Machine behavior detection method and its device, equipment, and medium

Abstract

The present application relates to a machine behavior detection method and its device, equipment, and medium in the field of network security, the method comprising: responding to a page resource loading request submitted by a client, obtaining pre-collected user operation behavior data; performing a first detection on the user operation behavior data according to preset rules to determine whether the client's operation behavior belongs to machine behavior; when the first detection shows that it does not belong to machine behavior, a machine behavior detection model pre-trained to convergence is used to perform a second detection on the comprehensive feature vector of the user operation behavior data to determine whether the client's operation behavior belongs to machine behavior; when it is determined that the client's operation behavior belongs to machine behavior, the client's network address is added to a temporary blacklist to start a suspicious detection of the client; when the client passes the suspicious detection, the page resources required for the loading request are pushed to the client. The present application can accurately identify machine behavior.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a machine behavior detection method and its corresponding device, computer equipment, and computer-readable storage medium. Background Art

[0002] With the continuous development of network information technology, most companies will build Internet websites and deploy business-related online services in them. Users can access Internet websites online through the Internet, and then start the online services provided by the corresponding websites according to their own needs, thereby realizing their own needs, such as: handling certificates, opening online stores, online shopping, etc.

[0003] Generally speaking, enterprises need to ensure the network security of Internet websites to avoid adverse events such as websites being cracked or attacked by brute force, website information being crawled, etc., which may cause unnecessary economic losses. In traditional network security detection technical means, the IP addresses of clients accessing the website are usually counted. When the access frequency exceeds a certain threshold, the IP is blocked and the client's access to the website is not responded to. Alternatively, the port status of the client accessing the website is reversely scanned to determine whether the client is blocked and the client's access to the website is not responded to. In the above technical implementation, only the network information generated when the client accesses the website is detected without detecting the client's operation behavior, which is prone to misjudgment, affecting the user's normal use and user experience.

[0004] In view of the above shortcomings of traditional technology, this application makes corresponding explorations. Summary of the invention

[0005] The primary purpose of the present application is to solve at least one of the above problems and provide a machine behavior detection method and its corresponding device, computer equipment, and computer-readable storage medium.

[0006] In order to meet the various objectives of this application, this application adopts the following technical solutions:

[0007] A machine behavior detection method provided to meet one of the purposes of this application includes the following steps:

[0008] Responding to the page resource loading request submitted by the client, acquiring the collected user operation behavior data, wherein the user operation behavior data includes mouse movement trajectory data, user agent data in the browser data, and keyboard input data;

[0009] Performing a first level of detection on the user operation behavior data according to preset rules to determine whether the client's operation behavior is a machine behavior;

[0010] When the first detection indicates that the behavior is not a machine behavior, a second detection is performed on the comprehensive feature vector of the user operation behavior data using a machine behavior detection model that has been pre-trained to convergence to determine whether the operation behavior of the client is a machine behavior;

[0011] When it is determined that the client's operation behavior is a machine behavior, the client's network address is added to a temporary blacklist to start suspicious detection of the client;

[0012] When the client passes the suspicion detection, the page resources required for the loading request are pushed to the client.

[0013] On the other hand, a machine behavior detection device provided to meet one of the purposes of the present application includes a data acquisition module, a first detection module, a second detection module, a blacklist detection module and a resource push module, wherein: the data acquisition module is used to respond to a page resource loading request submitted by a client, and obtain collected user operation behavior data, wherein the user operation behavior data includes mouse movement trajectory data, user agent data in browser data and keyboard input data; the first detection module is used to perform a first detection on the user operation behavior data according to preset rules to determine whether the client's operation behavior belongs to machine behavior; the second detection module is used to perform a second detection on the comprehensive feature vector of the user operation behavior data using a machine behavior detection model pre-trained to convergence when the first detection shows that it does not belong to machine behavior, to determine whether the client's operation behavior belongs to machine behavior; the blacklist detection module is used to add the client's network address to a temporary blacklist when it is determined that the client's operation behavior belongs to machine behavior, so as to initiate suspicion detection of the client; the resource push module is used to push the page resources required for the loading request to the client when the client passes the suspicion detection.

[0014] On the other hand, a computer device provided to meet one of the purposes of the present application includes a central processing unit and a memory, wherein the central processing unit is used to call and run a computer program stored in the memory to execute the steps of the machine behavior detection method described in the present application.

[0015] On the other hand, a computer-readable storage medium is provided to meet another purpose of the present application, which stores a computer program implemented according to the machine behavior detection method in the form of computer-readable instructions, and when the computer program is called and executed by a computer, it executes the steps included in the method.

[0016] The technical solution of this application has many advantages, including but not limited to the following aspects:

[0017] On the one hand, a multiple detection mechanism is used to gradually and deeply detect the client's operation behavior. When the first detection determines that the client's operation behavior data is machine behavior, there is no need for a second detection, which can ensure the efficiency of detection. When the first detection determines that it is not machine behavior, a pre-trained to convergence machine behavior detection model is further used to achieve intelligent, fast and accurate detection, reduce the risk of misjudgment, ensure that users can use related services smoothly, and ensure a good user experience.

[0018] On the other hand, after the client submits a request to load a page resource, a multi-level in-depth combination of first-level detection, second-level detection, and suspicious detection is performed, which can effectively ensure network security in real time and avoid economic losses caused by machine cheating. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0020] Figure 1 A flowchart of a typical embodiment of the machine behavior detection method of the present application;

[0021] Figure 2 A schematic diagram of a machine behavior detection model training process in an embodiment of the present application;

[0022] Figure 3 A schematic diagram of a process of performing a second level of detection using a machine behavior detection model in an embodiment of the present application;

[0023] Figure 4 A schematic diagram of a process for obtaining comprehensive features corresponding to user operation behavior data in an embodiment of the present application;

[0024] Figure 5 A schematic diagram of obtaining comprehensive mouse features by extracting mouse movement trajectory data in an embodiment of the present application;

[0025] Figure 6 A schematic diagram of a process for obtaining basic statistical features, movement features, fallback features, and interaction frame features in an embodiment of the present application;

[0026] Figure 7 A schematic diagram of the process of executing the suspect detection in the embodiment of the present application;

[0027] Figure 8 This is a principle block diagram of the machine behavior detection device of the present application;

[0028] Fig. 9 A schematic diagram of the structure of a computer device used in this application. DETAILED DESCRIPTION

[0029] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be interpreted as limiting the present application.

[0030] It will be understood by those skilled in the art that, unless expressly stated, the singular forms "one", "said", and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of the present application refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof. It should be understood that when we refer to an element as being "connected" or "coupled" to another element, it may be directly connected or coupled to the other element, or there may be an intermediate element. In addition, the "connection" or "coupling" used herein may include wireless connection or wireless coupling. The term "and / or" used herein includes all or any unit and all combinations of one or more associated listed items.

[0031] It will be understood by those skilled in the art that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as those generally understood by those skilled in the art to which this application belongs. It should also be understood that terms such as those defined in general dictionaries should be understood to have meanings consistent with those in the context of the prior art, and will not be interpreted with idealized or overly formal meanings unless specifically defined as here.

[0032] It will be understood by those skilled in the art that the "client", "terminal" and "terminal device" used herein include both devices with wireless signal receivers, which are devices with only wireless signal receivers without transmission capabilities, and devices with receiving and transmitting hardware, which are devices with receiving and transmitting hardware capable of two-way communication on a two-way communication link. Such devices may include: cellular or other communication devices such as personal computers, tablet computers, which have single-line displays or multi-line displays or cellular or other communication devices without multi-line displays; PCS (Personal Communications Service, personal communication system), which can combine voice, data processing, fax and / or data communication capabilities; PDA (Personal Digital Assistant, personal digital assistant), which may include a radio frequency receiver, pager, Internet / intranet access, web browser, notepad, calendar and / or GPS (Global Positioning System, global positioning system) receiver; conventional laptop and / or palmtop computers or other devices, which have and / or include a conventional laptop and / or palmtop computer or other device with and / or including a radio frequency receiver. The "client", "terminal" and "terminal device" used herein may be portable, transportable, installed in a vehicle (air, sea and / or land), or suitable for and / or configured to run locally, and / or in a distributed form, at any other location on the earth and / or in space. The "client", "terminal" and "terminal device" used herein may also be a communication terminal, an Internet terminal, a music / video playing terminal, for example, a PDA, a MID (Mobile Internet Device) and / or a mobile phone with a music / video playing function, or a smart TV, a set-top box and other devices.

[0033] The hardware referred to by the names such as "server", "client", and "service node" in this application is essentially an electronic device with the equivalent capabilities of a personal computer. It is a hardware device with the necessary components revealed by the von Neumann principle, such as a central processing unit (including an arithmetic unit and a controller), a memory, an input device, and an output device. The computer program is stored in its memory, and the central processing unit calls the program stored in the external memory into the internal memory for execution, executes the instructions in the program, and interacts with the input and output devices to complete specific functions.

[0034] It should be pointed out that the concept of "server" referred to in this application can also be extended to the case of server clusters. According to the network deployment principle understood by those skilled in the art, the servers should be logically divided. In physical space, these servers can be independent of each other but can be called through interfaces, or integrated into a physical computer or a set of computer clusters. Those skilled in the art should understand this flexibility, and should not use it to restrict the implementation of the network deployment method of this application.

[0035] Unless expressly specified, one or more technical features of the present application can be deployed on a server for implementation and accessed by a client through a remote call to obtain an online service interface provided by the server, or can be directly deployed and run on a client for access.

[0036] The neural network models referenced or may be referenced in this application, unless expressly specified, can be deployed on a remote server and remotely called on the client, or can be deployed and directly called on a client with sufficient device capabilities. In some embodiments, when it runs on the client, its corresponding intelligence can be obtained through transfer learning to reduce the requirements for the client's hardware operating resources and avoid excessive occupation of the client's hardware operating resources.

[0037] Unless explicitly specified, the various data involved in this application can be stored remotely on a server or on a local terminal device, as long as it is suitable for being called by the technical solution of this application.

[0038] Those skilled in the art should be aware that, although the various methods of the present application are described based on the same concept and thus present commonality to each other, unless otherwise specified, these methods can be independently executed. Similarly, for each embodiment disclosed in the present application, they are all proposed based on the same inventive concept, therefore, concepts with the same expression, and concepts that are appropriately changed for convenience despite different expressions, should be understood as equivalent.

[0039] Unless the mutually exclusive relationship between the embodiments to be disclosed in this application is explicitly stated, the relevant technical features involved in each embodiment can be cross-combined to flexibly construct a new embodiment, as long as such combination does not deviate from the creative spirit of this application and can meet the needs of the prior art or solve certain deficiencies in the prior art. Those skilled in the art should be aware of this flexibility.

[0040] A machine behavior detection method of the present application can be programmed as a computer program product and deployed in a client or server for execution. For example, in the exemplary application scenario of the present application, it can be deployed and implemented in the server of an e-commerce platform, thereby accessing an interface opened after the computer program product is running and performing human-computer interaction with the process of the computer program product through a graphical user interface to execute the method.

[0041] See also Figure 1 The machine behavior detection method of the present application, in its typical embodiment, comprises the following steps:

[0042] Step S1100: respond to the page resource loading request submitted by the client, and obtain the collected user operation behavior data, wherein the user operation behavior data includes mouse movement trajectory data, user agent data in the browser data, and keyboard input data;

[0043] Generally speaking, users can establish an Internet connection with a website by operating a client and access the website online. Furthermore, users can trigger the generation of a page resource loading request by operating the graphical user interface of the website loaded on the client according to their own needs. The client submits the request to the website's server, and the server receives the request and responds to it. At this time, the machine behavior detection method implemented in this application can be triggered for the client's operation behavior. After the machine behavior detection passes, it is determined that the client's operation behavior does not belong to machine behavior, that is, the network security is ensured, and then the request is responded to and the required page resources are sent to the client.

[0044] In one embodiment, a functional module for collecting user operation behavior data can be deployed on the website. Specifically, whenever a user touches any interactive box on the graphical user interface of the website, such as jump, confirm, cancel, search, pay, form submission or acquisition, etc., the operation behavior of the client during the visit to the website, such as browser operation, mouse movement operation and keyboard input operation, is collected, and the corresponding user operation behavior data is uploaded to the server of the website. The server receives the user operation behavior data and stores it in a database. It can be understood that the mouse movement trajectory data includes a plurality of serialized information units, each of which contains a plurality of basic data, and the basic data includes the horizontal and vertical coordinates of the mouse position, and the timestamp of the mouse at the position. The mouse movement trajectory data is exemplified as follows: [[200, 200, 1651738042000], [620, 300, 1651738045000], [1300, 500, 1651738047000]…]. The user agent data in the browser data includes but is not limited to the operating system type, operating system version, CPU type, browser type, browser model, and browser rendering engine, for example: Mozilla / 5.0 (Windows NT 10.0; Win64; x64) AppleWebKit / 537.36 (KHTML, like Gecko) Chrome / 102.0.5005.124 Safari / 537.36 Edg / 102.0.1245.44. The keyboard input data includes special input and regular input, and the special input includes: any one or more corresponding keyboard key inputs such as Enter, Backspace, Tab, Esc, Delete, Shift, Ctrl, etc., and the regular input is the key input from A to Z.

[0045] Accordingly, in response to a page loading request submitted by the client, machine behavior detection is started, and user operation behavior data generated by the client's operation behavior during the collection of website access is obtained from the database.

[0046] Step S1200: performing a first detection on the user operation behavior data according to a preset rule to determine whether the operation behavior of the client is a machine behavior;

[0047] The preset rule may be multiple rules, each of which corresponds to one or more conditions. For example:

[0048] Rule 1:

[0049] 1. The number of points of the information unit in the mouse movement trajectory data of the collected user operation behavior data is less than the preset threshold a.

[0050] 2. The number of points of the information unit in the mouse movement track data of the user operation behavior data corresponding to the interactive box on the graphical user interface of the touch website is less than the preset threshold value b.

[0051] 3. The keyboard input data of the collected user operation behavior data is empty.

[0052] The preset thresholds a and b can be flexibly set by those skilled in the art according to actual business requirements.

[0053] Rule 2:

[0054] 1. The mouse movement trajectory data of the collected user operation behavior data is empty.

[0055] 2. The regular input in the keyboard input data of the collected user operation behavior data is empty.

[0056] The first level of detection is performed on the user operation behavior data according to the above-mentioned preset rules. When all conditions in any rule are met, it can be determined that the client's operation behavior is a machine behavior. Otherwise, it is determined that it is not a machine behavior.

[0057] Step S1300: When the first detection shows that the operation behavior does not belong to a machine behavior, a second detection is performed on the comprehensive feature vector of the user operation behavior data using a machine behavior detection model that has been pre-trained to convergence to determine whether the operation behavior of the client belongs to a machine behavior;

[0058] The machine behavior detection model can be a classification model such as a logistic regression classification model, a random forest model, or a deep learning model. For the classification model, two types of operations corresponding to machine behavior and human operation behavior, i.e., client operation behavior, can be used, and the corresponding user operation behavior data can be used as a training set. The model is trained until convergence, so that the model learns to distinguish whether the operation behavior that generates the user operation behavior data belongs to machine behavior; for the deep learning model, machine behavior and human corresponding user operation behavior data can also be used as training sets, and the model is pre-trained until convergence, so that the model learns to predict whether the operation behavior that generates the user operation behavior data belongs to machine behavior or not.

[0059] In one embodiment, the machine behavior detection model is a deep learning model. When the first detection indicates that the behavior does not belong to a machine behavior, a second detection is performed. The machine behavior detection model that has been pre-trained to convergence is used to extract the mouse movement trajectory data of the user operation behavior data, the user agent data in the browser data, and the three dimensions of features corresponding to the keyboard input data that characterize the machine behavior. The features of the three dimensions are spliced ​​as comprehensive features to obtain a comprehensive feature vector that vectorizes the comprehensive features. The comprehensive feature vector is input into a fully connected layer to obtain a one-dimensional vector, and the one-dimensional vector is mapped to a classification space belonging to machine behavior to obtain a probability of belonging to machine behavior. Then, it can be determined whether the probability reaches a preset threshold. If it reaches a preset threshold, it is determined that the client's operation behavior belongs to machine behavior. Otherwise, it is determined that it does not belong to machine behavior. The preset threshold can be set by a technician in this field based on prior knowledge or experimental data.

[0060] In another embodiment, the machine behavior detection model is a machine learning model. When the first detection finds that the behavior is not a machine behavior, the second detection is triggered to execute. The mouse movement trajectory data of the user operation behavior data, the user agent data in the browser data, and the keyboard input data are preprocessed respectively, and the features of the three dimensions corresponding to the three data are extracted. The features of the three dimensions are spliced ​​as comprehensive features, and the comprehensive features are encoded to obtain a comprehensive feature vector that vectorizes the comprehensive features. The comprehensive feature vector is classified into two categories to obtain a classification result of whether it belongs to machine behavior, and then the client's operation behavior can be judged as machine behavior based on the classification result.

[0061] A scheduled task can be set to iteratively update the machine behavior detection model to ensure the accuracy of model detection. For example, every time a preset time point is reached, the collected user operation behavior data can be called from the database to train the currently deployed machine behavior detection model. After the training converges, the corresponding updated machine behavior detection model is obtained to replace the currently deployed machine behavior detection model.

[0062] Step S1400: When it is determined that the operation behavior of the client is a machine behavior, the network address of the client is added to a temporary blacklist to start a suspicious detection of the client;

[0063] It can be understood that when the first or second detection determines that the operation behavior of the client belongs to machine behavior, the network security between the current client and the website is abnormal, and the client is suspected of illegal operation, and the client is temporarily banned. When the client accesses the website, the network address of the client is obtained from the network message submitted by the client, and the network address can be an Internet Protocol address such as an IPv4 address, an IPv6 address, or a MAC address of the client device, etc. Further, the network address of the client is added to the temporary blacklist for temporary storage, and the temporary blacklist is a data list pre-created and stored in the server of the website, and the network address of the banned client is temporarily saved according to the preset time limit, and deleted when the preset time limit is reached. Accordingly, the server of the website can start the suspicion detection of the client according to the website address of the client in the temporary blacklist. The suspicion detection can be a common detection method that requires the user to manually operate on the client, such as picture slider verification, picture object recognition verification, picture Chinese character sorting verification, picture number or letter input verification, etc., which can be flexibly implemented by those skilled in the art.

[0064] Step S1500: When the client passes the suspicion detection, the page resources required for the loading request are pushed to the client.

[0065] When the client passes the suspicion detection, the network address of the client is removed from the temporary blacklist, and the network security between the current client and the website is considered normal. The server of the website can normally respond to the loading request submitted by the client and push the page resources required for the loading request to the client.

[0066] In one embodiment, when the client fails to pass the suspicion detection, the network address of the client is removed from the temporary blacklist and added to the permanent blacklist, the client is permanently banned, and the client is controlled to display an appeal review interface to provide a complaint service to the user. The user can submit an appeal so that the client is removed from the permanent blacklist after the appeal is reviewed, thereby achieving a permanent ban on the client. The permanent blacklist is a data list pre-created and stored in the server of the website. The permanent ban is that the server intercepts any page resource acquisition request submitted by the client to access the website, and only controls the client to display the appeal review interface.

[0067] It can be known from the typical embodiments of the present application that the technical solution of the present application has many advantages, including but not limited to the following aspects:

[0068] On the one hand, a multiple detection mechanism is used to gradually and deeply detect the client's operation behavior. When the first detection determines that the client's operation behavior data is machine behavior, there is no need for a second detection, which can ensure the efficiency of detection. When the first detection determines that it is not machine behavior, a pre-trained to convergence machine behavior detection model is further used to achieve intelligent, fast and accurate detection, reduce the risk of misjudgment, ensure that users can use related services smoothly, and ensure a good user experience.

[0069] On the other hand, after the client submits a request to load a page resource, a multi-level in-depth combination of first-level detection, second-level detection, and suspicious detection is performed, which can effectively ensure network security in real time and avoid economic losses caused by machine cheating.

[0070] See also Figure 2 In a further embodiment, step S1300, the training process of the machine behavior detection model comprises the following steps:

[0071] Step S1301: obtaining a pre-prepared training set, wherein the training set includes a first type of training samples of user operation behavior data generated manually and a second type of training samples of user operation behavior data generated by machine behavior, and annotating corresponding supervisory labels according to the operation behavior types of the training samples;

[0072] Based on the ability of the human-machine model to learn to judge whether it is a machine behavior based on the user operation behavior data, two types of data can be collected in advance as training samples. The first type of data is the user operation behavior data generated by humans as the first type of training samples. For example, the website can be accessed by a normal human operation client, and the user operation behavior data generated by the mouse movement operation, keyboard input operation and browser operation can be collected; the second type of data is the user operation behavior data generated by machine behavior as the second type of training samples. For example, the website can be accessed by a software operation client of multiple open source machines simulating human operation of the browser, and the user operation behavior data generated by the mouse movement operation, keyboard input operation and browser operation can be collected. The user operation behavior data includes mouse movement trajectory data, user agent data in the browser data, and keyboard input data.

[0073] Furthermore, each training sample in the training set can be labeled with a corresponding supervisory label according to its operation behavior type. For example, the supervisory label of the first type of training samples is labeled to represent human operation, and the supervisory label of the second type of training samples is labeled to represent machine behavior operation, so that the subsequent machine behavior detection model can use the labeled training samples for supervised training and perform binary classification prediction.

[0074] Step S1302: Determine the comprehensive features corresponding to each training sample in the training set to construct a comprehensive feature vector, wherein the comprehensive features include mouse comprehensive features, keyboard input features, and browser features;

[0075] The mouse comprehensive features are determined based on the mouse movement trajectory data in the user operation behavior data of the training sample. By way of example, it can be understood that the mouse movement trajectory data generated by moving the mouse when the operating client accesses a website can represent a variety of features, and the multiple features are spliced ​​together as the mouse comprehensive features, which include basic statistical features, movement features, fallback features, and interaction box features.

[0076] For basic statistical features, statistical data of multiple dimensions can be calculated as basic statistical features according to the horizontal and vertical coordinates of the mouse position during the mouse movement process. The statistical data of multiple dimensions include but are not limited to any one or more of the sum, mean, maximum, minimum, range, variance, standard deviation, mean absolute error, mode, and quantile;

[0077] For the movement feature, multiple dimensions of movement data may be calculated as the movement feature according to the horizontal coordinate and the vertical coordinate of the position of the mouse corresponding to the mouse movement process and the timestamp of the mouse being at the position, wherein the multiple dimensions of movement data include but are not limited to any one or more of the movement distance, movement time, movement speed, movement speed, and movement acceleration;

[0078] As for the fallback feature, according to the horizontal coordinate and the vertical coordinate of the position of the mouse in the process of the mouse moving in the assumed mouse moving direction and the timestamp of the mouse at the said position, statistical data of multiple dimensions and movement data of multiple dimensions can be counted and calculated, and the two data can be combined as the fallback feature, and the said assumed mouse moving direction refers to the direction in which the mouse moves away from the interactive box on the graphical user interface of the website;

[0079] For the interaction frame features, statistical data in multiple dimensions and movement data in multiple dimensions can be counted based on the horizontal and vertical coordinates of the mouse position when the mouse moves in the interaction frame and the timestamp of the mouse at the said position, and the two data can be combined as the interaction frame features.

[0080] The browser features can be represented by the user agent data in the browser data in the user operation behavior data of the training samples. For example, the corresponding operating system type, operating system version, CPU type, browser type, browser model, browser kernel, and browser rendering engine can be separated from the user agent data in the browser data, and the data in these fields can be used as browser features.

[0081] The keyboard input data in the user operation behavior data of the training samples can represent the keyboard input features. For example, special input data is separated from the keyboard input data as keyboard input features. The special input includes: any one or any multiple corresponding keyboard key inputs of Enter, Backspace, Tab, Esc, Delete, Shift, Ctrl, etc.

[0082] The keyboard input feature and the browser feature data are encoded using a one-hot encoding method to obtain two corresponding feature vectors, and the two feature vectors and the mouse comprehensive feature are concatenated to obtain a comprehensive feature vector.

[0083] Step S1303: Obtain a comprehensive feature vector corresponding to a single training sample in the training set and input it into a machine behavior detection model to predict the operation behavior type corresponding to the training sample;

[0084] Further, the comprehensive feature vector is input into the machine behavior detection model. Taking the machine learning model built by using traditional machine learning principles as an example, it is recommended to use LightGBM as the model prototype. The fully connected layer of the model performs linear transformation to obtain a one-dimensional vector. The preset binary classification function is used to calculate the predicted probability corresponding to the mapping of the one-dimensional vector to the binary classification space, and then the operation behavior type corresponding to the classification space with the maximum probability of the mapping is obtained as the predicted operation behavior type. The binary classification function can be a sigmoid function, and the binary classification space contains classification spaces corresponding to two types of operation behavior types, namely, the human classification space and the machine behavior classification space.

[0085] Step S1304: Calculate the loss value of the predicted operation behavior type according to the supervisory label corresponding to the single training sample, and determine whether the loss value reaches a preset threshold. When it reaches the preset threshold, terminate the training; otherwise, update the weights of the model according to the loss value, and call the next training sample in the training set to continue iterative training of the model.

[0086] A preset cross entropy loss function is called, which can be flexibly set by technicians in this field according to prior knowledge or experimental experience. The cross entropy loss value of the predicted operation behavior type is calculated based on the supervision mark corresponding to the single training sample. When the loss value reaches the preset threshold, it indicates that the model has been trained to a convergence state, thereby terminating the model training; when the loss value does not reach the preset threshold, it indicates that the model has not converged, and then the model is gradient updated according to the loss value, usually by correcting the weight parameters of each link of the model through back propagation to make the model further close to convergence, and then, the next sample data in the training set is continued to be called to perform iterative training on the model until the model is trained to a convergence state.

[0087] In this embodiment, on the one hand, each training sample in the collected training set is preprocessed to obtain its corresponding multi-dimensional comprehensive features, which are vectorized into comprehensive feature vectors and input into the model for training, thereby ensuring the accuracy of the model trained to convergence in practical applications.

[0088] On the other hand, the training process of the machine behavior detection model is revealed. It can be seen that under the sample data and supervised label training of the data set, the model has the ability to quickly classify the corresponding operation behavior types according to the comprehensive feature vector corresponding to the user operation behavior data, thereby ensuring that it can subsequently serve the execution of the second level of detection, greatly improving the accuracy and efficiency of the second level of detection.

[0089] See also Figure 3 In a further embodiment, step S1300, using a machine behavior detection model pre-trained to convergence to perform a second detection on the comprehensive feature vector of the user operation behavior data, to determine whether the operation behavior of the client is a machine behavior, includes the following steps:

[0090] Step S1310: pre-process the user operation behavior data to obtain its comprehensive features, wherein the comprehensive features include mouse comprehensive features, keyboard input features, and browser features;

[0091] The preprocessing is to obtain mouse comprehensive features, keyboard input features, and browser features based on the mouse movement trajectory data, keyboard input data, and user agent data in the browser data in the user operation behavior data, and combine the features of the three dimensions to obtain comprehensive features. The specific implementation of obtaining the mouse comprehensive features will be further disclosed in the subsequent embodiments, and this step will not be discussed for the time being.

[0092] The specific implementation of obtaining the keyboard input features and browser features is exemplified as follows:

[0093] The browser characteristics can be represented by the user agent data in the browser data in the user operation behavior data. For example, the corresponding operating system type, operating system version, CPU type, browser type, browser model, browser kernel, and browser rendering engine can be separated from the user agent data in the browser data, and the data in these fields can be used as browser characteristics.

[0094] The keyboard input features can be represented according to the keyboard input data in the user operation behavior data. For example, special input data is separated from the keyboard input data as keyboard input features. The special input includes: any one or any multiple corresponding keyboard key inputs of Enter, Backspace, Tab, Esc, Delete, Shift, Ctrl, etc.

[0095] Step S1320: Encode the keyboard input feature and the browser feature in the comprehensive feature by using a one-hot encoding method, obtain corresponding encoding data and construct a comprehensive feature vector together with the mouse comprehensive feature;

[0096] The keyboard input feature and the browser feature data are encoded using a one-hot encoding method to obtain two corresponding feature vectors, and the two feature vectors and the mouse comprehensive feature are concatenated to obtain a comprehensive feature vector.

[0097] Step S1330: using a machine behavior detection model that has been pre-trained to convergence to perform binary classification on the comprehensive feature vector to obtain a corresponding classification result;

[0098] The comprehensive feature vector is input into a machine behavior detection model, which is a classification model. The fully connected layer of the model performs linear transformation to obtain a one-dimensional vector. A preset binary classification function is used to calculate the predicted probability corresponding to the mapping of the one-dimensional vector to the binary classification space, and then the operation behavior type corresponding to the classification space with the maximum probability of the mapping is obtained as the classification result. The binary classification function can be a sigmoid function, and the binary classification space includes classification spaces corresponding to two types of operation behavior types, namely, a human classification space and a machine behavior classification space.

[0099] Step S1340: According to the classification result, determine whether the operation behavior of the client is a machine behavior.

[0100] It is not difficult to understand that, according to the type of operation behavior corresponding to the classification result, if it is a machine behavior, it can be determined that the operation behavior of the client is a machine behavior, otherwise it can be determined that it is not a machine behavior but a human behavior.

[0101] In this embodiment, the process of performing the second level of detection using a machine behavior detection model is disclosed. The application model can quickly and accurately identify the client's operating behavior. Each time the client submits a request to obtain page resources, this can efficiently complete the second level of detection and accurate identification in scenarios with high real-time requirements, thereby ensuring network security in real time, ensuring user experience with lower latency, and ensuring the security of corporate website resources.

[0102] See also Figure 4In a further embodiment, step S1310, pre-processing the user operation behavior data to obtain its comprehensive features, includes the following steps:

[0103] Step S1311: determining a mouse comprehensive feature according to the mouse movement trajectory data in the user operation behavior data, wherein the mouse comprehensive feature includes basic statistical features, movement features, fallback features, and interaction box features corresponding to the mouse operation;

[0104] According to the mouse movement data in the user operation behavior data, the corresponding statistical features, the feature data during the mouse movement, the corresponding feature data under the assumption that the mouse moves in the opposite direction, and the feature data represented by the mouse moving in the interaction box on the graphical user interface are extracted to obtain the corresponding basic statistical features, movement features, fallback features, and interaction box features. The specific implementation here will be further revealed by the subsequent embodiments, and this step will not be discussed for the time being.

[0105] Step S1312: determining corresponding browser features and keyboard input features according to the user agent data and keyboard input data in the browser data in the user operation behavior data;

[0106] The browser characteristics can be represented according to the user agent data in the browser data in the user operation behavior data. For example, the data of the fields corresponding to the operating system type, operating system version, CPU type, browser type, browser model, browser kernel, and browser rendering engine are split out from the user agent data in the browser data as browser characteristics.

[0107] The keyboard input features can be represented according to the keyboard input data in the user operation behavior data. For example, special input data is separated from the keyboard input data as keyboard input features. The special input includes: any one or any multiple corresponding keyboard key inputs of Enter, Backspace, Tab, Esc, Delete, Shift, Ctrl, etc.

[0108] Step S1313: merge the mouse comprehensive features, browser features and keyboard input features to obtain corresponding comprehensive features.

[0109] The mouse comprehensive features, browser features and keyboard data features are concatenated into an array as the comprehensive features.

[0110] In this embodiment, by performing feature extraction and merging processing on user operation behavior data, a comprehensive feature consisting of fine-grained features in multiple dimensions is obtained, which helps to ensure the accuracy of classification prediction of subsequent machine behavior detection models.

[0111] See also Figure 5 In a further embodiment, step S1311, the step of determining the comprehensive characteristics of the mouse according to the mouse movement trajectory data in the user operation behavior data, includes the following steps:

[0112] Step S13110: extracting statistical features according to the mouse movement trajectory data to obtain basic statistical features;

[0113] A plurality of first subsequences are determined based on the statistical features extracted from the mouse movement trajectory data, and a plurality of statistical data corresponding to each first subsequence is calculated as a basic statistical feature.

[0114] Specifically, the mouse movement trajectory data includes a plurality of serialized information units, each of which contains a plurality of basic data, and the basic data include the horizontal and vertical coordinates of the mouse position and the timestamp of the mouse at the position. The mouse movement trajectory data are exemplified by [[200, 200, 1651738042000], [620, 300, 1651738045000], [1300, 500, 1651738047000], [1800, 600, 1651738059000]…]. It can be understood that the mouse movement trajectory data is sequence data, and it is used as the original sequence. Further, the horizontal axis subsequence, the vertical axis subsequence, the first half of the horizontal axis subsequence, the second half of the horizontal axis subsequence, the first half of the vertical axis subsequence, and the second half of the vertical axis subsequence can be extracted from each information unit in the original sequence, and the horizontal axis subsequence and the vertical axis subsequence are respectively subjected to first-order difference processing to obtain the corresponding horizontal axis first-order difference subsequence and vertical axis first-order difference subsequence. The horizontal axis subsequence, the vertical axis subsequence, the first half of the horizontal axis subsequence, the second half of the horizontal axis subsequence, the first half of the vertical axis subsequence, the second half of the vertical axis subsequence, the horizontal axis first-order difference subsequence, and the vertical axis first-order difference subsequence, a total of eight subsequences, including the horizontal axis subsequence, the vertical axis subsequence, the first half of the horizontal axis subsequence, the second half of the vertical axis subsequence, the horizontal axis first-order difference subsequence, and the vertical axis first-order difference subsequence, are used as the first subsequence.

[0115] Perform multiple statistics on the eight first subsequences respectively, wherein the multiple statistics include sum, mean, maximum, minimum, range, variance, standard deviation, mean absolute error, mode, and quantile, obtain multiple statistical data corresponding to each first subsequence, and splice the multiple statistical data into an array as the basic statistical feature.

[0116] Step S13111, extracting feature data of the mouse movement process according to the mouse movement trajectory data to obtain movement features;

[0117] According to the mouse movement trajectory data, movement data corresponding to multiple movement indicators in the mouse movement process are calculated, and second subsequences corresponding to multiple trigonometric function indicators are calculated, and multiple statistical data corresponding to the second subsequences are calculated, and the multiple statistical data and movement data are spliced ​​as movement features.

[0118] Specifically, based on the basic data of each information unit in the mouse movement trajectory data, that is, the horizontal and vertical coordinates of the mouse position, and the timestamp of the mouse at the position, the moving distance, moving time, moving speed, and moving acceleration of each information unit to the next information unit during the mouse movement process are calculated to obtain the movement data corresponding to the multiple movement indicators.

[0119] In addition, according to the basic data of each information unit in the mouse movement trajectory data, that is, the horizontal coordinate and the vertical coordinate of the mouse position, the sine, cosine, and tangent between each information unit and the next information unit are calculated, and three subsequences corresponding to the multiple trigonometric function indicators are obtained as the second subsequence.

[0120] Furthermore, multiple statistics are performed on the second subsequences respectively, and the multiple statistics include sum, mean, maximum, minimum, range, variance, standard deviation, mean absolute error, mode, and quantile to obtain multiple statistical data corresponding to each second subsequence, and the multiple statistical data and movement data are spliced ​​as movement features.

[0121] Step S13112: extracting feature data corresponding to the assumed reverse movement direction of the mouse according to the mouse movement trajectory data to obtain a rollback feature;

[0122] Determine a plurality of third subsequences corresponding to the assumed reverse direction of the mouse movement according to the mouse movement trajectory data, calculate a plurality of statistical data corresponding to each third subsequence, calculate movement data corresponding to a plurality of movement indicators in the process of mouse movement according to the third subsequence representing the coordinates corresponding to the horizontal axis and the vertical axis, calculate a fourth subsequence corresponding to a plurality of trigonometric function indicators, calculate a plurality of statistical data corresponding to the fourth subsequence, and splice the plurality of statistical data corresponding to the third subsequence, the plurality of statistical data corresponding to the fourth subsequence, and the movement data as fallback features;

[0123] Specifically, it can be assumed that the mouse moves closer to the interactive box on the website's graphical user interface as a positive moving direction, and vice versa as a reverse moving direction. Accordingly, the corresponding horizontal coordinate subsequence and vertical coordinate subsequence under the assumed reverse moving direction of the mouse are determined from each information unit in the mouse movement trajectory data. For example, the coordinates of the interactive box on the graphical user interface are [1100 to 1300, 400 to 500], and the mouse movement trajectory data are [[1300, 500, 1651738042000], [620, 300, 1651738045000], [200, 200, 1651738047000]], and the horizontal coordinate subsequence of the reverse moving direction can be determined to be [620, 200], and the vertical coordinate subsequence is [300, 200]. The abscissa subsequence and the ordinate subsequence are respectively subjected to first-order difference processing to obtain corresponding abscissa first-order difference subsequences and ordinate first-order difference subsequences, and the abscissa subsequence, the ordinate subsequence, the abscissa first-order difference subsequence, and the ordinate first-order difference subsequence, a total of four subsequences, are used as the third subsequence.

[0124] Furthermore, multiple statistics are performed on the third subsequences respectively, and the multiple statistics include sum, mean, maximum, minimum, range, variance, standard deviation, mean absolute error, mode, and quantile to obtain multiple statistical data corresponding to each third subsequence.

[0125] In addition, based on the horizontal axis subsequence, the vertical axis subsequence in the third subsequence, and the timestamps in each information unit corresponding to the horizontal and vertical coordinates of the two subsequences, the moving distance, moving time, moving speed, and moving acceleration of each information unit to the next information unit during the mouse movement process are calculated to obtain the movement data corresponding to the multiple movement indicators.

[0126] In addition, according to the corresponding horizontal and vertical coordinates in the horizontal coordinate subsequence and the vertical coordinate subsequence in the third subsequence, the sine, cosine and tangent between each corresponding information unit and the next information unit are calculated to obtain three subsequences corresponding to the multiple trigonometric function indicators.

[0127] Furthermore, multiple statistics are performed on the three subsequences respectively, and the multiple statistics include sum, mean, maximum, minimum, range, variance, standard deviation, mean absolute error, mode, and quantile to obtain multiple statistical data corresponding to the three subsequences, and the movement data corresponding to the multiple movement indicators are taken as the fourth subsequence.

[0128] Multiple statistical data corresponding to the third subsequence, multiple statistical data corresponding to the fourth subsequence, and movement data are concatenated as fallback features.

[0129] Step S13113: extracting feature data represented by the movement of the mouse in the interaction box on the graphical user interface according to the mouse movement trajectory data, and obtaining interaction box features;

[0130] According to the mouse movement trajectory data, multiple fifth subsequences moving within the interaction box on the graphical user interface are determined, and multiple statistical data corresponding to each fifth subsequence is calculated. According to the fifth subsequence representing the coordinates corresponding to the horizontal axis and the vertical axis, the movement data corresponding to the multiple movement indicators in the mouse movement process are calculated, and the sixth subsequences corresponding to the multiple trigonometric function indicators are calculated, and the multiple statistical data corresponding to the sixth subsequence are calculated. The multiple statistical data corresponding to the fifth subsequence, the multiple statistical data corresponding to the sixth subsequence and the movement data are spliced ​​as the interaction box features.

[0131] Specifically, the horizontal coordinate subsequence and the vertical coordinate subsequence corresponding to the coordinates of the mouse position moving in the interaction box on the graphical user interface are determined from each information unit in the mouse movement trajectory data. For example, the coordinates of the interaction box on the graphical user interface are [1100 to 1300, 400 to 500], and the mouse movement trajectory data are [[1340, 520, 1651738042000], [1250, 440, 1651738048000], [1270, 450, 1651738050000], [1290, 490, 1651738054000]], it can be determined that the horizontal coordinate subsequence moving in the interaction box on the graphical user interface is [1250, 1270, 1290], and the vertical coordinate subsequence is [440, 450, 490]. The abscissa subsequence and the ordinate subsequence are respectively subjected to first-order difference processing to obtain corresponding abscissa first-order difference subsequences and ordinate first-order difference subsequences, and the abscissa subsequence, the ordinate subsequence, the abscissa first-order difference subsequence, and the ordinate first-order difference subsequence, a total of four subsequences, are used as the fifth subsequence.

[0132] Furthermore, multiple statistics are performed on the fifth subsequences respectively, and the multiple statistics include sum, mean, maximum, minimum, range, variance, standard deviation, mean absolute error, mode, and quantile to obtain multiple statistical data corresponding to each fifth subsequence.

[0133] In addition, based on the horizontal axis subsequence, the vertical axis subsequence in the fifth subsequence, and the timestamps in each information unit corresponding to the horizontal and vertical coordinates of the two subsequences, the moving distance, moving time, moving speed, and moving acceleration of each information unit to the next information unit during the mouse movement process are calculated to obtain the movement data corresponding to the multiple movement indicators.

[0134] In addition, according to the corresponding horizontal and vertical coordinates in the horizontal coordinate subsequence and the vertical coordinate subsequence in the fifth subsequence, the sine, cosine and tangent between each corresponding information unit and the next information unit are calculated to obtain three subsequences corresponding to the multiple trigonometric function indicators.

[0135] Furthermore, multiple statistics are performed on the three subsequences respectively, and the multiple statistics include sum, mean, maximum, minimum, range, variance, standard deviation, mean absolute error, mode, and quantile to obtain multiple statistical data corresponding to the three subsequences, and the movement data corresponding to the multiple movement indicators are used as the sixth subsequence.

[0136] Multiple statistical data corresponding to the fifth subsequence, multiple statistical data corresponding to the sixth subsequence, and movement data are concatenated as interaction frame features.

[0137] Step S13114: merge the basic statistical features, movement features, fallback features and interaction box features as comprehensive mouse features.

[0138] The basic statistical features, movement features, fallback features and interaction frame features are concatenated into an array as a comprehensive mouse feature.

[0139] In this embodiment, by extracting the features of four dimensions corresponding to the mouse movement trajectory data generated during the mouse movement process, multi-dimensional features are used to represent the mouse movement trajectory data, so that more distinguishing features between the mouse movement trajectory feature data generated by human and machine behaviors can be exposed, which helps to ensure the accuracy of machine behavior detection, reduce the risk of misjudgment, ensure user experience, and maintain the network security of the enterprise.

[0140] See also Figure 6 In a preferred embodiment: Step S13110, extracting statistical features according to the mouse movement trajectory data to obtain basic statistical features, includes:

[0141] Step S131101, extracting statistical features from the mouse movement trajectory data to determine a plurality of first subsequences, and calculating a plurality of statistical data corresponding to each of the first subsequences as basic statistical features, wherein the mouse movement trajectory data includes a plurality of serialized information units, each of which includes a plurality of basic data, and the basic data includes a horizontal coordinate and a vertical coordinate of a position of the mouse, and a timestamp of when the mouse is at the position;

[0142] Please refer to step S13110, this step will not be repeated.

[0143] And / or, step S13111, extracting feature data of the mouse movement process according to the mouse movement trajectory data, and obtaining the movement feature, includes:

[0144] Step S131111, calculating movement data corresponding to a plurality of movement indicators in the process of mouse movement according to the mouse movement trajectory data, calculating a second subsequence corresponding to a plurality of trigonometric function indicators, calculating a plurality of statistical data corresponding to the second subsequence, and splicing the plurality of statistical data and movement data as movement features;

[0145] Please refer to step S13111, this step will not be repeated.

[0146] And / or, step S13112, extracting feature data corresponding to the assumed reverse movement direction of the mouse according to the mouse movement trajectory data, and obtaining the rollback feature, includes:

[0147] Step S131121, determining a plurality of third subsequences corresponding to the assumed reverse direction of mouse movement according to the mouse movement trajectory data, calculating a plurality of statistical data corresponding to each third subsequence, calculating movement data corresponding to a plurality of movement indicators in the process of mouse movement according to the third subsequence representing the coordinates corresponding to the horizontal axis and the vertical axis, and calculating a fourth subsequence corresponding to a plurality of trigonometric function indicators, calculating a plurality of statistical data corresponding to the fourth subsequence, splicing the plurality of statistical data corresponding to the third subsequence, the plurality of statistical data corresponding to the fourth subsequence and the movement data as fallback features;

[0148] Please refer to step S13112, this step will not be repeated.

[0149] And / or, step S13113, extracting feature data represented by the movement of the mouse in the interaction box on the graphical user interface according to the mouse movement trajectory data, and obtaining the feature of the interaction box, includes:

[0150] Step S131131, determine multiple fifth subsequences moving within the interaction box on the graphical user interface according to the mouse movement trajectory data, calculate multiple statistical data corresponding to each fifth subsequence, calculate the movement data corresponding to multiple movement indicators in the mouse movement process according to the fifth subsequence representing the coordinates corresponding to the horizontal axis and the vertical axis, and calculate the sixth subsequences corresponding to the multiple trigonometric function indicators, calculate the multiple statistical data corresponding to the sixth subsequence, and splice the multiple statistical data corresponding to the fifth subsequence, the multiple statistical data corresponding to the sixth subsequence and the movement data as the interaction box feature.

[0151] Please refer to step S13113, this step will not be repeated.

[0152] In this embodiment, by extracting features from the mouse movement trajectory data and further using multiple statistical methods to calculate corresponding multiple statistical data as features, it is possible to make the distinguishing features between the mouse movement trajectory feature data generated by human operation and machine behavior operation apparent, which is beneficial to improving the accuracy of machine behavior detection and greatly reducing the risk of misjudgment.

[0153] See also Figure 7 In a further embodiment, after step S1400, starting the suspicion detection on the client, the following steps are also included:

[0154] Step S1410, responding to the user operation event immediately generated by the client, collecting the current user operation behavior data, and again using the machine behavior detection model to perform a third detection on the current user operation behavior data to determine whether the client's operation behavior is a machine behavior;

[0155] It can be understood that there may be certain errors in the first and second detections. In order to ensure network security, suspicion detection can be performed. For example, the graphical user interface of the website accessed by the client can be controlled to display a corresponding prompt message pop-up window, prompting the user to be suspected of illegal operation, requiring the user's usual operation behavior to manually operate the graphical user interface of the website accessed by the client, and the interactive box on the touch interface, and then eliminate the suspicion through suspicion detection. Thus, when the user performs manual operation according to the prompt, the user operation event generated by the client is triggered immediately, and the server responds to the event, obtains the user operation behavior data generated by the current manual operation client collected by the module for collecting user operation behavior data pre-deployed on the website from the database, and again uses the machine behavior detection model to perform a third detection on the current user operation behavior data. The third detection has the same function as the second detection, and the disclosure of the embodiments in the previous part of this application can be referred to, and no further description is given here. Further, according to the classification results predicted by the model, it is determined whether the operation behavior of the client belongs to machine behavior.

[0156] Step S1420: When the third detection determines that the behavior is a machine behavior, the client is controlled to display a verification code verification interface;

[0157] When the third-level detection determines that it is a machine behavior, a verification code verification method can be further adopted. Based on the accuracy of machine behavior detection, the server can push a verification code verification interface to the client, which may include a verification code picture of numbers and / or letters, so that the user can enter the verification code according to the verification code picture.

[0158] Step S1430, obtain the verification code input by the user, verify the verification code, and when the verification fails, determine that the client's operation behavior is a machine behavior, and stop responding to the client's subsequent page resource loading request. When the verification passes, remove the client's network address from the temporary blacklist.

[0159] Get the verification code input by the user, compare and verify it, compare the verification code with the verification code used to generate the verification code image, and pass the verification when the comparison is consistent, otherwise fail the verification. Furthermore, when the verification fails, it can be determined that the client's operation behavior is a machine behavior. When it passes the verification, the client's network address is removed from the temporary blacklist, and the client's page resource loading request is responded to normally. It can be understood that after the multiple detections, if the client's operation behavior is still determined to be a machine behavior, it can be considered that the network security is abnormal. In order to ensure the security of website resources and not leak them to the client, the client's subsequent page resource loading requests can be terminated, and the page resource loading request submitted by the current client is not responded to, and the request loading failure prompt is pushed to the client;

[0160] In this embodiment, the execution process of the suspicion detection is disclosed. Under the execution of the suspicion detection, the network security can be further guaranteed and the security of enterprise resources can be maintained.

[0161] See also Figure 8 , a machine behavior detection device provided to meet one of the purposes of the present application is a functional embodiment of the machine behavior detection method of the present application, the device includes a data acquisition module 1100, a first detection module 1200, a second detection module 1300, a blacklist detection module 1400 and a resource push module 1500, wherein: the data acquisition module 1100 is used to respond to a page resource loading request submitted by a client, and obtain the collected user operation behavior data, the user operation behavior data includes mouse movement trajectory data, user agent data in browser data and keyboard input data; the first detection module 1200 is used to perform the user operation behavior data according to preset rules. A first detection is performed to determine whether the client's operation behavior is a machine behavior; a double detection module 1300 is used to perform a second detection on the comprehensive feature vector of the user operation behavior data using a machine behavior detection model that has been pre-trained to convergence to determine whether the client's operation behavior is a machine behavior when the first detection shows that it is not a machine behavior; a blacklist detection module 1400 is used to add the client's network address to a temporary blacklist to initiate a suspicion detection on the client when it is determined that the client's operation behavior is a machine behavior; a resource push module 1500 is used to push the page resources required for the loading request to the client when the client passes the suspicion detection.

[0162] In a further embodiment, the training process of the machine behavior detection model includes: a training set acquisition submodule, which is used to obtain a pre-prepared training set, wherein the training set includes a first type of training samples of user operation behavior data generated manually, and a second type of training samples of user operation behavior data generated by machine behavior, and corresponding supervisory labels are annotated according to the operation behavior type of the training samples; a vector construction submodule, which is used to determine the comprehensive features corresponding to each training sample in the training set to construct a comprehensive feature vector, wherein the comprehensive features include mouse comprehensive features, keyboard input features, and browser features; a model prediction submodule, which is used to obtain the comprehensive feature vector corresponding to a single training sample in the training set and input it into the machine behavior detection model to predict the operation behavior type corresponding to the training sample; an iterative training submodule, which is used to calculate the loss value of the predicted operation behavior type according to the supervisory label corresponding to the single training sample, and determine whether the loss value reaches a preset threshold. When it reaches the preset threshold, the training is terminated; otherwise, the weight of the model is updated according to the loss value, and the next training sample in the training set is called to continue iterative training of the model.

[0163] In a further embodiment, after the blacklist detection module 1400, it also includes: a triple detection module, which is used to respond to the user operation event generated immediately by the client, collect the current user operation behavior data, and again use the machine behavior detection model to perform a third detection on the current user operation behavior data to determine whether the client's operation behavior belongs to machine behavior; an interface display module, which is used to control the client to display the verification code verification interface when the third detection determines that it belongs to machine behavior; a verification code verification module, which is used to obtain the verification code input by the user, verify the verification code, and when the verification fails, determine that the client's operation behavior belongs to machine behavior, and terminate responding to the client's subsequent page resource loading request. When the verification passes, the client's network address is removed from the temporary blacklist.

[0164] In a further embodiment, the double detection module 1300 includes: a data preprocessing submodule, used to preprocess the user operation behavior data to obtain its comprehensive features, wherein the comprehensive features include mouse comprehensive features, keyboard input features, and browser features; a feature encoding submodule, used to encode the keyboard input features and browser features in the comprehensive features using a one-hot encoding method, and obtain corresponding encoding data and the mouse comprehensive features to construct a comprehensive feature vector; a model classification submodule, used to use a machine behavior detection model pre-trained to convergence to perform binary classification on the comprehensive feature vector to obtain corresponding classification results; a classification discrimination submodule, used to judge whether the client's operation behavior belongs to machine behavior based on the classification results.

[0165] In a further embodiment, the data preprocessing submodule includes: a first feature processing unit, used to determine the mouse comprehensive features according to the mouse movement trajectory data in the user operation behavior data, and the mouse comprehensive features include basic statistical features, movement features, fallback features, and interaction box features corresponding to the mouse operation; a second feature processing unit, used to determine the corresponding browser features and keyboard input features according to the user agent data and keyboard input data in the browser data in the user operation behavior data; a feature integration unit, used to merge the mouse comprehensive features, browser features and keyboard input features to obtain corresponding comprehensive features.

[0166] In a further embodiment, the first feature processing unit includes: a first feature extraction subunit, used to extract statistical features based on the mouse movement trajectory data to obtain basic statistical features; a second feature extraction subunit, used to extract feature data of the mouse movement process based on the mouse movement trajectory data to obtain movement features; a third feature extraction subunit, used to extract feature data corresponding to the assumed reverse movement direction of the mouse based on the mouse movement trajectory data to obtain a fallback feature; a fourth feature extraction subunit, used to extract feature data represented by the movement of the mouse in an interaction box on a graphical user interface based on the mouse movement trajectory data to obtain an interaction box feature; a feature integration subunit, used to merge the basic statistical features, movement features, fallback features and interaction box features as comprehensive mouse features.

[0167] In a preferred embodiment: the first feature extraction subunit includes: a basic statistical feature component, which is used to extract statistical features according to the mouse movement trajectory data to determine multiple first subsequences, and calculate multiple statistical data corresponding to each first subsequence as basic statistical features, the mouse movement trajectory data includes multiple serialized information units, each information unit includes multiple basic data, and the basic data includes the horizontal coordinate and the vertical coordinate of the mouse position, and the timestamp of the mouse at the position;

[0168] And / or, the second feature extraction subunit includes: a movement feature component, which is used to calculate movement data corresponding to multiple movement indicators in the mouse movement process according to the mouse movement trajectory data, and calculate second subsequences corresponding to multiple trigonometric function indicators, calculate multiple statistical data corresponding to the second subsequences, and splice the multiple statistical data and the movement data as movement features;

[0169] And / or, the third feature extraction subunit includes: a fallback feature component, which is used to determine a plurality of third subsequences corresponding to the assumed reverse movement direction of the mouse according to the mouse movement trajectory data, calculate a plurality of statistical data corresponding to each third subsequence, calculate movement data corresponding to a plurality of movement indicators in the mouse movement process according to the third subsequence representing the coordinates corresponding to the horizontal axis and the vertical axis, and calculate a fourth subsequence corresponding to a plurality of trigonometric function indicators, calculate a plurality of statistical data corresponding to the fourth subsequence, and splice the plurality of statistical data corresponding to the third subsequence, the plurality of statistical data corresponding to the fourth subsequence and the movement data as the fallback feature;

[0170] And / or, the fourth feature extraction subunit includes: an interactive frame feature component, which is used to determine multiple fifth subsequences moving in the interactive frame on the graphical user interface according to the mouse movement trajectory data, calculate multiple statistical data corresponding to each fifth subsequence, calculate the movement data corresponding to multiple movement indicators in the mouse movement process according to the fifth subsequence representing the coordinates corresponding to the horizontal axis and the vertical axis, and calculate the sixth subsequence corresponding to multiple trigonometric function indicators, calculate multiple statistical data corresponding to the sixth subsequence, and splice the multiple statistical data corresponding to the fifth subsequence, the multiple statistical data corresponding to the sixth subsequence and the movement data as the interactive frame feature.

[0171] In order to solve the above technical problems, the present application also provides a computer device. Fig. 9 As shown, a schematic diagram of the internal structure of a computer device. The computer device includes a processor, a computer-readable storage medium, a memory, and a network interface connected via a system bus. Among them, the computer-readable storage medium of the computer device stores an operating system, a database, and computer-readable instructions. The database may store a control information sequence. When the computer-readable instructions are executed by the processor, the processor may implement a machine behavior detection method. The processor of the computer device is used to provide computing and control capabilities to support the operation of the entire computer device. The memory of the computer device may store computer-readable instructions. When the computer-readable instructions are executed by the processor, the processor may execute the machine behavior detection method of the present application. The network interface of the computer device is used to connect and communicate with a terminal. Those skilled in the art will understand that Fig. 9 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0172] In this embodiment, the processor is used to execute Figure 8The memory stores the program code and various data required to execute the above modules or submodules. The network interface is used to transmit data between user terminals or servers. The memory in this embodiment stores the program code and data required to execute all modules / submodules in the machine behavior detection device of this application, and the server can call the program code and data of the server to execute the functions of all submodules.

[0173] The present application also provides a storage medium storing computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the machine behavior detection method of any embodiment of the present application.

[0174] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments of the present application can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the aforementioned storage medium can be a computer-readable storage medium such as a disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0175] In summary, this application can extract fine-grained features of multiple dimensions corresponding to the user operation behavior data generated by the operating client, which can be used to train the machine behavior detection model and improve the accuracy of model prediction. In addition, the machine behavior detection implemented in this application adopts a multiple detection mechanism, which can effectively ensure network security in real time and maintain the security of enterprise resources.

[0176] Those skilled in the art will appreciate that the various operations, methods, steps, measures, and schemes in the processes discussed in this application may be alternated, altered, combined, or deleted. Further, other steps, measures, and schemes in the various operations, methods, and processes discussed in this application may also be alternated, altered, rearranged, decomposed, combined, or deleted. Further, the steps, measures, and schemes in the prior art that are similar to those disclosed in this application may also be alternated, altered, rearranged, decomposed, combined, or deleted.

[0177] The above description is only a partial implementation method of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A machine behavior detection method, characterized in that: The steps include: Responding to the page resource loading request submitted by the client, acquiring the collected user operation behavior data, wherein the user operation behavior data includes mouse movement trajectory data, user agent data in the browser data, and keyboard input data; Performing a first level of detection on the user operation behavior data according to preset rules to determine whether the client's operation behavior is a machine behavior; When the first detection shows that the behavior does not belong to a machine behavior, a second detection is performed on the comprehensive feature vector of the user operation behavior data using a machine behavior detection model that has been pre-trained to convergence to determine whether the operation behavior of the client belongs to a machine behavior, including: pre-processing the user operation behavior data to obtain its comprehensive features, wherein the comprehensive features include mouse comprehensive features, keyboard input features, and browser features; When it is determined that the client's operation behavior is a machine behavior, the client's network address is added to a temporary blacklist to start suspicious detection of the client; When the client passes the suspicion detection, the page resources required for the loading request are pushed to the client; Wherein: the step of preprocessing the user operation behavior data to obtain its comprehensive features includes: Determine a mouse comprehensive feature according to the mouse movement trajectory data in the user operation behavior data, wherein the mouse comprehensive feature includes basic statistical features, movement features, fallback features, and interaction box features corresponding to the mouse operation; Determine corresponding browser features and keyboard input features according to user agent data and keyboard input data in the browser data in the user operation behavior data; Combining the mouse comprehensive features, browser features and keyboard input features to obtain corresponding comprehensive features; The step of determining the comprehensive features of the mouse according to the mouse movement trajectory data in the user operation behavior data includes: Extracting statistical features according to the mouse movement trajectory data to obtain basic statistical features includes: extracting statistical features according to the mouse movement trajectory data to determine multiple first subsequences, and calculating multiple statistical data corresponding to each first subsequence as basic statistical features, the mouse movement trajectory data includes multiple serialized information units, each information unit includes multiple basic data, the basic data includes the horizontal coordinate and the vertical coordinate of the mouse position, and the timestamp of the mouse at the position, the first subsequence includes all serialized horizontal coordinates, the first half of the horizontal coordinates, the second half of the horizontal coordinates, all vertical coordinates, the first half of the vertical coordinates, the second half of the vertical coordinates, the results of first-order difference processing of all horizontal coordinates, and the results of first-order difference processing of all vertical coordinates, and the multiple statistical data include any multiple of the sum, mean, maximum value, minimum value, range, variance, standard deviation, mean absolute error, mode, and quantile; Extracting feature data of the mouse movement process according to the mouse movement trajectory data to obtain movement features; Extracting feature data corresponding to the assumed reverse movement direction of the mouse according to the mouse movement trajectory data to obtain a rollback feature; Extracting feature data represented by the movement of the mouse in the interaction box on the graphical user interface according to the mouse movement trajectory data to obtain interaction box features; The basic statistical features, movement features, fallback features and interaction frame features are combined as comprehensive mouse features.

2. The machine behavior detection method according to claim 1, characterized in that: The training process of the machine behavior detection model includes the following steps: Obtain a pre-prepared training set, wherein the training set includes a first type of training samples of user operation behavior data generated manually and a second type of training samples of user operation behavior data generated by machine behavior, and annotate corresponding supervision labels according to the operation behavior types of the training samples; Determine the comprehensive features corresponding to each training sample in the training set to construct a comprehensive feature vector, wherein the comprehensive features include mouse comprehensive features, keyboard input features, and browser features; Obtain a comprehensive feature vector corresponding to a single training sample in the training set and input it into the machine behavior detection model to predict the operation behavior type corresponding to the training sample; According to the supervisory label corresponding to the single training sample, the loss value of the predicted operation behavior type is calculated to determine whether the loss value reaches a preset threshold. When it reaches the preset threshold, the training is terminated; otherwise, the weight of the model is updated according to the loss value, and the next training sample in the training set is called to continue iterative training of the model.

3. The machine behavior detection method according to claim 1, characterized in that: The step of using a machine behavior detection model that has been pre-trained to convergence to perform a second detection on the comprehensive feature vector of the user operation behavior data to determine whether the operation behavior of the client is a machine behavior includes the following steps: Preprocess the user operation behavior data to obtain its comprehensive features, The comprehensive features include mouse comprehensive features, keyboard input features, and browser features; Encoding the keyboard input feature and the browser feature in the comprehensive feature by using a one-hot encoding method, and obtaining corresponding encoding data and constructing the comprehensive feature vector together with the mouse comprehensive feature; Using a machine behavior detection model that has been pre-trained to convergence to perform binary classification on the comprehensive feature vector to obtain a corresponding classification result; According to the classification result, it is determined whether the operation behavior of the client is a machine behavior.

4. The machine behavior detection method according to claim 1, characterized in that : The step of extracting feature data of the mouse movement process according to the mouse movement trajectory data to obtain movement features includes: Calculate the movement data corresponding to the multiple movement indicators in the process of mouse movement according to the mouse movement trajectory data, calculate the second subsequences corresponding to the multiple trigonometric function indicators, calculate the multiple statistical data corresponding to the second subsequences, and splice the multiple statistical data and the movement data as movement features; And / or, the step of extracting feature data corresponding to the assumed reverse movement direction of the mouse according to the mouse movement trajectory data to obtain the rollback feature includes: Determine a plurality of third subsequences corresponding to the assumed reverse direction of the mouse movement according to the mouse movement trajectory data, calculate a plurality of statistical data corresponding to each third subsequence, calculate movement data corresponding to a plurality of movement indicators in the process of mouse movement according to the third subsequence representing the coordinates corresponding to the horizontal axis and the vertical axis, calculate a fourth subsequence corresponding to a plurality of trigonometric function indicators, calculate a plurality of statistical data corresponding to the fourth subsequence, and splice the plurality of statistical data corresponding to the third subsequence, the plurality of statistical data corresponding to the fourth subsequence, and the movement data as fallback features; And / or, extracting feature data represented by the movement of the mouse in the interaction box on the graphical user interface according to the mouse movement trajectory data, and obtaining the feature of the interaction box, comprises: According to the mouse movement trajectory data, multiple fifth subsequences moving within the interaction box on the graphical user interface are determined, and multiple statistical data corresponding to each fifth subsequence is calculated. According to the fifth subsequence representing the coordinates corresponding to the horizontal axis and the vertical axis, the movement data corresponding to the multiple movement indicators in the mouse movement process are calculated, and the sixth subsequences corresponding to the multiple trigonometric function indicators are calculated, and the multiple statistical data corresponding to the sixth subsequence are calculated. The multiple statistical data corresponding to the fifth subsequence, the multiple statistical data corresponding to the sixth subsequence and the movement data are spliced ​​as the interaction box features.

5. The machine behavior detection method according to claim 1, characterized in that: After starting the suspicious detection on the client, the following steps are also included: In response to the user operation event immediately generated by the client, current user operation behavior data is collected, and the machine behavior detection model is used again to perform a third detection on the current user operation behavior data to determine whether the client operation behavior is a machine behavior; When the third level of detection determines that the behavior is a machine behavior, the client is controlled to display a verification code verification interface; Obtain the verification code input by the user, verify the verification code, and when the verification fails, determine that the client's operation behavior is a machine behavior, and stop responding to the client's subsequent page resource loading request. When the verification passes, remove the client's network address from the temporary blacklist.

6. A machine behavior detection device, characterized in that: include: A data acquisition module is used to respond to a page resource loading request submitted by a client and acquire collected user operation behavior data, wherein the user operation behavior data includes mouse movement trajectory data, user agent data in browser data, and keyboard input data; A first detection module, used to perform a first detection on the user operation behavior data according to a preset rule to determine whether the operation behavior of the client is a machine behavior; A double detection module is used to perform a second detection on the comprehensive feature vector of the user operation behavior data using a pre-trained to converge machine behavior detection model when the first detection does not belong to the machine behavior, to determine whether the client's operation behavior belongs to the machine behavior, including: pre-processing the user operation behavior data to obtain its comprehensive features, the comprehensive features including mouse comprehensive features, keyboard input features, and browser features; The blacklist detection module is used to add the client's network address to a temporary blacklist when it is determined that the client's operation behavior is a machine behavior, so as to start the suspicion detection of the client; A resource push module, used for pushing the page resources required for the loading request to the client when the client passes the suspicion detection; Wherein: the step of preprocessing the user operation behavior data to obtain its comprehensive features includes: Determine a mouse comprehensive feature according to the mouse movement trajectory data in the user operation behavior data, wherein the mouse comprehensive feature includes basic statistical features, movement features, fallback features, and interaction box features corresponding to the mouse operation; Determine corresponding browser features and keyboard input features according to user agent data and keyboard input data in the browser data in the user operation behavior data; Combining the mouse comprehensive features, browser features and keyboard input features to obtain corresponding comprehensive features; The step of determining the comprehensive features of the mouse according to the mouse movement trajectory data in the user operation behavior data includes: Extracting statistical features according to the mouse movement trajectory data to obtain basic statistical features includes: extracting statistical features according to the mouse movement trajectory data to determine multiple first subsequences, and calculating multiple statistical data corresponding to each first subsequence as basic statistical features, the mouse movement trajectory data includes multiple serialized information units, each information unit includes multiple basic data, the basic data includes the horizontal coordinate and the vertical coordinate of the mouse position, and the timestamp of the mouse at the position, the first subsequence includes all serialized horizontal coordinates, the first half of the horizontal coordinates, the second half of the horizontal coordinates, all vertical coordinates, the first half of the vertical coordinates, the second half of the vertical coordinates, the results of first-order difference processing of all horizontal coordinates, and the results of first-order difference processing of all vertical coordinates, and the multiple statistical data include any multiple of the sum, mean, maximum value, minimum value, range, variance, standard deviation, mean absolute error, mode, and quantile; Extracting feature data of the mouse movement process according to the mouse movement trajectory data to obtain movement features; Extracting feature data corresponding to the assumed reverse movement direction of the mouse according to the mouse movement trajectory data to obtain a rollback feature; Extracting feature data represented by the movement of the mouse in the interaction box on the graphical user interface according to the mouse movement trajectory data to obtain interaction box features; The basic statistical features, movement features, fallback features and interaction frame features are combined as comprehensive mouse features.

7. A computer device comprising a central processing unit and a memory, characterized in that: The central processing unit is used to call and run the computer program stored in the memory to execute the steps of the method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that: It stores a computer program implemented according to the method described in any one of claims 1 to 5 in the form of computer-readable instructions, and when the computer program is called and executed by a computer, the steps included in the corresponding method are executed.

Images