Anomaly access detection method and apparatus

Abstract

The application discloses an abnormal access detection method and device, and relates to the technical field of computers. A specific implementation manner of the method comprises the following steps: acquiring log data in a set period, wherein the log data comprises a plurality of execution subjects, a plurality of promotion information and an access relationship between the execution subjects and the promotion information; constructing a relationship graph for the log data according to the plurality of execution subjects, the plurality of promotion information and the access relationship between the execution subjects and the promotion information, wherein the relationship graph comprises suspicious degrees of the plurality of execution subjects and suspicious degrees of the plurality of promotion information; finding a sub-relationship graph with the largest average suspicious degree from the relationship graph according to the suspicious degrees of the plurality of execution subjects and the suspicious degrees of the plurality of promotion information included in the relationship graph; analyzing the sub-relationship graph, and determining the promotion information with abnormal access and the execution subject with abnormal access according to the analysis result. The implementation manner can guarantee the authenticity and accuracy of abnormal access detection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, and in particular, to an abnormal access detection method and device. BACKGROUND

[0002] Online information promotion, such as online advertisement promotion, has become a mainstream marketing promotion method, that is, an information provider, such as an advertisement sponsor or a commodity promotion party, provides online information to a media channel, and the media channel charges according to a Cost Per Click (CPC) of the online information or charges according to a Cost Per Thousand Impression (CPM) of traffic generated by the online information according to the CPC (or the CPM). The media channel may have false clicks, and cannot reflect the real promotion situation of the online information. Therefore, detecting false clicks / accesses of the online information can more accurately reflect the promotion / access situation of the online information.

[0003] The existing detection method for abnormal access of promotion information mainly selects a corresponding user granularity according to business experience, and compares the traffic size of the user granularity with a preset experience threshold, and the part exceeding the threshold is identified as fraudulent traffic.

[0004] In the process of implementing the present application, the inventors have found that the prior art at least has the following problems:

[0005] The existing detection method has a relatively strict experience threshold, and it is difficult to detect the abnormal access when the aggregation of clicks or accesses of the promotion information is not obvious, and therefore, the existing detection method has low accuracy in abnormal access detection. SUMMARY

[0006] Therefore, the embodiments of the present application provide an abnormal access detection method and device, which can ensure the authenticity and accuracy of abnormal access detection.

[0007] To achieve the above object, according to one aspect of the embodiments of the present application, an abnormal access detection method is provided, characterized in that comprising:

[0008] obtaining log data in a set period, wherein the log data comprises a plurality of execution subjects, a plurality of promotion information and an access relationship between the execution subjects and the promotion information;

[0009] constructing a relationship graph for the log data according to the plurality of execution subjects, the plurality of promotion information and the access relationship between the execution subjects and the promotion information, wherein the relationship graph comprises a suspicious degree of the plurality of execution subjects and a suspicious degree of the plurality of promotion information;

[0010] According to suspicious degrees of the execution subjects and suspicious degrees of the promotion information included in the relationship graph, find a sub-relationship graph with the largest average suspicious degree in the relationship graph;

[0011] Parse the sub-relationship graph, and determine the promotion information with abnormal access and the execution subject with abnormal access according to a result of the parsing.

[0012] Preferably, the relationship graph is constructed for the log data, including:

[0013] Convert the execution subjects and the promotion information into corresponding subject nodes and information nodes in the relationship graph;

[0014] According to the access relationship between the execution subjects and the promotion information, construct a connection relationship between the subject nodes and the information nodes in the relationship graph;

[0015] According to the connection relationship between the subject nodes and the information nodes, calculate suspicious degrees of the execution subjects and suspicious degrees of the promotion information.

[0016] Preferably, the connection relationship between the subject nodes and the information nodes in the relationship graph is constructed, including:

[0017] Construct a connection edge between the subject nodes and the information nodes in the relationship graph, and calculate an initial weight of the connection edge, wherein the subject nodes, the information nodes, the connection edge between the subject nodes and the information nodes, and the initial weight of the connection edge constitute the connection relationship.

[0018] Preferably, the initial weight of the connection edge is calculated, including:

[0019] For each information node corresponding to the promotion information, perform:

[0020] Count a number of subject nodes connected to the information node;

[0021] According to a result of the counting, calculate an initial weight of a connection edge corresponding to the information node.

[0022] Preferably, the suspicious degrees of the execution subjects and the suspicious degrees of the promotion information are calculated, including:

[0023] According to the initial weights of all the connection edges connected to the subject node, calculate a suspicious degree of an execution subject corresponding to the subject node;

[0024] According to the initial weights of all the connection edges connected to the information node, calculate a suspicious degree of a promotion information corresponding to the information node.

[0025] Preferably, the step of searching the sub-relation graph with the maximum average suspiciousness comprises:

[0026] The steps N1 and N2 are executed in a loop until a loop stop condition is met:

[0027] N1: determining the average suspiciousness of the relation graph and deleting the node with the minimum suspiciousness in the relation graph, wherein the node with the minimum suspiciousness is an information node or an agent node;

[0028] N2: recalculating the average suspiciousness and the suspiciousness of each node after the node with the minimum suspiciousness is deleted, and taking the sub-relation graph after the node with the minimum suspiciousness is deleted as the relation graph;

[0029] From the average suspiciousness of each sub-relation graph obtained in the loop, the sub-relation graph with the maximum average suspiciousness is searched.

[0030] Preferably, the step of determining the average suspiciousness of the relation graph comprises:

[0031] According to the suspiciousness of each node included in the relation graph and the number of nodes included in the sub-relation graph, the average suspiciousness of the sub-relation graph is calculated.

[0032] Preferably, the step of recalculating the average suspiciousness after the node with the minimum suspiciousness is deleted comprises:

[0033] According to the suspiciousness of the deleted node with the minimum suspiciousness, the average suspiciousness of the relation graph and the number of nodes included in the sub-relation graph after the node with the minimum suspiciousness is deleted, the average suspiciousness of the sub-relation graph is calculated.

[0034] Preferably, the abnormal access detection method further comprises:

[0035] The steps M1 to M3 are executed in a loop:

[0036] M1: deleting the nodes included in the sub-relation graph with the maximum average suspiciousness from the relation graph;

[0037] M2: according to the suspiciousness of the remaining nodes of the relation graph, continuing to search for the sub-relation graph with the maximum average suspiciousness in the remaining nodes of the relation graph;

[0038] M3: judging whether the number of the searched sub-relation graphs with the maximum average suspiciousness reaches a preset detection number, if yes, ending the loop, otherwise, executing the step M1.

[0039] Preferably, the step of searching the sub-relation graph with the maximum average suspiciousness comprises:

[0040] A two-dimensional coordinate graph is constructed for the number of loops and the average suspiciousness recalculated each time the loop is executed.

[0041] From the two-dimensional coordinate graph, the cycle number corresponding to the maximum value of the average suspicious degree is found out;

[0042] According to the correspondence between the cycle number and the sub-relation graph pre-cached, the sub-relation graph with the maximum average suspicious degree is determined.

[0043] Preferably, the abnormal access detection method further comprises:

[0044] A minimum priority tree is constructed for the relation graph, wherein the suspicious degree of each node in the relation graph is stored as each leaf node in the bottom layer of the minimum priority tree, and in the minimum priority tree, the leaf nodes in the layers other than the bottom layer inherit the minimum value of the leaf nodes in the next layer connected thereto;

[0045] According to the minimum value recorded in the highest layer of the minimum priority tree and the inheritance relationship corresponding to the minimum value of the highest layer, a target leaf node in the bottom layer is found out;

[0046] According to the target leaf node found out, the node with the minimum suspicious degree in the relation graph is determined;

[0047] For the node with the minimum suspicious degree, the step of deleting the node with the minimum suspicious degree in the relation graph is performed.

[0048] In a second aspect, an embodiment of the present application provides an abnormal access detection device, comprising: an acquisition unit, a relation graph construction unit, a finding unit and an analysis unit, wherein,

[0049] The acquisition unit is configured to acquire log data in a set period, wherein the log data comprises: a plurality of execution subjects, a plurality of promotion information and an access relationship between the execution subjects and the promotion information;

[0050] The relation graph construction unit is configured to construct a relation graph for the log data according to the plurality of execution subjects, the plurality of promotion information and the access relationship between the execution subjects and the promotion information, wherein the relation graph comprises: suspicious degrees of the plurality of execution subjects and suspicious degrees of the plurality of promotion information;

[0051] The finding unit is configured to find a sub-relation graph with the maximum average suspicious degree contained in the relation graph according to the suspicious degrees of the plurality of execution subjects and the suspicious degrees of the plurality of promotion information included in the relation graph;

[0052] The analysis unit is configured to analyze the sub-relation graph and determine the promotion information with abnormal access and the execution subject with abnormal access according to the analysis result.

[0053] An embodiment of the above application has the following advantages or beneficial effects: since the present application obtains log data including a plurality of execution subjects, a plurality of promotion information and an access relationship between the execution subjects and the promotion information, and constructs a relationship graph for the log data according to the plurality of execution subjects, the plurality of promotion information and the access relationship between the execution subjects and the promotion information, the relationship graph can reflect the relationship between the execution subjects and the promotion information more truly, and can reflect the suspicious degree of the plurality of execution subjects and the suspicious degree of the plurality of promotion information included in the relationship graph, and by searching for a sub-relationship graph with the largest average suspicious degree included in the relationship graph, a sub-relationship graph with abnormal access, i.e., an execution subject in the relationship with abnormal access and promotion information with abnormal access, can be obtained more accurately and truly. Therefore, by constructing the relationship graph, the relationship of the relationship graph and the suspicious degrees of the promotion information and the execution subjects can be used to ensure the authenticity and accuracy of abnormal access detection.

[0054] Further effects of the above non-conventional optional mode will be described in the following in combination with the specific embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0055] The accompanying drawings are used to better understand the present application and do not constitute undue limitations on the present application. Among them:

[0056] Figure 1 is a schematic diagram of the main process of the abnormal access detection method according to an embodiment of the present application;

[0057] Figure 2 is a schematic diagram of a relationship graph according to an embodiment of the present application;

[0058] Figure 3 is a schematic diagram of a sub-relationship graph with the largest average suspicious degree according to an embodiment of the present application;

[0059] Figure 4 is a schematic diagram of the main process of constructing a relationship graph for log data according to an embodiment of the present application;

[0060] Figure 5 is a schematic diagram of a constructed relationship graph according to an embodiment of the present application;

[0061] Figure 6 is a schematic diagram of the main process of calculating the suspicious degree of an execution subject and the suspicious degree of promotion information according to an embodiment of the present application;

[0062] Figure 7 is a schematic diagram of the main process of searching for a sub-relationship graph with the largest average suspicious degree included in a relationship graph according to an embodiment of the present application;

[0063] Figure 8is a schematic diagram of the main flow of finding and deleting the node with the minimum suspicious degree in a relationship graph according to an embodiment of the present application;

[0064] Figure 9 is a schematic diagram of the main flow of finding the sub-relationship graph with the maximum average suspicious degree according to an embodiment of the present application;

[0065] Figure 10 is a schematic diagram of the cycle number-average suspicious degree relationship curve according to an embodiment of the present application;

[0066] Figure 11 is a schematic diagram of the main flow of finding and deleting the node with the minimum suspicious degree in a relationship graph according to an embodiment of the present application;

[0067] Figure 12 is a schematic diagram of the structure of the minimum priority tree according to an embodiment of the present application;

[0068] Figure 13 is a schematic diagram of the main units of the abnormal access detection apparatus according to an embodiment of the present application;

[0069] Figure 14 is an exemplary system architecture diagram to which embodiments of the present application can be applied;

[0070] Figure 15 is a structural schematic diagram of a computer system of a terminal device or a server suitable for implementing embodiments of the present application. DETAILED DESCRIPTION

[0071] Exemplary embodiments of the present application are described below with reference to the accompanying drawings, which include various details of the embodiments of the present application to assist in understanding them. These should be considered as merely exemplary. Therefore, those of ordinary skill in the art will recognize that various changes and modifications of the embodiments described herein can be made without departing from the scope and spirit of the present application. Also, descriptions of known functions and constructions are omitted in the following description for clarity and conciseness.

[0072] At present, although there are many models (such as unsupervised learning models, supervised learning models, etc.) for detecting abnormal access, these models all rely on a large number of sample features. However, for abnormal access in the background of less cheating amount, sparse user behavior data, insignificant statistical features, lack of labeled samples, and existence of gang group patterns, such as advertisement click fraud, models still cannot accurately detect abnormal access.

[0073] It is found through research that abnormal access generally has target consistency and access synchronization and the like. For example, abnormal access such as frequent access to promotion information such as online picture advertisement, online video advertisement, and promotion activity information, in order to increase the access volume of the promotion information such as online advertisement, online video advertisement, and promotion activity information, and the like. Due to resource and task constraints of a fraud gang (a large number of registered accounts, a large number of virtual clients, and the like) performing such abnormal access, each fraud user (registered account, virtual client, and the like) will perform click attacks on their target advertisement and the like as much as possible, that is, the target of the attack by the fraud gang (a large number of registered accounts, a large number of virtual clients, and the like) has strong consistency and access synchronization.

[0074] Based on the characteristics of abnormal access, as shown in Figure 1 The embodiment of the present application provides an abnormal access detection method, which can include the following steps:

[0075] Step S101: acquiring log data in a set period, wherein the log data includes a plurality of execution subjects, a plurality of promotion information, and an access relationship between the execution subjects and the promotion information;

[0076] The execution subject refers to user information (such as a user name, a user account, and the like) of an access promotion information, client information (such as client feature encoding and the like), and virtual device information (such as virtual device feature code and the like).

[0077] The promotion information refers to information included in a page such as online advertisement (such as picture advertisement, video advertisement, text advertisement, and the like) and promotion activity information.

[0078] The access relationship refers to a relationship between the execution subject and the promotion information accessed by the execution subject.

[0079] Step S102: constructing a relationship graph for the log data according to the plurality of execution subjects, the plurality of promotion information, and the access relationship between the execution subjects and the promotion information, wherein the relationship graph includes suspicious degrees of the plurality of execution subjects and suspicious degrees of the plurality of promotion information;

[0080] The suspicious degree of the execution subject refers to a possibility that the execution subject is suspected of performing abnormal access;

[0081] The suspicious degree of the promotion information refers to a possibility that the promotion information is abnormally accessed.

[0082] For example, for detection of abnormal access of a fraud gang to online advertisement, the relationship graph constructed through this step can be as shown in Figure 2

[0083] ​Step S103: according to the suspicious degrees of the plurality of execution subjects included in the relationship graph and the suspicious degrees of the plurality of promotion information, finding a sub-relationship graph with the maximum average suspicious degree in the relationship graph;

[0084] It is worth noting that the sub-relationship graph is also a relationship graph itself.

[0085] In addition, it is worth noting that the plurality of execution subjects and the plurality of promotion information included in the relationship graph are the results of deduplication of the log data. That is, the repeated execution subjects and the repeated promotion information in the log data are deduplicated, and the same access relationship is also deduplicated. For example, there are multiple times of execution subject 1 accessing promotion information a in the log file, and only one access relationship of execution subject 1 accessing promotion information a is retained in the relationship graph. For the abnormal access with less cheating amount and sparse user behavior data, the number of accesses has little effect on the detection of abnormal access, and the deduplication can improve the utilization of computing resources and the detection efficiency.

[0086] For example, for the relationship graph shown in FIG. 1, the sub-relationship graph with the maximum average suspicious degree can be as shown in FIG. 2. Figure 2 Figure 3

[0087] Step S104: analyzing the sub-relationship graph, and determining the promotion information with abnormal access and the execution subject with abnormal access according to the analysis result.

[0088] The specific implementation of determining the promotion information with abnormal access and the execution subject with abnormal access is that the promotion information and the execution subject included in the sub-relationship graph are analyzed, and then it is determined that the promotion information included in the sub-relationship graph is the promotion information with abnormal access, and it is determined that the execution subject included in the sub-relationship graph is the execution subject with abnormal access.

[0089] Through the scheme provided by the embodiment of the present application, in the relationship graph (i.e., bipartite graph) of the interaction between the execution subject and the promotion information of the promotion information access, the execution subject with abnormal access (such as a fraudulent gang user) and the promotion information with abnormal access (such as an attack target advertisement) will form a dense sub-graph structure. This dense sub-graph structure can effectively capture the group fraud behavior of the fraudulent gang. Therefore, the embodiment of the present application converts the problem of detecting the abnormal access of the execution subject into the problem of detecting the dense sub-graph structure in the relationship graph (such as a fraudulent gang user-advertisement bipartite graph) constructed from the execution subject and the promotion information.

[0090] ​​In addition, since the log data including the plurality of execution subjects, the plurality of promotion information and the access relationship between the execution subjects and the promotion information is acquired, and the relationship graph is constructed according to the plurality of execution subjects, the plurality of promotion information and the access relationship between the execution subjects and the promotion information, the relationship between the execution subjects and the promotion information can be truly reflected by the relationship graph, and the suspicious degree of the plurality of execution subjects and the suspicious degree of the plurality of promotion information included in the relationship graph can be reflected, the sub-relationship graph with the maximum average suspicious degree can be found, and the sub-relationship graph with abnormal access, i.e., the execution subject in the relationship with abnormal access and the promotion information with abnormal access, can be obtained accurately and truly. Therefore, by constructing the relationship graph, the relationship of the relationship graph and the suspicious degrees of the promotion information and the execution subjects can be guaranteed, and the authenticity and accuracy of the abnormal access detection can be guaranteed.

[0091] In the embodiment of the present application, as shown in Figure 4 the specific implementation of the step S102 can include the following steps:

[0092] Step S401: converting the plurality of execution subjects and the plurality of promotion information into corresponding subject nodes and information nodes in the relationship graph;

[0093] For example, the subject nodes corresponding to the plurality of execution subjects are 0, 1, 2, 3, 4, 5 and 6 respectively, and the information nodes corresponding to the plurality of promotion information are a, b, c, d, e and f respectively. The subject nodes and information nodes converted in this step can be as shown in the relationship graph of Figure 5 , wherein the subject nodes and information nodes are arranged on the two sides of the connection relationship.

[0094] Step S402: constructing the connection relationship between each subject node and information node in the relationship graph according to the access relationship between the execution subjects and the promotion information;

[0095] For example, the execution subject 0 accesses the promotion information a, b and c, the execution subject 1 accesses the promotion information a, b and c, the execution subject 2 accesses the promotion information a, b and c, the execution subject 3 accesses the promotion information a, b, c and d, the execution subject 4 accesses the promotion information e, the execution subject 5 accesses the promotion information c and f, and the execution subject 6 accesses the promotion information f, and a part of the relationship graph between the execution subjects and the promotion information is obtained as shown in Figure 5 , wherein the connection directed line segment (i.e., connection edge) between the execution subjects and the promotion information is the connection relationship between the subject nodes and the information nodes.

[0096] Specifically, the connection edges between each main node and information node in the relationship graph are constructed, and the initial weights of the connection edges are calculated. The connection edges between main nodes, information nodes, and between main nodes and information nodes, along with their initial weights, constitute the connection relationships. A specific implementation method for calculating the initial weights of the connection edges may include: for each information node corresponding to a promotional message, performing the following: counting the number of main nodes connected to the information node; and calculating the initial weights of the connection edges corresponding to the information node based on the statistical results.

[0097] The initial weight of the connection edge corresponding to the information node can be calculated using the following formula (1).

[0098]

[0099] Where, μ i The initial weight of the connection edge corresponding to information node i; x i The number of principal nodes connected to information node i is represented by M and N; M and N represent setting parameters that are not less than 1, and x i +N>M. It's worth noting that M and N can be set according to actual needs. For example, M=2, N=5, etc.

[0100] Given M=2 and N=5, calculate Figure 5 The initial weights of each connecting edge are shown. Specifically, for information node a, the number of main nodes it connects to is 4. That is, the initial weight of all edges connecting to information node a is 0.315; for information node b, the number of main nodes it connects to is 4. That is, the initial weight of the connection edges connected to information node b is 0.315; for information node c, the number of main nodes it is connected to is 5. That is, the initial weight of the connection edges connected to information node c is 0.301; for information node d, the number of main nodes it is connected to is 1. That is, the initial weight of the connection edges connected to information node d is 0.387; for information node e, the number of main nodes it is connected to is 1. That is, the initial weight of the connection edges connected to information node e is 0.387; for information node f, the number of main nodes it is connected to is 2. That is, the initial weight of the connection edge connected to the information node f is 0.356.

[0101] Step S403: Calculate the suspiciousness of the executing entity and the suspiciousness of the promotion information based on the connection relationship between each entity node and information node.

[0102] By constructing the relationship diagram between the implementing entity and the promotional information as described above, the relationship between the implementing entity and the promotional information can be presented quite intuitively.

[0103] In embodiments of the present invention, such as Figure 6 As shown, a specific implementation of step S403 above may include the following steps:

[0104] Step S601: Calculate the suspiciousness of the execution subject corresponding to the main node based on the initial weights of all the connecting edges connected to the main node;

[0105] Step S602: Calculate the suspiciousness of the promotion information corresponding to the information node based on the initial weights of all the connection edges connected to the information node.

[0106] Specifically, the suspiciousness of the executing entity and the suspiciousness of the promotion information in steps S601 and S602 can be calculated according to the following calculation formula (2).

[0107]

[0108] SD j The degree of suspicion corresponding to node j (which is either an information node or a subject node); μ jy The initial weight of the y-th edge connected to node j is represented by g; g represents the total number of edges connected to node j.

[0109] For example, targeting Figure 5 The suspiciousness scores of each node obtained through the above calculation method are as follows: For information node a, it has 4 connected edges, each with an initial weight of 0.315. Therefore, the suspiciousness score SD of information node a is... a =1.26; For information node b, it has 4 connecting edges, each with an initial weight of 0.315. Therefore, the suspiciousness SD of information node b is 1.26. b =1.26; For information node c, it has 5 connecting edges, each with an initial weight of 0.301. Therefore, the suspiciousness SD of information node c is... c =1.505; For information node d, it has 1 connecting edge with an initial weight of 0.387, so the suspiciousness of information node d is SD. d = 0.387; For information node e, it has one connecting edge with an initial weight of 0.387. Therefore, the suspiciousness SD of information node e is... e = 0.387; For information node f, it has 2 connecting edges, each with an initial weight of 0.356. Therefore, the suspiciousness SD of information node f is 0.387. f =0.712; For the main node 0, it has 3 connecting edges with initial weights of respectively.

[0110] Given values ​​of 0.315, 0.315, and 0.301, the suspicion level of the main node 0 is SD0 = 0.931. For the main node 1, it has three connecting edges with initial weights of [weights missing].

[0111] Given values ​​of 0.315, 0.315, and 0.301, the suspicion level of main node 1, SD1, is 0.931. For main node 2, it has three connecting edges with initial weights of [weights missing].

[0112] Given values ​​of 0.315, 0.315, and 0.301, the suspicion level SD2 of the main node 2 is 0.931. For the main node 3, it has four connecting edges with initial weights of [weights missing].

[0113] Given the values ​​0.315, 0.315, 0.301, and 0.387, the suspicion level of the main node 3 is SD3 = 1.318. For the main node 4, it has one connecting edge with an initial weight of 0.387, so the suspicion level of the main node 4 is SD4 = 0.387. For the main node 5, it has two connecting edges with initial weights of 0.301 and 0.356 respectively, so the suspicion level of the information node f is SD5 = 0.657. For the main node 6, it has one connecting edge with an initial weight of 0.356, so the suspicion level of the main node 6 is SD6 = 0.356.

[0114] It is worth noting that there is no strict order between steps S601 and S602.

[0115] The above method of calculating suspiciousness can accurately reflect the likelihood of each node being accessed abnormally.

[0116] In embodiments of the present invention, such as Figure 7 As shown, the specific implementation of finding the sub-relationship graph with the highest average suspicion level contained in the relationship graph in step S103 above may include the following steps:

[0117] Repeat steps S701 and S702 until the loop termination condition is met:

[0118] Step S701: Determine the average suspiciousness of the relationship graph and delete the node with the lowest suspiciousness in the relationship graph, wherein the node with the lowest suspiciousness is an information node or a main node;

[0119] In this step, the specific implementation of determining the average suspicion degree of the initially constructed relationship graph may include: calculating it using the following formula (3).

[0120]

[0121] wherein, characterizes the average suspiciousness of the relationship graph initially constructed; SD t characterizes the suspiciousness of the tth node in the relationship graph, the tth node being an information node or a subject node; R characterizes the total number of nodes in the relationship graph.

[0122] For the sub-relationship graph obtained in step S702, the average suspiciousness of the relationship graph is determined as the average suspiciousness calculated in step S702.

[0123] Step S702: Recalculating the average suspiciousness and the suspiciousness of each node after deleting the node with the minimum suspiciousness, and taking the sub-relationship graph after deleting the node with the minimum suspiciousness as the relationship graph.

[0124] In this step, there are two implementation manners for recalculating the average suspiciousness after deleting the node with the minimum suspiciousness.

[0125] The first implementation manner for recalculating the average suspiciousness after deleting the node with the minimum suspiciousness:

[0126] According to the suspiciousness of the deleted node with the minimum suspiciousness, the average suspiciousness of the relationship graph, and the number of nodes included in the sub-relationship graph after deleting the node with the minimum suspiciousness, the average suspiciousness of the sub-relationship graph is calculated.

[0127] Specifically, the average suspiciousness of the sub-relationship graph can be calculated according to the following calculation formula (4).

[0128]

[0129] wherein, characterizes the average suspiciousness of the relationship graph recalculated in step S702 after deleting the node with the minimum suspiciousness; characterizes the average suspiciousness of the relationship graph determined in step S701; R characterizes the total number of nodes in the relationship graph for which step S701 is performed; SD min characterizes the suspiciousness of the deleted node with the minimum suspiciousness.

[0130] It is worth noting that, and R are changed according to the number of cycles. For example, for the first cycle, is the average suspiciousness of the relationship graph initially constructed calculated by the above calculation formula (3), and R is the total number of nodes in the relationship graph initially constructed; for the second cycle and the cycles thereafter, is the average suspiciousness calculated in step S702 in the last cycle, and R is the total number of nodes in the sub-relationship graph obtained in step S702 in the last cycle.

[0131] The second implementation of recalculating the average suspiciousness after deleting the node with the minimum suspiciousness: according to the suspiciousness of each node in the sub-relation graph after the recalculation and the total number of nodes in the sub-relation graph after deleting the node with the minimum suspiciousness, the average suspiciousness after deleting the node with the minimum suspiciousness is calculated.

[0132] The suspiciousness of each node in the sub-relation graph after deleting the node with the minimum suspiciousness can be adjusted according to the initial weight of the connection edge connected to the node.

[0133] Step S703: finding the sub-relation graph with the maximum average suspiciousness from the average suspiciousness of each sub-relation graph obtained in the loop.

[0134] The specific implementation of the step S703 can be of two kinds.

[0135] The loop stopping condition can be that all nodes in the relation graph are deleted or only one node in the relation graph is not deleted.

[0136] The first implementation of finding the sub-relation graph with the maximum average suspiciousness can include: comparing the average suspiciousness of each sub-relation graph, and selecting the sub-relation graph with the maximum average suspiciousness.

[0137] The following takes the relation graph shown in Figure 8 as an example. Figure 5 The loop executes the above steps S701 and S702, and the process of deleting the node with the minimum suspiciousness and calculating the average suspiciousness.

[0138] As shown in Figure 5 , the suspiciousness of each node is respectively: the suspiciousness SDaof the information node a = 1.26; the suspiciousness SDbof the information node b = 1.26; the suspiciousness SDCof the information node c = 1.505; the suspiciousness SDDof the information node d = 0.387; the suspiciousness SDeof the information node e = 0.387; the suspiciousness SDFof the information node f = 0.712; the suspiciousness SD0of the subject node 0 = 0.931; the suspiciousness SD1of the subject node 1 = 0.931; the suspiciousness SD2of the subject node 2 = 0.931; the suspiciousness SD3of the subject node 3 = 1.318; the suspiciousness SD4of the subject node 4 = 0.387; the suspiciousness SD5of the subject node 5 = 0.657; the suspiciousness SD6of the subject node 6 = 0.356. a b c d e f By comparing or sorting the above suspiciousness, it can be concluded that the suspiciousness of the subject node 6 is the minimum, and then as shown in Figure 8 ​​​​​As shown, step A: Delete the main node 6 and the corresponding connecting edge connected to the main node 6; by recalculating the suspicion of each node (since only the connecting edge of information node f changed, the recalculation also only changed the suspicion of information node f, and the suspicion of information node f became 0.356), then step B is further executed: Delete information node f and the corresponding connecting edge of information node f; by recalculating the suspicion of each node (since only the connecting edge of information node 5 changed, the recalculation also only changed the suspicion of information node 5, and the suspicion of main node 5 became 0.301), then step C is further executed: Delete main node 5 and the corresponding connecting edge of main node 5; by recalculating the suspicion of each node (since the connecting edges of all existing nodes have not changed, the suspicion of main node 4 and information node e in the graph obtained after step C is executed is the smallest), then step D is further executed: Delete main node 4 and the corresponding connecting edge of main node 4; and then step E is further executed: Delete information node e and the corresponding connecting edge of information node e; it is worth noting that step D and step E can be interchanged. By recalculating the suspiciousness of each node (since the connecting edges of all existing nodes have not changed, the suspiciousness of information node d in the graph obtained after step E is the lowest), step F is further executed: deleting information node d and its corresponding connecting edges. The deletion of the lowest node continues in the same manner as steps A and F until all stages in the relationship graph have been deleted. By comparing the suspiciousness of the sub-relationship graphs obtained from each deletion step, it is determined that the sub-relationship graph obtained after deleting the lowest node in step F has the highest suspiciousness. Therefore, the sub-relationship graph with the highest average suspiciousness is obtained after step F is executed.

[0139] like Figure 9 As shown, the second method for finding the sub-relationship graph with the highest average suspicion level may include the following steps:

[0140] Step S901: Construct a two-dimensional coordinate graph for the number of iterations and the average suspicion level recalculated for each iteration;

[0141] In response to the above Figure 8 In the illustrated cyclic deletion steps, the average suspicion level of the initial graph is 0.848; based on the above calculation formula (4), the average suspicion level of the sub-graph after deleting the main node 6 (the suspicion level of the main node 6 is 0.356) in step A (the result after the first cycle) is calculated as follows: Based on the above calculation formula (4), the average suspicion of the sub-relationship graph after deleting information node f (the suspicion of information node f is recalculated as 0.356) in step B (the result after the second loop) is: The average suspiciousness of the sub-relation graph after deleting the main node 5 (the suspiciousness of the main node 5 is 0.301) based on the calculation formula (4) is The average suspiciousness of the sub-relation graph after deleting the main node 4 (the suspiciousness of the main node 4 is 0.387) based on the calculation formula (4) is The average suspiciousness of the sub-relation graph after deleting the information node e (the suspiciousness of the information node e is 0) based on the calculation formula (4) is The average suspiciousness of the sub-relation graph after deleting the information node d (the suspiciousness of the information node d is 0.387) based on the calculation formula (4) is The average suspiciousness of the sub-relation graph after deleting the main node 3 (the suspiciousness of the main node 3 is 0.931) based on the calculation formula (4) is Then, the nodes are continuously deleted, and the suspiciousness corresponding to the deleting step is continuously obtained, and a part of the cycle number-average suspiciousness curve diagram as shown in Figure 10 is constructed. It can be found from the diagram that the sub-relation graph with the maximum average suspiciousness is the sub-relation graph obtained in step F (the result after the sixth cycle).

[0142] Step S902: Find the cycle number corresponding to the maximum average suspiciousness from the two-dimensional coordinate diagram;

[0143] Step S903: Determine the sub-relation graph with the maximum average suspiciousness according to the pre-cached corresponding relationship between the cycle number and the sub-relation graph.

[0144] For example, Figure 10 It can be seen from the diagram that the maximum suspiciousness is 1.062, and the corresponding cycle number is 6 times, that is, the sub-relation graph obtained in the sixth cycle is the sub-relation graph with the maximum suspiciousness.

[0145] In addition, before deleting the node with the minimum suspiciousness in the relation graph in step S701, the node with the minimum suspiciousness needs to be found. There are two implementation manners for finding and deleting the node with the minimum suspiciousness.

[0146] The first implementation manner for finding and deleting the node with the minimum suspiciousness in the relation graph is as follows:

[0147] The suspiciousness of each node included in the relation graph is sorted, the node with the minimum suspiciousness is obtained according to the sorting result, and the node with the minimum suspiciousness is deleted.

[0148] For example,Figure 11 As shown in the second embodiment of finding and deleting the node with the minimum suspicious degree in the suspicious relationship graph, the embodiment can include the following steps:

[0149] Step S1101: constructing a minimum priority tree for the relationship graph;

[0150] It is worth mentioning that the relationship graph can be an initial relationship graph or each sub-relationship graph obtained by the above-mentioned loop.

[0151] In the minimum priority tree, the suspicious degrees of the nodes in the relationship graph are stored as the leaf nodes in the bottom layer of the minimum priority tree, and the leaf nodes in the layers other than the bottom layer in the minimum priority tree inherit the minimum values of the leaf nodes in the next layer connected thereto; specifically, as shown in the figure, the index numbers of the leaf nodes stored in the bottom layer correspond to the nodes in the relationship graph, and the values of the leaf nodes stored in the bottom layer are the suspicious degrees of the nodes in the relationship graph. For example, the index number eid=0 corresponds to the subject node 0; eid=1 corresponds to the subject node 1; eid=2 corresponds to the subject node 2; eid=3 corresponds to the subject node 3; eid=4 corresponds to the subject node 4; eid=5 corresponds to the subject node 5; eid=6 corresponds to the subject node 6; eid=a corresponds to the information node a; eid=b corresponds to the information node b; eid=c corresponds to the information node c; eid=d corresponds to the information node d; eid=e corresponds to the information node e; and eid=f corresponds to the information node f. The way of constructing the minimum priority tree is: comparing each two values in the same layer, selecting the smaller value to form the value of the upper layer, and if there are odd number of values in a layer, supplementing a leaf node with a larger value or an infinite value. As shown in the figure, the values in the bottom layer are 0.931, 0.931, 0.931, 1.318, 0.387, 0.657, 0.356, 1.26, 1.26, 1.505, 0.387, 0.387, 0.712, and since the number of these values is odd, an infinite value +∞ is supplemented. Comparing each two values, the values of the leaf nodes in the second layer are 0.931, 0.931, 0.387, 0.356, 1.26, 0.387, 0.712, the number of the leaf nodes in the second layer is odd, and therefore a leaf node is continuously supplemented and assigned with a value +∞. Comparing each two values in the second layer, the values of the leaf nodes in the third layer are 0.931, 0.356, 0.387, 0.712. Comparing each two values in the third layer, the values of the leaf nodes in the fourth layer are 0.356, 0.387. Comparing each two values in the fourth layer, the value of the leaf node in the fifth layer is 0.356. Figure 12 Figure 12

[0152] ​​Step S1102: finding the target leaf node in the bottom layer according to the minimum value recorded in the highest layer of the minimum priority tree and the inheritance relationship corresponding to the minimum value of the highest layer;

[0153] As Figure 12 The dashed line as identified is the value of the fifth layer leaf node that should be inherited, and through the dashed line, the target leaf node in the bottom layer can be easily found as the leaf node with index number eid=6.

[0154] Step S1103: determining the node with the minimum suspicious degree in the relationship graph according to the found target leaf node;

[0155] It has been mentioned above that each index number has a corresponding relationship with each node in the relationship graph, and thus the subject node 6 with the index number eid=6 can be accurately and quickly determined as the node with the minimum suspicious degree.

[0156] Step S1104: performing the step of deleting the node with the minimum suspicious degree in the relationship graph.

[0157] In the embodiment of the present application, in order to find a more comprehensive abnormal access subject and abnormal inquiry promotion information, the above abnormal access detection method can further include:

[0158] deleting the node included in the sub-relationship graph with the maximum average suspicious degree from the relationship graph;

[0159] The relationship graph in this step refers to the relationship graph initially constructed for the log data by step S102, for example, the relationship graph is the relationship graph shown in Figure 5 After this step, the subject nodes 0, 1, 2, 3 and the information nodes a, b, c are deleted, and the remaining nodes are the subject nodes 4, 5, 6 and the information nodes d, e, f.

[0160] Then, the following steps M1 and M2 (not shown in the figure) are executed in a loop:

[0161] Step M1: determining whether the number of found sub-relationship graphs with the maximum average suspicious degree reaches a preset detection number, if yes, ending the loop, otherwise, executing step M2;

[0162] The detection number can be set according to actual needs. For example, the detection number is 1, and one sub-relationship graph with the maximum average suspicious degree has been found in the foregoing, and thus the loop is directly ended.

[0163] For another example, the detection number is 3, and since only one sub-relationship graph with the maximum average suspicious degree has been found in the foregoing, the following step M2 needs to be continuously executed.

[0164] Step M2: Based on the suspicion level of the remaining nodes in the relationship graph, continue searching for the sub-relationship graph with the highest average suspicion level among the remaining nodes in the relationship graph.

[0165] The suspicion level of the remaining nodes in the graph is the recalculated suspicion level after deleting the nodes included in the subgraph with the highest average suspicion level (the sum of the initial weights of all edges connected to the remaining nodes). For example, for a graph where the remaining nodes are the main nodes 4, 5, and 6 and the information nodes d, e, and f, the search continues among these main nodes 4, 5, and 6 and the information nodes d, e, and f to find the subgraph with the highest average suspicion level.

[0166] For the current cycle being the first cycle, the remaining nodes in the relational graph refer to the nodes remaining after deleting the nodes of the sub-relationship graph with the highest average suspicion degree in the relational graph initially constructed for the log data in step S102. For the current cycle being the second or subsequent cycle, the remaining nodes in the relational graph refer to the nodes remaining after deleting all nodes in the sub-relationship graph with the highest average suspicion degree obtained in the previous cycle, based on all the remaining nodes in the previous cycle.

[0167] Accordingly, in step S104 above, parsing the sub-relationship graph specifically refers to parsing all the sub-relationship graphs with the highest average suspiciousness. Correspondingly, the promotional information with abnormal access and the execution entity of abnormal access are derived from all the sub-relationship graphs with the highest average suspiciousness.

[0168] like Figure 13 As shown, this embodiment of the invention provides an abnormal access detection device 1300, which may include: an acquisition unit 1301, a relationship graph construction unit 1302, a search unit 1303, and a parsing unit 1304, wherein...

[0169] The acquisition unit 1301 is used to acquire log data within a set period, wherein the log data includes: multiple execution entities, multiple promotional information, and the access relationship between the execution entities and the promotional information;

[0170] The relationship graph construction unit 1302 is used to construct a relationship graph for log data based on multiple execution entities, multiple promotional information, and the access relationship between execution entities and promotional information. The relationship graph includes the suspiciousness of multiple execution entities and the suspiciousness of multiple promotional information.

[0171] The search unit 1303 is used to search for the sub-relationship graph with the highest average suspicion level based on the suspicion levels of multiple execution entities and multiple promotional information included in the relationship graph.

[0172] The analysis unit 1304 is configured to analyze the sub-relation graph, and determine the promoted information with abnormal access and the execution subject with abnormal access according to the analysis result.

[0173] In the embodiment of the present application, the relation graph construction unit 1302 is configured to convert the plurality of execution subjects and the plurality of promoted information into corresponding subject nodes and information nodes in the relation graph, construct the connection relationship between the subject nodes and the information nodes in the relation graph according to the access relationship between the execution subjects and the promoted information, and calculate the suspicious degree of the execution subject and the suspicious degree of the promoted information according to the connection relationship between the subject nodes and the information nodes.

[0174] In the embodiment of the present application, the relation graph construction unit 1302 is further configured to construct the connection edges between the subject nodes and the information nodes in the relation graph, and calculate the initial weight of the connection edges, wherein the subject nodes, the information nodes, the connection edges between the subject nodes and the information nodes, and the initial weight of the connection edges constitute the connection relationship.

[0175] In the embodiment of the present application, the relation graph construction unit 1302 is further configured to, for each information node corresponding to the promoted information, perform the following steps: count the number of the subject nodes connected to the information node; and calculate the initial weight of the connection edge corresponding to the information node according to the counting result.

[0176] In the embodiment of the present application, the relation graph construction unit 1302 is further configured to calculate the suspicious degree of the execution subject corresponding to the subject node according to the initial weight of all the connection edges connected to the subject node, and calculate the suspicious degree of the promoted information corresponding to the information node according to the initial weight of all the connection edges connected to the information node.

[0177] In the embodiment of the present application, the searching unit 1303 is configured to cyclically perform steps N1 and N2 until a loop stop condition is met: N1: determine the average suspicious degree of the relation graph, and delete the node with the minimum suspicious degree in the relation graph, wherein the node with the minimum suspicious degree is the information node or the subject node; N2: recalculate the average suspicious degree and the suspicious degree of each node after the node with the minimum suspicious degree is deleted, and take the sub-relation graph after the node with the minimum suspicious degree is deleted as the relation graph; and search for the sub-relation graph with the maximum average suspicious degree from the average suspicious degrees of the sub-relation graphs obtained from the loop.

[0178] In the embodiment of the present application, the searching unit 1303 is further configured to calculate the average suspicious degree of the sub-relation graph according to the suspicious degree of each node included in the relation graph and the number of nodes included in the sub-relation graph.

[0179] In the embodiment of the present application, the searching unit 1303 is further configured to calculate the average suspiciousness of the sub-relation graph according to the suspiciousness of the deleted node with the minimum suspiciousness, the average suspiciousness of the relation graph, and the number of nodes included in the sub-relation graph after the node with the minimum suspiciousness is deleted.

[0180] In the embodiment of the present application, the searching unit 1303 is further configured to delete the nodes included in the sub-relation graph with the maximum average suspiciousness from the relation graph, and repeatedly perform the following steps M1 and M2.

[0181] M1: determining whether the number of the searched sub-relation graphs with the maximum average suspiciousness reaches a preset detection number, if yes, ending the loop, otherwise, performing step M2.

[0182] M2: continuing to search for the sub-relation graph with the maximum average suspiciousness from the remaining nodes of the relation graph according to the suspiciousness of the remaining nodes of the relation graph.

[0183] In the embodiment of the present application, the searching unit 1303 is further configured to construct a two-dimensional coordinate graph for the loop number and the average suspiciousness recalculated in each loop, search for the loop number corresponding to the maximum value of the average suspiciousness from the two-dimensional coordinate graph, and determine the sub-relation graph with the maximum average suspiciousness according to the pre-stored corresponding relationship between the loop number and the sub-relation graph.

[0184] In the embodiment of the present application, the searching unit 1303 is further configured to construct a minimum priority tree for the relation graph, wherein the suspiciousness of each node in the relation graph is stored as each leaf node in the bottom layer of the minimum priority tree, and the leaf nodes in the layers other than the bottom layer in the minimum priority tree inherit the minimum values of the leaf nodes in the next layer connected thereto, search for a target leaf node in the bottom layer according to the minimum value recorded in the highest layer of the minimum priority tree and the inheritance relationship corresponding to the minimum value of the highest layer, determine the node with the minimum suspiciousness in the relation graph according to the searched target leaf node, and perform the step of deleting the node with the minimum suspiciousness in the relation graph for the node with the minimum suspiciousness.

[0185] Figure 14 An exemplary system architecture 1400 to which the abnormal access detection method or the abnormal access detection apparatus of the embodiments of the present application can be applied is shown.

[0186] As Figure 14As shown, the system architecture 1400 can include terminal devices 1401, 1402, 1403, a network 1404, an access server 1405, and a detection server 1406. The network 1404 is a medium for providing a communication link between the terminal devices 1401, 1402, 1403 and the access server 1405. The network 1404 is also a medium for providing a communication link between the access server 1405 and the detection server 1406. The network 1404 can include various connection types, such as wired, wireless communication links, or fiber optic cables, etc.

[0187] A user can use the terminal devices 1401, 1402, 1403 to interact with the access server 1405 through the network 1404 to access promotion information provided by the access server 1405, etc. Various communication client applications can be installed on the terminal devices 1401, 1402, 1403, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples). The terminal devices 1401, 1402, 1403 can access the promotion information provided by the access server 1405, such as advertisements, through the various communication client applications installed, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0188] The terminal devices 1401, 1402, 1403 can be various electronic devices with display screens and support for web browsing, including but not limited to smartphones, tablet computers, laptop computers, and desktop computers, etc.

[0189] The detection server 1406 can be a server that provides various services, such as detecting whether the access to the promotion information provided by the access server 1405 by the user using the terminal devices 1401, 1402, 1403 is abnormal access based on the log data recorded by the access server 1405. The detection server 1406 can analyze and process the log data of the access server 1405, etc., and feed back the processing results (such as the terminal and promotion information of the detected abnormal access - only as an example) to the terminal device.

[0190] It should be noted that the abnormal access detection method provided by the embodiments of the present application is generally executed by the detection server 1406, and correspondingly, the abnormal access detection apparatus is generally provided in the server 1406.

[0191] It should be understood that Figure 14 The number of terminal devices, networks, access servers, and detection servers in the system architecture 1400 is only illustrative. According to the needs of implementation, there can be any number of terminal devices, networks, access servers, and detection servers.

[0192] Reference will now be made to Figure 15 which shows a structural diagram of a computer system 1500 suitable for use in implementing the terminal device of an embodiment of the present application. Figure 15 The terminal device shown is merely an example and should not impose any limitation on the functions and the range of use of an embodiment of the present application.

[0193] As shown in Figure 15 , the computer system 1500 includes a central processing unit (CPU) 1501 which can perform various appropriate actions and processes in accordance with a program stored in a read only memory (ROM) 1502 or a program loaded from a storage section 1508 into a random access memory (RAM) 1503. In the RAM 1503, various programs and data required for the operation of the system 1500 are also stored. The CPU 1501, the ROM 1502, and the RAM 1503 are connected to each other through a bus 1504. An input / output (I / O) interface 1505 is also connected to the bus 1504.

[0194] The following components are connected to the I / O interface 1505: an input section 1506 including a keyboard, a mouse, etc.; an output section 1507 including a display such as a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1508 including a hard disk, etc.; and a communication section 1509 including a network interface card such as a LAN card, a modem, etc. The communication section 1509 performs communication processing via a network such as the Internet. A drive 1510 is also connected to the I / O interface 1505 as necessary. A removable media 1511 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc. is attached to the drive 1510 as necessary, so that a computer program read therefrom is installed into the storage section 1508 as necessary.

[0195] In particular, the processes described above with reference to the flowcharts can be implemented as a computer software program in accordance with an embodiment of the present application. For example, an embodiment of the present application includes a computer program product comprising a computer program carried on a computer readable medium, the computer program containing program code for executing the methods shown in the flowcharts. In such an embodiment, the computer program can be downloaded and installed from a network by the communication section 1509, and / or installed from the removable media 1511. When the computer program is executed by the central processing unit (CPU) 1501, the above-described functions defined in the system of the present application are executed.

[0196] It should be noted that the computer-readable medium shown in the present application can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may, for example, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or component, or any combination of the above. More specific examples of computer-readable storage media can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device or component. In the present application, the computer-readable signal medium can include a data signal carried in a baseband or as a part of a carrier wave, which carries computer-readable program code. Such a propagated data signal can take various forms, including but not limited to an electromagnetic signal, an optical signal or any suitable combination of the above. The computer-readable signal medium can also be any computer-readable medium other than the computer-readable storage medium, which can send, propagate or transmit a program for use by or in conjunction with an instruction execution system, device or component. The program code contained on the computer-readable medium can be transmitted by any suitable medium, including but not limited to wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0197] The flowcharts and block diagrams in the drawings illustrate the possible implementation architectures, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each block in the flowcharts or block diagrams can represent a module, a program segment or a part of code containing one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur in different order than that shown in the drawings. For example, two blocks that are shown in succession can actually be executed substantially in parallel, and sometimes in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams or flowcharts, and the combination of blocks in the block diagrams or flowcharts, can be implemented by a dedicated hardware-based system that performs the specified functions or operations, or can be implemented by a combination of dedicated hardware and computer instructions.

[0198] The units described in the embodiments of the present application can be implemented by software or by hardware. The units described can also be implemented in a processor, for example, a processor can be described as including an obtaining unit, a relationship graph constructing unit, a searching unit and an analyzing unit. In some cases, the names of the units do not limit the units themselves, for example, the obtaining unit can also be described as a unit that obtains log data in a setting period.

[0199] As another aspect, the present application also provides a computer readable medium, which can be included in the device described in the above embodiments or can exist independently without being assembled into the device. The computer readable medium carries one or more programs, which, when executed by the device, cause the device to include: obtaining log data in a setting period, wherein the log data includes a plurality of execution subjects, a plurality of promotion information and an access relationship between the execution subjects and the promotion information; constructing a relationship graph for the log data according to the plurality of execution subjects, the plurality of promotion information and the access relationship between the execution subjects and the promotion information, wherein the relationship graph includes suspicious degrees of the plurality of execution subjects and suspicious degrees of the plurality of promotion information; searching for a sub-relationship graph with the largest average suspicious degree included in the relationship graph according to the suspicious degrees of the plurality of execution subjects and the suspicious degrees of the plurality of promotion information included in the relationship graph; and analyzing the sub-relationship graph and determining the promotion information with abnormal access and the execution subject with abnormal access according to the analysis result.

[0200] According to the technical scheme of the embodiments of the present application, since the log data including a plurality of execution subjects, a plurality of promotion information and an access relationship between the execution subjects and the promotion information is obtained, and a relationship graph is constructed for the log data according to the plurality of execution subjects, the plurality of promotion information and the access relationship between the execution subjects and the promotion information, the relationship between the execution subjects and the promotion information can be more truly reflected by the relationship graph, and the suspicious degrees of the plurality of execution subjects and the suspicious degrees of the plurality of promotion information included in the relationship graph can be reflected. By searching for a sub-relationship graph with the largest average suspicious degree included in the relationship graph, a sub-relationship graph with abnormal access can be more accurately and truly obtained, i.e., the execution subject in the relationship with abnormal access and the promotion information with abnormal access. Therefore, by constructing the relationship graph, the relationship of the relationship graph and the suspicious degrees of the promotion information and the execution subject can be used to ensure the authenticity and accuracy of abnormal access detection.

[0201] The foregoing detailed description has set forth various embodiments of the devices and / or processes via the use of specific terminology. However, embodiments thereof can be practiced with the exact description not being presented in detail. The term "device" should be understood to encompass devices operating in various modes, such as active mode, sleep mode, hibernate mode, and the like. The terms "coupled" and "connected," along with their derivatives, can be used. It should be understood that these terms are not intended as synonyms for each other. Rather, particular circuitry that can be said to be coupled or connected can be coupled and connected via some transmission medium.

Claims

1. An anomalous access detection method, characterized by, The method comprises the following steps: acquiring log data in a set period, wherein the log data comprises a plurality of execution subjects, a plurality of promotion information, and an access relationship between the execution subjects and the promotion information; constructing a relationship graph for the log data according to the plurality of execution subjects, the plurality of promotion information, and the access relationship between the execution subjects and the promotion information, wherein the relationship graph comprises suspicious degrees of the plurality of execution subjects and suspicious degrees of the plurality of promotion information; the suspicious degree of the execution subject is calculated according to initial weights of all connection edges connected by a subject node; and the suspicious degree of the promotion information is calculated according to initial weights of all connection edges connected by an information node; finding a sub-relationship graph with the largest average suspicious degree from the relationship graph according to the suspicious degrees of the plurality of execution subjects and the suspicious degrees of the plurality of promotion information included in the relationship graph; analyzing the sub-relationship graph, and determining the promotion information with abnormal access and the execution subject with abnormal access according to an analysis result.

2. The anomalous access detection method of claim 1, wherein, The method of constructing a relationship graph for the log data comprises the following steps: converting the plurality of execution subjects and the plurality of promotion information into corresponding subject nodes and information nodes in the relationship graph; constructing a connection relationship between each of the subject nodes and the information nodes in the relationship graph according to the access relationship between the execution subjects and the promotion information; calculating the suspicious degrees of the execution subjects and the suspicious degrees of the promotion information according to the connection relationship between each of the subject nodes and the information nodes.

3. The anomalous access detection method of claim 2, wherein, The method of constructing a connection relationship between each of the subject nodes and the information nodes in the relationship graph comprises the following steps: constructing connection edges between each of the subject nodes and the information nodes in the relationship graph, and calculating initial weights of the connection edges, wherein the subject nodes, the information nodes, the connection edges between the subject nodes and the information nodes, and the initial weights of the connection edges constitute the connection relationship.

4. The anomalous access detection method of claim 3, wherein, The method of calculating the initial weights of the connection edges comprises the following steps: for each information node corresponding to each of the promotion information, performing the following steps: counting a number of subject nodes connected to the information node; calculating the initial weight of the connection edge corresponding to the information node according to a counting result.

5. The anomalous access detection method according to claim 3 or 4, characterized in that, The method of calculating the suspicious degrees of the execution subjects and the suspicious degrees of the promotion information comprises the following steps: calculating the suspicious degree of the execution subject corresponding to the subject node according to the initial weights of all connection edges connected by the subject node; calculating the suspicious degree of the promotion information corresponding to the information node according to the initial weights of all connection edges connected by the information node.

6. The anomalous access detection method of claim 1, wherein, The method of finding a sub-relationship graph with the largest average suspicious degree from the relationship graph comprises the following steps: recursively performing the following steps N1 and N2 until a loop stopping condition is met: N1: determining an average suspicious degree of the relationship graph, and deleting a node with the smallest suspicious degree in the relationship graph, wherein the node with the smallest suspicious degree is an information node or a subject node; N2: recalculating the average suspicious degree and the suspicious degrees of all nodes after deleting the node with the smallest suspicious degree, and taking the sub-relationship graph after deleting the node with the smallest suspicious degree as the relationship graph. From the average suspicious degree of each of the sub-relation graphs obtained in the loop, find the sub-relation graph with the maximum average suspicious degree.

7. The anomalous access detection method of claim 6, wherein, Determine the average suspicious degree of the relation graph, comprising: According to the suspicious degree of each node included in the relation graph and the number of nodes included in the sub-relation graph, calculate the average suspicious degree of the sub-relation graph.

8. The anomalous access detection method of claim 6, wherein, Recalculate the average suspicious degree after deleting the node with the minimum suspicious degree, comprising: According to the suspicious degree of the deleted node with the minimum suspicious degree, the average suspicious degree of the relation graph, and the number of nodes included in the sub-relation graph after deleting the node with the minimum suspicious degree, calculate the average suspicious degree of the sub-relation graph.

9. The method according to any one of claims 1 to 4, 6 to 8, wherein Further comprising: Delete the nodes included in the sub-relation graph with the maximum average suspicious degree from the relation graph; Loop the following steps M1 and M2: M1: Determine whether the number of the sub-relation graphs with the maximum average suspicious degree found reaches a preset detection number, if yes, end the loop, otherwise, execute step M2; M2: Continue to find the sub-relation graph with the maximum average suspicious degree from the remaining nodes of the relation graph according to the suspicious degree of the remaining nodes of the relation graph.

10. The anomalous access detection method of claim 6, wherein, Find the sub-relation graph with the maximum average suspicious degree, comprising: Build a two-dimensional coordinate graph for the number of loops and the average suspicious degree recalculated each time the loop; From the two-dimensional coordinate graph, find the loop number corresponding to the maximum value of the average suspicious degree; According to the pre-cached correspondence between the loop number and the sub-relation graph, determine the sub-relation graph with the maximum average suspicious degree.

11. The anomalous access detection method of claim 6, wherein, Further comprising: Build a minimum priority tree for the relation graph, wherein the suspicious degree of each node in the relation graph is stored as each leaf node in the bottom layer of the minimum priority tree, and in the minimum priority tree, the leaf nodes in the layers other than the bottom layer inherit the minimum value of the leaf nodes in the next layer connected thereto; According to the minimum value recorded in the highest layer of the minimum priority tree and the inheritance relationship corresponding to the minimum value of the highest layer, find the target leaf node in the bottom layer; According to the target leaf node found, determine the node with the minimum suspicious degree in the relation graph; For the node with the minimum suspicious degree, execute the step of deleting the node with the minimum suspicious degree in the relation graph.

12. An anomalous access detection apparatus characterized by comprising: Comprise: An acquisition unit, a relation graph construction unit, a finding unit, and an analysis unit, wherein, The acquisition unit is configured to acquire log data in a set period, wherein the log data comprises a plurality of execution subjects, a plurality of promotion information, and an access relationship between the execution subjects and the promotion information; The relation graph construction unit is configured to construct a relation graph for the log data according to the plurality of execution subjects, the plurality of promotion information, and the access relationship between the execution subjects and the promotion information, wherein the relation graph comprises suspicious degrees of the plurality of execution subjects and suspicious degrees of the plurality of promotion information; the suspicious degree of the execution subject is calculated according to the initial weight of all connection edges connected to the subject node, and the suspicious degree of the promotion information is calculated according to the initial weight of all connection edges connected to the information node; The searching unit is configured to search for a sub-relation graph with the maximum average suspicious degree from the relation graph according to suspicious degrees of the execution subjects and suspicious degrees of the promotion information included in the relation graph. The analyzing unit is configured to analyze the sub-relation graph and determine the promotion information with the abnormal access and the execution subject with the abnormal access according to an analysis result.

13. An anomalous access detection electronic device, comprising: The computer program product includes: one or more processors; a memory configured to store one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the method in any one of claims 1-11.

14. A computer readable medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the method in any one of claims 1-11.

Images