An abnormal object detection method and device, electronic equipment and storage medium

Abstract

The application relates to the technical field of information security, in particular to an abnormal object detection method and device, electronic equipment and a storage medium. After obtaining each target attribute feature corresponding to a to-be-detected object, the following operations are respectively performed on each target attribute feature: when it is determined that one target attribute feature is not contained in a preset feature library, an abnormal score corresponding to the feature type of the target attribute feature is obtained; and based on the determined abnormal scores, an abnormal detection result of the to-be-detected object is determined. In this way, when the to-be-detected object is subjected to abnormal detection, the target attribute features corresponding to the to-be-detected object in different dimensions are subjected to abnormal detection, so that the problem of missed detection caused by the fact that the IP address of the to-be-detected object is not contained in a preset IP black list is avoided, and the accuracy of abnormal object detection is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and particularly relates to an abnormal object detection method and device, electronic equipment and a storage medium. BACKGROUND

[0002] At present, with the development of information technology, more and more web crawlers capable of automatically extracting web page content have appeared.

[0003] Since the web crawler will capture a large amount of site information during operation, the site information will be leaked, and therefore, in order to improve the security of the site information, abnormal detection needs to be performed on the to-be-detected object accessing the site.

[0004] In the related art, when performing abnormal detection on the to-be-detected object, an IP blacklist is usually set in advance, and abnormal detection is performed according to the IP address corresponding to the to-be-detected object and the IP blacklist.

[0005] However, since the pre-set IP blacklist cannot contain the IP addresses corresponding to all abnormal objects, the problem of missed detection will occur, for example, when the abnormal object is detected for the first time, since the IP address of the abnormal object is not contained in the pre-set IP blacklist, the abnormal object cannot be detected.

[0006] Therefore, the accuracy of the abnormal object detection in the related art is not high. SUMMARY

[0007] The embodiments of the present application provide an abnormal object detection method, device, electronic equipment and storage medium to improve the accuracy of abnormal object detection.

[0008] The specific technical solutions provided by the embodiments of the present application are as follows:

[0009] An abnormal object detection method comprises:

[0010] Obtaining each target attribute feature corresponding to a to-be-detected object;

[0011] For each target attribute feature, the following operation is performed: when it is determined that one target attribute feature is not contained in a pre-set feature library, an abnormal score corresponding to a feature type of the one target attribute feature is obtained, wherein each abnormal score is determined based on the importance of the corresponding feature type, and the feature library at least contains each normal attribute feature, and each normal attribute feature represents an attribute feature corresponding to a normal object.

[0012] Based on the determined abnormal scores, an abnormal detection result of the to-be-detected object is determined.

[0013] Optionally, before the acquiring the respective target attribute features corresponding to the to-be-detected object, the method further includes:

[0014] For each feature type, the following operations are performed respectively: determining an importance degree parameter between one feature type and the respective feature types, wherein each importance degree parameter represents a comparison result of the importance degree between the corresponding feature type and one of the respective feature types;

[0015] Based on the obtained respective importance degree parameters, determining a feature weight corresponding to the corresponding feature type;

[0016] Based on the respective feature weights, determining an anomaly score corresponding to the corresponding feature type.

[0017] Optionally, the determining, based on the obtained respective importance degree parameters, a feature weight corresponding to the corresponding feature type includes:

[0018] For each feature type, the following operations are performed respectively: based on the respective importance degree parameters corresponding to one feature type, determining a feature vector corresponding to the one feature type;

[0019] Accumulating the obtained respective feature vectors to determine a vector sum of the respective feature vectors;

[0020] For each feature type, the following operations are performed respectively: based on the feature vector corresponding to one feature type and the vector sum, determining a feature weight corresponding to the one feature type.

[0021] Optionally, before the determining, based on the respective feature weights, an anomaly score corresponding to the corresponding feature type, the method further includes:

[0022] Based on the type quantity corresponding to the respective feature types, the respective importance degree parameters, and the respective feature weights, determining a maximum eigenvalue;

[0023] Based on the maximum eigenvalue and the type quantity, determining a to-be-verified parameter corresponding to the respective importance degree parameters;

[0024] Based on the type quantity, determining, from a preset random parameter set, a random parameter corresponding to the type quantity;

[0025] Based on the to-be-verified parameter and the random parameter, determining a consistency verification result of the respective importance degree parameters.

[0026] Optionally, the determining, based on the type quantity corresponding to the respective feature types, the respective importance degree parameters, and the respective feature weights, a maximum eigenvalue includes:

[0027] constructing a parameter matrix containing the importance degree parameters;

[0028] determining a standard matrix corresponding to the parameter matrix based on the parameter matrix and the normalized feature weights;

[0029] determining a maximum eigenvalue based on the standard matrix, the feature weights, and the type number corresponding to the feature types.

[0030] Optionally, the determining the consistency verification result of the importance degree parameters based on the to-be-verified parameters and the random parameters comprises:

[0031] determining a ratio parameter based on the to-be-verified parameters and the random parameters;

[0032] when it is determined that the ratio parameter is less than a preset verification threshold, determining that the consistency verification result of the importance degree parameters is consistent;

[0033] when it is determined that the ratio parameter is not less than the verification threshold, determining that the consistency verification result is inconsistent.

[0034] Optionally, the determining the anomaly detection result of the to-be-detected object based on the determined anomaly scores comprises:

[0035] determining an accumulated result between the anomaly scores;

[0036] when it is determined that the accumulated result is greater than a preset anomaly threshold, determining the anomaly detection result of the to-be-detected object based on the obtained verification code verification result;

[0037] when it is determined that the accumulated result is not greater than the anomaly threshold, determining that the anomaly detection result of the to-be-detected object is a normal object.

[0038] Optionally, the determining the anomaly detection result of the to-be-detected object based on the obtained verification code verification result comprises:

[0039] when the obtained verification code verification result is verification failure, determining that the anomaly detection result of the to-be-detected object is an abnormal object;

[0040] when the verification code verification result is verification success, determining that the anomaly detection result of the to-be-detected object is a normal object.

[0041] An anomaly object detection apparatus, comprising:

[0042] an obtaining module configured to obtain target attribute features corresponding to a to-be-detected object;

[0043] The first processing module is configured to perform the following operations for each target attribute feature: when it is determined that a target attribute feature is not included in a preset feature library, obtaining an abnormal score corresponding to a feature type of the target attribute feature, wherein each abnormal score is determined based on an importance degree of a corresponding feature type, and the feature library at least includes normal attribute features, and each normal attribute feature represents an attribute feature of a normal object.

[0044] The detection module is configured to determine an abnormal detection result of the to-be-detected object based on the determined abnormal scores.

[0045] Optionally, before the obtaining of the target attribute features corresponding to the to-be-detected object, the apparatus further includes a second processing module, which is configured to:

[0046] perform the following operations for each feature type: respectively determining an importance degree parameter between a feature type and each feature type, wherein each importance degree parameter represents a comparison result of an importance degree between the corresponding feature type and one of the feature types;

[0047] respectively determining a feature weight corresponding to a feature type based on the obtained importance degree parameters;

[0048] respectively determining an abnormal score corresponding to a feature type based on the feature weight.

[0049] Optionally, when the second processing module respectively determines a feature weight corresponding to a feature type based on the obtained importance degree parameters, the second processing module is further configured to:

[0050] perform the following operations for each feature type: determining a feature vector corresponding to a feature type based on the importance degree parameters corresponding to the feature type;

[0051] accumulating the obtained feature vectors to determine a vector sum of the feature vectors;

[0052] perform the following operations for each feature type: determining a feature weight corresponding to a feature type based on the feature vector corresponding to the feature type and the vector sum.

[0053] Optionally, before the second processing module respectively determines an abnormal score corresponding to a feature type based on the feature weight, the apparatus further includes a verification module, which is configured to:

[0054] determining a maximum eigenvalue based on a type number of the feature types, the importance degree parameters and the feature weights;

[0055] determine the to-be-verified parameters corresponding to the importance degree parameters based on the maximum eigenvalue and the type quantity;

[0056] determine the random parameters corresponding to the type quantity from a preset random parameter set based on the type quantity;

[0057] determine the consistency verification result of the importance degree parameters based on the to-be-verified parameters and the random parameters.

[0058] Optionally, when the maximum eigenvalue is determined based on the type quantity corresponding to each feature type, the importance degree parameters, and the feature weights, the verification module is further configured to:

[0059] construct a parameter matrix containing the importance degree parameters;

[0060] determine a standard matrix corresponding to the parameter matrix based on the parameter matrix and the normalized feature weights;

[0061] determine the maximum eigenvalue based on the standard matrix, the feature weights, and the type quantity corresponding to each feature type.

[0062] Optionally, when the consistency verification result of the importance degree parameters is determined based on the to-be-verified parameters and the random parameters, the verification module is further configured to:

[0063] determine a ratio parameter based on the to-be-verified parameters and the random parameters;

[0064] when it is determined that the ratio parameter is less than a preset verification threshold, determine that the consistency verification result of the importance degree parameters is consistent;

[0065] when it is determined that the ratio parameter is not less than the verification threshold, determine that the consistency verification result is inconsistent.

[0066] Optionally, when the abnormality detection result of the to-be-detected object is determined based on the determined abnormality scores, the detection module is further configured to:

[0067] determine an accumulated result between the abnormality scores;

[0068] when it is determined that the accumulated result is greater than a preset abnormality threshold, determine the abnormality detection result of the to-be-detected object based on the obtained verification code verification result;

[0069] when it is determined that the accumulated result is not greater than the abnormality threshold, determine that the abnormality detection result of the to-be-detected object is a normal object.

[0070] Optionally, when the abnormality detection result of the to-be-detected object is determined based on the obtained verification code verification result, the detection module is further configured to:

[0071] When the verification code verification result is a verification failure, the abnormality detection result of the to-be-detected object is determined as an abnormal object.

[0072] When the verification code verification result is a verification success, the abnormality detection result of the to-be-detected object is determined as a normal object.

[0073] An electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the steps of the abnormal object detection method when executing the program.

[0074] A computer readable storage medium has a computer program stored thereon, and the computer program implements the steps of the abnormal object detection method when executed by a processor.

[0075] In the embodiments of the present application, after obtaining each target attribute feature corresponding to the to-be-detected object, the following operations are performed for each target attribute feature: when it is determined that a target attribute feature is not included in a preset feature library, an abnormality score corresponding to the feature type of the target attribute feature is obtained, and based on the determined abnormality scores, the abnormality detection result of the to-be-detected object is determined. In this way, when the to-be-detected object is detected for abnormality, the target attribute features corresponding to the to-be-detected object in different dimensions are detected for abnormality, so as to avoid the problem of missed detection caused by the IP address of the to-be-detected object not being included in the preset IP blacklist, thereby further improving the accuracy of abnormal object detection and ensuring the security of site information. BRIEF DESCRIPTION OF DRAWINGS

[0076] Figure 1 A first flowchart of an abnormal object detection method in the embodiments of the present application;

[0077] Figure 2 A schematic diagram of the meanings of the importance degree parameters in the embodiments of the present application;

[0078] Figure 3 A schematic diagram of the importance degree parameters corresponding to each feature type in the embodiments of the present application;

[0079] Figure 4 A schematic diagram of the feature weights corresponding to each feature type in the embodiments of the present application;

[0080] Figure 5 A schematic diagram of the abnormality scores corresponding to each feature type in the embodiments of the present application;

[0081] Figure 6A schematic diagram of a consistency verification result in an embodiment of the present application;

[0082] Figure 7 A second flowchart of an abnormal object detection method in an embodiment of the present application;

[0083] Figure 8 A structural schematic diagram of an abnormal object detection apparatus in an embodiment of the present application;

[0084] Figure 9 A structural schematic diagram of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0085] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, and not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application.

[0086] At present, with the rapid development of the network, the World Wide Web has become a carrier of a large amount of information. Whether it is the Internet industry or various traditional industries, they have provided a large amount of valuable information through the World Wide Web. Consequently, the World Wide Web application platform is facing more and more security threats, for example, a web crawler that can automatically extract web page content.

[0087] Since the web crawler will capture a large amount of site information in the process of running, thereby causing the site information to be leaked. Therefore, in order to improve the security of the site information, it is necessary to perform abnormal detection on the to-be-detected object accessing the site and intercept the detected abnormal object.

[0088] In the related art, when performing abnormal detection on the to-be-detected object, an IP blacklist is usually set in advance, and abnormal detection is performed according to the IP address corresponding to the to-be-detected object and the IP blacklist. If the IP address corresponding to the to-be-detected object is included in the IP blacklist, the abnormal detection result of the to-be-detected object is an abnormal object.

[0089] However, since the pre-set IP blacklist cannot include all IP addresses corresponding to abnormal objects, the problem of missed detection will occur. For example, when the abnormal object is detected for the first time, since the IP address of the abnormal object is not included in the pre-set IP blacklist, the abnormal object cannot be detected.

[0090] To solve the above problems, in the embodiments of the present application, before obtaining each target attribute feature corresponding to the to-be-detected object, the following operations are performed for each feature type: respectively determining an importance degree parameter between a feature type and each feature type, respectively determining a feature weight corresponding to the corresponding feature type based on the obtained importance degree parameters, respectively determining an anomaly score corresponding to the corresponding feature type based on the feature weight, after obtaining each target attribute feature corresponding to the to-be-detected object, the following operations are performed for each target attribute feature: when it is determined that a target attribute feature is not included in the preset feature library, an anomaly score corresponding to the feature type of the target attribute feature is obtained, and the anomaly detection result of the to-be-detected object is determined based on the determined anomaly scores. In this way, when the to-be-detected object is detected, the importance degree of different dimensions of feature types is quantified to obtain the corresponding anomaly score, and based on the anomaly scores corresponding to each feature type, the anomaly scores corresponding to the feature types of each target attribute feature corresponding to the to-be-detected object in different dimensions are determined, the accuracy of anomaly object detection is improved by combining qualitative and quantitative methods, and measures can be taken more timely to intercept the access of the anomaly object, thereby ensuring the security of the site information.

[0091] Based on the above embodiments, refer to Figure 1 The first flowchart of an anomaly object detection method in the embodiments of the present application is shown in FIG. 1, which specifically includes the following steps:

[0092] S10: Obtain each target attribute feature corresponding to the to-be-detected object.

[0093] In the embodiments of the present application, each target attribute feature corresponding to the to-be-detected object is obtained from the server.

[0094] In the embodiments of the present application, each target attribute feature can be a network proxy, a browser user agent (User-agent), a browser system font, a browser language, a browser screen resolution, data (Cookie) stored on a user's local terminal, a browser canvas (Canvas) fingerprint, a browser 3D drawing protocol (Web Graphics Library, WebGL) fingerprint, and browser plug-in information, etc., which are not limited in the embodiments of the present application.

[0095] S11: For each target attribute feature, the following operations are performed: when it is determined that a target attribute feature is not included in the preset feature library, an anomaly score corresponding to the feature type of the target attribute feature is obtained.

[0096] Each anomaly score is determined based on the importance degree of the corresponding feature type, and the feature library at least includes each normal attribute feature, and each normal attribute feature represents an attribute feature corresponding to a normal object.

[0097] In the embodiments of the present application, after obtaining each target attribute feature of the to-be-detected object, the following operations are performed for each target attribute feature: since the preset feature library contains each normal attribute feature corresponding to each feature type, it is determined whether a target attribute feature is contained in the preset feature library based on each normal attribute feature contained in each feature library, when it is determined that the target attribute feature is not contained in the feature library, the feature type of the target attribute feature is determined, and an abnormal score corresponding to the feature type is obtained, when it is determined that the target attribute feature is contained in the feature library, the abnormal score corresponding to the target attribute feature is set to 0.

[0098] For example, assuming that the target attribute feature of the to-be-detected object is Song Ti, and each normal attribute feature contained in the preset feature library is Kai Ti, Microsoft YaHei and Black Body, the target attribute feature is not contained in the preset feature library, it is determined that the feature type of the target attribute feature is browser system font, and an abnormal score corresponding to the browser system font is obtained, which is 3.228.

[0099] For another example, assuming that the target attribute feature of the to-be-detected object is Black Body, and each normal attribute feature contained in the preset feature library is Kai Ti, Microsoft YaHei and Black Body, the target attribute feature is contained in the preset feature library, and the abnormal score corresponding to the target attribute feature is set to 0.

[0100] It should be noted that in the embodiments of the present application, the feature library contains at least each normal attribute feature, each normal attribute feature is obtained after feature extraction is performed on a normal object, for example, an attribute feature corresponding to a network agent feature type of a normal object, an attribute feature corresponding to a User-agent feature type of a normal object, an attribute feature corresponding to a browser system font feature type of a normal object, an attribute feature corresponding to a browser screen resolution feature type of a normal object, an attribute feature corresponding to a Cookie feature type of a normal object, an attribute feature corresponding to a browser Canvas fingerprint feature type of a normal object, an attribute feature corresponding to a browser WebGL fingerprint feature type of a normal object, and an attribute feature corresponding to a browser plug-in information feature type of a normal object, and the present application is not limited thereto.

[0101] S12: determining an abnormality detection result of the to-be-detected object based on the determined abnormal scores.

[0102] In the embodiments of the present application, after obtaining each abnormal score, an abnormality detection result of the to-be-detected object is determined based on each abnormal score.

[0103] Optionally, in the embodiments of the present application, a possible implementation for determining the abnormality detection result of the to-be-detected object is provided, and the process of determining the abnormality detection result of the to-be-detected object in the embodiments of the present application is described below, which specifically includes:

[0104] S121: determining the accumulation result between the abnormality scores.

[0105] In the embodiments of the present application, after obtaining the abnormality scores, the abnormality scores are summed to determine the accumulation result between the abnormality scores.

[0106] For example, the feature types determined based on the target attribute features are network agent, browser system font, browser system language, Cookie, and browser Canvas fingerprint, the abnormality score corresponding to the feature type of network agent is 28.217, the abnormality score corresponding to the feature type of browser system font is 3.228, the abnormality score corresponding to the feature type of browser system language is 2.492, the abnormality score corresponding to the feature type of Cookie is 12.974, and the abnormality score corresponding to the feature type of browser Canvas fingerprint is 12.974, and the accumulation result between the abnormality scores is 28.217+3.228+2.492+12.974+12.974=59.885.

[0107] S122: when it is determined that the accumulation result is greater than the preset abnormality threshold, determining the abnormality detection result of the to-be-detected object based on the obtained verification code verification result.

[0108] In the embodiments of the present application, after obtaining the accumulation result, it is determined whether the accumulation result is greater than the preset abnormality threshold, if it is determined that the accumulation result is greater than the preset abnormality threshold, the verification code is sent to the to-be-detected object, and the to-be-verified verification code input by the to-be-detected object is obtained, the verification code verification result of the to-be-detected object is determined based on the to-be-verified verification code and the standard verification code, and the abnormality detection result of the to-be-detected object is determined based on the obtained verification code verification result.

[0109] For example, assuming that the accumulation result is 59.885 and the preset abnormality threshold is 50, the accumulation result 59.885 is greater than the preset abnormality threshold 50, and the abnormality detection result of the to-be-detected object is determined based on the obtained verification code verification result.

[0110] Specifically, when step S122 is executed, it includes:

[0111] S1221: when the obtained verification code verification result is verification failure, determining that the abnormality detection result of the to-be-detected object is an abnormal object;

[0112] In the embodiment of the present application, after determining that the accumulated result is greater than the preset abnormal threshold, it is judged whether the obtained verification code verification result passes. If the obtained verification code verification result is not passed, the abnormal detection result of the to-be-detected object is an abnormal object.

[0113] The verification code can be a picture type verification code, a motion type verification code, a digital type verification code, and an SMS verification code, and the present application does not limit this.

[0114] For example, assuming that the verification code is a sliding verification code in the motion type verification code, and the obtained sliding verification code verification result is not passed, it is determined that the abnormal detection result of the to-be-detected object is an abnormal object.

[0115] Further, in the embodiment of the present application, when determining the verification code verification result, the to-be-verified verification code input by the to-be-detected object is received, and it is judged whether the to-be-verified verification code is consistent with the standard verification code. If not, it is determined that the verification code verification result is not passed, and if yes, it is determined that the verification code verification result is passed.

[0116] S1222: When the verification code verification result is passed, it is determined that the abnormal detection result of the to-be-detected object is a normal object.

[0117] In the embodiment of the present application, after determining that the accumulated result is greater than the preset abnormal threshold, the abnormal detection result of the to-be-detected object can be further determined based on the obtained verification code verification result. Specifically, if the obtained verification code verification result is passed, the abnormal detection result of the to-be-detected object is a normal object.

[0118] For example, assuming that the verification code is a sliding verification code in the motion type verification code, and the obtained sliding verification code verification result is passed, it is determined that the abnormal detection result of the to-be-detected object is a normal object.

[0119] S123: When it is determined that the accumulated result is not greater than the abnormal threshold, it is determined that the abnormal detection result of the to-be-detected object is a normal object.

[0120] In the embodiment of the present application, after obtaining the accumulated result, it is judged whether the accumulated result is greater than the preset abnormal threshold. If it is determined that the accumulated result is not greater than the preset abnormal threshold, the abnormal detection result of the to-be-detected object is a normal object.

[0121] For example, assuming that the accumulated result is 33.937 and the preset abnormal threshold is 50, the accumulated result 33.937 is not greater than the preset abnormal threshold 50, and it is determined that the abnormal detection result of the to-be-detected object is a normal object.

[0122] Further, in the embodiments of the present application, before obtaining each target attribute feature corresponding to the to-be-detected object, a corresponding abnormality score is determined based on the importance of each feature type. The process of determining the abnormality score in the embodiments of the present application is described below, and specifically includes:

[0123] A1: For each preset feature type, the following operation is performed respectively: an importance degree parameter between one feature type and each feature type is determined respectively.

[0124] Each importance degree parameter represents a comparison result of the importance between the corresponding feature type and one feature type in each feature type.

[0125] In the embodiments of the present application, for each preset feature type, the following operation is performed respectively: the importance of one feature type is compared with the importance of each feature type to obtain a corresponding importance comparison result, and based on each obtained importance comparison result, an importance degree parameter between the feature type and the corresponding feature type is determined.

[0126] In the embodiments of the present application, each feature type at least includes: network agent, browser user agent (User-agent), browser system font, browser language, browser screen resolution, data (Cookie) stored on the user's local terminal, browser canvas (Canvas) fingerprint, browser 3D drawing protocol (Web Graphics Library, WebGL) fingerprint and browser plug-in information, etc., which are not limited in the embodiments of the present application.

[0127] The meaning of each importance degree parameter in the embodiments of the present application is described below by taking a specific example, which is described with reference to Figure 2As shown, the diagram is a schematic diagram of the meaning of each importance parameter in the embodiments of the present application. In the embodiments of the present application, the importance parameter of 1 indicates that one feature type is as important as another feature type, the importance parameter of 3 indicates that one feature type is slightly more important than another feature type, the importance parameter of 5 indicates that one feature type is obviously more important than another feature type, the importance parameter of 7 indicates that one feature type is strongly more important than another feature type, the importance parameter of 9 indicates that one feature type is extremely more important than another feature type, the importance parameter of 2 indicates that one feature type is between as important as and slightly more important than another feature type, the importance parameter of 4 indicates that one feature type is between slightly more important and obviously more important than another feature type, the importance parameter of 6 indicates that one feature type is between obviously more important and strongly more important than another feature type, the importance parameter of 8 indicates that one feature type is between strongly more important and extremely more important than another feature type, and the inverse of the importance parameter of 1-9 indicates that one feature type is between the importance parameter of 1-9 of another feature type, i.e., the importance parameter of one feature type is the inverse of the importance parameter of another feature type.

[0128] The importance parameters in the embodiments of the present application are described below by taking a specific example. Referring to FIG. 3, the importance parameters of the feature types in the example are shown in the table in FIG. 3. Figure 3As shown, the diagram is a schematic diagram of the importance degree parameters corresponding to each feature type in the embodiments of the present application. Taking a network agent as an example, the importance degree parameter between the network agent and the User-agent is 5, thus the network agent is obviously more important than the User-agent, the importance degree parameter between the network agent and the browser system font is 7, thus the network agent is strongly more important than the browser system font, the importance degree parameter between the network agent and the browser language is 9, thus the network agent is extremely more important than the browser language, the importance degree parameter between the network agent and the browser screen resolution is 9, thus the network agent is extremely more important than the browser screen resolution, the importance degree parameter between the network agent and the Cookie is 2, thus the importance degree of the network agent is between the same importance and slightly important, the importance degree parameter between the network agent and the browser Canvas fingerprint is 2, thus the importance degree of the network agent is between the same importance and slightly important, the importance degree parameter between the network agent and the browser WebGL fingerprint is 2, thus the importance degree of the network agent is between the same importance and slightly important, and the importance degree parameter between the network agent and the browser plug-in information is 4, thus the importance degree of the network agent is between slightly important and obviously important.

[0129] A2: Based on the obtained importance degree parameters, respectively, determine the feature weight corresponding to the corresponding feature type.

[0130] In the embodiments of the present application, after obtaining the importance degree parameters, for each feature type, the following operations are performed respectively: based on the importance degree parameters corresponding to one feature type, determine the feature weight corresponding to the feature type.

[0131] Optionally, in the embodiments of the present application, a possible implementation for determining the feature weight is provided, and the process of determining the feature weight corresponding to the corresponding feature type in the embodiments of the present application is described below, which specifically includes:

[0132] A21: For each feature type, the following operations are performed respectively: based on the importance degree parameters corresponding to one feature type, determine the feature vector corresponding to one feature type.

[0133] In the embodiments of the present application, for each feature type, the following operations are performed respectively: calculate the multiplication result between the importance degree parameters corresponding to one feature type, and based on the total number of the importance degree parameters and the multiplication result, obtain the feature vector corresponding to the feature type.

[0134] Specifically, the feature vector corresponding to the feature type in the embodiments of the present application can be expressed as:

[0135]

[0136] wherein, is a feature vector corresponding to the i-th feature type, m is a preset total number of feature types, a ij is an importance parameter between the i-th feature type and the j-th feature type, a ij satisfies the following condition a ij > 0, a ij = 1 / a ji , a ii = 1.

[0137] For example, assuming that the i-th feature type is a network agent, the preset total number of feature types is 9, and the importance parameters corresponding to the network agent are 1, 5, 7, 9, 9, 2, 2, 2, and 4 respectively, then the feature vector corresponding to the network agent is

[0138] A22: Accumulate the obtained feature vectors to determine a vector sum of the feature vectors.

[0139] In the embodiment of the present application, after obtaining the feature vectors corresponding to the feature types, the feature vectors are accumulated to obtain a vector sum of the feature vectors.

[0140] Specifically, the vector sum of the feature vectors in the embodiment of the present application can be expressed as:

[0141]

[0142] wherein, s is the vector sum of the feature vectors, is a feature vector corresponding to the i-th feature type, and m is a type number corresponding to the feature type.

[0143] For example, assuming that the type number of the feature types is 9, and the feature vectors corresponding to the feature types are 3.555, 1.051, 0.407, 0.314, 0.314, 1.635, 1.635, 2.795, and 0.894, then the vector sum is 3.555+1.051+0.407+0.314+0.314+1.635+1.635+2.795+0.894=12.6.

[0144] A23: For each feature type, the following operation is performed: based on the feature vector and the vector sum corresponding to one feature type, a feature weight corresponding to the feature type is determined.

[0145] In the embodiment of the present application, after obtaining the vector sum of each feature vector, the following operations are performed for each feature type: the proportion of the feature vector corresponding to a feature type in the sum of each vector is determined, thereby obtaining the feature weight corresponding to the feature type.

[0146] Specifically, the feature weight corresponding to the feature type can be expressed as:

[0147]

[0148] Among them, w i is the feature weight corresponding to the i-th feature type, s is the vector sum of each feature vector, is the feature vector corresponding to the i-th feature type.

[0149] For example, see Figure 4 As shown, this is a schematic diagram of the feature weights corresponding to each feature type in an embodiment of the present application. Taking User-agent as an example, the feature vector corresponding to User-agent is 1.051, and the vector sum of each feature vector is 12.6. Therefore, the feature weight corresponding to User-agent is 1.051 / 12.6=0.08341=8.341%.

[0150] Furthermore, after obtaining the feature weights corresponding to each feature type, a weight matrix is ​​constructed, and the obtained weight matrix includes the weights of each feature.

[0151] Specifically, the weight matrix can be expressed as:

[0152] W=(w i ) m×1

[0153] Among them, W is the weight matrix, w i is the feature weight corresponding to the i-th feature type, and m is the number of types corresponding to each feature type.

[0154] A3: Determine the anomaly score corresponding to the corresponding feature type based on the weight of each feature.

[0155] In the embodiment of the present application, the feature weight corresponding to each feature type is obtained, and the product between each feature weight and the preset score conversion parameter is calculated respectively to obtain the abnormality score corresponding to the corresponding feature type.

[0156] Among them, the preset score conversion parameter can be 100, which is not limited in the embodiments of the present application.

[0157] For example, see Figure 5As shown, it is a schematic diagram of the abnormal score corresponding to each feature type in the embodiment of the present application, taking User-agent as an example, the feature weight corresponding to User-agent is 8.341%, and the preset score parameter is 100, therefore, the abnormal score corresponding to the feature type User-agent is 8.341%*100=8.341.

[0158] Further, in the embodiment of the present application, after obtaining each importance parameter, in order to ensure that each importance parameter corresponding to each feature type determined is consistent with logic, it is necessary to perform consistency verification on each importance parameter, the process of performing consistency verification on each importance parameter in the embodiment of the present application is described below, specifically including:

[0159] B1: determining the maximum eigenvalue based on the type number corresponding to each feature type, each importance parameter and each feature weight.

[0160] In the embodiment of the present application, after obtaining the feature weight corresponding to each feature type, the maximum eigenvalue is determined based on the type number corresponding to each feature type, each importance parameter and each feature weight.

[0161] Optionally, the embodiment of the present application provides a possible implementation manner for determining the maximum eigenvalue, the process of determining the maximum eigenvalue in the embodiment of the present application is described below, specifically including:

[0162] B11: constructing a parameter matrix containing each importance parameter.

[0163] In the embodiment of the present application, based on each importance parameter corresponding to each feature type, a parameter matrix is constructed, and the parameter matrix obtained contains each importance parameter.

[0164] Specifically, the parameter matrix in the embodiment of the present application can be expressed as:

[0165]

[0166] Wherein, A is the parameter matrix, the number of rows of the parameter matrix is m, the number of columns is n, a ij is the importance parameter between the ith feature type and the jth feature type.

[0167] B12: determining the standard matrix corresponding to the parameter matrix based on the parameter matrix and each feature weight.

[0168] In the embodiment of the present application, after obtaining the parameter matrix, the product of the parameter matrix and each feature weight is calculated, and the product calculated is the standard matrix corresponding to the parameter matrix.

[0169] Specifically, the standard matrix in the embodiment of the present application can be expressed as:

[0170] AW=A·W

[0171] Wherein, A is a parameter matrix, and W is a weight matrix.

[0172] B13: determining a maximum eigenvalue based on the standard matrix, the feature weight of each feature, and the type quantity corresponding to each feature type.

[0173] In the embodiment of the application, the maximum eigenvalue is determined based on the standard matrix, the feature weight of each feature, and the type quantity corresponding to each feature type.

[0174] Specifically, the maximum eigenvalue in the embodiment of the application can be expressed as:

[0175]

[0176] Wherein, λ max is the maximum eigenvalue, W i is the feature weight corresponding to the i-th row of the weight matrix, B i is the value of the i-th row of the standard matrix, and n is the type quantity corresponding to each feature type.

[0177] B2: determining the to-be-verified parameter corresponding to each importance degree parameter based on the maximum eigenvalue and the type quantity.

[0178] In the embodiment of the application, after obtaining the maximum eigenvalue, a first difference value between the maximum eigenvalue and the type quantity is calculated, a second difference value between the type quantity and a preset default value is calculated, and finally, based on the ratio between the first difference value and the second difference value, the to-be-verified parameter corresponding to each importance degree parameter is obtained.

[0179] Specifically, the to-be-verified parameter corresponding to each importance degree parameter in the embodiment of the application can be expressed as:

[0180]

[0181] Wherein, CI is the to-be-verified parameter corresponding to each importance degree parameter, λ max is the maximum eigenvalue, n is the type quantity corresponding to each feature type, and r is a preset default value. The default value can be 1, and the embodiment of the application does not limit this.

[0182] For example, assuming that the maximum eigenvalue is 9.788, the type quantity corresponding to each feature type is 9, and the preset default value is 1, the to-be-verified parameter corresponding to each importance degree parameter is (9.788-9) / (9-1)=0.098.

[0183] B3: determining the random parameter corresponding to the type quantity from a preset random parameter set based on the type quantity.

[0184] In the embodiments of the present application, based on the type quantity corresponding to each feature type, a random parameter corresponding to the type quantity in the preset random parameter set is searched, and the random parameter is determined as the random parameter of the type quantity corresponding to each feature type.

[0185] For example, assuming that the type quantity corresponding to each feature type is 9, and the random parameter corresponding to the type quantity 9 in the preset random parameter set is 1.451, the random parameter corresponding to the type quantity 9 of each feature type is 1.451.

[0186] B4: determining the consistency verification result of each importance degree parameter based on the to-be-verified parameter and the random parameter.

[0187] In the embodiments of the present application, after obtaining the to-be-verified parameter and the random parameter, the consistency verification result of each importance degree parameter is determined based on the to-be-verified parameter and the random parameter.

[0188] Specifically, when step B4 is performed, the following steps are included:

[0189] B41: determining the ratio parameter based on the to-be-verified parameter and the random parameter.

[0190] In the embodiments of the present application, after obtaining the to-be-verified parameter and the random parameter, the ratio of the to-be-verified parameter and the random parameter is calculated to obtain the ratio parameter.

[0191] Specifically, the ratio parameter in the embodiments of the present application can be expressed as:

[0192] CR = CI / RI

[0193] Wherein, CR is the ratio parameter, CI is the to-be-verified parameter, and RI is the random parameter.

[0194] For example, assuming that the to-be-verified parameter is 0.098 and the random parameter is 1.451, the ratio parameter is 0.098 / 1.451 = 0.068.

[0195] B42: when it is determined that the ratio parameter is less than the preset verification threshold, determining that the consistency verification result of each importance degree parameter is consistent.

[0196] In the embodiments of the present application, after obtaining the ratio parameter, it is judged whether the ratio parameter is less than the preset verification threshold. If the ratio parameter is less than the preset verification threshold, it is determined that the consistency verification result of each importance degree parameter is consistent.

[0197] For example, referring to Figure 6Fig. 2 is a schematic diagram of the consistency verification result in the embodiment of the present application. In the figure, the maximum eigenvalue is 9.788, the parameter to be verified is 0.098, the random parameter is 1.451, the ratio parameter is 0.068, and the preset verification threshold is 0.1. Since the ratio parameter 0.068 is less than the preset verification threshold 0.1, the consistency verification result of the importance degree parameters is determined to be consistent.

[0198] B43: When it is determined that the ratio parameter is not less than the verification threshold, the consistency verification result is determined to be inconsistent.

[0199] In the embodiment of the present application, after the ratio parameter is obtained, it is determined whether the ratio parameter is less than the preset verification threshold. If the ratio parameter is not less than the preset verification threshold, the consistency verification result of the importance degree parameters is determined to be inconsistent.

[0200] For example, assuming that the ratio parameter is 0.151 and the preset verification threshold is 0.1, the ratio parameter 0.151 is not less than the preset verification threshold 0.1, and the consistency verification result of the importance degree parameters is determined to be inconsistent.

[0201] Further, if the determined consistency verification result is inconsistent, the importance degree parameters are modified, the modified importance degree parameters are obtained, the steps B1 to B4 are executed again until the consistency verification result of the modified importance degree parameters is consistent, and the abnormality scores determined based on the importance degree parameters are saved to the score database, so that the abnormal object detection can be performed based on the abnormality scores saved in the score database.

[0202] Before acquiring each target attribute feature corresponding to the to-be-detected object, the following operations are respectively performed for each preset feature type: an importance degree parameter between each feature type and a feature type is respectively determined, each feature weight corresponding to the corresponding feature type is respectively determined based on the obtained importance degree parameters, and an anomaly score corresponding to the corresponding feature type is respectively determined based on each feature weight. In this way, when performing anomaly detection on the to-be-detected object, the importance degrees of feature types of different dimensions are quantified, the anomaly scores corresponding to the feature types of different dimensions are determined, the accuracy of anomaly object detection is improved by combining qualitative and quantitative methods, and in addition, after acquiring each target attribute feature corresponding to the to-be-detected object, the following operations are respectively performed for each target attribute feature: when it is determined that a target attribute feature is not included in the preset feature library, an anomaly score corresponding to the feature type of the target attribute feature is acquired, and the anomaly detection result of the to-be-detected object is determined based on the determined anomaly scores. When performing anomaly detection on the to-be-detected object, anomaly detection is performed based on the target attribute features corresponding to the to-be-detected object in different dimensions, so as to avoid the problem of missed detection caused by the fact that the IP address of the to-be-detected object is not included in the preset IP blacklist, thereby further improving the accuracy of anomaly object detection, enabling measures to be taken more timely to intercept access of anomaly objects, and ensuring the security of site information.

[0203] Based on the above embodiments, refer to Figure 7 FIG. 2 shows a second flowchart of an anomaly object detection method in an embodiment of the present application, and specifically includes the following steps:

[0204] Step 700: For each preset feature type, the following operations are respectively performed: an importance degree parameter between each feature type and a feature type is respectively determined.

[0205] Step 701: For each feature type, the following operations are respectively performed: based on each importance degree parameter corresponding to a feature type, a feature vector corresponding to the feature type is determined.

[0206] Step 702: For each feature type, the following operations are respectively performed: based on the feature vector corresponding to a feature type and a vector sum of each feature vector, a feature weight corresponding to the feature type is determined.

[0207] Step 703: Based on the type quantity of each feature type, each importance degree parameter, and each feature weight, a maximum eigenvalue is determined.

[0208] Step 704: Based on the maximum eigenvalue and the type quantity, a to-be-verified parameter corresponding to each importance degree parameter is determined.

[0209] Step 705: determining a random parameter corresponding to the type quantity from a preset random parameter set based on the type quantity.

[0210] Step 706: judging whether the consistency verification result of each importance degree parameter is consistent based on the to-be-verified parameter and the random parameter, if not, executing step 707, and if yes, executing step 708.

[0211] Step 707: modifying each importance degree parameter to obtain modified each importance degree parameter.

[0212] Step 708: saving each abnormal score determined based on each importance degree parameter to a score library.

[0213] Step 709: acquiring each target attribute feature corresponding to the to-be-detected object.

[0214] Step 710: for each target attribute feature, performing the following operation: when it is determined that one target attribute feature is not contained in a preset feature library, acquiring an abnormal score corresponding to a feature type of the one target attribute feature.

[0215] Step 711: determining an abnormal detection result of the to-be-detected object based on the determined each abnormal score.

[0216] Based on the same inventive concept, the embodiment of the present application further provides an abnormal object detection device, which may be a server for example, and the abnormal object detection device may be a hardware structure, a software module, or a hardware structure plus a software module. Based on the above embodiment, refer to Figure 8 FIG. 8 shows a structure schematic diagram of an abnormal object detection device in an embodiment of the present application, which specifically includes:

[0217] The acquisition module 800 is configured to acquire each target attribute feature corresponding to the to-be-detected object.

[0218] The first processing module 801 is configured to, for each target attribute feature, perform the following operation: when it is determined that one target attribute feature is not contained in a preset feature library, acquire an abnormal score corresponding to a feature type of the one target attribute feature, wherein each abnormal score is determined based on the importance degree of the corresponding feature type, and the feature library at least contains each normal attribute feature, and each normal attribute feature represents an attribute feature corresponding to a normal object.

[0219] The detection module 802 is configured to determine an abnormal detection result of the to-be-detected object based on the determined each abnormal score.

[0220] Optionally, before the acquisition of each target attribute feature corresponding to the to-be-detected object, the device further includes a second processing module 803, which is configured to:

[0221] For each feature type, the following operations are performed respectively: an importance degree parameter between one feature type and each feature type is determined respectively, wherein each importance degree parameter represents an importance degree comparison result between the corresponding feature type and one feature type of each feature type;

[0222] Based on each obtained importance degree parameter, a feature weight corresponding to the corresponding feature type is determined respectively;

[0223] Based on each feature weight, an anomaly score corresponding to the corresponding feature type is determined respectively.

[0224] Optionally, when the feature weight corresponding to the corresponding feature type is determined based on each obtained importance degree parameter, the second processing module 803 is further configured to:

[0225] For each feature type, the following operations are performed respectively: based on each importance degree parameter corresponding to one feature type, a feature vector corresponding to the one feature type is determined;

[0226] The obtained each feature vector is accumulated to determine a vector sum of the each feature vector;

[0227] For each feature type, the following operations are performed respectively: based on the feature vector corresponding to one feature type and the vector sum, a feature weight corresponding to the one feature type is determined.

[0228] Optionally, before the anomaly score corresponding to the corresponding feature type is determined based on each feature weight, the device further comprises a verification module 804, and the verification module 804 is configured to:

[0229] Based on the type number corresponding to each feature type, each importance degree parameter and each feature weight, a maximum eigenvalue is determined;

[0230] Based on the maximum eigenvalue and the type number, a to-be-verified parameter corresponding to the each importance degree parameter is determined;

[0231] Based on the type number, a random parameter corresponding to the type number is determined from a preset random parameter set;

[0232] Based on the to-be-verified parameter and the random parameter, a consistency verification result of the each importance degree parameter is determined.

[0233] Optionally, when the maximum eigenvalue is determined based on the type number corresponding to each feature type, each importance degree parameter and each feature weight, the verification module 804 is further configured to:

[0234] constructing a parameter matrix containing the importance degree parameters;

[0235] determining a standard matrix corresponding to the parameter matrix based on the parameter matrix and the normalized feature weights;

[0236] determining a maximum eigenvalue based on the standard matrix, the feature weights, and the type number corresponding to the feature type.

[0237] Optionally, when determining the consistency verification result of the importance degree parameters based on the to-be-verified parameters and the random parameters, the verification module 804 is further configured to:

[0238] determining a ratio parameter based on the to-be-verified parameters and the random parameters;

[0239] when determining that the ratio parameter is less than a preset verification threshold, determining that the consistency verification result of the importance degree parameters is consistent;

[0240] when determining that the ratio parameter is not less than the verification threshold, determining that the consistency verification result is inconsistent.

[0241] Optionally, when determining the anomaly detection result of the to-be-detected object based on the determined anomaly scores, the detection module 802 is further configured to:

[0242] determining an accumulated result of the anomaly scores;

[0243] when determining that the accumulated result is greater than a preset anomaly threshold, determining the anomaly detection result of the to-be-detected object based on the obtained verification code verification result;

[0244] when determining that the accumulated result is not greater than the anomaly threshold, determining that the anomaly detection result of the to-be-detected object is a normal object.

[0245] Optionally, when determining the anomaly detection result of the to-be-detected object based on the obtained verification code verification result, the detection module 802 is further configured to:

[0246] when the obtained verification code verification result is verification failure, determining that the anomaly detection result of the to-be-detected object is an abnormal object;

[0247] when the verification code verification result is verification success, determining that the anomaly detection result of the to-be-detected object is a normal object.

[0248] Based on the above embodiments, refer to Figure 9 FIG. 1 shows a structural schematic diagram of an electronic device according to an embodiment of the present application.

[0249] The electronic device can include a processor 910 (Center Processing Unit, CPU), a memory 920, an input device 930, and an output device 940, etc. The input device 930 can include a keyboard, a mouse, a touch screen, etc. The output device 940 can include a display device, such as a Liquid Crystal Display (LCD), a Cathode Ray Tube (CRT), etc.

[0250] The memory 920 can include a Read Only Memory (ROM) and a Random Access Memory (RAM), and provide the processor 910 with program instructions and data stored in the memory 920. In the embodiments of the present application, the memory 920 can be used to store the program of any of the abnormal object detection methods in the embodiments of the present application.

[0251] The processor 910 calls the program instructions stored in the memory 920, and the processor 910 is used to execute any of the abnormal object detection methods in the embodiments of the present application according to the obtained program instructions.

[0252] Based on the above embodiments, in the embodiments of the present application, a computer readable storage medium is provided, and the computer readable storage medium stores a computer program. The computer program is executed by a processor to implement the abnormal object detection method in any of the method embodiments.

[0253] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can be in the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can be in the form of a computer program product implemented on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program code.

[0254] The present application is described with reference to flowcharts and / or block diagrams according to the methods, devices (systems), and computer program products of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a general purpose computer, a special purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions executed by the computer or other programmable data processing apparatus produce a device that implements the functions specified in the flowcharts and / or block diagrams. Figure 1 The functions specified in one or more flows and / or blocks Figure 1 The functions specified in one or more flows and / or blocks

[0255] These computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture including instructions which implement the flow Figure 1 The flow or flows and / or blocks Figure 1 The flow or flows and / or blocks

[0256] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions that execute on the computer or other programmable apparatus provide steps for implementing the flow Figure 1 The flow or flows and / or blocks Figure 1 The flow or flows and / or blocks

[0257] Obviously, numerous modifications and variations of the present application are possible in light of the above teachings. It is therefore to be understood that within the scope of the appended claims and their equivalents, the application can be practiced otherwise than as specifically described.

Claims

1. An abnormal object detection method characterized by, The method comprises the following steps: obtaining each target attribute feature corresponding to the to-be-detected object; for each target attribute feature, the following operations are performed: when it is determined that one target attribute feature is not included in a preset feature library, an abnormal score corresponding to the feature type of the one target attribute feature is obtained, wherein each abnormal score is determined in advance based on the importance between each feature type, and the feature library at least includes each normal attribute feature, and each normal attribute feature represents an attribute feature corresponding to a normal object; based on the determined abnormal scores, an abnormal detection result of the to-be-detected object is determined; Before the step of obtaining each target attribute feature corresponding to the to-be-detected object, the method further comprises the following steps: for each feature type, the following operations are performed: the importance parameter between one feature type and each feature type is determined respectively, wherein each importance parameter represents the comparison result of the importance between the corresponding feature type and one feature type in the feature types; based on each obtained importance parameter, the feature weight corresponding to the corresponding feature type is determined; based on each feature weight, the abnormal score corresponding to the corresponding feature type is determined.

2. The method of claim 1, wherein, The step of determining the feature weight corresponding to the corresponding feature type based on each obtained importance parameter comprises the following steps: for each feature type, the following operations are performed: based on the importance parameters corresponding to one feature type, the feature vector corresponding to the one feature type is determined; the obtained feature vectors are accumulated to determine the vector sum of the feature vectors; for each feature type, the following operations are performed: based on the feature vector corresponding to one feature type and the vector sum, the feature weight corresponding to the one feature type is determined.

3. The method of claim 1, wherein, Before the step of determining the abnormal score corresponding to the corresponding feature type based on each feature weight, the method further comprises the following steps: based on the type quantity corresponding to each feature type, the importance parameters and the feature weights, a maximum eigenvalue is determined; based on the maximum eigenvalue and the type quantity, a to-be-verified parameter corresponding to the importance parameters is determined; based on the type quantity, a random parameter corresponding to the type quantity is determined from a preset random parameter set; based on the to-be-verified parameter and the random parameter, a consistency verification result of the importance parameters is determined.

4. The method of claim 3, wherein, The step of determining the maximum eigenvalue based on the type quantity corresponding to each feature type, the importance parameters and the feature weights comprises the following steps: a parameter matrix containing the importance parameters is constructed; based on the parameter matrix and the feature weights, a standard matrix corresponding to the parameter matrix is determined; based on the standard matrix, the feature weights and the type quantity corresponding to each feature type, a maximum eigenvalue is determined.

5. The method of claim 3 or 4, wherein, The step of determining the consistency verification result of the importance parameters based on the to-be-verified parameter and the random parameter comprises the following steps: based on the to-be-verified parameter and the random parameter, a ratio parameter is determined; When it is determined that the ratio parameter is less than a preset verification threshold, it is determined that the consistency verification result of the importance degree parameters is consistent. When it is determined that the ratio parameter is not less than the verification threshold, it is determined that the consistency verification result is inconsistent.

6. The method of claim 1, wherein, The method further includes determining an anomaly detection result of the to-be-detected object based on the determined anomaly scores. The method further includes determining an accumulation result between the anomaly scores. When it is determined that the accumulation result is greater than a preset anomaly threshold, determining the anomaly detection result of the to-be-detected object based on the obtained verification code verification result. When it is determined that the accumulation result is not greater than the anomaly threshold, determining the anomaly detection result of the to-be-detected object as a normal object.

7. The method of claim 6, wherein, The method further includes determining the anomaly detection result of the to-be-detected object based on the obtained verification code verification result. When the obtained verification code verification result is verification failure, determining the anomaly detection result of the to-be-detected object as an abnormal object. When the verification code verification result is verification success, determining the anomaly detection result of the to-be-detected object as a normal object.

8. An abnormal object detection apparatus characterized by comprising: The method further includes: obtaining each target attribute feature corresponding to a to-be-detected object; for each target attribute feature, determining an anomaly score corresponding to a feature type of the target attribute feature when the target attribute feature is not contained in a preset feature library, wherein each anomaly score is determined based on an importance degree of a corresponding feature type, and the feature library at least contains each normal attribute feature, and each normal attribute feature represents an attribute feature corresponding to a normal object; determining an anomaly detection result of the to-be-detected object based on the determined anomaly scores; The apparatus further includes a second processing module configured to: before obtaining each target attribute feature corresponding to a to-be-detected object, for each feature type, respectively determining an importance degree parameter between the feature type and each feature type, wherein each importance degree parameter represents a comparison result of an importance degree between the feature type and one of the feature types; determining a feature weight corresponding to the feature type based on the obtained importance degree parameter; determining an anomaly score corresponding to the feature type based on the feature weight.

9. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor implements the steps of the method of any one of claims 1-7 when executing the program.

10. A computer readable storage medium having stored thereon a computer program, characterized in that: The computer program implements the steps of the method of any one of claims 1-7 when executed by the processor.

Images