Abnormality detection method, device, equipment and computer-readable storage medium

Abstract

The present invention discloses an anomaly detection method, apparatus, device, and computer-readable storage medium, wherein the method includes: performing statistical analysis on log data of each user account in the log data to be processed based on operation category information to obtain the number of operations and the operation ratio; determining the anomaly score of each user account corresponding to each operation category information based on the operation number and operation ratio; determining the scoring benchmark corresponding to each operation category information based on the anomaly score, and determining the operation ratio benchmark corresponding to each operation category information based on the operation ratio; and determining target abnormal accounts in each user account that have abnormal operations based on the anomaly score, the operation ratio, the scoring benchmark, and the operation ratio benchmark. The present invention performs anomaly detection using two parameters, namely, the number of operations and the operation ratio, which are closely related to similar operations, to improve the accuracy of anomaly detection for data leaks through non-technical means.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to an anomaly detection method, apparatus, device, and computer-readable storage medium. Background Art

[0002] As informatization gradually permeates every aspect of life, the digital storage of personal information, commercial secrets, and state secrets has become mainstream, leading to increasingly serious damage caused by various information leaks. Data leaks are caused by numerous factors, but in the internet industry, which accounts for the largest proportion, technical factors are the primary cause. With the increasing strengthening of domestic information security controls, government agencies, leading internet companies, and operators have begun to prioritize cybersecurity. As the difficulty of obtaining sensitive data through technical means has gradually increased, the proportion of technical factors has begun to decline significantly, leading to an increase in the use of non-technical means.

[0003] In the prior art, for monitoring related to non-technical means, statistical methods are usually used to detect abnormalities in access volume, abnormalities in access nodes, and analysis of access sequences.

[0004] However, the anomaly analysis of access volume and access sequence ignores the analysis of various access behaviors, resulting in the inability to accurately monitor access behaviors other than anomalies. For example, for business systems, abnormal behavior of excessively querying data without conducting business transactions cannot be detected through anomaly analysis of access volume and access sequence, resulting in inaccurate anomaly detection of data leaks through non-technical means.

[0005] The above content is only used to assist in understanding the technical solution of the present invention and does not constitute an admission that the above content is prior art. Summary of the Invention

[0006] The main purpose of the present invention is to provide an anomaly detection method, device, equipment and computer-readable storage medium, aiming to solve the technical problem of inaccurate anomaly detection for data leakage using existing non-technical means.

[0007] To achieve the above object, the present invention provides an anomaly detection method, which includes:

[0008] Based on the operation category information corresponding to the log data to be processed, performing statistical analysis on the log data of each user account in the log data to be processed to obtain the number of operations and the operation ratio of each user account corresponding to each operation category information;

[0009] Determining an anomaly score for each user account corresponding to each operation category information based on the number of operations and the operation ratio;

[0010] Determining a score benchmark corresponding to each piece of operation category information based on the abnormality score, and determining an operation ratio benchmark corresponding to each piece of operation category information based on the operation ratio;

[0011] Based on the abnormality score, the operation ratio, the score benchmark, and the operation ratio benchmark, a target abnormal account having abnormal operation among the user accounts is determined.

[0012] Furthermore, the step of determining a scoring benchmark corresponding to each operation category information based on the abnormality score includes:

[0013] Sort the abnormality scores of user accounts corresponding to each operation category information respectively to obtain multiple score rankings;

[0014] The abnormality score corresponding to the first preset percentile in each score ranking is used as the scoring basis corresponding to each operation category information.

[0015] Furthermore, the step of determining an operation ratio benchmark corresponding to each operation category information based on the operation ratio includes:

[0016] sorting the operation ratios of the user accounts corresponding to the respective operation category information to obtain multiple operation ratio rankings;

[0017] The operation ratio corresponding to the second preset percentile in each operation ratio ranking is used as the operation ratio benchmark corresponding to each operation category information.

[0018] Furthermore, the step of determining a target abnormal account having abnormal operations among the user accounts based on the abnormality score, the operation ratio, the score benchmark, and the operation ratio benchmark includes:

[0019] Determining whether there is a suspected abnormal user account among the user accounts whose abnormality score is greater than or equal to the scoring benchmark;

[0020] If so, the user account whose operation ratio among the suspected abnormal user accounts is less than or equal to the operation ratio benchmark is used as the target abnormal account.

[0021] Furthermore, the step of determining an anomaly score of each user account corresponding to each operation category information based on the operation quantity and operation ratio includes:

[0022] The number of operations and the operation ratio of each user account corresponding to each operation category information are input into the pre-trained isolation forest algorithm model for model training to obtain the anomaly score of each user account corresponding to each operation category information.

[0023] Furthermore, before the step of sequentially inputting the number of operations and the operation ratio of each user account corresponding to each operation category information into the trained isolation forest algorithm model for model training to obtain the anomaly score of each user account corresponding to each operation category information, the step further includes:

[0024] The number of operations and the operation ratio of each user account corresponding to each operation category information are input into the isolation forest algorithm model for model training to obtain a pre-trained isolation forest algorithm model.

[0025] Furthermore, before the step of performing statistical analysis on the log data of each user account in the log data to be processed based on the operation category information corresponding to the log data to be processed and obtaining the number of operations and the operation ratio of each user account corresponding to each operation category information, the step further includes:

[0026] Obtaining the operation log of the business system and storing the operation log of the business system in the target database; and / or,

[0027] Obtaining access logs of a preset database, determining sensitive logs in the access logs based on preset sensitive data, and storing the sensitive logs in a target database;

[0028] The operation logs and / or sensitive logs during a preset period in the target database are obtained as the log data to be processed.

[0029] In addition, to achieve the above-mentioned object, the present invention further provides an abnormality detection device, the abnormality detection device comprising:

[0030] A statistics module is used to perform statistical analysis on the log data of each user account in the log data to be processed based on the operation category information corresponding to the log data to be processed, and obtain the number of operations and the operation ratio of each user account corresponding to each operation category information;

[0031] A first determination module is configured to determine an anomaly score of each user account corresponding to each operation category information based on the number of operations and the operation ratio;

[0032] a second determining module, configured to determine a scoring benchmark corresponding to each piece of operation category information based on the abnormality score, and to determine an operation ratio benchmark corresponding to each piece of operation category information based on the operation ratio;

[0033] An anomaly detection module is used to determine target abnormal accounts with abnormal operations in each of the user accounts based on the anomaly score, the operation ratio, the score benchmark and the operation ratio benchmark.

[0034] In addition, to achieve the above-mentioned purpose, the present invention also provides an abnormality detection device, which includes: a memory, a processor, and an abnormality detection program stored on the memory and runnable on the processor, and when the abnormality detection program is executed by the processor, the steps of the aforementioned abnormality detection method are implemented.

[0035] In addition, to achieve the above-mentioned purpose, the present invention also provides a computer-readable storage medium, on which an anomaly detection program is stored. When the anomaly detection program is executed by a processor, the steps of the aforementioned anomaly detection method are implemented.

[0036] The present invention performs statistical analysis on the log data of each user account in the log data to be processed based on the operation category information corresponding to the log data to be processed, and obtains the number of operations and the operation ratio of each user account corresponding to each operation category information; then determines the anomaly score of each user account corresponding to each operation category information based on the operation number and the operation ratio; then determines the scoring benchmark corresponding to each operation category information based on the anomaly score, and determines the operation ratio benchmark corresponding to each operation category information based on the operation ratio; then determines the target abnormal account with abnormal operation in each of the user accounts based on the anomaly score, the operation ratio, the scoring benchmark and the operation ratio benchmark, and performs anomaly detection through parameters of two dimensions, namely the number of operations and the operation ratio, which are closely related to similar operations, to avoid misjudgment caused by anomaly detection using access volume and access sequence, and improves the accuracy of anomaly detection for data leakage using non-technical means. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 Schematic diagram of the structure of an anomaly detection device in a hardware operating environment involved in an embodiment of the present invention;

[0038] Figure 2 This is a flow chart of the first embodiment of the anomaly detection method of the present invention;

[0039] Figure 3 Schematic diagram of the functional modules of an abnormality detection device according to an embodiment of the present invention.

[0040] The purpose, features and advantages of the present invention will be further described with reference to the accompanying drawings and in conjunction with the embodiments. DETAILED DESCRIPTION

[0041] It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0042] like Figure 1 As shown, Figure 1It is a structural diagram of an anomaly detection device in a hardware operating environment involved in an embodiment of the present invention.

[0043] The abnormality detection device in the embodiment of the present invention may be a PC. Figure 1 As shown, the anomaly detection device may include: a processor 1001, such as a CPU, a network interface 1004, a user interface 1003, a memory 1005, and a communication bus 1002. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 may be a high-speed RAM memory or a stable memory (non-volatile memory), such as a disk memory. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0044] Optionally, the anomaly detection device may further include a camera, an RF (Radio Frequency) circuit, a sensor, an audio circuit, a WiFi module, etc. Of course, the anomaly detection device may also be configured with other sensors such as a barometer, a hygrometer, a thermometer, an infrared sensor, etc., which will not be described in detail here.

[0045] Those skilled in the art will understand that Figure 1 The terminal structure shown in the figure does not constitute a limitation on the abnormality detection device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0046] like Figure 1 As shown, the memory 1005 as a computer storage medium may include an operating system, a network communication module, a user interface module, and an anomaly detection program.

[0047] exist Figure 1 In the terminal shown, the network interface 1004 is mainly used to connect to the background server and communicate data with the background server; the user interface 1003 is mainly used to connect to the client (user end) and communicate data with the client; and the processor 1001 can be used to call the anomaly detection program stored in the memory 1005.

[0048] In this embodiment, the anomaly detection device includes: a memory 1005, a processor 1001, and an anomaly detection program stored on the memory 1005 and executable on the processor 1001, wherein the processor 1001 calls the anomaly detection program stored in the memory 1005 and executes the steps of the anomaly detection method in each of the following embodiments.

[0049] The present invention also provides an abnormality detection method, referring to Figure 2 , Figure 2 Schematic diagram of the first embodiment of the abnormality detection method of the present invention.

[0050] In this embodiment, the anomaly detection method includes:

[0051] Step S101, based on the operation category information corresponding to the log data to be processed, performing statistical analysis on the log data of each user account in the log data to be processed, and obtaining the number of operations and the operation ratio of each user account corresponding to each operation category information;

[0052] In this embodiment, log data to be processed is obtained, and operation category information corresponding to the log data in the log data to be processed is obtained. The log data to be processed includes operation logs and / or sensitive logs. The operation logs are operation logs of a preset business system, and the sensitive logs are sensitive logs in the access logs of a preset database. For operation logs, the operation category information of each operation log can be directly obtained, such as data query, business processing, data download, etc. For sensitive logs, the corresponding operation category information can be determined according to the command field of the SQL command in each sensitive log, such as query, modification, insertion, deletion, export, data definition and other operations.

[0053] Next, based on the operation category information, the log data of each user account in the log data to be processed is statistically analyzed to obtain the number of operations and the operation ratio of each user account corresponding to each operation category information; specifically, the number of operations corresponding to each operation category information of each user account is counted, and then the operation ratio of the operations corresponding to each operation category information of each user account is calculated. The operation ratio of the operation corresponding to a certain operation category information is the number of operations corresponding to the operation category information / the total number of operations of the user account. For example, for the user account accc01, the operations corresponding to each operation category information include query operations and modification operations. The query operation volume in the log data to be processed is 1200 and the modification operation volume is 50. The query operation ratio is 95.7%, and the modification operation ratio is 1.3%.

[0054] Step S102: determining an abnormality score of each user account corresponding to each operation category information based on the operation quantity and operation ratio;

[0055] In this embodiment, when the number of operations and the operation ratio are obtained, the anomaly score of each user account corresponding to each operation category information is determined based on the number of operations and the operation ratio. Specifically, step S102 includes: inputting the number of operations and the operation ratio of each user account corresponding to each operation category information into the pre-trained isolation forest algorithm model for model training, and obtaining the anomaly score of each user account corresponding to each operation category information.

[0056] In this embodiment, a pre-trained isolation forest algorithm model is first obtained, and then the number of operations and the operation ratio of each user account corresponding to each operation category information are sequentially input into the pre-trained isolation forest algorithm model for model training. Each operation category information can be corresponded to a pre-trained isolation forest algorithm model, and the number of operations and the operation ratio of each user account corresponding to each operation category information are sequentially input into the pre-trained isolation forest algorithm model corresponding to each operation category information for model training. For each operation category, the number of operations and the operation ratio of each user account corresponding to the operation category are input into the corresponding pre-trained isolation forest algorithm model for model training, so as to train the number of operations and the operation ratio of each user account corresponding to the operation category through the pre-trained isolation forest algorithm model, and obtain the anomaly score of each user account corresponding to the operation category. For this operation category, each user account corresponds to an anomaly score.

[0057] For example, for a query operation, a pre-trained isolation forest algorithm model corresponding to the query operation is obtained, and a two-dimensional matrix N*2 is obtained based on the number of operations and the operation ratio of each user account corresponding to the query operation, where N is the number of user accounts. The two-dimensional matrix is ​​input into the pre-trained isolation forest algorithm model corresponding to the query operation for model training. The output of the pre-trained isolation forest algorithm model corresponding to the query operation is the anomaly score of each user account.

[0058] Furthermore, before step S102 , the method further includes: inputting the operation quantity and operation ratio of each user account corresponding to each operation category information into an isolation forest algorithm model for model training to obtain a pre-trained isolation forest algorithm model.

[0059] In this embodiment, the number of operations and the operation ratio for each user account corresponding to each operation category information are input into the isolation forest algorithm model for model training, thereby obtaining a pre-trained isolation forest algorithm model corresponding to the operation category information. For example, for a query operation, a two-dimensional matrix N*2 is generated based on the number of operations and the operation ratio for each user account corresponding to the query operation, where N is the number of user accounts. This two-dimensional matrix is ​​then input into the isolation forest algorithm model for model training, thereby obtaining a pre-trained isolation forest algorithm model corresponding to the query operation.

[0060] This embodiment uses the isolation forest algorithm model to predict the abnormal score, and uses the number of operations and operation ratios obtained each time as a training set to train the isolation forest algorithm model, so as to avoid the inability of the solidified training set to respond to the rapid changes in the data set.

[0061] Step S103, determining a score benchmark corresponding to each operation category information based on the abnormality score, and determining an operation ratio benchmark corresponding to each operation category information based on the operation ratio;

[0062] In this embodiment, when the anomaly score is obtained, the scoring benchmark corresponding to each operation category information is determined based on the anomaly score. Specifically, for each operation category information, the percentile value of the anomaly score corresponding to the operation category information can be obtained as the scoring benchmark.

[0063] At the same time, an operation ratio benchmark corresponding to each operation category information is determined based on the operation ratio. For each operation category information, a percentile value of the operation ratio corresponding to the operation category information can be obtained as the operation ratio benchmark.

[0064] Step S104 : determining target abnormal accounts having abnormal operations among the user accounts based on the abnormality score, the operation ratio, the score benchmark, and the operation ratio benchmark.

[0065] In this embodiment, when the scoring benchmark and the operation ratio benchmark are obtained, the target abnormal accounts with abnormal operations in each user account are determined based on the abnormal score, operation ratio, scoring benchmark and operation ratio benchmark. Specifically, the user accounts in each user account whose abnormal scores meet the abnormal conditions corresponding to the scoring benchmark and whose operation ratios meet the abnormal conditions corresponding to the operation ratio benchmark are used as target abnormal accounts.

[0066] In this embodiment, anomaly detection is performed based on parameters in two dimensions: the number of operations closely related to the same type of operations and the operation ratio, thereby achieving anomaly detection based on the user's access behavior / operation behavior.

[0067] The anomaly detection method proposed in this embodiment performs statistical analysis on the log data of each user account in the log data to be processed based on the operation category information corresponding to the log data to be processed, and obtains the number of operations and the operation ratio of each user account corresponding to each operation category information; then, based on the number of operations and the operation ratio, determines the anomaly score of each user account corresponding to each operation category information; then, based on the anomaly score, determines the scoring benchmark corresponding to each operation category information, and based on the operation ratio, determines the operation ratio benchmark corresponding to each operation category information; then, based on the anomaly score, the operation ratio, the scoring benchmark, and the operation ratio benchmark, determines the target abnormal account with abnormal operations in each of the user accounts, and performs anomaly detection using parameters in two dimensions, namely, the number of operations and the operation ratio that are closely related to similar operations, to avoid misjudgment caused by anomaly detection using access volume and access sequence, and improve the accuracy of anomaly detection for data leakage using non-technical means.

[0068] Based on the first embodiment, a second embodiment of the anomaly detection method of the present invention is proposed. In this embodiment, step S103 includes:

[0069] Step S201: sorting the abnormality scores of user accounts corresponding to each operation category information to obtain multiple score rankings;

[0070] Step S202 : Using the abnormality score corresponding to the first preset percentile in each score ranking as the score basis corresponding to each operation category information.

[0071] In this embodiment, when the anomaly scores are obtained, the anomaly scores of the user accounts corresponding to the respective operation category information are sorted respectively to obtain multiple score rankings. Specifically, for each operation category information, the anomaly scores corresponding to the operation category information are sorted in order from large to small or from small to large to obtain the score ranking of the operation category information.

[0072] Next, the abnormality score corresponding to the first preset percentile in each score sort is used as the scoring basis for each operation category information. Specifically, for each operation category information, the first preset percentile can be a percentile, and the smallest first preset percentile value in the score sort of the operation category information is used as the scoring basis. If the abnormality scores are sorted in order from small to large, the first preset percentile can be 5%, and the abnormality score at the 5% percentile position in the score sort is used as the scoring basis. If the abnormality scores are sorted in order from large to small, the first preset percentile can be 95%, and the abnormality score at the 95% percentile position in the score sort is used as the scoring basis. The smaller the abnormality score value, the further the user behavior deviates from the normal range, and the greater the possibility that the corresponding operation is abnormal. For example, for 1000 user accounts (1-1000), the operation ratio is sorted from small to large, the first preset percentile can be 5%, and the abnormality score at the 50th position in the score sort is used as the scoring basis. Among them, the first preset percentile can be set reasonably.

[0073] The anomaly detection method proposed in this embodiment obtains multiple score rankings by sorting the anomaly scores of user accounts corresponding to each operation category information respectively; then, the anomaly score corresponding to the first preset percentile in each score ranking is used as the scoring benchmark corresponding to each operation category information. The scoring benchmark is accurately obtained through the preset percentile, thereby improving the accuracy of the scoring benchmark and further improving the accuracy of anomaly detection for data leaks through non-technical means.

[0074] Based on the first embodiment, a third embodiment of the abnormality detection method of the present invention is proposed. In this embodiment, step S103 includes:

[0075] Step S301, sorting the operation ratios of each user account corresponding to each operation category information to obtain multiple operation ratio rankings;

[0076] Step S302 : Using the operation ratio corresponding to the second preset percentile in the operation ratio ranking as the operation ratio benchmark corresponding to each operation category information.

[0077] In this embodiment, the operation ratios of the user accounts corresponding to the respective operation category information are sorted respectively to obtain a plurality of operation ratio rankings. Specifically, for each operation category information, the operation ratios corresponding to the operation category information are sorted in a descending order or a descending order to obtain the operation ratio ranking of the operation category information.

[0078] Next, the operation ratio corresponding to the second preset percentile in each operation ratio ranking is used as the operation ratio benchmark corresponding to each operation category information. Specifically, for each operation category information, the first preset percentile can be a percentile, and the quantile value of the largest second preset percentile in the operation ratio ranking of the operation category information is used as the operation ratio benchmark. If the operation ratio is sorted in order from large to small, the second preset percentile can be 5%, and the operation ratio at the 5% percentile position in the operation ratio ranking is used as the operation ratio benchmark. If the operation ratio is sorted in order from small to large, the second preset percentile can be 95%, and the operation ratio at the 95% percentile position in the operation ratio ranking is used as the operation ratio benchmark. For example, for 1000 user accounts (1-1000), if the operation ratio is sorted from large to small, the second preset percentile can be 5%, and the operation ratio at the 50th position in the operation ratio ranking is used as the operation ratio benchmark. Among them, the second preset percentile can be set reasonably.

[0079] The anomaly detection method proposed in this embodiment obtains multiple operation ratio rankings by sorting the operation ratios of each user account corresponding to each operation category information respectively; then, the operation ratio corresponding to the second preset percentile in each operation ratio ranking is used as the operation ratio benchmark corresponding to each operation category information. The operation ratio benchmark is accurately obtained through the preset percentile, thereby improving the accuracy of the operation ratio benchmark and further improving the accuracy of anomaly detection for data leakage by non-technical means.

[0080] Based on the above embodiments, a fourth embodiment of the abnormality detection method of the present invention is proposed. In this embodiment, before step S101, the method further includes:

[0081] Step S401: Obtain the operation log of the business system and store the operation log of the business system in the target database; and / or,

[0082] Step S402: obtaining access logs of a preset database, determining sensitive logs in the access logs based on preset sensitive data, and storing the sensitive logs in a target database;

[0083] Step S403: Obtain operation logs and / or sensitive logs in the target database during a preset period as the log data to be processed.

[0084] In this embodiment, with respect to the operation log of the business system, the operation log of the business system is obtained, and the operation log of the business system is stored in the target database.

[0085] For the access log of the preset database, obtain the access log of the preset database, determine the sensitive log in the access log based on the preset sensitive data, and store the sensitive log in the target database. Specifically, compare the data tables and fields contained in the SQL commands in the access log with the preset sensitive data (sensitive tables, sensitive fields) of the sensitive information library to obtain the sensitive log in the access log.

[0086] Then, the operation logs and / or sensitive logs of a preset period in the target database are obtained as the log data to be processed, wherein the preset period can be 1 day or multiple days.

[0087] The anomaly detection method proposed in this embodiment obtains the operation log of the business system and stores the operation log of the business system in a target database; and / or obtains the access log of a preset database, determines the sensitive log in the access log based on preset sensitive data, and stores the sensitive log in the target database; then obtains the operation log and / or sensitive log of a preset period in the target database as the log data to be processed, thereby achieving accurate acquisition of the log data to be processed and further improving the accuracy of anomaly detection for data leakage by non-technical means.

[0088] The present invention also provides an abnormality detection device, referring to Figure 3 , the abnormality detection device includes:

[0089] A statistics module 10 is configured to perform statistical analysis on the log data of each user account in the log data to be processed based on the operation category information corresponding to the log data to be processed, and obtain the number of operations and the operation ratio of each user account corresponding to each operation category information;

[0090] A first determining module 20 is configured to determine an abnormality score of each user account corresponding to each operation category information based on the number of operations and the operation ratio;

[0091] A second determining module 30 is configured to determine a score benchmark corresponding to each piece of operation category information based on the abnormality score, and to determine an operation ratio benchmark corresponding to each piece of operation category information based on the operation ratio;

[0092] The anomaly detection module 40 is configured to determine target abnormal accounts having abnormal operations among the user accounts based on the anomaly score, the operation ratio, the score benchmark, and the operation ratio benchmark.

[0093] The methods executed by the above-mentioned program units can refer to the various embodiments of the abnormality detection method of the present invention, and will not be described in detail here.

[0094] The present invention also provides a computer-readable storage medium.

[0095] The computer-readable storage medium of the present invention stores an anomaly detection program, which implements the steps of the anomaly detection method described above when executed by a processor.

[0096] The method implemented when the abnormality detection program running on the processor is executed can refer to the various embodiments of the abnormality detection method of the present invention, and will not be described in detail here.

[0097] In addition, an embodiment of the present invention further provides a computer program product, which includes an anomaly detection program. When the anomaly detection program is executed by a processor, the steps of the anomaly detection method described above are implemented.

[0098] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or system comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or system. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or system comprising the element.

[0099] The serial numbers of the above embodiments of the present invention are for description only and do not represent the advantages or disadvantages of the embodiments.

[0100] Through the description of the above embodiments, those skilled in the art can clearly understand that the above embodiment methods can be implemented by means of software plus the necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better embodiment. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present invention.

[0101] The above are only preferred embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention description and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for detecting anomalies, characterized in that: The anomaly detection method comprises: Based on the operation category information corresponding to the log data to be processed, performing statistical analysis on the log data of each user account in the log data to be processed to obtain the number of operations and the operation ratio of each user account corresponding to each operation category information; Determining an anomaly score for each user account corresponding to each operation category information based on the number of operations and the operation ratio; Determine the scoring benchmark corresponding to each piece of operation category information based on the anomaly score corresponding to the preset percentile of the score ranking of the anomaly score, and determine the operation ratio benchmark corresponding to each piece of operation category information based on the operation ratio corresponding to the preset percentile of the operation ratio ranking of the operation ratio; Determining target abnormal accounts having abnormal operations among the user accounts based on the abnormality score, the operation ratio, the score benchmark, and the operation ratio benchmark; The step of determining a target abnormal account having abnormal operations among the user accounts based on the abnormality score, the operation ratio, the score benchmark, and the operation ratio benchmark includes: determining whether there is a suspected abnormal user account among the user accounts based on the abnormality score and the scoring benchmark; If so, the target abnormal user in the suspected abnormal user account is determined according to the operation ratio and the operation ratio benchmark.

2. The anomaly detection method according to claim 1, wherein: The step of determining the abnormality score of each user account corresponding to each operation category information based on the operation quantity and operation ratio includes: The number of operations and the operation ratio of each user account corresponding to each operation category information are input into the pre-trained isolation forest algorithm model for model training to obtain the anomaly score of each user account corresponding to each operation category information.

3. The anomaly detection method according to claim 2, wherein: Before the step of sequentially inputting the number of operations and the operation ratio of each user account corresponding to each operation category information into a pre-trained isolation forest algorithm model for model training to obtain anomaly scores of each user account corresponding to each operation category information, the method further includes: The number of operations and the operation ratio of each user account corresponding to each operation category information are input into the isolation forest algorithm model for model training to obtain a pre-trained isolation forest algorithm model.

4. The abnormality detection method according to any one of claims 1 to 3, characterized in that: Before the step of performing statistical analysis on the log data of each user account in the log data to be processed based on the operation category information corresponding to the log data to be processed and obtaining the number of operations and the operation ratio of each user account corresponding to each operation category information, the method further includes: Obtaining the operation log of the business system and storing the operation log of the business system in the target database; and / or, Obtaining access logs of a preset database, determining sensitive logs in the access logs based on preset sensitive data, and storing the sensitive logs in a target database; The operation logs and / or sensitive logs during a preset period in the target database are obtained as the log data to be processed.

5. An abnormality detection device, characterized in that: The abnormality detection device comprises: A statistics module is used to perform statistical analysis on the log data of each user account in the log data to be processed based on the operation category information corresponding to the log data to be processed, and obtain the number of operations and the operation ratio of each user account corresponding to each operation category information; A first determination module is configured to determine an abnormality score of each user account corresponding to each operation category information based on the number of operations and the operation ratio; a second determining module, configured to determine a scoring benchmark corresponding to each piece of operation category information based on the anomaly score corresponding to a preset percentile of the score ranking of the anomaly score, and to determine an operation ratio benchmark corresponding to each piece of operation category information based on the operation ratio corresponding to a preset percentile of the operation ratio ranking of the operation ratio; an anomaly detection module, configured to determine a target abnormal account having abnormal operations among the user accounts based on the anomaly score, the operation ratio, the score benchmark, and the operation ratio benchmark; The anomaly detection module is further configured to: determining whether there is a suspected abnormal user account among the user accounts based on the abnormality score and the scoring benchmark; If so, the target abnormal user in the suspected abnormal user account is determined according to the operation ratio and the operation ratio benchmark.

6. An abnormality detection device, characterized in that: The abnormality detection device includes: a memory, a processor, and an abnormality detection program stored in the memory and executable on the processor. When the abnormality detection program is executed by the processor, the steps of the abnormality detection method according to any one of claims 1 to 4 are implemented.

7. A computer-readable storage medium, characterized in that The computer-readable storage medium stores an anomaly detection program, which, when executed by a processor, implements the steps of the anomaly detection method according to any one of claims 1 to 4.

Images