be issued. If a sub-account has called an API before the time period to be detected, and there is behavioral data of the sub-account calling the API in the training data used in the model training phase, the multi-task autoencoder learns the behavioral characteristics of the account calling the API normally during training. Using the multi-task autoencoder for abnormal detection can detect abnormalities for other behavioral characteristics of the account calling the API that are inconsistent with the historical calls to the API and inconsistent with the historical call frequency, and give abnormal detection results, and can also issue abnormal warnings.

[0099] Step S402: According to the configured sliding window size, the original time series data is divided into multiple vectors, and the multiple vectors are arranged into a first feature matrix.

[0100] The sliding window size can be set according to the needs of the actual application scenario, such as 10, 20, 25, etc.

[0101] Exemplarily, the sliding window size can be represented by N, where N is a positive integer. In this step, starting from the starting position of the original time series data, segments containing data items within N unit time periods are sequentially segmented, and vectors corresponding to each segment are generated, and multiple vectors can be obtained. Each vector generated by segmentation is a row vector, and multiple row vectors constitute a first feature matrix.

[0102] Optionally, this step can be implemented in the following ways:

[0103] Each data item in the original time series data is converted into a vector representation to obtain a vector representation sequence; the vector representation sequence is segmented according to the configured sliding window size to obtain multiple row vectors, wherein each row vector includes the vector representation of data items within a specified number of unit time periods in the vector representation sequence, and the specified number is equal to the sliding window size; the multiple row vectors are arranged into a matrix to obtain a first feature matrix.

[0104] Optionally, this step can be implemented in the following ways:

[0105] According to the configured sliding window size, the original time series data is divided into multiple data segments, wherein each data segment includes a specified number of data items within a unit time period in the original time series data, and the specified number is equal to the sliding window size; each data item in each data segment is converted into a vector representation to obtain a vector corresponding to each data segment; multiple row vectors are arranged into a matrix to obtain a first characteristic matrix.

[0106] In addition, in this embodiment, according to the configured sliding window size, the original time series data is divided into multiple vectors and arranged into a first feature matrix, which can be implemented by a similar method in the prior art and is not specifically limited here.

[0107] Optionally, after determining the first feature matrix, before inputting the first feature matrix into each autoencoder unit for reconstruction, the first feature matrix is ​​normalized, and in a subsequent step, the normalized first feature matrix is ​​input into each autoencoder unit for reconstruction, thereby achieving standardized processing of the input of the multi-task autoencoder to improve the fitting speed and accuracy of the multi-task autoencoder.

[0108] Step S403: input the first feature matrix into each autoencoder unit for reconstruction, and obtain a second feature matrix reconstructed by each autoencoder unit.

[0109] In this embodiment, the multi-task autoencoder is a trained autoencoder based on multi-task learning. During the model training process, the multi-task autoencoder learns the behavioral characteristics of each account's normal access to each resource. The multi-task autoencoder includes at least two autoencoder units, and different autoencoder units contain convolution kernels of different sizes.

[0110] Each autoencoder unit is a single-task learning autoencoder, including an encoder and a decoder. A variety of different convolution kernel structures have different detection effects in the single-task learning autoencoder unit. By combining autoencoder units with a variety of different convolution kernels together to form a multi-task autoencoder, after the loss function drops to an appropriate level, by combining the time series features learned by three different convolution kernels, a more accurate anomaly detection effect can be achieved.

[0111] Optionally, the convolution kernel included in the autoencoder unit is a symmetric convolution kernel. Of course, the convolution kernel included in the autoencoder unit may also be an asymmetric convolution kernel.

[0112] Optionally, each autoencoder unit may be a single-task autoencoder model based on a time-domain convolutional network (TCN).

[0113] After determining the first feature matrix corresponding to the original time series data, the first feature matrix is ​​input into a trained multi-task autoencoder. The trained multi-task autoencoder reconstructs the behavior of the account accessing the resource according to the input first feature matrix to obtain multiple second feature matrices, which contain the behavioral characteristics of the account accessing the resource normally.

[0114] Step S404: parse each second characteristic matrix to obtain corresponding reconstructed time series data.

[0115] After a plurality of second feature matrices are reconstructed by the multi-task autoencoder, corresponding reconstructed time series data can be obtained by analyzing each second feature matrix.

[0116] Exemplarily, the types, quantities and order of the data items contained in the reconstructed time series data and the original time series data are consistent. In this step, the row vectors in the second feature matrix can be concatenated in sequence to obtain a complete sequence; according to the dimension of the vector corresponding to each data item in the reconstructed time series data, the vector corresponding to each data item is segmented from the complete sequence, and the vector corresponding to each data item is converted into the value of the data item, so that the reconstructed time series data can be obtained.

[0117] In this embodiment, when the multi-task autoencoder model is used for anomaly detection, the original time series data is input into the multi-task autoencoder for reconstruction through the above steps S402-S404 to obtain a plurality of reconstructed time series data.

[0118] After using the multi-task autoencoder model to reconstruct multiple reconstructed time series data, the multiple reconstructed time series data are compared with the original time series data through steps S405-S407, and the difference between the access frequency of each unit time period in the original time series data and the access frequency of the same unit time period in the multiple reconstructed time series data is analyzed. If the difference is large, it means that the possibility of the account's access to the resource in the unit time period is abnormal access behavior is high, and the unit time period is determined as a unit time period with abnormal access behavior, thereby determining the anomaly detection result.

[0119] Step S405: compare the multiple reconstructed time series data with the original time series data to determine the anomaly detection result.

[0120] Optionally, this step can be implemented in the following ways:

[0121] Determine the difference value of the access frequency of the same unit time period in the original time series data and each reconstructed time series data; perform weighted summation on the difference value of the access frequency of the same unit time period in the original time series data and each reconstructed time series data to determine the comprehensive difference information corresponding to each unit time period; determine the unit time period whose corresponding comprehensive difference information is greater than the difference threshold as the unit time period in which abnormal access behavior exists within the time period to be detected, and obtain the anomaly detection result.

[0122] Optionally, the difference threshold may be the standard deviation of the comprehensive difference information corresponding to all unit time periods, or the difference threshold may be the standard deviation of all difference values ​​corresponding to all unit time periods, or the difference threshold may be a fixed value set according to the actual application scenario, which is not specifically limited here.

[0123] For example, assuming that the original time series data of a certain account accessing a certain resource is sequence 1, after reconstruction using a multi-task autoencoder, the following three reconstructed sequences are obtained: sequence 2, sequence 3 and sequence 4. Then, by comparing the difference value a1 of the access frequency in the first unit time period between sequence 1 and sequence 2, comparing the difference a2 of the access frequency in the first unit time period between sequence 1 and sequence 3, and comparing the difference a3 of the access frequency in the first unit time period between sequence 1 and sequence 4, according to the difference values ​​a1, a2 and a3, a1, a2 and a3 are weighted and summed to obtain the comprehensive difference information corresponding to the first unit time period. If the comprehensive difference information is greater than the difference threshold, it is determined that the first unit time period is a unit time period with abnormal access behavior; if the comprehensive difference information is less than or equal to the difference threshold, it is determined that the first unit time period is not a unit time period with abnormal access behavior. Similarly, it can be determined whether each unit time period in the time period to be detected is a unit time period with abnormal access behavior, thereby obtaining an abnormal detection result.

[0124] Optionally, this step may be implemented in the following manner:

[0125] Determine the difference in access frequency between the original time series data and each reconstructed time series data in the same unit time period; average the difference in access frequency between the original time series data and each reconstructed time series data to obtain the mean difference information corresponding to each unit time period; determine the unit time period whose corresponding mean difference information is greater than the difference mean threshold as the unit time period in which abnormal access behavior exists within the time period to be detected, and obtain the anomaly detection result.

[0126] Optionally, the difference mean threshold may be the standard deviation of the mean difference information corresponding to all unit time periods, or the difference mean threshold may be the standard deviation of all difference values ​​corresponding to all unit time periods, or the difference mean threshold may be a fixed value set according to the actual application scenario, which is not specifically limited here.

[0127] Step S406: determine the unit time period during which the account accesses resources for the first time within the time period to be detected as the unit time period during which abnormal access behavior exists, and obtain an abnormality detection result.

[0128] In this embodiment, if it is determined in step S401 that the account has not accessed the resource before the time period to be detected, the unit time period in which the account first accesses the resource within the time period to be detected is determined as the unit time period with abnormal access behavior to obtain an abnormal detection result.

[0129] Step S407: Issue an abnormal access warning based on the abnormal detection result.

[0130] In this embodiment, after determining the abnormal detection result, an abnormal access warning can be issued based on the abnormal detection result to remind relevant personnel to verify and handle the abnormal account access to resources in a timely manner to improve the security of resources.

[0131] In this embodiment, based on the historical access data before the time period to be detected, it is determined whether the account has accessed the resource before the time period to be detected; if it is determined that the account has accessed the resource before the time period to be detected, a multi-task autoencoding model is used for anomaly detection; if it is determined that the account has not accessed the resource before the time period to be detected, that is, the account accesses the resource for the first time during the time period to be detected, the first time an account accesses a resource can be regarded as an abnormal access, and the unit time period when the account first accesses the resource during the time period to be detected is determined as a unit time period with abnormal access behavior, and the anomaly detection result is obtained, which can warn the account's first access to the resource, improve the security of the resources, and reduce the false alarm rate and missed alarm rate of anomaly detection.

[0132] Figure 5 This is a schematic diagram of the structure of a resource access anomaly detection device provided by an exemplary embodiment of the present application. The resource access anomaly detection device provided by the embodiment of the present application can execute the processing flow provided by the resource access anomaly detection method embodiment. Figure 5 As shown, the resource access anomaly detection device 50 includes: a time series determination module 501, a time series reconstruction module 502 and a detection processing module 503.

[0133] Specifically, the time series determination module 501 is used to determine the original time series data of the account accessing the resources within the time period to be detected according to the behavior data of the account accessing the resources within the time period to be detected.

[0134] The time series reconstruction module 502 is used to input the original time series data into the multi-task autoencoder for reconstruction to obtain a plurality of reconstructed time series data.

[0135] The detection processing module 503 is used to compare the multiple reconstructed time series data with the original time series data to determine the abnormality detection result.

[0136] The device provided in the embodiment of the present application can be specifically used to perform the above Figure 2 The solutions, specific functions and technical effects that can be achieved by the corresponding method embodiments are not described in detail here.

[0137] In an optional embodiment, the multi-task autoencoder includes at least two autoencoder units, and different autoencoder units include convolution kernels of different sizes.

[0138] When the original time series data is input into the multi-task autoencoder for reconstruction to obtain multiple reconstructed time series data, the time series reconstruction module is specifically used to:

[0139] According to the configured sliding window size, the original time series data is divided into multiple vectors, and the multiple vectors are arranged into a first feature matrix; the first feature matrix is ​​input into each autoencoder unit for reconstruction to obtain a second feature matrix reconstructed by each autoencoder unit; each second feature matrix is ​​analyzed to obtain the corresponding reconstructed time series data.

[0140] In an optional embodiment, when the original time series data is divided into multiple vectors according to the configured sliding window size, and the multiple vectors are arranged into a first feature matrix, the time series reconstruction module is further used to:

[0141] Convert each data item in the original time series data into a vector representation to obtain a vector representation sequence, wherein the original time series data includes the timestamp and access frequency of each unit time period in the time period to be detected, and the start timestamp of the time period to be detected; divide the vector representation sequence according to the configured sliding window size to obtain multiple row vectors, wherein each row vector includes the vector representation of data items within a specified number of unit time periods in the vector representation sequence, and the specified number is equal to the sliding window size; arrange the multiple row vectors into a matrix to obtain a first feature matrix.

[0142] In an optional embodiment, the convolution kernel included in the autoencoder unit is a symmetric convolution kernel, and each autoencoder unit is a single-task autoencoder based on a time-domain convolutional network.

[0143] In an optional embodiment, when comparing the multiple reconstructed time series data with the original time series data to determine the abnormality detection result, the detection processing module is specifically used to:

[0144] Determine the difference value of the access frequency of the same unit time period in the original time series data and each reconstructed time series data; perform weighted summation on the difference value of the access frequency of the same unit time period in the original time series data and each reconstructed time series data to determine the comprehensive difference information corresponding to each unit time period; determine the unit time period whose corresponding comprehensive difference information is greater than the difference threshold as the unit time period in which abnormal access behavior exists within the time period to be detected, and obtain the anomaly detection result.

[0145] In an optional embodiment, before the original time series data is input into the multi-task autoencoder for reconstruction to obtain a plurality of reconstructed time series data, the time series reconstruction module is further used to:

[0146] According to the historical access data before the time period to be detected, it is determined that the account has accessed the resource before the time period to be detected.

[0147] In an optional embodiment, before the original time series data is input into the multi-task autoencoder for reconstruction to obtain a plurality of reconstructed time series data, the detection processing module is further used to:

[0148] According to the historical access data before the time period to be detected, if it is determined that the account has not accessed the resource before the time period to be detected, the unit time period when the account first accesses the resource within the time period to be detected is determined as the unit time period with abnormal access behavior to obtain the abnormal detection result.

[0149] The device provided in the embodiments of the present application can be specifically used to execute the solution provided by any of the above-mentioned method embodiments, and the specific functions and technical effects that can be achieved are not repeated here.

[0150] Figure 6 This is a schematic diagram of the structure of an electronic device provided by an exemplary embodiment of the present application. Figure 6 As shown, the electronic device 60 includes: a processor 601, and a memory 602 communicatively connected to the processor 601, and the memory 602 stores computer-executable instructions.

[0151] The processor executes the computer-executable instructions stored in the memory to implement the solution provided by any of the above method embodiments, and the specific functions and technical effects that can be achieved are not described in detail here. The electronic device can be the server mentioned above.

[0152] An embodiment of the present application also provides a computer-readable storage medium, in which computer execution instructions are stored. When the computer execution instructions are executed by a processor, they are used to implement the solution provided by any of the above method embodiments. The specific functions and technical effects that can be achieved are not repeated here.

[0153] An embodiment of the present application also provides a computer program product, which includes: a computer program, which is stored in a readable storage medium. At least one processor of an electronic device can read the computer program from the readable storage medium, and at least one processor executes the computer program so that the electronic device executes the solution provided by any of the above method embodiments. The specific functions and technical effects that can be achieved are not repeated here.

[0154] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0155] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A resource access anomaly detection method, characterized in that: include: Determine original time series data of the account accessing the resource within the time period to be detected according to the behavior data of the account accessing the resource within the time period to be detected; Inputting the original time series data into a multi-task autoencoder for reconstruction to obtain a plurality of reconstructed time series data; Comparing the plurality of reconstructed time series data with the original time series data to determine an anomaly detection result; The multi-task autoencoder includes at least two autoencoder units, and the original time series data is input into the multi-task autoencoder for reconstruction to obtain a plurality of reconstructed time series data, including: According to the configured sliding window size, the original time series data is divided into a plurality of vectors, and the plurality of vectors are arranged into a first feature matrix; Inputting the first feature matrix into each of the autoencoder units for reconstruction, to obtain a second feature matrix reconstructed by each of the autoencoder units; Each of the second characteristic matrices is analyzed to obtain corresponding reconstructed time series data.

2. The method according to claim 1, characterized in that Different autoencoder units in the multi-task autoencoder contain convolution kernels of different sizes.

3. The method according to claim 2, characterized in that The original time series data is divided into a plurality of vectors according to the configured sliding window size, and the plurality of vectors are arranged into a first feature matrix, including: Convert each data item in the original time series data into a vector representation to obtain a vector representation sequence, wherein the original time series data includes a timestamp and access frequency of each unit period of the time period to be detected, and a start timestamp of the time period to be detected; According to the configured sliding window size, the vector representation sequence is segmented to obtain a plurality of row vectors, wherein each row vector includes vector representations of data items within a specified number of unit time periods in the vector representation sequence, and the specified number is equal to the sliding window size; The multiple row vectors are arranged into a matrix to obtain the first characteristic matrix.

4. The method according to claim 2, characterized in that: The convolution kernel included in the autoencoder unit is a symmetric convolution kernel, and each of the autoencoder units is a single-task autoencoder based on a time-domain convolutional network.

5. The method according to claim 1, characterized in that The comparing the plurality of reconstructed time series data with the original time series data to determine anomaly detection results includes: Determine a difference value of the access frequency in the same unit time period between the original time series data and each of the reconstructed time series data; Taking a weighted sum of the difference values ​​of the access frequencies in the same unit time period between the original time series data and each of the reconstructed time series data, to determine the comprehensive difference information corresponding to each unit time period; The unit time period in which the corresponding comprehensive difference information is greater than the difference threshold is determined as the unit time period in which the abnormal access behavior exists within the time period to be detected, and the abnormality detection result is obtained.

6. The method according to any one of claims 1 to 5, characterized in that Before inputting the original time series data into the multi-task autoencoder for reconstruction to obtain a plurality of reconstructed time series data, the method further includes: According to the historical access data before the time period to be detected, it is determined that the account has accessed the resource before the time period to be detected.

7. The method according to claim 6, characterized in that Before inputting the original time series data into the multi-task autoencoder for reconstruction to obtain a plurality of reconstructed time series data, the method further includes: Based on the historical access data before the time period to be detected, if it is determined that the account has not accessed the resource before the time period to be detected, the unit time period in which the account first accesses the resource within the time period to be detected is determined as the unit time period in which abnormal access behavior exists, and the abnormal detection result is obtained.

8. A resource access anomaly detection device, characterized in that: include: A time series determination module, used to determine original time series data of the account accessing the resource within the time period to be detected based on the behavior data of the account accessing the resource within the time period to be detected; A time series reconstruction module, used for inputting the original time series data into a multi-task autoencoder for reconstruction to obtain a plurality of reconstructed time series data; A detection processing module, used to compare the plurality of reconstructed time series data with the original time series data to determine an abnormality detection result; The multi-task autoencoder includes at least two autoencoder units, and the time series reconstruction module is specifically used for: According to the configured sliding window size, the original time series data is divided into a plurality of vectors, and the plurality of vectors are arranged into a first feature matrix; Inputting the first feature matrix into each of the autoencoder units for reconstruction, to obtain a second feature matrix reconstructed by each of the autoencoder units; Each of the second characteristic matrices is analyzed to obtain corresponding reconstructed time series data.

9. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 7 when executed by a processor.

11. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 7 when being executed by a processor.

Images