Abnormal access behavior detection method, device, storage medium and electronic device

Abstract

The present application discloses a method, device, storage medium and electronic device for detecting abnormal access behavior. The method includes: obtaining multiple access logs in a network server, and obtaining the access path and the path reference source of the access path in each access log; generating a directed graph of the access path of the network server based on each access path and the path reference source; selecting candidate nodes from the directed graph according to the number of node connections of each node, obtaining multiple candidate nodes, and generating a target matrix based on the node information of each candidate node; determining abnormal nodes from multiple candidate nodes through the target matrix, and determining the access path corresponding to the abnormal node as an abnormal access path, and determining the access behavior corresponding to the abnormal access path as an abnormal access behavior. Through this application, the problem of low accuracy in detecting access behavior through the annotation information of the code file in the related art is solved.

Description

Technical Field

[0001] The present application relates to the field of network security, and more specifically, to a method, device, storage medium, and electronic device for detecting abnormal access behavior. Background Art

[0002] A webshell (web script) is an interface similar to a shell (script). It can be used to remotely access a web server and launch network attacks against it, thereby controlling the web server. To connect to the web server and launch an attack, the attacker can program the webshell in any programming language supported by the web server. The controller then obtains the relevant permissions of the web server by accessing a specific URL address, ultimately achieving the attack goal.

[0003] To prevent web servers from being attacked by webshells, webshell detection is necessary, allowing for timely defense upon detection. Webshell detection typically involves two phases: the first, uploading the webshell backdoor code; the second, exploiting the webshell backdoor. The different control end behaviors and targets in these two phases necessitate different detection methods.

[0004] In the second stage of backdoor application, the commonly used technical method for detecting webshell access is to obtain the annotation information of the code file through the annotation information extraction module, match it with the "annotation information feature library", obtain the permission value, and determine whether a certain access is a webshell access by judging whether the permission value exceeds the preset threshold.

[0005] However, in the prior art, when detecting whether an access is a webshell access, the code annotation information is relied on, which is relatively easy to bypass and the annotation information is easy to forge. Furthermore, the method of directly comparing the permission value with the threshold is prone to false positives, causing normal access to be misjudged as webshell access, thereby affecting normal access operations.

[0006] Currently, no effective solution has been proposed to address the problem of low accuracy in detecting access behaviors through annotation information in code files in related technologies. Summary of the Invention

[0007] The present application provides a method, device, storage medium and electronic device for detecting abnormal access behavior to solve the problem of low accuracy in detecting access behavior through annotation information of code files in related technologies.

[0008] According to one aspect of the present application, a method for detecting abnormal access behavior is provided. The method includes: obtaining multiple access logs in a network server, and obtaining the access path and at least one path reference source of the access path in each access log, wherein each access log includes at least one of the following: the access path, the path reference source, and the visitor IP; generating a directed graph of the access path of the network server based on each access path and the path reference source of each access path, wherein the directed graph includes multiple nodes, each node representing an access path; selecting candidate nodes from the directed graph according to the number of node connections of each node to obtain multiple candidate nodes, and generating a target matrix based on the node information of each candidate node, wherein the node information includes: the access path corresponding to the node, the visitor IP of the access path, and the number of visits of each visitor IP; determining abnormal nodes from the multiple candidate nodes through the target matrix, and determining the access path corresponding to the abnormal node as an abnormal access path, and determining the access behavior corresponding to the abnormal access path as abnormal access behavior.

[0009] Optionally, generating a directed graph of the access path of the network server based on each access path and the path reference source of each access path includes: generating a node for each access path and a node for each path reference source to obtain multiple nodes; connecting the multiple nodes according to a reference relationship to obtain a directed graph of the access path, wherein the reference relationship is a reference relationship between the access path and the path reference source.

[0010] Optionally, selecting candidate nodes from a directed graph according to the number of node connections of each node includes: determining whether the node is an isolated node, wherein an isolated node indicates that the node has no connection relationship in the directed graph; if the node is an isolated node, determining the node as a candidate node; and / or determining the number of parent nodes of the node, and determining whether the number of parent nodes is greater than a first preset number; if the number of parent nodes is greater than the first preset number, determining the node as a candidate node.

[0011] Optionally, the node information also includes a first access count and a second access count, the first access count being the number of accesses the candidate node's access path is searched for, and the second access count being the number of accesses the candidate node's access path is jumped to. Before generating a target matrix based on the node information of each candidate node, the method also includes: determining whether the number of visitor IPs corresponding to each candidate node is greater than a second preset number; if the number of visitor IPs corresponding to the candidate node is greater than the second preset number, deleting the candidate node to obtain multiple updated candidate nodes, and executing the step of generating a target matrix based on the node information of each candidate node through the updated multiple candidate nodes; and / or dividing the first access count of the candidate node by the second access count to obtain the initial access rate of the candidate node; determining whether the initial access rate is less than or equal to the access rate threshold; if the initial access rate is less than or equal to the access rate threshold, deleting the candidate node to obtain multiple updated candidate nodes, and executing the step of generating a target matrix based on the node information of each candidate node through the updated multiple candidate nodes.

[0012] Optionally, generating a target matrix based on the node information of each candidate node includes: constructing a table of access paths and visitor IPs with access paths as columns and visitor IPs as rows, and adding the number of visits of each visitor IP to each access path to the table to obtain an initial relationship matrix; obtaining the transposed matrix of the initial relationship matrix to obtain an initial transposed matrix; multiplying the initial transposed matrix and the initial relationship matrix to obtain a metric matrix; normalizing the diagonal elements in the metric matrix to obtain a target matrix.

[0013] Optionally, determining an abnormal node from multiple candidate nodes through a target matrix includes: determining the number of non-zero elements in the row matrix corresponding to each access path in the target matrix to obtain multiple element numbers; judging whether each element number is less than a third preset number; if the element number is less than the third preset number, determining the node corresponding to the access path corresponding to the element number as an abnormal node; and / or determining the proportion of non-zero elements in the row matrix corresponding to each access path in the target matrix to all elements in the row matrix to obtain multiple element proportions; judging whether each element proportion is less than a preset proportion; if the element proportion is less than the preset proportion, determining the node corresponding to the access path corresponding to the element proportion as an abnormal node.

[0014] Optionally, before determining the abnormal node from multiple candidate nodes through the target matrix, the method also includes: judging whether there are visitor IPs of the same jurisdiction among the multiple visitor IPs in the target matrix; if there are visitor IPs of the same jurisdiction, adding the column matrices corresponding to the multiple visitor IPs of the same jurisdiction in the target matrix to obtain an updated target matrix, and executing the step of determining the abnormal node from multiple candidate nodes through the target matrix according to the updated target matrix.

[0015] According to another aspect of the present application, a device for detecting abnormal access behavior is provided. The device includes: an acquisition unit for acquiring multiple access logs from a network server, and acquiring an access path and at least one path reference source of the access path in each access log, wherein each access log includes at least one of the following: an access path, a path reference source, and a visitor IP address; a first generation unit for generating a directed graph of the access path of the network server based on each access path and the path reference source of each access path, wherein the directed graph includes multiple nodes, each node representing an access path; a second generation unit for selecting candidate nodes from the directed graph according to the number of node connections of each node to obtain multiple candidate nodes, and generating a target matrix based on the node information of each candidate node, wherein the node information includes: the access path corresponding to the node, the visitor IP address of the access path, and the number of accesses of each visitor IP address; a determination unit for determining an abnormal node from the multiple candidate nodes using the target matrix, determining the access path corresponding to the abnormal node as an abnormal access path, and determining the access behavior corresponding to the abnormal access path as an abnormal access behavior.

[0016] According to another aspect of an embodiment of the present invention, a computer storage medium is provided. The computer storage medium is used to store a program. When the program is running, the device where the computer storage medium is located is controlled to execute a method for detecting abnormal access behavior.

[0017] According to another aspect of an embodiment of the present invention, an electronic device is provided, comprising one or more processors and a memory; the memory stores computer-readable instructions, and the processor is used to run the computer-readable instructions, wherein a method for detecting abnormal access behavior is executed when the computer-readable instructions are run.

[0018] The present application adopts the following steps: obtaining multiple access logs from a network server, and obtaining the access path and at least one path reference source of each access log, wherein each access log includes at least one of the following: the access path, the path reference source, and the visitor IP address; generating a directed graph of the access path of the network server based on each access path and the path reference source of each access path, wherein the directed graph includes multiple nodes, each node representing an access path; selecting candidate nodes from the directed graph according to the number of node connections of each node to obtain multiple candidate nodes, and generating a target matrix based on the node information of each candidate node, wherein the node information includes: the access path corresponding to the node, the visitor IP address of the access path, and the number of visits for each visitor IP address; determining abnormal nodes from the multiple candidate nodes through the target matrix, and determining the access path corresponding to the abnormal node as an abnormal access path, and determining the access behavior corresponding to the abnormal access path as an abnormal access behavior. This solves the problem of low accuracy in detecting access behavior through the annotation information of the code file in the related art. By using the access path, that is, the URL, and the path reference source corresponding to the access path, an access path relationship graph of the network server, that is, a directed graph of the access path, is generated. Candidate nodes are selected based on the directed graph, and a target matrix is generated based on the node information of the candidate nodes. Abnormal nodes are determined by calculating the target matrix, and the access behavior corresponding to the abnormal node is determined as abnormal access, thereby achieving the effect of accurately detecting abnormal access. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings, which constitute part of this application, are intended to provide a further understanding of this application. The exemplary embodiments and descriptions of this application are intended to explain this application and do not constitute an improper limitation on this application. In the accompanying drawings:

[0020] Figure 1 This is a flowchart of a method for detecting abnormal access behavior according to an embodiment of the present application;

[0021] Figure 2 is a first directed graph of optional access paths provided according to an embodiment of the present application;

[0022] Figure 3 is a second directed graph of optional access paths provided according to an embodiment of the present application;

[0023] Figure 4 is a third directed graph of optional access paths provided according to an embodiment of the present application;

[0024] Figure 5 2 is a schematic diagram of a device for detecting abnormal access behavior according to an embodiment of the present application. DETAILED DESCRIPTION

[0025] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0026] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] It should be noted that the relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display and analysis, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties. For example, an interface is set up between this system and the relevant user or organization. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain the relevant information after receiving the consent information fed back by the aforementioned user or organization.

[0029] It should be noted that the detection method, device, storage medium and electronic device for abnormal access behavior determined in the present disclosure can be used in the field of network security, and can also be used in any field other than the field of network security. The application field of the detection method, device, storage medium and electronic device for abnormal access behavior determined in the present disclosure is not limited.

[0030] According to an embodiment of the present application, a method for detecting abnormal access behavior is provided.

[0031] Figure 1 This is a flow chart of a method for detecting abnormal access behavior according to an embodiment of the present application. Figure 1 As shown, the method includes the following steps:

[0032] Step S102: obtaining multiple access logs from the network server, and obtaining the access path and at least one path reference source of each access log, wherein each access log includes at least one of the following: access path, path reference source, and visitor IP.

[0033] It's important to note that webshells (web scripts) are primarily used for website and server management. Webshell access refers to accessing web pages through a webshell. When accessing a web server remotely through a webshell, it can be used to launch network attacks against the web server, thereby controlling it. To connect to the web server and launch an attack, the attacker can program the webshell in any programming language supported by the web server. The controller then accesses a specific URL to gain access to the web server's permissions, ultimately achieving their attack objectives.

[0034] Specifically, when detecting webshell access, all access logs within any time period can be obtained from the network server, and each access is detected according to the access path and path reference source in the access log to determine whether there is a webshell access.

[0035] It should be noted that each access log includes the access path, also known as the URL (Uniform Resource Locator), the visitor of the access path, also known as the visitor's IP address, and the path reference source of the URL, also known as the referer (path reference source). The path reference source is the access path of the previous level of the access path. The path reference source is used to determine the source webpage of the URL, that is, the URL of the previous level of the URL. For example, if visitor A accesses www.B.com through the link www.B.com in www.A.com, the path reference source of the access path www.B.com is www.A.com. In particular, if the access path is accessed by directly entering the access path, there is no path reference source for the access path.

[0036] Step S104 : generating a directed graph of the access paths of the network server according to each access path and the path reference source of each access path, wherein the directed graph includes a plurality of nodes, and each node represents an access path.

[0037] Specifically, after obtaining multiple access paths and at least one path reference source corresponding to each access path from multiple access logs, each access path can be taken as a node, thereby obtaining multiple nodes. Since the path reference source in one access log is used as a reference path in another access log, a directed graph of the access path of the network server can be generated through the relationship between the access path and the path reference source.

[0038] For example, the content of A's access log is: access path is A, path reference source is B, visitor IP is C; the content of B's access log is: access path is B, path reference source is empty, visitor IP is C. Then, based on the above content, a directed graph of the access path can be generated as B→A, in which B is the parent node of A.

[0039] Step S106, select candidate nodes from the directed graph according to the number of node connections of each node to obtain multiple candidate nodes, and generate a target matrix based on the node information of each candidate node, where the node information includes: the access path corresponding to the node, the visitor IP of the access path, and the number of visits for each visitor IP.

[0040] Specifically, after obtaining a directed graph, nodes whose number of node connections meets a preset condition can be selected from the directed graph, and the selected nodes are used as candidate nodes, i.e., nodes suspected of being abnormal. For example, the preset condition can be that if the number of node connections of a node is less than 10, then the node is a candidate node.

[0041] Furthermore, after obtaining the candidate nodes, a target matrix can be generated based on the node information of each candidate node, wherein the target matrix is used to represent the access relationship between the access path and the access IP. For example, the target matrix can be:

[0042]

[0043] The first row in the matrix represents the number of times IP1-IP4 access url1, and so on. Each row represents the number of times each IP accesses a url.

[0044] Step S108 : determining an abnormal node from multiple candidate nodes using the target matrix, determining the access path corresponding to the abnormal node as an abnormal access path, and determining the access behavior corresponding to the abnormal access path as an abnormal access behavior.

[0045] Specifically, after obtaining the target matrix, the abnormal node can be determined from multiple candidate nodes through the target matrix, and the access behavior corresponding to the access path corresponding to the abnormal node can be determined as a webshell access.

[0046] For example, URL2 in matrix 1 has only been accessed by IP2, and IP2 has only accessed URL2 a significant number of times. Therefore, we can determine that IP2's access to URL2 is a webshell access. By determining the target matrix and determining webshell access based on the target matrix, we can accurately detect webshell access.

[0047] The present invention provides a method for detecting abnormal access behavior, which obtains multiple access logs from a network server and obtains the access path and at least one path reference source of each access log, wherein each access log includes at least one of the following: an access path, a path reference source, and a visitor IP address; generates a directed graph of the access path of the network server based on each access path and the path reference source of each access path, wherein the directed graph includes multiple nodes, each node representing an access path; selects candidate nodes from the directed graph according to the number of node connections of each node to obtain multiple candidate nodes, and generates a target matrix based on the node information of each candidate node, wherein the node information includes: the access path corresponding to the node, the visitor IP address of the access path, and the number of visits for each visitor IP address; determines abnormal nodes from the multiple candidate nodes through the target matrix, and determines the access path corresponding to the abnormal node as an abnormal access path, and determines the access behavior corresponding to the abnormal access path as abnormal access behavior. This method solves the problem of low accuracy in detecting access behavior through the annotation information of code files in the related art. By using the access path, that is, the URL, and the path reference source corresponding to the access path, an access path relationship graph of the network server, that is, a directed graph of the access path, is generated. Candidate nodes are selected based on the directed graph, and a target matrix is generated based on the node information of the candidate nodes. Abnormal nodes are determined by calculating the target matrix, and the access behavior corresponding to the abnormal node is determined as abnormal access, thereby achieving the effect of accurately detecting abnormal access.

[0048] In order to generate an accurate directed graph, optionally, in the method for detecting abnormal access behavior provided in an embodiment of the present application, generating a directed graph of the access path of the network server based on each access path and the path reference source of each access path includes: generating a node for each access path and a node for each path reference source to obtain multiple nodes; connecting the multiple nodes according to a reference relationship to obtain a directed graph of the access path, wherein the reference relationship is a reference relationship between the access path and the path reference source.

[0049] Specifically, since the path reference source in the access log is an access path in another access log, a node corresponding to each access path and each path reference source can be generated, and multiple nodes can be connected according to the reference relationship between the access path and the path reference source, thereby obtaining a directed graph of the access path of the web server.

[0050] For example, the content of access log A is: access path is A, path reference source is B, visitor IP is C; the content of access log B is: access path is C, path reference source is A, visitor IP is C. Then, the directed graph of access path can be generated based on the above content as B→A→C.

[0051] It should be noted that each node may include multiple attributes of the access path corresponding to that node. For example, attribute 1 is the number of times the access path has been accessed, attribute 2 is the number of times the access path has served as the starting access path, and attribute 3 is the number of visitor IP addresses that have accessed the current path. The starting access path is the access path obtained by the visitor through a query, not a redirect, and the number of times the access path has been accessed includes the number of times the access path served as the starting access path.

[0052] Figure 2 is a first directed graph of optional access paths provided according to an embodiment of the present application, such as Figure 2 As shown, in multiple access logs, the content of access log A is: access path is A, path reference source is C, visitor IP is C; the content of access log B is: access path is C, path reference source is A, visitor IP is C. Then, in the directed graph of access paths, there is a phenomenon that access paths A and C point to each other. Similarly, access paths A and D, and access paths C and D also point to each other. Since only access log C has the content: access path is B, path reference source is C, visitor IP is G, then in the directed graph of access paths, there is a phenomenon that only nodes of access path C point to nodes of access path B.

[0053] In order to accurately obtain candidate nodes, optionally, in the abnormal access behavior detection method provided in the embodiment of the present application, selecting candidate nodes from a directed graph according to the number of node connections of each node includes: determining whether the node is an isolated node, wherein an isolated node represents that the node has no connection relationship in the directed graph; if the node is an isolated node, determining the node as a candidate node; and / or determining the number of parent nodes of the node, and determining whether the number of parent nodes is greater than a first preset number; if the number of parent nodes is greater than the first preset number, determining the node as a candidate node.

[0054] Specifically, after obtaining the access path directed graph, the connection relationship of each node can be intuitively determined through the directed graph. Therefore, candidate nodes can be determined in the access path directed graph in two ways. One way is to determine whether there is an isolated node, that is, the node has no connection relationship with any node. Figure 3 is a second directed graph of an optional access path provided according to an embodiment of the present application, such as Figure 3 As shown, Figure 3 As shown in Node 1 in , Node 1 has no connection relationship with any node, so Node 1 is determined as a candidate node.

[0055] Furthermore, when a node has too many parent nodes, the node is also determined as a candidate node. Figure 4 is a third directed graph of optional access paths provided according to an embodiment of the present application, such as Figure 4 As shown, Figure 4 There are 8 parent nodes for node 2 in the example. When the first preset number is 5, node 2 has too many parent nodes, and node 2 is determined as a candidate node.

[0056] Optionally, in the detection method for abnormal access behavior provided in an embodiment of the present application, the node information also includes a first access count and a second access count, the first access count being the access count when the access path of the candidate node is searched and accessed, and the second access count being the access count when the access path of the candidate node is jumped and accessed. Before generating a target matrix based on the node information of each candidate node, the method also includes: determining whether the number of visitor IPs corresponding to each candidate node is greater than a second preset number; if the number of visitor IPs corresponding to the candidate node is greater than the second preset number, deleting the candidate node to obtain multiple updated candidate nodes, and executing the step of generating a target matrix based on the node information of each candidate node through the updated multiple candidate nodes; and / or dividing the first access count of the candidate node by the second access count to obtain the initial access rate of the candidate node; determining whether the initial access rate is less than or equal to the access rate threshold; if the initial access rate is less than or equal to the access rate threshold, deleting the candidate node to obtain multiple updated candidate nodes, and executing the step of generating a target matrix based on the node information of each candidate node through the updated multiple candidate nodes.

[0057] It should be noted that, in order to prevent misjudgment of candidate nodes, after obtaining multiple candidate nodes, the candidate nodes need to be screened once to obtain the final candidate nodes.

[0058] Specifically, after obtaining multiple candidate nodes, determine whether the number of visitor IPs in the attributes of each candidate node is greater than a second preset number. If it is greater than the second preset number, it indicates that the access path corresponding to the candidate node has been visited by a large number of IPs, and the access behavior corresponding to the access path must not be a webshell access, so the candidate node can be deleted from multiple candidate nodes.

[0059] Furthermore, the candidate node can also be judged by its initial access rate, where the initial access rate is calculated by dividing the first access count by the second access count. The first access count is the number of times the candidate node's access path is searched, that is, the number of times the access path is a direct access path. The second access count is the number of times the candidate node's access path is jumped, that is, the number of times the access path is jumped from other access paths. The initial access rate is obtained by dividing the two access counts. It should be noted that the second access count is not the first access count, that is, no matter how many other access paths the candidate node's access path has previously experienced, as long as the candidate node's access path is not searched, it is the second access count.

[0060] After obtaining the initial access rate, determine whether the initial access rate is less than or equal to the access rate threshold. If it is less than or equal to the access rate threshold, it indicates that the access path is not frequently accessed in a targeted manner. Therefore, the access behavior of the access path corresponding to the candidate node is not a webshell access, and the candidate node can be deleted from multiple candidate nodes.

[0061] Optionally, in the method for detecting abnormal access behavior provided in an embodiment of the present application, generating a target matrix based on the node information of each candidate node includes: constructing a table of access paths and visitor IPs with access paths as columns and visitor IPs as rows, and adding the number of visits of each visitor IP to each access path to the table to obtain an initial relationship matrix; obtaining the transposed matrix of the initial relationship matrix to obtain an initial transposed matrix; multiplying the initial transposed matrix and the initial relationship matrix to obtain a metric matrix; normalizing the diagonal elements in the metric matrix to obtain a target matrix.

[0062] Specifically, after obtaining multiple candidate nodes, a target matrix can be constructed according to the node information of the candidate nodes, and the target matrix can be transformed to obtain an updated target matrix, so that abnormal nodes can be better determined through the updated target matrix.

[0063] For example, the target matrix could be:

[0064]

[0065] The first row in the matrix represents the number of times IP1-IP4 access url1, which are 10 times, 0 times, 10 times, 15 times, and so on. Each row represents the number of visits by each IP corresponding to a url.

[0066] Furthermore, the target matrix is transposed to obtain the following transposed matrix:

[0067]

[0068] Multiplying the target matrix and the transposed matrix yields the following metric matrix:

[0069]

[0070] The rows and columns in the metric matrix represent IP information, that is, each number in the matrix represents the similarity between IPs. For example, the position (1,1) in the matrix represents the similarity between IP1 and IP1.

[0071] Normalize the diagonal elements in the metric matrix to obtain the updated target matrix.

[0072]

[0073] Optionally, in the method for detecting abnormal access behavior provided in an embodiment of the present application, before determining the abnormal node from multiple candidate nodes through the target matrix, the method also includes: judging whether there are visitor IPs of the same jurisdiction among the multiple visitor IPs in the target matrix; if there are visitor IPs of the same jurisdiction, adding the column matrices corresponding to the multiple visitor IPs of the same jurisdiction in the target matrix to obtain an updated target matrix, and executing the step of determining the abnormal node from multiple candidate nodes through the target matrix according to the updated target matrix.

[0074] Specifically, after obtaining the target matrix, the column matrices of the target matrix whose IP addresses belong to the same territory can be added together to obtain an updated target matrix, thereby reducing the amount of data in the matrix and further reducing the amount of matrix calculation.

[0075] For example, the target matrix looks like this:

[0076]

[0077] When the territories of IP2 and IP3 in the target matrix are the same, the column matrices of IP2 and IP3 may be added together to obtain a changed target matrix.

[0078]

[0079] Optionally, in the method for detecting abnormal access behavior provided in an embodiment of the present application, determining abnormal nodes from multiple candidate nodes through a target matrix includes: determining the number of non-zero elements in the row matrix corresponding to each access path in the target matrix to obtain multiple element numbers; judging whether each element number is less than a third preset number respectively; if the element number is less than the third preset number, determining the node corresponding to the access path corresponding to the element number as an abnormal node; and / or determining the proportion of non-zero elements in the row matrix corresponding to each access path in the target matrix to all elements in the row matrix to obtain multiple element proportions; judging whether each element proportion is less than a preset proportion respectively; if the element proportion is less than the preset proportion, determining the node corresponding to the access path corresponding to the element proportion as an abnormal node.

[0080] Specifically, after obtaining the target matrix, whether each access path is abnormal can be determined by determining the number of non-zero elements in the row matrix corresponding to each access path, or the proportion of non-zero elements in the row matrix corresponding to the access path to all elements in the row matrix.

[0081] When the number of non-zero elements in the row matrix corresponding to the access path is less than a third preset number, the access behavior corresponding to the access path is determined to be a webshell access. For example, if the number of non-zero elements is less than 40, the access behavior corresponding to the access path is a webshell access. Or, if the proportion of non-zero elements in the row matrix corresponding to the access path to all elements in the row matrix is less than a preset proportion, for example, if the proportion of non-zero elements in the row matrix corresponding to the access path to all elements in the row matrix is less than 10%, the access behavior corresponding to the access path is a webshell access. Thus, the abnormal node is determined by calculating the target matrix, and the access behavior corresponding to the abnormal node is determined to be an abnormal access, thereby achieving the effect of accurately detecting abnormal access.

[0082] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0083] The embodiments of the present application also provide a device for detecting abnormal access behavior. It should be noted that the device for detecting abnormal access behavior in the embodiments of the present application can be used to execute the method for detecting abnormal access behavior provided in the embodiments of the present application. The following introduces the device for detecting abnormal access behavior provided in the embodiments of the present application.

[0084] Figure 5 Schematic diagram of a detection device for abnormal access behavior according to an embodiment of the present application. Figure 5As shown, the device includes: an acquisition unit 51, a first generation unit 52, a second generation unit 53, and a determination unit 54.

[0085] Among them, the acquisition unit 51 is used to obtain multiple access logs in the network server, and obtain the access path in each access log and at least one path reference source of the access path, wherein each access log includes at least one of the following: access path, path reference source and visitor IP, and the path reference source is the upper-level access path of the access path.

[0086] It should be noted that a webshell (web script) is an interface similar to a shell (script). It can be used to remotely access a web server and launch network attacks against the web server, thereby controlling the web server. To connect to the web server and launch an attack, the attacker can program the webshell in any programming language supported by the web server. The controller then obtains relevant permissions of the web server by accessing a specific URL address, ultimately achieving the attack purpose.

[0087] Specifically, when detecting webshell access, all access logs within any time period can be obtained from the network server, and each access is detected according to the access path and path reference source in the access log to determine whether there is a webshell access.

[0088] It's important to note that each access log includes the access path, also known as the URL (Uniform Resource Locator), the visitor's IP address, and the URL's path reference source, also known as the referer. The referer is used to identify the URL's source webpage, or the URL's parent URL. For example, if visitor A accesses www.B.com via the link www.B.com in www.A.com, the path reference source for www.B.com is www.A.com. Specifically, if the access path is accessed by directly entering the path, no referer exists for that access path.

[0089] The first generating unit 52 is configured to generate a directed graph of access paths of the network server according to each access path and a path reference source of each access path, wherein the directed graph includes a plurality of nodes, and each node represents an access path.

[0090] Specifically, after obtaining multiple access paths and at least one path reference source corresponding to each access path from multiple access logs, each access path can be taken as a node, thereby obtaining multiple nodes. Since the path reference source in one access log is used as a reference path in another access log, a directed graph of the access path of the network server can be generated through the relationship between the access path and the path reference source.

[0091] For example, the content of A's access log is: access path is A, path reference source is B, visitor IP is C; the content of B's access log is: access path is B, path reference source is empty, visitor IP is C. Then, based on the above content, a directed graph of the access path can be generated as B→A, in which B is the parent node of A.

[0092] The second generation unit 53 is used to select candidate nodes from the directed graph according to the number of node connections of each node to obtain multiple candidate nodes, and generate a target matrix based on the node information of each candidate node, wherein the node information includes: the access path corresponding to the node, the visitor IP of the access path, and the number of visits for each visitor IP.

[0093] Specifically, after obtaining a directed graph, nodes whose number of node connections meets a preset condition can be selected from the directed graph, and the selected nodes are used as candidate nodes, i.e., nodes suspected of being abnormal. For example, the preset condition can be that if the number of node connections of a node is less than 10, then the node is a candidate node.

[0094] Furthermore, after obtaining the candidate nodes, a target matrix can be generated based on the node information of each candidate node, wherein the target matrix is used to represent the access relationship between the access path and the access IP. For example, the target matrix can be:

[0095]

[0096] The first row in the matrix represents the number of times IP1-IP4 access url1, and so on. Each row represents the number of times each IP accesses a url.

[0097] The determining unit 54 is configured to determine an abnormal node from a plurality of candidate nodes using a target matrix, determine an access path corresponding to the abnormal node as an abnormal access path, and determine an access behavior corresponding to the abnormal access path as an abnormal access behavior.

[0098] Specifically, after obtaining the target matrix, the abnormal node can be determined from multiple candidate nodes through the target matrix, and the access behavior corresponding to the access path corresponding to the abnormal node can be determined as a webshell access.

[0099] For example, URL2 in matrix 1 has only been accessed by IP2, and IP2 has only accessed URL2 a significant number of times. Therefore, we can determine that IP2's access to URL2 is a webshell access. By determining the target matrix and determining webshell access based on the target matrix, we can accurately detect webshell access.

[0100] The apparatus for detecting abnormal access behavior provided by an embodiment of the present application obtains multiple access logs from a network server through an acquisition unit 51, and obtains an access path and at least one path reference source of the access path in each access log, wherein each access log includes at least one of the following: an access path, a path reference source, and a visitor IP address; a first generation unit 52 generates a directed graph of the access path of the network server based on each access path and the path reference source of each access path, wherein the directed graph includes multiple nodes, each node representing an access path; a second generation unit 53 selects candidate nodes from the directed graph according to the number of node connections of each node to obtain multiple candidate nodes, and generates a target matrix based on the node information of each candidate node, wherein the node information includes: the access path corresponding to the node, the visitor IP address of the access path, and the number of accesses of each visitor IP address; a determination unit 54 determines an abnormal node from the multiple candidate nodes using the target matrix, determines the access path corresponding to the abnormal node as an abnormal access path, and determines the access behavior corresponding to the abnormal access path as abnormal access behavior. This solves the problem of low accuracy in detecting access behavior through annotation information in code files in related technologies. By using the access path, that is, the URL, and the path reference source corresponding to the access path, an access path relationship graph of the network server, that is, a directed graph of the access path, is generated. Candidate nodes are selected based on the directed graph, and a target matrix is generated based on the node information of the candidate nodes. Abnormal nodes are determined by calculating the target matrix, and the access behavior corresponding to the abnormal node is determined as abnormal access, thereby achieving the effect of accurately detecting abnormal access.

[0101] Optionally, in the abnormal access behavior detection device provided in the embodiment of the present application, the first generation unit 52 includes: a generation module, used to generate a node for each access path, and a node for each path reference source, to obtain multiple nodes; a connection module, used to connect the multiple nodes according to the reference relationship, to obtain a directed graph of the access path, wherein the reference relationship is a reference relationship between the access path and the path reference source.

[0102] Specifically, since the path reference source in the access log is an access path in another access log, a node corresponding to each access path and each path reference source can be generated, and multiple nodes can be connected according to the reference relationship between the access path and the path reference source, thereby obtaining a directed graph of the access path of the web server.

[0103] For example, the content of access log A is: access path is A, path reference source is B, visitor IP is C; the content of access log B is: access path is C, path reference source is A, visitor IP is C. Then, the directed graph of access path can be generated based on the above content as B→A→C.

[0104] It should be noted that each node may include multiple attributes of the access path corresponding to that node. For example, attribute 1 is the number of times the access path has been accessed, attribute 2 is the number of times the access path has served as the starting access path, and attribute 3 is the number of visitor IP addresses that have accessed the current path. The starting access path is the access path obtained by the visitor through a query, not a redirect, and the number of times the access path has been accessed includes the number of times the access path served as the starting access path.

[0105] Figure 2 is a first directed graph of optional access paths provided according to an embodiment of the present application, such as Figure 2 As shown, in multiple access logs, the content of access log A is: access path is A, path reference source is C, visitor IP is C; the content of access log B is: access path is C, path reference source is A, visitor IP is C. Then, in the directed graph of access paths, there is a phenomenon that access paths A and C point to each other. Similarly, access paths A and D, and access paths C and D also point to each other. Since only access log C has the content: access path is B, path reference source is C, visitor IP is G, then in the directed graph of access paths, there is a phenomenon that only nodes of access path C point to nodes of access path B.

[0106] Optionally, in the abnormal access behavior detection device provided in the embodiment of the present application, the second generation unit 53 includes: a first judgment module, used to judge whether the node is an isolated node, wherein an isolated node represents that the node has no connection relationship in a directed graph; a first determination module, used to determine the node as a candidate node when the node is an isolated node; and / or a second judgment module, used to determine the number of parent nodes of the node and judge whether the number of parent nodes is greater than a first preset number; a second determination module, used to determine the node as a candidate node when the number of parent nodes is greater than the first preset number.

[0107] Specifically, after obtaining the access path directed graph, the connection relationship of each node can be intuitively determined through the directed graph. Therefore, candidate nodes can be determined in the access path directed graph in two ways. One way is to determine whether there is an isolated node, that is, the node has no connection relationship with any node. Figure 3 is a second directed graph of an optional access path provided according to an embodiment of the present application, such as Figure 3 As shown, Figure 3 As shown in Node 1 in , Node 1 has no connection relationship with any node, so Node 1 is determined as a candidate node.

[0108] Furthermore, when a node has too many parent nodes, the node is also determined as a candidate node. Figure 4 is a third directed graph of optional access paths provided according to an embodiment of the present application, such as Figure 4 As shown, Figure 4 There are 8 parent nodes for node 2 in the example. When the first preset number is 5, node 2 has too many parent nodes, and node 2 is determined as a candidate node.

[0109] Optionally, in the abnormal access behavior detection device provided in the embodiment of the present application, the node information also includes a first access count and a second access count, the first access count is the access count of the candidate node's access path being searched and accessed, and the second access count is the access count of the candidate node's access path being jumped and accessed. Before generating a target matrix based on the node information of each candidate node, the device also includes: a first judgment unit for judging whether the number of visitor IPs corresponding to each candidate node is greater than a second preset number; a first deletion unit for deleting the candidate node when the number of visitor IPs corresponding to the candidate node is greater than the second preset number, obtaining multiple updated candidate nodes, and executing the step of generating a target matrix based on the node information of each candidate node through the updated multiple candidate nodes; and / or a calculation unit for dividing the first access count of the candidate node by the second access count to obtain an initial access rate of the candidate node; a second judgment unit for judging whether the initial access rate is less than or equal to the access rate threshold; a second deletion unit for deleting the candidate node when the initial access rate is less than or equal to the access rate threshold, obtaining multiple updated candidate nodes, and executing the step of generating a target matrix based on the node information of each candidate node through the updated multiple candidate nodes.

[0110] It should be noted that, in order to prevent misjudgment of candidate nodes, after obtaining multiple candidate nodes, the candidate nodes need to be screened once to obtain the final candidate nodes.

[0111] Specifically, after obtaining multiple candidate nodes, determine whether the number of visitor IPs in the attributes of each candidate node is greater than a second preset number. If it is greater than the second preset number, it indicates that the access path corresponding to the candidate node has been visited by a large number of IPs, and the access behavior corresponding to the access path must not be a webshell access, so the candidate node can be deleted from multiple candidate nodes.

[0112] Furthermore, the candidate node can also be judged by the initial access rate of the candidate node, wherein the initial access rate is the number of times the access path of the candidate node is searched and accessed, that is, the number of times the access path is a direct access path, and the number of times the access path of the candidate node is jumped and accessed, that is, the number of times the access path is jumped from other access paths. The two access times are divided to obtain the initial access rate, and it is judged whether the initial access rate is less than or equal to the access rate threshold. If it is less than or equal to the access rate threshold, it indicates that the access path is not frequently accessed in a targeted manner. Therefore, the access behavior of the access path corresponding to the candidate node is not a webshell access, and the candidate node can be deleted from multiple candidate nodes.

[0113] Optionally, in the detection device for abnormal access behavior provided in an embodiment of the present application, the second generation unit 53 includes: a construction module, used to construct a table of access paths and visitor IPs with access paths as columns and visitor IPs as rows, and add the number of visits of each visitor IP to each access path to the table to obtain an initial relationship matrix; an acquisition module, used to obtain the transposed matrix of the initial relationship matrix to obtain an initial transposed matrix; a first calculation module, used to multiply the initial transposed matrix and the initial relationship matrix to obtain a metric matrix; and a second calculation module, used to normalize the diagonal elements in the metric matrix to obtain a target matrix.

[0114] Specifically, after obtaining multiple candidate nodes, a target matrix can be constructed according to the node information of the candidate nodes, and the target matrix can be transformed to obtain an updated target matrix, so that abnormal nodes can be better determined through the updated target matrix.

[0115] For example, the target matrix could be:

[0116]

[0117] The first row in the matrix represents the number of times IP1-IP4 access url1, which are 10 times, 0 times, 10 times, 15 times, and so on. Each row represents the number of visits by each IP corresponding to a url.

[0118] Furthermore, the target matrix is transposed to obtain the following transposed matrix:

[0119]

[0120] Multiplying the target matrix and the transposed matrix yields the following metric matrix:

[0121]

[0122] The rows and columns in the metric matrix represent IP information, that is, each number in the matrix represents the similarity between IPs. For example, the position (1,1) in the matrix represents the similarity between IP1 and IP1.

[0123] Normalize the diagonal elements in the metric matrix to obtain the updated target matrix.

[0124]

[0125] Optionally, in the detection device for abnormal access behavior provided in the embodiment of the present application, the determination unit 54 includes: a third determination module, used to determine the number of non-zero elements in the row matrix corresponding to each access path in the target matrix, and obtain multiple element numbers; a third judgment module, used to respectively judge whether each element number is less than a third preset number; a fourth determination module, used to determine the node corresponding to the access path corresponding to the element number as an abnormal node when the element number is less than the third preset number; and / or a fifth determination module, used to determine the proportion of non-zero elements in the row matrix corresponding to each access path in the target matrix to all elements in the row matrix, and obtain multiple element proportions; a fourth judgment module, used to respectively judge whether each element proportion is less than a preset proportion; and a sixth determination module, used to determine the node corresponding to the access path corresponding to the element proportion as an abnormal node when the element proportion is less than the preset proportion.

[0126] Specifically, after obtaining the target matrix, whether each access path is abnormal can be determined by determining the number of non-zero elements in the row matrix corresponding to each access path, or the proportion of non-zero elements in the row matrix corresponding to the access path to all elements in the row matrix.

[0127] When the number of non-zero elements in the row matrix corresponding to the access path is less than a third preset number, the access behavior corresponding to the access path is determined to be a webshell access. For example, if the number of non-zero elements is less than 40, the access behavior corresponding to the access path is a webshell access. Or, if the proportion of non-zero elements in the row matrix corresponding to the access path to all elements in the row matrix is less than a preset proportion, for example, if the proportion of non-zero elements in the row matrix corresponding to the access path to all elements in the row matrix is less than 10%, the access behavior corresponding to the access path is a webshell access. Thus, the abnormal node is determined by calculating the target matrix, and the access behavior corresponding to the abnormal node is determined to be an abnormal access, thereby achieving the effect of accurately detecting abnormal access.

[0128] Optionally, in the abnormal access behavior detection device provided in the embodiment of the present application, before determining the abnormal node from multiple candidate nodes through the target matrix, the device also includes: a third judgment unit, used to determine whether there are visitor IPs of the same jurisdiction among the multiple visitor IPs in the target matrix; an update unit, used to add the column matrices corresponding to the multiple visitor IPs of the same jurisdiction in the target matrix when there are visitor IPs of the same jurisdiction, to obtain an updated target matrix, and perform the step of determining the abnormal node from multiple candidate nodes through the target matrix according to the updated target matrix.

[0129] Specifically, after obtaining the target matrix, the column matrices of the target matrix whose IP addresses belong to the same territory can be added together to obtain an updated target matrix, thereby reducing the amount of data in the matrix and further reducing the amount of matrix calculation.

[0130] For example, the target matrix looks like this:

[0131]

[0132] When the territories of IP2 and IP3 in the target matrix are the same, the column matrices of IP2 and IP3 may be added together to obtain a changed target matrix.

[0133]

[0134] The above-mentioned abnormal access behavior detection device includes a processor and a memory. The above-mentioned acquisition unit 51, first generation unit 52, second generation unit 53, determination unit 54, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize the corresponding functions.

[0135] The processor includes a kernel, which retrieves the corresponding program unit from the memory. One or more kernels can be configured, and kernel parameters can be adjusted to address the low accuracy of access behavior detection based on code file annotations in related technologies.

[0136] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0137] An embodiment of the present invention provides a computer-readable storage medium storing a program, which implements the method for detecting abnormal access behavior when executed by a processor.

[0138] An embodiment of the present invention provides a processor, which is used to run a program, wherein the method for detecting abnormal access behavior is executed when the program is running.

[0139] An embodiment of the present invention provides an electronic device comprising a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, the following steps are implemented: obtaining multiple access logs from a network server, and obtaining an access path and at least one path reference source of the access path in each access log, wherein each access log includes at least one of the following: an access path, a path reference source, and a visitor IP address; generating a directed graph of the access paths of the network server based on the access paths and the path reference sources of each access path, wherein the directed graph includes multiple nodes, each node representing an access path; selecting candidate nodes from the directed graph based on the number of node connections of each node to obtain multiple candidate nodes, and generating a target matrix based on the node information of each candidate node, wherein the node information includes the access path corresponding to the node, the visitor IP address of the access path, and the number of accesses for each visitor IP address; determining abnormal nodes from the multiple candidate nodes using the target matrix, determining the access path corresponding to the abnormal node as an abnormal access path, and determining the access behavior corresponding to the abnormal access path as abnormal access behavior. The device herein may be a server, a PC, a PAD, a mobile phone, etc.

[0140] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program initialized with the following method steps: obtaining multiple access logs in a network server, and obtaining the access path and at least one path reference source of the access path in each access log, wherein each access log includes at least one of the following: an access path, a path reference source, and a visitor IP; generating a directed graph of the access path of the network server based on each access path and the path reference source of each access path, wherein the directed graph includes multiple nodes, each node representing an access path; selecting candidate nodes from the directed graph according to the number of node connections of each node to obtain multiple candidate nodes, and generating a target matrix based on the node information of each candidate node, wherein the node information includes: the access path corresponding to the node, the visitor IP of the access path, and the number of visits for each visitor IP; determining abnormal nodes from multiple candidate nodes through the target matrix, and determining the access path corresponding to the abnormal node as an abnormal access path, and determining the access behavior corresponding to the abnormal access path as an abnormal access behavior.

[0141] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0142] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0143] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1The function specified in one or more boxes.

[0144] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0145] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0146] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0147] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0148] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0149] The above are merely embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

Claims

1. A method for detecting abnormal access behavior, characterized in that: include: Obtaining multiple access logs from a network server, and obtaining an access path and at least one path reference source of each access log, wherein each access log includes at least one of the following: an access path, a path reference source, and a visitor IP address; generating a directed graph of access paths of the network server according to each access path and a path reference source of each access path, wherein the directed graph includes a plurality of nodes, each of which represents one access path; Selecting candidate nodes from the directed graph according to the number of node connections of each node to obtain multiple candidate nodes, and generating a target matrix based on node information of each candidate node, wherein the node information includes: an access path corresponding to the node, an IP address of a visitor of the access path, and a number of visits by each visitor IP address; Determine an abnormal node from multiple candidate nodes using the target matrix, determine an access path corresponding to the abnormal node as an abnormal access path, and determine an access behavior corresponding to the abnormal access path as an abnormal access behavior; Generating a target matrix based on the node information of each candidate node includes: constructing a table of the access paths and the visitor IPs with the access paths as columns and the visitor IPs as rows, and adding the number of visits of each visitor IP to each access path to the table to obtain an initial relationship matrix; obtaining a transposed matrix of the initial relationship matrix to obtain an initial transposed matrix; multiplying the initial transposed matrix and the initial relationship matrix to obtain a metric matrix; and normalizing the diagonal elements in the metric matrix to obtain the target matrix.

2. The method according to claim 1, characterized in that Generating a directed graph of access paths of the network server according to each access path and a path reference source of each access path includes: Generate a node for each access path and a node referenced by each path to obtain a plurality of nodes; The multiple nodes are connected according to a reference relationship to obtain a directed graph of the access path, wherein the reference relationship is a reference relationship between the access path and the path reference source.

3. The method according to claim 1, characterized in that Selecting candidate nodes from the directed graph according to the number of node connections of each node includes: Determining whether the node is an isolated node, wherein the isolated node indicates that the node has no connection relationship in the directed graph; In the case that the node is the isolated node, determining the node as the candidate node; and / or Determining the number of parent nodes of the node, and judging whether the number of parent nodes is greater than a first preset number; When the number of the parent nodes is greater than the first preset number, the node is determined as the candidate node.

4. The method according to claim 1, wherein The node information further includes a first access count and a second access count, wherein the first access count is the number of times the access path of the candidate node is searched and accessed, and the second access count is the number of times the access path of the candidate node is jumped and accessed. Before generating a target matrix based on the node information of each candidate node, the method further includes: Determining whether the number of visitor IP addresses corresponding to each candidate node is greater than a second preset number; If the number of visitor IP addresses corresponding to the candidate node is greater than the second preset number, deleting the candidate node to obtain multiple updated candidate nodes, and performing the step of generating a target matrix according to the node information of each candidate node through the updated multiple candidate nodes; and / or Dividing the first number of visits to the candidate node by the second number of visits to obtain an initial visit rate of the candidate node; Determining whether the initial access rate is less than or equal to an access rate threshold; When the initial access rate is less than or equal to the access rate threshold, the candidate node is deleted to obtain multiple updated candidate nodes, and the step of generating a target matrix according to the node information of each candidate node is performed through the updated multiple candidate nodes.

5. The method according to claim 1, wherein Determining an abnormal node from a plurality of candidate nodes using the target matrix includes: Determining the number of non-zero elements in the row matrix corresponding to each access path in the target matrix to obtain multiple numbers of elements; Determine whether the number of each element is less than a third preset number; When the number of elements is less than the third preset number, determining the node corresponding to the access path corresponding to the number of elements as the abnormal node; and / or Determining, in the target matrix, a ratio of non-zero elements in a row matrix corresponding to each access path to all elements in the row matrix, to obtain a plurality of element ratios; Determine whether the proportion of each element is less than the preset proportion; When the element ratio is less than the preset ratio, the node corresponding to the access path corresponding to the element ratio is determined as the abnormal node.

6. The method according to claim 1, characterized in that Before determining an abnormal node from a plurality of candidate nodes using the target matrix, the method further includes: Determine whether there is a visitor IP from the same location among the multiple visitor IPs in the target matrix; In the case where there are visitor IPs of the same jurisdiction, the column matrices corresponding to multiple visitor IPs of the same jurisdiction are added in the target matrix to obtain an updated target matrix, and the step of determining abnormal nodes from multiple candidate nodes through the target matrix is performed based on the updated target matrix.

7. A device for detecting abnormal access behavior, characterized in that: include: an acquisition unit, configured to acquire a plurality of access logs from a network server, and acquire an access path and at least one path reference source of each access log, wherein each access log includes at least one of the following: an access path, a path reference source, and a visitor IP address; a first generating unit, configured to generate a directed graph of access paths of the network server according to each access path and a path reference source of each access path, wherein the directed graph includes a plurality of nodes, each of which represents one access path; a second generating unit, configured to select candidate nodes from the directed graph according to the number of node connections of each node to obtain a plurality of candidate nodes, and generate a target matrix according to node information of each candidate node, wherein the node information includes: an access path corresponding to the node, an IP address of a visitor of the access path, and a number of visits by each visitor IP address; a determining unit, configured to determine an abnormal node from a plurality of candidate nodes using the target matrix, determine an access path corresponding to the abnormal node as an abnormal access path, and determine an access behavior corresponding to the abnormal access path as an abnormal access behavior; The second generation unit includes: a construction module, which is used to construct a table of access paths and visitor IPs with access paths as columns and visitor IPs as rows, and add the number of visits of each visitor IP to each access path to the table to obtain an initial relationship matrix; an acquisition module, which is used to obtain the transposed matrix of the initial relationship matrix to obtain an initial transposed matrix; a first calculation module, which is used to multiply the initial transposed matrix and the initial relationship matrix to obtain a metric matrix; and a second calculation module, which is used to normalize the diagonal elements in the metric matrix to obtain a target matrix.

8. The device according to claim 7, characterized in that The first generation unit includes: A generation module is used to generate a node for each access path and a node for each path reference source to obtain multiple nodes; a connection module is used to connect the multiple nodes according to a reference relationship to obtain a directed graph of the access path, wherein the reference relationship is a reference relationship between the access path and the path reference source.

9. The device according to claim 7, characterized in that The second generation unit includes: A first judgment module is used to determine whether a node is an isolated node, wherein an isolated node indicates that the node has no connection relationship in a directed graph; a first determination module is used to determine the node as a candidate node when the node is an isolated node; and / or a second judgment module is used to determine the number of parent nodes of the node and determine whether the number of parent nodes is greater than a first preset number; a second determination module is used to determine the node as a candidate node when the number of parent nodes is greater than the first preset number.

10. The device according to claim 7, characterized in that The node information also includes a first access count and a second access count, the first access count being the number of times the candidate node's access path is searched and accessed, and the second access count being the number of times the candidate node's access path is jumped and accessed. Before generating a target matrix based on the node information of each candidate node, the device further includes: The first judgment unit is used to judge whether the number of visitor IPs corresponding to each candidate node is greater than a second preset number; the first deletion unit is used to delete the candidate node when the number of visitor IPs corresponding to the candidate node is greater than the second preset number, to obtain multiple updated candidate nodes, and to execute the step of generating a target matrix according to the node information of each candidate node through the updated multiple candidate nodes; and / or the calculation unit is used to divide the first visit number of the candidate node by the second visit number to obtain the initial visit rate of the candidate node; the second judgment unit is used to judge whether the initial visit rate is less than or equal to the visit rate threshold; the second deletion unit is used to delete the candidate node when the initial visit rate is less than or equal to the visit rate threshold, to obtain multiple updated candidate nodes, and to execute the step of generating a target matrix according to the node information of each candidate node through the updated multiple candidate nodes.

11. The device according to claim 7, characterized in that The identified units include: A third determination module is used to determine the number of non-zero elements in the row matrix corresponding to each access path in the target matrix to obtain multiple element numbers; a third judgment module is used to respectively judge whether the number of each element is less than a third preset number; a fourth determination module is used to determine the node corresponding to the access path corresponding to the number of elements as an abnormal node when the number of elements is less than the third preset number; and / or a fifth determination module is used to determine the proportion of non-zero elements in the row matrix corresponding to each access path in the target matrix to all elements in the row matrix to obtain multiple element proportions; a fourth judgment module is used to respectively judge whether each element proportion is less than a preset proportion; a sixth determination module is used to determine the node corresponding to the access path corresponding to the element proportion as an abnormal node when the element proportion is less than the preset proportion.

12. The device according to claim 7, characterized in that The device also includes: The third judgment unit is used to judge whether there are visitor IPs of the same jurisdiction among the multiple visitor IPs in the target matrix; the updating unit is used to add the column matrices corresponding to the multiple visitor IPs of the same jurisdiction in the target matrix when there are visitor IPs of the same jurisdiction to obtain an updated target matrix, and perform the step of determining abnormal nodes from multiple candidate nodes through the target matrix according to the updated target matrix.

13. A computer storage medium, characterized in that The computer storage medium is used to store a program, wherein when the program is run, the device where the computer storage medium is located is controlled to execute the method for detecting abnormal access behavior according to any one of claims 1 to 6.

14. An electronic device, characterized in that: It includes one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method for detecting abnormal access behavior as described in any one of claims 1 to 6.

Images