Method and device for detecting abnormal access of application across resource pools

Abstract

The present application discloses a method and device for detecting abnormal access of an application across resource pools. The method comprises: obtaining a target access record of an application accessing a registry entry corresponding to a source resource pool, the target access record being used to reflect the access record of the application accessing the target resource pool; extracting from the target access record a plurality of first access frequencies of the application accessing the registry entry in a plurality of time periods within a detection cycle, and weighting the plurality of first access frequencies to obtain a first frequency; extracting from the target access record a plurality of second access frequencies of the application accessing the registry entry in a plurality of time periods within a historical cycle, and weighting the second access frequencies to obtain a second frequency, and determining a detection parameter based on the second frequency; comparing the first frequency with the detection parameter, and determining whether the application has an access abnormality based on the comparison result. The present application solves the technical problem of low coverage of detection of abnormal access of an application across resource pools.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method and device for detecting abnormal access of an application across resource pools. Background Art

[0002] In the related art, a directly connected distributed firewall is generally used to enforce security policies on the APIs (Application Programming Interfaces) and objects called by applications that access across resource pools. The reference relationship between the application and the API library will be mapped to an object and stored in a registry key. After the function in the application code returns, the object used as the function parameter will be garbage collected, and the content in the registry will also be deleted. This characteristic of the registry is the volatility of the registry key. In the related art, the detection of abnormal behavior of applications across resource pools only obtains the access information within a certain period of time, compares it with the access behavior characteristics in the preset database, and determines whether it is abnormal access behavior.

[0003] To address the above-mentioned problems, no effective solutions have been proposed so far. Summary of the Invention

[0004] The embodiments of the present application provide a method and apparatus for detecting anomalies in cross-resource pool access by an application program, so as to at least solve the technical problem of low coverage of detection of anomalies in cross-resource pool access by an application program.

[0005] According to one aspect of an embodiment of the present application, a method for detecting anomalies in application access across resource pools is provided, including: obtaining a target access record of a target application accessing a registry item corresponding to a source resource pool, the target access record being used to reflect the access record of the target application accessing the target resource pool; extracting from the target access record a plurality of first access frequencies of the target application accessing the registry item in a plurality of time periods within a detection cycle, and weighting the plurality of first access frequencies according to a preset weight to obtain a first frequency; extracting from the target access record a plurality of second access frequencies of the target application accessing the registry item in a plurality of time periods within a historical cycle, and weighting the second access frequencies according to a preset weight to obtain a second frequency, and determining a detection parameter based on the second frequency; comparing the first frequency with the detection parameter to obtain a comparison result, and determining whether the target application has an access anomaly based on the comparison result.

[0006] Optionally, multiple first access frequencies of the target application accessing the registry item in multiple time periods within the detection cycle are extracted from the target access record, and the multiple first access frequencies are weighted according to preset weights to obtain the first frequency, including: determining multiple time periods within the detection cycle; extracting multiple first access frequencies in multiple time periods from the first access record; and weighting the multiple first access frequencies according to multiple weight values ​​in the preset weights to obtain the first frequency.

[0007] Optionally, multiple first access frequencies are weighted according to multiple weight values ​​in the preset weights to obtain the first frequency, including: multiplying the multiple weight values ​​by the first access frequencies of the corresponding time period to obtain multiple weighted first access frequencies; adding the multiple weighted first access frequencies to obtain the first frequency.

[0008] Optionally, determining the detection parameter based on the second frequency includes: obtaining multiple second frequencies of multiple historical periods, and determining the upper quartile and lower quartile of the multiple second frequencies; and determining the difference between the upper quartile and the lower quartile as the detection parameter.

[0009] Optionally, determining whether the target application has access abnormality based on the comparison result includes: if the comparison result shows that the ratio of the first frequency to the detection parameter is greater than a preset threshold, determining that the target application has access abnormality.

[0010] Optionally, when the comparison result shows that the ratio of the first frequency to the detection parameter is greater than a preset threshold, determining that the target application has an access abnormality includes: when the comparison result shows that the ratio of the first frequency to the detection parameter is greater than the first threshold and less than the second threshold, determining that the target application is in a first abnormal state; when the comparison result shows that the ratio of the first frequency to the detection parameter is greater than the second threshold, determining that the target application is in a second abnormal state, wherein the preset threshold includes the first threshold and the second threshold, and the access abnormality includes the first abnormal state and the second abnormal state.

[0011] Optionally, after determining that the target application has access abnormality, the method further includes: when the target application is in a first abnormal state, issuing a first warning message, the first warning message being used to indicate that the target application has access abnormality; when the target application is in a second abnormal state, issuing a second warning message, the second warning message being used to indicate that the protection level needs to be increased.

[0012] According to another aspect of an embodiment of the present application, a device for detecting abnormal cross-resource pool access of an application is also provided, including: an acquisition module for obtaining a target access record of a target application corresponding to a source resource pool accessing a registry item, the target access record being used to reflect the access record of the target application accessing the target resource pool; an extraction module for extracting from the target access record a plurality of first access frequencies of the target application accessing the registry item in a plurality of time periods within a detection cycle, and weighting the plurality of first access frequencies according to a preset weight to obtain a first frequency; a determination module for extracting from the target access record a plurality of second access frequencies of the target application accessing the registry item in a plurality of time periods within a historical cycle, and weighting the second access frequencies according to a preset weight to obtain a second frequency, and determining a detection parameter based on the second frequency; a comparison module for comparing the first frequency with the detection parameter to obtain a comparison result, and determining whether the target application has an access abnormality based on the comparison result.

[0013] According to another aspect of an embodiment of the present application, a non-volatile storage medium is further provided, which includes a stored program, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to perform the above-mentioned detection of application program cross-resource pool access anomalies.

[0014] According to another aspect of an embodiment of the present application, an electronic device is provided, including a memory and a processor, wherein the processor is configured to run a program, wherein the program performs the detection of the above-mentioned application program's cross-resource pool access anomaly when the program is running.

[0015] In an embodiment of the present application, a target access record of a target application accessing a registry item corresponding to a source resource pool is obtained, and the target access record is used to reflect the access record of the target application accessing the target resource pool; multiple first access frequencies of the target application accessing the registry item in multiple time periods within a detection cycle are extracted from the target access record, and the multiple first access frequencies are weighted according to a preset weight to obtain a first frequency; multiple second access frequencies of the target application accessing the registry item in multiple time periods within a historical cycle are extracted from the target access record, and the second access frequencies are weighted according to a preset weight to obtain a second frequency, and a detection parameter is determined based on the second frequency; the first frequency is compared with the detection parameter to obtain a comparison result, and whether the target application has an access anomaly is determined based on the comparison result. By weighting the access frequencies of multiple time periods within the detection cycle and comparing them with the historical access frequencies, the purpose of simultaneously considering the differences in access frequencies in different time periods and the access habits of each application is achieved, thereby achieving the technical effect of improving detection coverage, and further solving the technical problem of low detection coverage of application access anomalies across resource pools. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0017] Figure 1 This is a hardware structure block diagram of a computer terminal (or mobile device) for a method for detecting abnormal access of an application across resource pools according to an embodiment of the present application;

[0018] Figure 2 This is a flowchart of a method for detecting abnormal access of an application across resource pools according to the present application;

[0019] Figure 3 This is a schematic diagram of the system structure of an optional application cross-resource pool access system according to an embodiment of the present application;

[0020] Figure 4 This is a schematic diagram of the results of an optional detection device for application cross-resource pool access anomalies according to an embodiment of the present application. DETAILED DESCRIPTION

[0021] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0022] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in a sequence other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0023] According to an embodiment of the present application, an embodiment of a method for detecting anomalies in application access across resource pools is also provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0024] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal, a cloud server or a similar computing device. Figure 1 The hardware structure block diagram of a computer terminal (or mobile device) for implementing a method for detecting abnormal access of an application across resource pools is shown. Figure 1 As shown, the computer terminal 10 (or mobile device 10) may include one or more (illustrated as 102a, 102b, ..., 102n) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission module 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, a power supply and / or a camera. It will be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components than shown, or with Figure 1 Different configurations shown.

[0025] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuitry". The data processing circuitry may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuitry may be a single independent processing module, or may be incorporated in whole or in part into any of the other components of the computer terminal 10 (or mobile device). As described in the embodiments of the present application, the data processing circuitry serves as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0026] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the method for detecting abnormal cross-resource pool access of an application in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, realizes the above-mentioned method for detecting abnormal cross-resource pool access of an application. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include but are not limited to the Internet, corporate intranet, local area network, mobile communication network and combinations thereof.

[0027] The transmission module 106 is configured to receive or transmit data via a network. A specific example of the aforementioned network may include a wireless network provided by the communications provider of the computer terminal 10. In one embodiment, the transmission module 106 includes a network interface controller (NIC), which can be connected to other network devices via a base station to enable communication with the Internet. In another embodiment, the transmission module 106 may be a radio frequency (RF) module, which is configured to communicate with the Internet wirelessly.

[0028] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 (or mobile device).

[0029] According to an embodiment of the present application, an embodiment of a method for detecting anomalies in application access across resource pools is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0030] Figure 2 Flowchart of a method for detecting abnormal access of an application across resource pools according to an embodiment of the present application. Figure 2 As shown, the method includes the following steps:

[0031] Step S202: obtaining a target access record of a target application accessing a registry entry corresponding to the source resource pool, wherein the target access record is used to reflect an access record of the target application accessing the target resource pool;

[0032] Step S204: extracting multiple first access frequencies of the target application program accessing the registry entry in multiple time periods within the detection period from the target access record, and weighting the multiple first access frequencies according to a preset weight to obtain a first frequency;

[0033] Step S206: extracting multiple second access frequencies of the target application program accessing the registry key in multiple time periods of the historical period from the target access record, weighting the second access frequencies according to a preset weight to obtain a second frequency, and determining a detection parameter based on the second frequency;

[0034] Step S208: Compare the first frequency with the detection parameter to obtain a comparison result, and determine whether the target application has access abnormality based on the comparison result.

[0035] Through the above steps, it is possible to achieve the purpose of simultaneously considering the differences in access frequencies in different time periods and the access habits of each application by weighting the access frequencies of multiple time periods within the detection cycle and comparing them with the historical access frequencies, thereby achieving the technical effect of improving detection coverage and solving the technical problem of low detection coverage of application access anomalies across resource pools.

[0036] It should be noted that, since the reference relationship between the application and the API library will be mapped to an object and stored in a registry entry, the object used as a function parameter in the application code will be garbage collected after the function returns, and the content in the registry will also be deleted. The method provided by this application obtains the target access record from the object call record of the distributed firewall on the target resource pool side. Through the object call record of the firewall, the volatile content (access record) in the registry entry is obtained, which expands the detection range and improves the detection coverage. It is understandable that in actual application scenarios, the access record in the registry entry will be deleted after a period of time, thereby reducing the detection coverage. However, the object call record of the distributed firewall in the embodiment of this application does not have the risk of being deleted, and thus the full amount of registry entry access records can be obtained, thereby improving the detection coverage.

[0037] It should be further explained that the firewall's object call records correspond one-to-one to the registry entry's access records, and thus it can be determined that the number of firewall object call records is equal to the number of registry entry accesses.

[0038] In step S202, the target application and the user terminal correspond to the source resource pool together. The target resource pool can be the resource pool corresponding to other applications that the user terminal and the target application are to access. At the same time, since the application's reference relationship to the API library will be mapped to an object and stored in a registry entry, the target application's access record to the registry entry can be used to reflect the target application's access record to the target resource pool.

[0039] In related technologies, the source resource pool collects application access records through cloud node probes, including content updates and access frequencies of files, processes, and registries. The out-of-band controller determines the access behavior characteristics of the application based on the collected application access records, and compares the determined access behavior characteristics with the access behaviors in the pre-stored malicious behavior detection library to determine the score of the access behavior characteristics, and issues an early warning based on the threat level determined by the score.

[0040] It is understandable that the solutions in related technologies only focus on the access behavior characteristics of a specific time period, and do not compare them with the access records of historical time periods. At the same time, they do not weight the access frequency of different time periods, resulting in low coverage of detection results.

[0041] The method provided in this application not only weights each time period within the detection cycle, but also compares the access frequency with the historical period, and at the same time takes into account the impact of different time periods and access habits on the detection results, thereby improving the detection coverage.

[0042] The above steps S202 to S208 are described in detail below through a specific embodiment.

[0043] In step S204, the first frequency can be determined by: determining multiple time periods within the detection period; extracting multiple first access frequencies of multiple time periods from the first access record; and weighting the multiple first access frequencies according to multiple weight values ​​in the preset weights to obtain the first frequency.

[0044] It can be understood that the detection cycle represents the time period for the current detection of the target application. For example, the previous day (August 1) is determined as the detection cycle. In some embodiments of the present application, the first access frequencies of the four time periods of 3 to 4, 6 to 7, 11 to 12, and 14 to 15 on August 1 are obtained. For example, the first access frequency from 3 to 4 is 1, the first access frequency from 6 to 7 is 1, the first access frequency from 11 to 12, and the first access frequency from 14 to 15 is 2. The weight value can be set according to the actual application scenario. For example, the weight values ​​from 0 to 7 and from 18 to 24 (non-working hours) are set to 0.25, and the other time periods of the day (working hours) are set to 0.75, etc. The weight value of the peak access period can also be set to 0.8, etc.

[0045] In an optional manner, the multiple first access frequencies are weighted according to multiple weight values ​​in the preset weights. The method for obtaining the first frequency may be to multiply the multiple weight values ​​by the first access frequencies of the corresponding time periods to obtain multiple weighted first access frequencies; add the multiple weighted first access frequencies to obtain the first frequency. Taking the weight values ​​of 0:00 to 7:00 and 18:00 to 24:00 (non-working hours) as 0.25, and the other time periods of the day (working hours) as 0.75 as an example, the weighted first access frequency from 3:00 to 4:00 is 0.25, the weighted first access frequency from 6:00 to 7:00 is 0.25, the weighted first access frequency from 11:00 to 12:00 is 1.5, and the weighted first access frequency from 14:00 to 15:00 is 1.5. The weighted first access frequencies of the four time periods are added together to obtain a first frequency of 3.5.

[0046] In step S206, determining the detection parameter based on the second frequency can be achieved by: obtaining multiple second frequencies of multiple historical periods, and determining the upper quartile and lower quartile of the multiple second frequencies; and determining the difference between the upper quartile and the lower quartile as the detection parameter.

[0047] It should be noted that the method for determining the second frequency is similar to that for the first frequency and will not be described in detail here.

[0048] Taking multiple historical periods of July 26, July 27, July 28, July 29 and July 30 as examples, the second frequency on July 26 was 2.4, the second frequency on July 27 was 1.45, the second frequency on July 28 was 2, the second frequency on July 29 was 1.78, and the second frequency on July 30 was 1.59. The upper quartile was determined to be 1.52 and the lower quartile was 2.2, thus determining the detection parameter to be 0.68.

[0049] In an optional manner, when the comparison result shows that the ratio of the first frequency to the detection parameter is greater than a preset threshold, it is determined that the target application access is abnormal.

[0050] It should be further explained that the preset threshold can be set according to the actual application scenario, for example: 1.5, 2, etc.

[0051] In some embodiments of the present application, when the comparison result shows that the ratio of the first frequency to the detection parameter is greater than a first threshold and less than a second threshold, it is determined that the target application is in a first abnormal state; when the comparison result shows that the ratio of the first frequency to the detection parameter is greater than the second threshold, it is determined that the target application is in a second abnormal state, wherein the preset threshold includes the first threshold and the second threshold, and the access abnormality includes the first abnormal state and the second abnormal state.

[0052] Taking the first threshold as 1.5 and the second threshold as 2 as an example, when the ratio of the first frequency to the detection parameter is less than 1.5, it is determined that the target application access is normal; when the ratio of the first frequency to the detection parameter is greater than 1.5 and less than 2, it is determined that the target application is in a first abnormal state; when the ratio of the first frequency to the detection parameter is greater than 2, it is determined that the target application is in a second abnormal state.

[0053] In an optional manner, when the target application is in a first abnormal state, a first warning message is issued, and the first warning message is used to indicate that the target application has access abnormality; when the target application is in a second abnormal state, a second warning message is issued, and the second warning message is used to indicate that the protection level needs to be increased, for example: the warning level in the issued warning message is increased, and it is reported to the secondary support account or the account of the superior department for processing, etc.

[0054] The first warning information may take various forms, such as sound and light alarms, pop-up warning windows, etc. The second warning information may be information to the detection device to increase the protection level, etc.

[0055] In actual application scenarios, a cross-resource pool access system is provided, such as Figure 3As shown, it includes: a target terminal 40, an out-of-band controller 42, and a detection module 44. The target terminal 40 corresponding to the source resource pool and passing the verification is used to send an access request of the target resource pool to the out-of-band controller 42, and the out-of-band controller 42 grants the target terminal 40 the permission to access the target resource pool. The detection module 44 is used to obtain the target access record of the target application corresponding to the source resource pool to the registry item, and the target access record is used to reflect the access record of the target application to the target resource pool; extract the multiple first access frequencies of the target application accessing the registry item in multiple time periods within the detection cycle from the target access record, and weight the multiple first access frequencies according to the preset weight to obtain the first frequency; extract the multiple second access frequencies of the target application accessing the registry item in multiple time periods of the historical cycle from the target access record, and weight the second access frequency according to the preset weight to obtain the second frequency, and determine the detection parameter based on the second frequency; compare the first frequency with the detection parameter to obtain a comparison result, and determine whether the target application has access abnormality based on the comparison result.

[0056] The embodiment of the present application also provides a device for detecting abnormal access of an application across resource pools, such as Figure 4 As shown, it includes: an acquisition module 50, which is used to obtain a target access record of a target application corresponding to a source resource pool accessing a registry item, and the target access record is used to reflect the access record of the target application accessing the target resource pool; an extraction module 52, which is used to extract a plurality of first access frequencies of the target application accessing the registry item in a plurality of time periods within a detection cycle from the target access record, and weight the plurality of first access frequencies according to a preset weight to obtain a first frequency; a determination module 54, which is used to extract a plurality of second access frequencies of the target application accessing the registry item in a plurality of time periods of a historical cycle from the target access record, and weight the second access frequencies according to the preset weight to obtain a second frequency, and determine a detection parameter based on the second frequency; a comparison module 56, which is used to compare the first frequency with the detection parameter to obtain a comparison result, and determine whether the target application has an access abnormality based on the comparison result.

[0057] The extraction module 52 includes: a first determination submodule, the first determination submodule being configured to determine multiple time periods within the detection period; extract multiple first access frequencies in the multiple time periods from the first access record; and weight the multiple first access frequencies according to multiple weight values ​​in a preset weight to obtain the first frequency;

[0058] The first determination submodule includes a calculation unit, which is used to multiply the multiple weight values ​​by the first access frequencies of the corresponding time period to obtain multiple weighted first access frequencies; and add the multiple weighted first access frequencies to obtain the first frequency;

[0059] The determination module 54 includes: a second determination submodule, the second determination submodule being configured to obtain a plurality of second frequencies from a plurality of historical periods, and determine an upper quartile and a lower quartile of the plurality of second frequencies; and determine a difference between the upper quartile and the lower quartile as the detection parameter;

[0060] The comparison module 56 includes: a detection submodule, configured to determine that the target application access is abnormal if the comparison result shows that the ratio of the first frequency to the detection parameter is greater than a preset threshold;

[0061] The detection submodule includes: a detection unit, configured to determine that the target application is in a first abnormal state if the comparison result shows that the ratio of the first frequency to the detection parameter is greater than a first threshold and less than a second threshold; and to determine that the target application is in a second abnormal state if the comparison result shows that the ratio of the first frequency to the detection parameter is greater than the second threshold, wherein the preset thresholds include the first threshold and the second threshold, and the access anomaly includes the first abnormal state and the second abnormal state;

[0062] The detection unit includes an early warning subunit, which is used to issue a first warning message when the target application is in a first abnormal state, and the first warning message is used to indicate that the target application has access abnormality; when the target application is in a second abnormal state, the early warning subunit is used to issue a second warning message, and the second warning message is used to indicate that the protection level needs to be increased.

[0063] An embodiment of the present application further provides a non-volatile storage medium, including a stored program, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute the above-mentioned method for detecting abnormal access of application programs across resource pools.

[0064] The above-mentioned method for detecting abnormal access of the above-mentioned application across resource pools stored in the non-volatile storage medium achieves the purpose of simultaneously considering the differences in access frequencies in different time periods and the access habits of each application by weighting the access frequencies of multiple time periods within the detection cycle and comparing them with the historical access frequencies, thereby achieving the technical effect of improving the detection coverage rate and solving the technical problem of low detection coverage rate of abnormal access of applications across resource pools.

[0065] The embodiment of the present application also provides an electronic device, including a memory and a processor, the processor is used to run a program, wherein the above-mentioned detection method for abnormal access of an application across resource pools is executed when the program is running. The specific structure of the electronic device can be found in Figure 1 The hardware structure of the computer is shown, but not limited to this.

[0066] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0067] In the above embodiments of the present application, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0068] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only exemplary. For example, the division of units can be a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0069] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple units. Some or all of the units may be selected to achieve the purpose of the present embodiment according to actual needs.

[0070] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0071] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, server or network device, etc.) to execute all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program code.

[0072] The above is only a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for detecting abnormal access of an application across resource pools, characterized in that: include: Obtaining a target access record of a target application accessing a registry entry corresponding to a source resource pool, wherein the target access record is used to reflect an access record of the target application accessing a target resource pool; Extracting a plurality of first access frequencies of the target application program accessing the registry entry in a plurality of time periods within a detection period from the target access record, and weighting the plurality of first access frequencies according to a preset weight to obtain a first frequency; Extracting, from the target access record, a plurality of second access frequencies of the target application program accessing the registry entry within a plurality of time periods of a historical period, weighting the second access frequencies according to the preset weight to obtain a second frequency, and determining a detection parameter based on the second frequency; Comparing the first frequency with the detection parameter to obtain a comparison result, and determining whether the target application has access abnormality based on the comparison result; Determining a detection parameter based on the second frequency includes: obtaining a plurality of second frequencies in a plurality of historical periods, and determining an upper quartile and a lower quartile of the plurality of second frequencies; The difference between the upper quartile and the lower quartile is determined as the detection parameter.

2. The method according to claim 1, characterized in that Extracting a plurality of first access frequencies of the target application program accessing the registry entry in a plurality of time periods within a detection period from the target access record, and weighting the plurality of first access frequencies according to a preset weight to obtain a first frequency, including: determining a plurality of time periods within the detection cycle; extracting a plurality of first access frequencies in a plurality of time periods from the first access record; The multiple first access frequencies are weighted respectively according to multiple weight values ​​in the preset weights to obtain the first frequency.

3. The method according to claim 2, characterized in that The first access frequencies are weighted according to a plurality of weight values ​​in a preset weight to obtain the first frequency, comprising: multiplying the plurality of weight values ​​by the first access frequencies of the corresponding time period respectively to obtain a plurality of weighted first access frequencies; The multiple weighted first access frequencies are added together to obtain the first frequency.

4. The method according to claim 1, characterized in that Determining whether the target application has access abnormality based on the comparison result includes: If the comparison result shows that the ratio of the first frequency to the detection parameter is greater than a preset threshold, it is determined that the target application access is abnormal.

5. The method according to claim 4, characterized in that When the comparison result shows that the ratio of the first frequency to the detection parameter is greater than a preset threshold, determining that the target application access is abnormal includes: If the comparison result shows that the ratio of the first frequency to the detection parameter is greater than a first threshold and less than a second threshold, determining that the target application is in a first abnormal state; When the comparison result shows that the ratio of the first frequency to the detection parameter is greater than the second threshold, it is determined that the target application is in a second abnormal state, wherein the preset threshold includes the first threshold and the second threshold, and the access abnormality includes the first abnormal state and the second abnormal state.

6. The method according to claim 5, characterized in that After determining that the target application has access exception, the method further includes: When the target application is in a first abnormal state, issuing a first warning message, wherein the first warning message is used to indicate that the target application is accessed abnormally; When the target application is in a second abnormal state, a second warning message is issued, where the second warning message is used to indicate that a protection level needs to be increased.

7. A device for detecting abnormal access of an application across resource pools, characterized in that: include: An acquisition module, configured to acquire a target access record of a target application accessing a registry entry corresponding to a source resource pool, wherein the target access record is used to reflect an access record of the target application accessing a target resource pool; an extraction module, configured to extract, from the target access record, a plurality of first access frequencies of the target application program accessing the registry entry in a plurality of time periods within a detection period, and weight the plurality of first access frequencies according to a preset weight to obtain a first frequency; a determination module, configured to extract, from the target access record, a plurality of second access frequencies of the target application program accessing the registry entry within a plurality of time periods of a historical period, weight the second access frequencies according to the preset weight to obtain a second frequency, and determine a detection parameter based on the second frequency; a comparison module, configured to compare the first frequency with the detection parameter to obtain a comparison result, and determine whether the target application has an access abnormality based on the comparison result; Determining a detection parameter based on the second frequency includes: obtaining a plurality of second frequencies in a plurality of historical periods, and determining an upper quartile and a lower quartile of the plurality of second frequencies; The difference between the upper quartile and the lower quartile is determined as the detection parameter.

8. A non-volatile storage medium, characterized in that: The non-volatile storage medium stores a computer program, wherein the device where the non-volatile storage medium is located executes the method for detecting abnormal cross-resource pool access by an application program as described in any one of claims 1 to 6 by running the computer program.

9. An electronic device, characterized in that: The method comprises a memory and a processor, wherein the processor is used to run a program, wherein the method for detecting anomaly in cross-resource pool access of an application program as claimed in any one of claims 1 to 6 is executed when the program is run.

Images