Method and device for detecting abnormality in access data

Abstract

The present application discloses a method and device for detecting abnormal access data. The method includes: determining a business parameter tree diagram corresponding to the business access data of the target business; assigning values ​​to multiple dimensional features in the target branch in the business parameter tree diagram to obtain a target business parameter matrix model; extracting multiple feature values ​​of the business access data at the current moment, adapting the multiple feature values ​​to multiple target feature values, and generating an adaptation result; when the adaptation result is inconsistent with the target result, determining that the business access data has abnormal access. The present application solves the technical problem of a high false alarm rate in business access data detection caused by too few feature dimensions to be compared with the detected business access data.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method and device for detecting abnormalities in accessing data. Background Art

[0002] In recent years, data leakage incidents have occurred frequently in various industries, with a trend of intensifying, causing huge economic losses to enterprises, seriously affecting the normal life of the public, and pushing data security to the "hardest hit area". Data security issues have become the hottest topic of society, enterprises, and users.

[0003] The existing privacy risk monitoring method includes: extracting the target domain name information from the Uniform Resource Locator (URL) of the application request link; determining the object information corresponding to the target domain name information based on the target domain name information based on the pre-set domain name knowledge graph containing the correspondence between domain name information and object information; comparing the object information obtained from the signature information of the application that initiated the request link with the object information corresponding to the target domain name information, and monitoring whether there is a privacy leakage risk based on the first comparison result. The existing method only uses domain name information and object information for comparison, which has too few feature dimensions, a high false alarm rate, and lacks other means to prove whether there is a false alarm.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present application provide a method and device for detecting anomalies in access data, so as to at least solve the technical problem of a high false alarm rate in business access data detection caused by too few feature dimensions for comparison with the detected business access data.

[0006] According to one aspect of an embodiment of the present application, a method for detecting anomalies in access data is provided, including: determining a business parameter tree diagram corresponding to business access data of a target business, wherein the business parameter tree diagram includes multiple branches, and the nodes in each branch include various business parameters of the business access data or multiple dimensional features of the business access data; assigning values ​​to multiple dimensional features in a target branch in the business parameter tree diagram to obtain a target business parameter matrix model, wherein the target branch is a branch in which the cache log volume of the business access data is a preset target value, and the target business parameter matrix model includes multiple target feature values ​​corresponding to the multiple dimensional features; extracting multiple feature values ​​of the business access data at the current moment, adapting the multiple feature values ​​to the multiple target feature values, and generating an adaptation result; when the adaptation result is inconsistent with the target result, determining that the business access data has abnormal access.

[0007] Optionally, determining a business parameter tree diagram corresponding to the business access data of the target business includes: determining multiple dimensional features of the business access data based on multiple business parameters in the business access data, wherein the multiple dimensional features include: business identification features, parameter coordinate features, parameter type features, parameter range features, and parameter behavior features; determining a business parameter matrix model based on the multiple dimensional features; and determining a business parameter tree diagram based on the business parameter matrix model.

[0008] Optionally, multiple dimensional features of the business access data are determined based on multiple business parameters in the business access data, including: adapting the business parameters to the business types in the preset business tag library to determine the business identification features of the business access data, wherein the business identification features include: query class, processing class and recharge class; determining the parameter coordinate features of the business access data based on the position of the business parameters in the hypertext transfer protocol, wherein the parameter coordinate features include: uniform resource locator, data stored on the local terminal and commands; determining the parameter type features of the business access data based on the preset type value library, wherein the parameter type features include: integer, floating point and string; determining the parameter range features of the business access data based on the character length of the business parameters, wherein the parameter range features include: telephone number, email address and name; calculating the business parameters according to a preset calculation method to determine the parameter behavior features of the business access data, wherein the preset calculation method includes: statistics, grouping and built-in dictionary, and the parameter behavior features include: the number of Internet Protocol addresses of the business parameters, and the number of times the business parameters are submitted by multiple Internet Protocol addresses.

[0009] Optionally, multiple dimensional features in the target branch of the business parameter tree diagram are assigned to obtain a target business parameter matrix model, including: assigning business identification features in the target branch according to the numerical values ​​of each business in the preset business tag library to determine a first target feature value, wherein the first target feature value is the feature value of the business identification feature; assigning parameter coordinate features in the target branch according to the coordinate parameters of the position of the business parameter in the hypertext transfer protocol to determine a second target feature value, wherein the second target feature value is the feature value of the parameter coordinate feature; assigning parameter type features in the target branch according to the characters of the business parameters to determine Determine a third target characteristic value, wherein the third target characteristic value is the characteristic value of the parameter type characteristic; assign a parameter range characteristic in the target branch according to a density clustering algorithm, and determine a fourth target characteristic value, wherein the fourth target characteristic value is the characteristic value of the parameter range characteristic; assign a parameter behavior characteristic in the target branch according to the amount of business access data and the number of access sources in the target branch, and determine a fifth target characteristic value, wherein the fifth target characteristic value is the characteristic value of the parameter behavior characteristic; determine a target business parameter matrix model according to the first target characteristic value, the second target characteristic value, the third target characteristic value, the fourth target characteristic value and the fifth target characteristic value.

[0010] Optionally, according to the density clustering algorithm, the parameter range characteristics in the target branch are assigned to determine the fourth target characteristic value, including: step S1, converting multiple business parameters of the target branch into multiple numerical values, and determining a numerical value group based on the multiple numerical values, wherein the length of the numerical value is the same as the character length of the business parameter; step S2, labeling the first numerical value in the numerical value group to generate a target numerical value, wherein the first numerical value is a numerical value without a label; step S3, determining the target range according to the target numerical value and a preset target radius, and determining a first number, wherein the first number is the number of numerical values ​​in the numerical value group within the target range; step S4, when the first number is greater than or equal to the preset target number, clustering the numerical values ​​within the target range to generate a first clustering result; step S5, repeating steps S2 to S4 to generate multiple clustering results until the first numerical value no longer exists in the numerical value group; step S6: determining the fourth target characteristic value based on the multiple clustering results.

[0011] Optionally, according to the characters of the business parameters, the parameter type characteristics in the target branch are processed to determine the third target characteristic value, including: traversing all the characters of the business parameters and judging the type of the characters; if the character is an integer, determining the character to be a first value; if the character is a floating point type, determining the character to be a second value; if the character is a character type, determining the character to be a third value; determining the third target characteristic value based on the first value, the second value and the third value.

[0012] Optionally, a business parameter tree diagram is determined according to a business parameter matrix model, including: determining the business identification features of the business parameter matrix model as the first-level nodes of the business parameter tree diagram; determining the business parameters corresponding to the business identification features as the second-level nodes of the business parameter tree diagram; determining the parameter coordinate features, parameter type features, parameter range features and parameter behavior features of the business parameter matrix model as the third-level nodes of the business parameter tree diagram, wherein the first-level node is connected to multiple second-level nodes, and the second-level node is connected to multiple third-level nodes.

[0013] Optionally, abnormal access includes at least one of the following: unauthorized access, brute force cracking, illegal charging, and cross-site attack.

[0014] According to another aspect of the embodiments of the present application, a non-volatile storage medium is provided, the storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the above method for detecting abnormalities in accessing data.

[0015] According to yet another aspect of the embodiments of the present application, a processor is provided, which is used to run a program stored in a memory, wherein the above method for detecting abnormalities in accessing data is executed when the program is running.

[0016] In an embodiment of the present application, a business parameter tree diagram corresponding to the business access data of the target business is determined, wherein the business parameter tree diagram includes multiple branches, and the nodes in each branch include various business parameters of the business access data or multiple dimensional features of the business access data; multiple dimensional features in the target branch in the business parameter tree diagram are assigned to obtain a target business parameter matrix model, wherein the target branch is a branch in which the cache log volume of the business access data is a preset target value, and the target business parameter matrix model includes multiple target feature values ​​corresponding to the multiple dimensional features; multiple feature values ​​of the business access data at the current moment are extracted, and the multiple feature values ​​are adapted to the multiple target feature values ​​to generate an adaptation result; when the adaptation result is inconsistent with the target result, it is determined that there is an abnormal access mode in the business access data, and by determining a business parameter tree diagram with multiple feature dimensions and a business parameter matrix model with multiple feature dimensions, the purpose of adapting multiple feature dimensions to the detected business access data is achieved, thereby achieving the technical effect of improving the accuracy of detecting business access data, and further solving the technical problem of a high false alarm rate in business access data detection caused by too few feature dimensions for comparison with the detected business access data. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 is a flow chart of a method for detecting abnormality in accessing data according to an embodiment of the present application;

[0019] Figure 2 is a flow chart of another method for detecting abnormality in accessing data according to an embodiment of the present application;

[0020] Figure 3 is a schematic diagram of a service parameter tree diagram according to an embodiment of the present application;

[0021] Figure 4 is a structural diagram of an access data anomaly detection device according to an embodiment of the present application;

[0022] Figure 5 It is a hardware structure block diagram of a computer terminal (or electronic device) according to a method for detecting abnormalities in accessing data provided in an embodiment of the present application. DETAILED DESCRIPTION

[0023] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0024] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0025] According to an embodiment of the present application, a method embodiment of a method for detecting anomalies in access data is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0026] Figure 1is a flow chart of a method for detecting abnormality in accessing data according to an embodiment of the present application. Figure 1 As shown, the method comprises the following steps:

[0027] Step S102, determining a business parameter tree diagram corresponding to the business access data of the target business, wherein the business parameter tree diagram includes multiple branches, and a node in each branch includes each business parameter of the business access data or multiple dimensional features of the business access data.

[0028] According to an optional embodiment of the present application, the service access data includes multiple service parameters. For example, the service access data formed by the user after completing the phone recharge service includes but is not limited to the following service parameters: recharge amount, recharge phone number, international mobile equipment identity code of the recharge phone number, international mobile subscriber identity code of the recharge phone number, and Internet Protocol address of the recharge terminal device. Based on multiple service parameters, the present application extracts five feature dimensions for characterizing the above service access data, wherein the five feature dimensions are service identification feature dimension, parameter coordinate feature dimension, parameter type feature dimension, parameter range feature dimension, and parameter behavior feature dimension. Each branch of the service parameter tree diagram includes multiple service parameters of the service access data and any multiple of the above five feature dimensions.

[0029] Figure 3 is a schematic diagram of a service parameter tree diagram according to an embodiment of the present application, Figure 3 In the business access data, there are n business parameters in total, and the business parameter tree diagram has n branches in total. For example, the branch corresponding to business parameter 1 is the first branch, and the first branch includes the identification dimension of recharge request parameter 1 and business parameters (business identification feature), the coordinate dimension of business parameters (parameter coordinate feature), the type dimension of business parameters (parameter type feature), the range dimension of business parameters (parameter range feature), and the behavior dimension of business parameters (parameter behavior feature). In each branch of the business parameter tree diagram, when the data corresponding to the current node is a business parameter, the next-level node of the current node corresponds to the multi-dimensional feature of the business parameter, wherein the next-level node includes multiple nodes, and each node corresponds to a dimensional feature.

[0030] Step S104, assign values ​​to multiple dimensional features in the target branch in the business parameter tree diagram to obtain a target business parameter matrix model, wherein the target branch is a branch in which the cache log volume of business access data is a preset target value, and the target business parameter matrix model includes multiple target feature values ​​corresponding to the multiple dimensional features.

[0031] According to another optional embodiment of the present application, when the amount of business access data of a branch in the business parameter tree diagram reaches a specific threshold, multiple features of the branch are reassigned to obtain the characteristic value of the business identification feature, the characteristic value of the parameter coordinate feature, the characteristic value of the parameter type feature, the characteristic value of the parameter range feature, and the characteristic value of the parameter behavior feature. According to the above multiple characteristic values, a parameter matrix can be determined, that is, a target business parameter matrix model, and the matrix model is as follows:

[0032]

[0033]

[0034] Step S106, extracting multiple feature values ​​of the service access data at the current moment, adapting the multiple feature values ​​to multiple target feature values, and generating an adaptation result.

[0035] In some optional embodiments of the present application, the service access data at the current moment, that is, multiple feature values ​​of the latest service access data, are adapted to each feature value of the service access data at the current moment and each target feature value in the target service parameter matrix model to generate an adaptation result, which is as follows:

[0036]

[0037] In an optional embodiment, extracting multiple feature values ​​of the service access data at the current moment includes the following steps:

[0038] 1. Parse the business access log from the business access data and identify the business name and business type based on the business access log.

[0039] 2. Extract the business access parameters in the business access data, including: access command, parameter name (Key), parameter value (Value), parameter coordinates (command parameters, data parameters stored on the local terminal, uniform resource locator parameters, request body parameters).

[0040] 3. Identify parameter types, such as integer, character, etc.; identify parameter length; identify parameter characteristics.

[0041] 4. Business parameter behavior analysis, such as counting the number of source network protocol addresses with the same business parameter, counting the number of different business parameters submitted by the same source network protocol address within a short period of time, etc.

[0042] In another optional embodiment, the specific process of adapting multiple feature values ​​to multiple target feature values ​​and generating the adaptation result is as follows:

[0043] 1. Perform adaptation on dimensions such as access command, business parameter name, business parameter value, business parameter coordinate, business parameter length, and business parameter type to discover abnormal access behaviors that exceed the baseline range.

[0044] 2. Perform business parameter behavior adaptation, such as: the same business parameter is submitted by multiple source network protocol addresses (unauthorized access), the same source network protocol address submits different business parameters (brute force cracking, illegal recharge), and discover abnormal access behavior.

[0045] 3. Perform parameter feature phrase adaptation, such as SQL injection, cross-site attack, etc., to detect abnormal access behavior.

[0046] Step S108: When the adaptation result is inconsistent with the target result, it is determined that abnormal access exists in the service access data.

[0047] As an optional embodiment of the present application, when the adaptation result is inconsistent with the target result, an alarm reminder message is generated, and whether the adaptation result is accurate is determined through manual audit. When the adaptation result is accurate, the above-mentioned target business parameter matrix model is used to continue to adapt to the characteristic value of the business access data of the next adjacent moment of the current moment.

[0048] According to the above steps, by determining the business parameter tree diagram of multiple feature dimensions and the business parameter matrix model of multiple feature dimensions, the purpose of adapting multiple feature dimensions to the business access data being detected is achieved, thereby achieving the technical effect of improving the accuracy of detecting business access data, and further solving the technical problem of high false alarm rate in business access data detection caused by too few feature dimensions for comparison with the business access data being detected.

[0049] According to an optional embodiment of the present application, determining a business parameter tree diagram corresponding to business access data of a target business includes the following steps: determining multiple dimensional features of the business access data based on multiple business parameters in the business access data, wherein the multiple dimensional features include: business identification features, parameter coordinate features, parameter type features, parameter range features, and parameter behavior features; determining a business parameter matrix model based on the multiple dimensional features; and determining a business parameter tree diagram based on the business parameter matrix model.

[0050] According to another optional embodiment of the present application, a business parameter matrix model is determined according to the business identification feature, the parameter coordinate feature, the parameter type feature, the parameter range feature and the parameter behavior feature. The business parameter matrix model is as follows:

[0051]

[0052]

[0053] The business identification feature (business identification dimension indicator) is determined as the first-level node of the business parameter tree diagram, the business parameter corresponding to the business identification feature is determined as the second-level node of the business parameter tree diagram, and the parameter coordinate feature (parameter coordinate dimension indicator), parameter type feature (parameter type dimension indicator), parameter range feature (parameter range dimension indicator) and parameter behavior feature (parameter behavior dimension indicator) of the business parameter matrix model are determined as the third-level node of the business parameter tree diagram, wherein the first-level node is connected to multiple second-level nodes, and the second-level node is connected to multiple third-level nodes. Figure 3 is a schematic diagram of a service parameter tree diagram according to an embodiment of the present application. The service parameter tree diagram determined according to the service parameter matrix model is as follows Figure 3 shown.

[0054] In some optional embodiments of the present application, determining multiple dimensional features of business access data based on multiple business parameters in the business access data can be achieved by the following method: adapting the business parameters to the business types in the preset business tag library to determine the business identification features of the business access data, wherein the business identification features include: query class, processing class and recharge class; determining the parameter coordinate features of the business access data based on the position of the business parameters in the hypertext transfer protocol, wherein the parameter coordinate features include: uniform resource locator, data stored on the local terminal and commands; determining the parameter type features of the business access data based on the preset type value library, wherein the parameter type features include: integer, floating point and string; determining the parameter range features of the business access data based on the character length of the business parameters, wherein the parameter range features include: telephone number, email address and name; calculating the business parameters according to the preset calculation method to determine the parameter behavior features of the business access data, wherein the preset calculation method includes: statistics, grouping and built-in dictionary, and the parameter behavior features include: the number of Internet Protocol addresses of the business parameters, and the number of times the business parameters are submitted by multiple Internet Protocol addresses.

[0055] In some optional embodiments of the present application, multiple dimensional features in the target branch in the business parameter tree diagram are assigned to obtain a target business parameter matrix model, which is achieved by the following method: according to the numerical value of each business in the preset business tag library, the business identification feature in the target branch is assigned to determine a first target feature value, wherein the first target feature value is the feature value of the business identification feature; according to the coordinate parameters of the position of the business parameter in the hypertext transfer protocol, the parameter coordinate feature in the target branch is assigned to determine a second target feature value, wherein the second target feature value is the feature value of the parameter coordinate feature; according to the characters of the business parameter, the parameter type in the target branch is assigned to determine a second target feature value, wherein the second target feature value is the feature value of the parameter coordinate feature. The characteristics are assigned to determine the third target characteristic value, wherein the third target characteristic value is the characteristic value of the parameter type characteristic; according to the density clustering algorithm, the parameter range characteristics in the target branch are assigned to determine the fourth target characteristic value, wherein the fourth target characteristic value is the characteristic value of the parameter range characteristic; according to the amount of business access data and the number of access sources in the target branch, the parameter behavior characteristics in the target branch are assigned to determine the fifth target characteristic value, wherein the fifth target characteristic value is the characteristic value of the parameter behavior characteristic; according to the first target characteristic value, the second target characteristic value, the third target characteristic value, the fourth target characteristic value and the fifth target characteristic value, the target business parameter matrix model is determined.

[0056] In an optional embodiment, according to a density clustering algorithm, a parameter range feature in a target branch is assigned a value to determine a fourth target feature value, including the following steps: step S1, converting multiple business parameters of the target branch into multiple numerical values, and determining a numerical value group based on the multiple numerical values, wherein the length of the numerical value is the same as the character length of the business parameter; step S2, labeling the first numerical value in the numerical value group to generate a target numerical value, wherein the first numerical value is a numerical value without a label; step S3, determining a target range based on the target numerical value and a preset target radius, and determining a first number, wherein the first number is the number of numerical values ​​in the numerical value group within the target range; step S4, when the first number is greater than or equal to the preset target number, clustering the numerical values ​​within the target range to generate a first clustering result; step S5, repeating steps S2 to S4 to generate multiple clustering results until the first numerical value no longer exists in the numerical value group; step S6: determining the fourth target feature value based on the multiple clustering results.

[0057] According to an optional embodiment of the present application, DBSCAN density-based clustering learning algorithm is used for analysis, and the specific execution steps are as follows:

[0058] Step 1. Parameter digitization. Get the business parameters in the target branch, digitize the business parameters according to the character length of the business parameter value, and store the digitized results of all business parameters in the array arr i middle.

[0059] Step 2. Input. Input array parameter arr i , eps (neighborhood radius), minPts (density), initialize the output object outset (range classification result).

[0060] Step 3. Core points. Randomly select a core point from the array arr i Select an unlabeled parameter object from the , which is represented by cp i , cp i Set as a suspected core node and i Lieutenant General cp i Marking.

[0061] Step 4. Traverse. Use the general Manhattan distance formula to get the distance from arr i Find the satisfying cp one by one i The smallest eps object coordinate point. After the traversal is completed, the current cp is counted i and the number of parameter objects within the range of eps. If the total number of parameter objects reaches minPts, all parameter objects in the current range are classified and stored in g i .

[0062] Step 5. Iterate. If arr i If all objects in the process have been marked, go to step 6, otherwise continue to step 3.

[0063] Step 6. Collect. Loop arr i Get all the parameter objects in the , get all the classified parameter objects, take values ​​according to the lower limit and upper limit values ​​in the parameter objects, and store them in the output object outset. The output result is expressed as:

[0064] outset=[g i ,……,g n ]

[0065] In the above output, g i is a certain classification, and n is the number of categories. If outset is empty, the algorithm ends, otherwise it goes to step 7;

[0066] Step 7: Output: Return the output result outset, and determine the output result outset as the fourth target feature value.

[0067] According to another optional embodiment of the present application, the parameter type characteristics in the target branch are processed according to the characters of the business parameters to determine the third target characteristic value, which can be achieved by the following method: traverse all characters of the business parameters and judge the type of the characters; if the character is an integer, determine the character to be a first value; if the character is a floating point type, determine the character to be a second value; if the character is a character type, determine the character to be a third value; determine the third target characteristic value based on the first value, the second value and the third value.

[0068] In some optional embodiments of the present application, the determination is performed by traversing all characters of the parameter value, and the specific steps are as follows:

[0069] 1. Input. Initialize the string input parameter pvalue and the output parameter outtype.

[0070] 2. Suspected integer. Traverse each character in the string parameter pvalue. If pvalue[i]>='0'||pvalue[i]<='9', assign outtype=1 and proceed to step 2. If pvalue[i]='.', proceed to step 3. Otherwise, proceed to step 4. After the traversal, proceed to step 5.

[0071] 3. Suspected floating point type. Assign outtype=2, continue to traverse the next character, if pvalue[i]>='0'||pvalue[i]<='9', continue to step 3, otherwise go to step 4, and then go to step 5 after the traversal.

[0072] 4. Suspected character type. Assign outtype=3 and go to step 5.

[0073] 5. Determine the type dimension indicator. Return the outtype parameter (1 integer, 2 floating point, 3 character).

[0074] As an optional embodiment of the present application, a business parameter tree diagram is determined according to a business parameter matrix model, which is achieved by the following method: determining the business identification features of the business parameter matrix model as the first-level nodes of the business parameter tree diagram; determining the business parameters corresponding to the business identification features as the second-level nodes of the business parameter tree diagram; determining the parameter coordinate features, parameter type features, parameter range features and parameter behavior features of the business parameter matrix model as the third-level nodes of the business parameter tree diagram, wherein the first-level node is connected to multiple second-level nodes, and the second-level node is connected to multiple third-level nodes.

[0075] In some optional embodiments of the present application, the business identification feature (business identification dimension indicator) is determined as the first-level node of the business parameter tree diagram, the business parameter corresponding to the business identification feature is determined as the second-level node of the business parameter tree diagram, and the parameter coordinate feature (parameter coordinate dimension indicator), parameter type feature (parameter type dimension indicator), parameter range feature (parameter range dimension indicator) and parameter behavior feature (parameter behavior dimension indicator) of the business parameter matrix model are determined as the third-level node of the business parameter tree diagram, wherein the first-level node is connected to multiple second-level nodes, the second-level node is connected to multiple third-level nodes, and the business parameter tree diagram is as follows: Figure 3 As shown, in Figure 3 In the business parameter tree, there are n business parameters, and the business parameter tree has n branches. Based on the parameter coordinate features, parameter type features, parameter range features, and parameter behavior features, it is possible to discover risks of abnormal handling of important businesses; based on the parameter range features and parameter type features, it is possible to discover risks of cross-site attacks and SQL injections; based on the parameter type features and parameter behavior features, it is possible to discover risks such as the theft of data stored on the local terminal.

[0076] As another optional embodiment of the present application, abnormal access includes at least one of the following: unauthorized access, brute force cracking, illegal charging, and cross-site attack.

[0077] Figure 2 is a flow chart of another method for detecting abnormality in accessing data according to an embodiment of the present application. Figure 2 As shown, the method includes:

[0078] Step S202, obtaining the original log, and determining whether the original log is a log based on the Hypertext Transfer Protocol (HTTP). If the original log is a log based on the Hypertext Transfer Protocol, proceeding to step S204.

[0079] Step S204, matching each service parameter in the service access data based on the hypertext transfer protocol log with all services in the service tag library, and determining whether the service access data is access data of a known service. If the service access data is access data of a known service, proceed to step S208; if the service access data is not access data of a known service, proceed to step S206.

[0080] Step S206: marking and clustering the services not in the service label library, generating clustering results, and inputting the clustering results into the service label library to expand the scope of services included in the service label library.

[0081] Step S208 , learning multiple business parameters, that is, assigning values ​​to feature dimensions corresponding to the multiple business parameters to obtain multiple feature values.

[0082] Step S210, determining a business parameter baseline model (target business parameter matrix model) according to the eigenvalues ​​obtained in step S208.

[0083] Step S212, adapt the characteristic values ​​of the latest business access data obtained with the characteristic values ​​of the above-mentioned target business parameter matrix model to generate an adaptation result, thereby realizing the function of detecting the business parameters in the business access data, wherein the abnormal behaviors existing in the business access data include but are not limited to: unauthorized access, brute force cracking, illegal charging of phone bills, and cross-site attacks.

[0084] Figure 4 is a structural diagram of an abnormality detection device for accessing data according to an embodiment of the present application, such as Figure 4 As shown, the device comprises:

[0085] A first determination module 40 is used to determine a business parameter tree diagram corresponding to the business access data of the target business, wherein the business parameter tree diagram includes multiple branches, and the nodes in each branch include each business parameter of the business access data or multiple dimensional features of the business access data;

[0086] An assignment module 42 is used to assign values ​​to multiple dimensional features in a target branch in the business parameter tree diagram to obtain a target business parameter matrix model, wherein the target branch is a branch in which the cache log volume of business access data is a preset target value, and the target business parameter matrix model includes multiple target feature values ​​corresponding to the multiple dimensional features;

[0087] An adaptation module 44 is used to extract multiple feature values ​​of the service access data at the current moment, adapt the multiple feature values ​​to multiple target feature values, and generate an adaptation result;

[0088] The second determining module 46 is configured to determine that abnormal access exists in the service access data when the adaptation result is inconsistent with the target result.

[0089] It should be noted that the above Figure 4 The modules in the embodiment may be program modules (e.g., a set of program instructions for implementing a specific function) or hardware modules. For the latter, they may be expressed in the following forms, but are not limited thereto: the expression form of the above modules is a processor, or the functions of the above modules are implemented by a processor.

[0090] Figure 5 FIG. 1 shows a hardware structure block diagram of a computer terminal (or mobile device) for implementing an abnormality detection method for accessing data. Figure 5As shown, the computer terminal 50 (or mobile device 50) may include one or more (502a, 502b, ..., 502n are used to illustrate) processors 502 (the processor 502 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 504 for storing data, and a transmission module 506 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 5 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 5 More or fewer components as shown, or with Figure 5 Different configurations are shown.

[0091] It should be noted that the one or more processors 502 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 50 (or mobile device). As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0092] The memory 504 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the abnormal detection method for accessing data in the embodiment of the present application. The processor 502 executes various functional applications and data processing by running the software programs and modules stored in the memory 504, that is, realizing the abnormal detection method for accessing data mentioned above. The memory 504 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 504 may further include a memory remotely arranged relative to the processor 502, and these remote memories may be connected to the computer terminal 50 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0093] The transmission module 506 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 50. In one example, the transmission module 506 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission module 506 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0094] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 50 (or mobile device).

[0095] It should be noted that, in some optional embodiments, the above Figure 5 The computer device (or electronic device) shown may include hardware elements (including circuits), software elements (including computer code stored on a computer-readable medium), or a combination of hardware elements and software elements. It should be noted that Figure 5 This is merely one example of a particular embodiment and is intended to illustrate the types of components that may be present in the above-described computer device (or electronic device).

[0096] It should be noted that Figure 5 The electronic device shown is used to perform Figure 1 The method for detecting abnormalities in accessing data shown in the figure, therefore the relevant explanations and instructions in the execution method of the above-mentioned command are also applicable to the electronic device and will not be repeated here.

[0097] An embodiment of the present application further provides a non-volatile storage medium, which includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the above-mentioned method for detecting abnormalities in accessing data.

[0098] A program for a non-volatile storage medium to perform the following functions: determining a business parameter tree diagram corresponding to business access data of a target business, wherein the business parameter tree diagram includes multiple branches, and nodes in each branch include various business parameters of the business access data or multiple dimensional features of the business access data; assigning values ​​to multiple dimensional features in a target branch in the business parameter tree diagram to obtain a target business parameter matrix model, wherein the target branch is a branch in which the cache log volume of the business access data is a preset target value, and the target business parameter matrix model includes multiple target feature values ​​corresponding to the multiple dimensional features; extracting multiple feature values ​​of the business access data at the current moment, adapting the multiple feature values ​​to the multiple target feature values, and generating an adaptation result; when the adaptation result is inconsistent with the target result, determining that abnormal access exists in the business access data.

[0099] An embodiment of the present application further provides an electronic device, including: a memory and a processor, wherein the processor is used to run a program stored in the memory, wherein the above method for detecting abnormalities in accessing data is executed when the program is running.

[0100] The processor is used to run a program that performs the following functions: determining a business parameter tree diagram corresponding to business access data of a target business, wherein the business parameter tree diagram includes multiple branches, and the nodes in each branch include various business parameters of the business access data or multiple dimensional features of the business access data; assigning values ​​to multiple dimensional features in a target branch in the business parameter tree diagram to obtain a target business parameter matrix model, wherein the target branch is a branch in which the cache log volume of the business access data is a preset target value, and the target business parameter matrix model includes multiple target feature values ​​corresponding to the multiple dimensional features; extracting multiple feature values ​​of the business access data at the current moment, adapting the multiple feature values ​​to the multiple target feature values, and generating an adaptation result; when the adaptation result is inconsistent with the target result, determining that abnormal access exists in the business access data.

[0101] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0102] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0103] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0104] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0105] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0106] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the relevant technology or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc. Various media that can store program codes.

[0107] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for detecting abnormality in access data, characterized in that: include: Determine a business parameter tree diagram corresponding to the business access data of the target business, wherein the business parameter tree diagram includes multiple branches, the number of the branches is the same as the number of business parameters included in the business access data, and the nodes in each branch include each business parameter of the business access data or multiple dimensional features of the business access data. In the case where the data corresponding to the current node is the business parameter, the data corresponding to the next-level node of the current node is the multi-dimensional feature of the business parameter, and each of the next-level nodes corresponds to one dimensional feature; Assigning values ​​to the multiple dimensional features in the target branch of the business parameter tree diagram to obtain a target business parameter matrix model, wherein the target branch is a branch in which the cache log volume of the business access data is a preset target value, and the target business parameter matrix model includes multiple target feature values ​​corresponding to the multiple dimensional features, and the multiple dimensional features include: business identification features, parameter coordinate features, parameter type features, parameter range features, and parameter behavior features; Extracting multiple feature values ​​of the service access data at the current moment, adapting the multiple feature values ​​to the multiple target feature values, and generating an adaptation result; When the adaptation result is inconsistent with the target result, it is determined that abnormal access exists in the business access data, wherein, based on the parameter coordinate characteristics, the parameter type characteristics, the parameter range characteristics and the parameter behavior characteristics, the risk of abnormal handling of important businesses is discovered; based on the parameter range characteristics and the parameter type characteristics, the risks of cross-site attacks and SQL injections are discovered; based on the parameter type characteristics and the parameter behavior characteristics, the risk of data theft stored on the local terminal is discovered.

2. The method according to claim 1, characterized in that Determine the business parameter tree diagram corresponding to the business access data of the target business, including: Determine a business parameter matrix model according to the multiple dimensional features; The service parameter tree diagram is determined according to the service parameter matrix model.

3. The method according to claim 2, characterized in that Determining the multiple dimensional features of the business access data according to the multiple business parameters in the business access data includes: Adapting the service parameters to the service types in the preset service tag library to determine the service identification features of the service access data, wherein the service identification features include: inquiry type, handling type and recharge type; Determining the parameter coordinate features of the service access data according to the location of the service parameter in the hypertext transfer protocol, wherein the parameter coordinate features include: a uniform resource locator, data and commands stored on a local terminal; Determine the parameter type characteristics of the service access data according to a preset type value library, wherein the parameter type characteristics include: integer, floating point and string; Determining the parameter range characteristics of the service access data according to the character length of the service parameter, wherein the parameter range characteristics include: telephone number, email address and name; The business parameters are calculated according to a preset calculation method to determine the parameter behavior characteristics of the business access data, wherein the preset calculation method includes: statistics, grouping and built-in dictionary, and the parameter behavior characteristics include: the number of Internet Protocol addresses of the business parameters, and the number of times the business parameters are submitted by multiple Internet Protocol addresses.

4. The method according to claim 3, characterized in that Assigning values ​​to the multiple dimensional features in the target branch in the business parameter tree diagram to obtain a target business parameter matrix model includes: Assigning a value to the service identification feature in the target branch according to the value of each service in the preset service label library to determine a first target feature value, wherein the first target feature value is a feature value of the service identification feature; Assigning a value to the parameter coordinate feature in the target branch according to the coordinate parameter of the position of the business parameter in the hypertext transfer protocol to determine a second target feature value, wherein the second target feature value is a feature value of the parameter coordinate feature; Assigning a value to the parameter type feature in the target branch according to the character of the business parameter to determine a third target feature value, wherein the third target feature value is a feature value of the parameter type feature; Assigning a value to the parameter range feature in the target branch according to a density clustering algorithm to determine a fourth target feature value, wherein the fourth target feature value is a feature value of the parameter range feature; Assigning a value to the parameter behavior feature in the target branch according to the amount of business access data and the number of access sources in the target branch to determine a fifth target feature value, wherein the fifth target feature value is a feature value of the parameter behavior feature; The target business parameter matrix model is determined according to the first target eigenvalue, the second target eigenvalue, the third target eigenvalue, the fourth target eigenvalue and the fifth target eigenvalue.

5. The method according to claim 4, characterized in that Assigning a value to the parameter range feature in the target branch according to a density clustering algorithm to determine a fourth target feature value includes: Step S1, converting the plurality of service parameters of the target branch into a plurality of numerical values, and determining a numerical value group according to the plurality of numerical values, wherein the length of the numerical value is the same as the character length of the service parameter; Step S2, labeling the first value in the value group to generate a target value, wherein the first value is a value without a label; Step S3, determining a target range according to the target value and a preset target radius, and determining a first quantity, wherein the first quantity is the quantity of the values ​​in the value group within the target range; Step S4, when the first number is greater than or equal to a preset target number, clustering the values ​​within the target range to generate a first clustering result; Step S5, repeatedly executing steps S2 to S4 to generate multiple clustering results until the first value does not exist in the value group; Step S6: Determine the fourth target feature value according to the multiple clustering results.

6. The method according to claim 4, characterized in that Processing the parameter type feature in the target branch according to the characters of the business parameter to determine a third target feature value includes: Traversing all characters of the service parameter and determining the type of the characters; If the character is an integer, determining that the character is a first value; If the character is a floating point type, determining that the character is a second numerical value; If the character is of character type, determining that the character is a third value; The third target characteristic value is determined according to the first value, the second value and the third value.

7. The method according to claim 2, characterized in that Determining the service parameter tree diagram according to the service parameter matrix model includes: Determine the service identification feature of the service parameter matrix model as a primary node of the service parameter tree diagram; Determine the service parameter corresponding to the service identification feature as a secondary node of the service parameter tree diagram; The parameter coordinate features, the parameter type features, the parameter range features and the parameter behavior features of the business parameter matrix model are determined as third-level nodes of the business parameter tree diagram, wherein the first-level node is connected to multiple second-level nodes, and the second-level node is connected to multiple third-level nodes.

8. The method according to claim 1, characterized in that The abnormal access includes at least one of the following: unauthorized access, brute force cracking, illegal charging, and cross-site attack.

9. A device for detecting abnormality in accessing data, characterized in that: include: A first determination module is used to determine a business parameter tree diagram corresponding to the business access data of the target business, wherein the business parameter tree diagram includes multiple branches, the number of the branches is the same as the number of business parameters included in the business access data, and the nodes in each branch include each business parameter of the business access data or multiple dimensional features of the business access data. In the case where the data corresponding to the current node is the business parameter, the data corresponding to the next-level node of the current node is the multi-dimensional feature of the business parameter, and each of the next-level nodes corresponds to one dimensional feature; An assignment module is used to assign values ​​to the multiple dimensional features in the target branch of the business parameter tree diagram to obtain a target business parameter matrix model, wherein the target branch is a branch in which the cache log volume of the business access data is a preset target value, and the target business parameter matrix model includes multiple target feature values ​​corresponding to the multiple dimensional features, and the multiple dimensional features include: business identification feature, parameter coordinate feature, parameter type feature, parameter range feature and parameter behavior feature; An adaptation module, used for extracting multiple characteristic values ​​of the service access data at the current moment, adapting the multiple characteristic values ​​to the multiple target characteristic values, and generating an adaptation result; The second determination module is used to determine that there is abnormal access to the business access data when the adaptation result is inconsistent with the target result, wherein, based on the parameter coordinate characteristics, the parameter type characteristics, the parameter range characteristics and the parameter behavior characteristics, the risks of abnormal handling of important businesses are discovered; based on the parameter range characteristics and the parameter type characteristics, the risks of cross-site attacks and SQL injections are discovered; based on the parameter type characteristics and the parameter behavior characteristics, the risks of data theft stored on the local terminal are discovered.

10. A non-volatile storage medium, characterized in that: The non-volatile storage medium includes a stored program, wherein when the program is executed, the device where the non-volatile storage medium is located is controlled to execute the method for detecting abnormality in accessing data according to any one of claims 1 to 8.

11. An electronic device, characterized in that: include: A memory and a processor, wherein the processor is used to run a program stored in the memory, wherein the method for detecting abnormalities in access data according to any one of claims 1 to 8 is executed when the program is run.

Images