Mobile internet abnormal behavior early warning method and device, and storage medium

Abstract

The application provides a mobile internet abnormal behavior early warning method, device and storage medium, the method comprises the following steps: collecting mass flow data of the mobile internet; identifying the mass flow data based on a first identification library, determining abnormal flow data; extracting the value signal element of the abnormal flow data based on a first extraction library; early warning the abnormal behavior of the mobile internet based on the value signal element. The mobile internet abnormal behavior early warning method provided by the application can quickly identify the abnormal flow data in the mobile internet, extract the value signal element of the abnormal flow data, restore the abnormal behavior of the mobile internet, and effectively early warn, thereby improving the early warning efficiency and realizing real-time security check on the abnormal data generated by the mobile internet.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method, device, and storage medium for early warning of abnormal behavior on mobile internet. Background Technology

[0002] With the development of information technology and the lightweighting of electronic devices, people are increasingly using terminal devices such as computers and mobile phones to complete asset transactions. While the rapid development of internet technology brings convenience to people's lives, it has also led to the rampant spread of many illegal activities through internet platforms, such as gambling, fraud, pornography, and gray and black market industries. These illegal websites or applications (APPs) spread rapidly, widely, and constantly evolve, even gradually becoming important drivers of other cybercrimes such as virus propagation, seriously endangering normal internet order, internet network security, and property security, and are currently one of the important targets in the fight against internet crime.

[0003] Through research on abnormal network access behavior, we found that illegal internet platforms, in order to achieve low cost, simple management, and easy disguise and change, mostly use a certain template technology to generate corresponding network platforms, including websites and apps. Illegal internet platforms update quickly, and existing identification methods are difficult to keep up with their update speed and cannot effectively warn against them. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides a method, device, and storage medium for early warning of abnormal behavior on mobile internet.

[0005] This invention provides a method for early warning of abnormal behavior on mobile internet, comprising:

[0006] Collect massive amounts of mobile internet traffic data;

[0007] Based on the first identification database, the massive traffic data is identified to determine abnormal traffic data;

[0008] Based on the first extraction library, extract the value information elements of the abnormal traffic data;

[0009] Based on the aforementioned value information elements, early warnings are issued for abnormal behaviors on the mobile Internet.

[0010] In some embodiments, after identifying the massive traffic data based on the first identification library and determining the abnormal traffic data, the method further includes:

[0011] Train on unidentified traffic data to determine a second identification database;

[0012] If the second identification library is determined to be valid based on the similarity between the second identification library and the first identification library, the first identification library is updated based on the second identification library.

[0013] In some embodiments, after training on the unidentified traffic data to determine the second identification library, the method further includes:

[0014] Determine the second extraction library;

[0015] If the second extraction library is determined to be valid based on the similarity between the second extraction library and the first extraction library, the first extraction library is updated based on the second extraction library.

[0016] In some embodiments, the value information element includes at least one of the following:

[0017] Withdrawal password, user login name, login password, real name, bank name, bank card number, and withdrawal amount.

[0018] In some embodiments, identifying abnormal traffic data based on a first identification library includes:

[0019] Based on the first identification library and the AC multi-mode matching algorithm, the massive traffic data is identified to determine abnormal traffic data.

[0020] The present invention also provides an early warning device for abnormal behavior on mobile internet, comprising:

[0021] The data collection module is used to collect massive amounts of mobile internet traffic data.

[0022] The identification module is used to identify the massive traffic data based on the first identification library and determine abnormal traffic data;

[0023] The extraction module is used to extract value information elements from the abnormal traffic data based on the first extraction library;

[0024] The early warning module is used to issue early warnings for abnormal behaviors of the mobile Internet based on the value information element.

[0025] In some embodiments, the early warning device for abnormal mobile internet behavior further includes:

[0026] The determination module is used to train on unidentified traffic data to determine the second identification library;

[0027] An update module is used to update the first recognition library based on the second recognition library if the second recognition library is determined to be valid based on the similarity between the second recognition library and the first recognition library.

[0028] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the early warning method for abnormal mobile Internet behavior as described above.

[0029] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a method for early warning of abnormal mobile Internet behavior as described above.

[0030] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements an early warning method for abnormal mobile Internet behavior as described above.

[0031] The present invention provides a method, device, and storage medium for early warning of abnormal behavior in the mobile Internet. By quickly identifying abnormal traffic data in the mobile Internet and extracting valuable information elements from the abnormal traffic data, the abnormal behavior of the mobile Internet can be reconstructed and an effective early warning can be given. This improves the early warning efficiency and realizes real-time security checks on abnormal data generated by the mobile Internet. Attached Figure Description

[0032] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0033] Figure 1 This is one of the flowcharts illustrating the early warning method for abnormal mobile internet behavior provided in this embodiment of the invention;

[0034] Figure 2 This is a schematic diagram of the structure of the early warning system for abnormal mobile internet behavior provided in an embodiment of the present invention;

[0035] Figure 3 This is a second flowchart illustrating the method for early warning of abnormal mobile internet behavior provided in this embodiment of the invention.

[0036] Figure 4 This is a schematic diagram of the structure of the early warning device for abnormal mobile internet behavior provided in an embodiment of the present invention;

[0037] Figure 5 This is a schematic diagram of the structure of the electronic device provided in an embodiment of the present invention. Detailed Implementation

[0038] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0039] Figure 1 This is one of the flowcharts illustrating the early warning method for abnormal mobile internet behavior provided in this embodiment of the invention. (Refer to...) Figure 1 The mobile internet abnormal behavior early warning method provided in this embodiment of the invention may include:

[0040] Step 101: Collect massive amounts of mobile internet traffic data;

[0041] Step 102: Based on the first identification library, identify the massive traffic data and determine abnormal traffic data;

[0042] Step 103: Based on the first extraction library, extract the value information elements of the abnormal traffic data;

[0043] Step 104: Based on the value information element, issue an early warning for abnormal behavior of the mobile Internet.

[0044] It should be noted that the executing entity of the mobile internet abnormal behavior early warning method provided by this invention can be an electronic device, a component in an electronic device, an integrated circuit, or a chip. The electronic device can be a mobile electronic device or a non-mobile electronic device. For example, mobile electronic devices can be mobile phones, tablets, laptops, PDAs, in-vehicle electronic devices, wearable devices, ultra-mobile personal computers (UMPCs), netbooks, or personal digital assistants (PDAs), etc., while non-mobile electronic devices can be servers, network attached storage (NAS), personal computers (PCs), televisions (TVs), ATMs, or self-service machines, etc. This invention does not impose specific limitations.

[0045] In step 101, massive amounts of mobile internet traffic data are collected.

[0046] Optionally, a bypass optical splitting method can be used to collect massive amounts of mobile internet traffic data. This does not affect the normal interaction of existing network data, and allows for real-time analysis and judgment of the data. The collected raw data is then sorted and reorganized to restore normal data traffic call detail records.

[0047] In step 102, based on the first identification library, the massive traffic data is identified to determine abnormal traffic data.

[0048] Optionally, the application message data of the massive traffic data can be matched with the first identification database to identify abnormal traffic data.

[0049] The first identification library is the initial identification library, which contains preset abnormal platform identification templates, such as multiple keywords.

[0050] When an application message is found to contain a feature fingerprint that matches the preset abnormal platform identification template, the source of the traffic data is marked as abnormal platform traffic, and the abnormal traffic data is identified.

[0051] For example, abnormal traffic data could include abnormal login traffic data, abnormal registration traffic data, abnormal message sending traffic data, etc.

[0052] In some embodiments, identifying abnormal traffic data based on a first identification library includes:

[0053] Based on the first identification library and the AC multi-mode matching algorithm, the massive traffic data is identified to determine abnormal traffic data.

[0054] Optionally, the AC multi-pattern matching algorithm can be used to match application packet data from massive traffic data with a first identification database to identify abnormal traffic data. Using the AC multi-pattern matching algorithm can effectively improve identification efficiency.

[0055] The AC algorithm constructs a trie (i.e., a finite automaton) from multiple pattern strings during the preprocessing stage, finds the internal relationships between each pattern string, and achieves efficient jump based on the result when a match fails, thereby reducing the invalid matching process.

[0056] The implementation of the AC algorithm involves constructing a finite pattern automaton, a failure function, and an output function. In the trie, pattern strings with the same prefix share a common path, and each tree node represents a state of the finite automaton, that is, a character of the pattern.

[0057] The failure function indicates the node to which the current node should jump when the match fails, while the output function represents the string output when the match is successful.

[0058] In step 103, value information elements of the abnormal traffic data are extracted based on the first extraction library.

[0059] Optionally, the first extraction library is an initial extraction library, which may include a preset extraction template for extracting value information elements from abnormal traffic data.

[0060] Based on the first extraction library, valuable information elements of abnormal traffic data can be extracted.

[0061] Optionally, the AC multi-mode matching algorithm can be used to match the application message data of abnormal traffic data with the first extraction database to extract the valuable information elements of the abnormal traffic data and improve the extraction efficiency.

[0062] Furthermore, in some embodiments, the value information element includes at least one of the following:

[0063] Withdrawal password, user login name, login password, real name, bank name, bank card number, and withdrawal amount.

[0064] In step 104, based on the value information element, an early warning is issued for abnormal behavior of the mobile Internet.

[0065] Based on the extracted value information elements, abnormal behaviors on the mobile Internet can be reconstructed, such as abnormal logins or abnormal transfers, thereby providing early warnings.

[0066] The mobile internet abnormal behavior early warning method provided in this embodiment of the invention quickly identifies abnormal traffic data in the mobile internet and extracts valuable information elements from the abnormal traffic data, thereby reconstructing the abnormal behavior of the mobile internet and providing effective early warning, improving early warning efficiency and realizing real-time security checks on abnormal data generated by the mobile internet.

[0067] In some embodiments, after identifying the massive traffic data based on the first identification library and determining the abnormal traffic data, the method further includes:

[0068] Train on unidentified traffic data to determine a second identification database;

[0069] If the second identification library is determined to be valid based on the similarity between the second identification library and the first identification library, the first identification library is updated based on the second identification library.

[0070] In some embodiments, after training on the unidentified traffic data to determine the second identification library, the method further includes:

[0071] Determine the second extraction library;

[0072] If the second extraction library is determined to be valid based on the similarity between the second extraction library and the first extraction library, the first extraction library is updated based on the second extraction library.

[0073] Optionally, for unidentified traffic data, artificial intelligence (AI) training can be performed to obtain a second identification library and a second extraction library.

[0074] For example, an XGBoost classification model can be trained based on unidentified traffic data. The XGBoost algorithm is an open-source decision tree algorithm, specifically an improvement on the gradient boosting decision tree algorithm. Its core lies in the optimization of the loss function and the solution algorithm.

[0075] The XGBoost loss function is modeled based on maximum likelihood estimation. Specifically, for each sample, it's essentially a typical binomial distribution probability model, continuously searching for split points to divide the sample set. Initially, all samples reside at a single node (the root node). As the tree expands, samples are assigned to the split child nodes. The split points are selected by enumerating extracted values ​​from the training sample set, with the selection criterion being to reduce the loss.

[0076] The XGBoost algorithm can enhance the capabilities of predictive models. It features regularization, parallel processing, high flexibility, missing value handling, pruning, built-in cross-validation, and the ability to continue training on existing models.

[0077] The second recognition library and the second extraction library obtained through AI training are shown in Table 1.

[0078] Table 1

[0079]

[0080] Based on the similarity between the second recognition library and the first recognition library, it is determined whether the second recognition library is effective. If the second recognition library is determined to be effective, it is supplemented and updated into the first recognition library to obtain a new first recognition library, that is, a more accurate recognition library is obtained.

[0081] Based on the similarity between the second extraction library and the first extraction library, it is determined whether the second extraction library is valid. If the second extraction library is valid, it is added to the first extraction library to obtain a new first extraction library, that is, a more accurate extraction library.

[0082] This allows for the effective identification of new traffic data based on the new primary identification database, identifying abnormal traffic data. Furthermore, the new primary extraction database is used to extract valuable information elements from the identified abnormal traffic data, effectively reconstructing abnormal internet behavior and issuing early warnings.

[0083] The mobile internet abnormal behavior early warning method provided in this invention can audit and warn of abnormal access data in the mobile internet, especially illegal websites. By combining AI training with manual judgment, the method automatically updates the identification library and extraction library of abnormal traffic data, improving the accuracy of identification and extraction, thereby effectively reconstructing abnormal behavior in the mobile internet and further improving the early warning efficiency.

[0084] Figure 2 This is a schematic diagram of the structure of the early warning system for abnormal mobile internet behavior provided in an embodiment of the present invention, as shown below. Figure 2 As shown, the mobile internet abnormal behavior early warning system provided in this embodiment of the invention consists of four main modules: data acquisition layer, data restoration layer, big data analysis layer, and data application layer.

[0085] The data acquisition layer includes acquisition units.

[0086] The data restoration layer includes an identification unit and an extraction unit.

[0087] The big data analytics layer includes storage units and training units.

[0088] The data application layer includes an analysis unit, an alarm unit, and an application unit.

[0089] The data acquisition layer is primarily used to collect data from the mobile core network. By using bypass splitting, it avoids disrupting normal data exchange within the existing network while enabling real-time analysis and assessment. Simultaneously, it employs load balancing technology based on International Mobile Subscriber Identity (IMSI) distribution, ensuring that single-user data is distributed to a unified restoration thread. The acquisition unit also sorts and reassembles the raw data to restore it into normal data traffic call detail records (CDRs).

[0090] The data restoration layer adopts a framework design and combines the AC multi-mode matching algorithm to match the application message data of massive traffic data with the identification unit and extraction unit.

[0091] The AC algorithm constructs a trie (i.e., a finite automaton) from multiple pattern strings during the preprocessing stage, finds the relationships within each pattern string, and implements efficient jumps based on the results of failed matches, thereby reducing invalid matching processes. The implementation of the AC algorithm includes constructing the finite pattern automaton, a failure function, and an output function. In the trie, pattern strings with the same prefix share a common path, and each tree node represents a state of the finite automaton, that is, a character of the pattern.

[0092] The failure function indicates the node to which the current node should jump when the match fails, while the output function represents the string output when the match is successful.

[0093] When the application message data contains a feature fingerprint that matches the abnormal platform identification template of the identification unit, the source of the traffic is marked as abnormal platform traffic.

[0094] The system extracts keywords through a framework configuration, extracts valuable information elements from abnormal traffic data through an extraction unit, and finally forms structured data which is sent to the storage unit of the big data analysis module for storage and processing, serving as the basic data for reporting alarms or other business applications at the application layer.

[0095] The traffic data that misses the target is sent to the training unit in the big data analysis module in a unified structured format for intelligent learning.

[0096] The big data analytics layer comprises data storage and training units. Its primary function is to train AI on data not matched by the data reconstruction layer (i.e., unknown data) to create new recognition and extraction libraries. The storage unit stores the structured data sent from the data reconstruction layer. The training unit is used to train the XGBoost classification model.

[0097] The XGBoost algorithm is an open-source decision tree algorithm, specifically an improvement on the gradient boosting decision tree algorithm. Its core lies in the optimization of the loss function and the solution algorithm.

[0098] The XGBoost loss function is modeled based on maximum likelihood estimation. Specifically, for each sample, it's essentially a typical binomial distribution probability model, continuously searching for split points to divide the sample set. Initially, all samples reside at a single node (the root node). As the tree expands, samples are assigned to the split child nodes. The split points are selected by enumerating the feature values ​​on the training sample set, with the selection criterion being to reduce the loss.

[0099] The XGBoost algorithm can enhance the capabilities of predictive models. It features regularization, parallel processing, high flexibility, missing value handling, pruning, built-in cross-validation, and the ability to continue training on existing models.

[0100] The recognition and extraction libraries obtained from the training unit are shown in Table 1. The new recognition and extraction libraries obtained through the training unit will have scores calculated based on pre-set weights. Specifically, this can be done using a similarity model.

[0101] The training unit displays all rules in the recognition and extraction databases in the judgment unit according to the average score or total score from high to low, in order to improve the value of human judgment.

[0102] The identification and extraction libraries, after manual evaluation, will be organized into a configurable form and added to the identification and extraction units of the data restoration module so that new data can be effectively matched.

[0103] The data application layer includes the analysis unit, the alarm unit, and other business application units.

[0104] The analysis unit can manually evaluate the results of AI learning, retaining recognition data that conforms to a set template, reviewing extracted keywords for valuable information elements, and discarding misclassified features. The extraction library contains various formats, including binary data, strings, key-value pairs, and regular expressions. This manual evaluation process further improves the efficiency and accuracy of AI learning, creating positive feedback and leading to a more precise recognition and extraction library.

[0105] The alarm unit reports abnormal data detected by the data restoration layer based on a preset alarm model. This data can also be used for other specialized business applications, such as those related to gambling, fraud, prostitution, and other illegal activities in the gray and black markets.

[0106] Figure 3 This is the second flowchart illustrating the early warning method for abnormal mobile internet behavior provided in this embodiment of the invention. (Refer to...) Figure 3 The workflow of the mobile internet abnormal behavior early warning system provided in this embodiment of the invention includes the following steps:

[0107] Step 1: Collect massive amounts of data from the mobile internet, and after load balancing and data packet reassembly, send the data to the data restoration module in the form of a data stream.

[0108] Step 2: The reconstructed data is matched with the identification unit. Matching data is sent to the extraction unit for value field extraction. Data that does not match is sent to the training unit of the big data analysis layer for machine learning.

[0109] Step 3: After the hit data is extracted by the extraction unit, it is transformed into structured data and used for alarms and other business applications in the data application layer.

[0110] Step 4: The training unit intelligently recommends new recognition and extraction libraries and sends them to the judgment unit at the application layer.

[0111] Step 5: The analysis unit determines whether the new identification and extraction libraries are valid. Valid identification and extraction libraries are sent to the identification and extraction units of the data restoration module for a new round of data restoration. Invalid identification and extraction libraries are discarded.

[0112] The mobile internet abnormal behavior early warning system and method provided in this invention can audit and warn of abnormal access data in the mobile internet, especially illegal websites. By combining AI training with manual judgment, it automatically updates the abnormal behavior identification library and the value information element extraction library, and reconstructs the abnormal behavior of the mobile internet, so as to realize real-time security checks on abnormal data generated by the mobile internet.

[0113] The following describes the early warning device for abnormal mobile internet behavior provided in the embodiments of the present invention. The early warning device for abnormal mobile internet behavior described below can be referred to in correspondence with the early warning method for abnormal mobile internet behavior described above.

[0114] Figure 4 This is a schematic diagram of the structure of the early warning device for abnormal mobile internet behavior provided in an embodiment of the present invention, with reference to... Figure 4 The mobile internet abnormal behavior early warning device provided in this embodiment of the invention may include:

[0115] The acquisition module 410 is used to collect massive amounts of mobile internet traffic data.

[0116] The identification module 420 is used to identify the massive traffic data based on the first identification library and determine abnormal traffic data;

[0117] Extraction module 430 is used to extract value information elements from the abnormal traffic data based on the first extraction library;

[0118] The early warning module 440 is used to issue early warnings for abnormal behavior of the mobile Internet based on the value information element.

[0119] In some embodiments, it also includes:

[0120] The determination module is used to train on unidentified traffic data to determine the second identification library;

[0121] An update module is used to update the first recognition library based on the second recognition library if the second recognition library is determined to be valid based on the similarity between the second recognition library and the first recognition library.

[0122] The mobile internet abnormal behavior early warning device provided in this embodiment of the invention quickly identifies abnormal traffic data in the mobile internet and extracts valuable information elements from the abnormal traffic data, thereby reconstructing the abnormal behavior of the mobile internet and providing effective early warning, improving early warning efficiency and realizing real-time security checks on abnormal data generated by the mobile internet.

[0123] Figure 5 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 5 As shown, the electronic device may include: a processor 510, a communications interface 520, a memory 530, and a communication bus 540, wherein the processor 510, the communications interface 520, and the memory 530 communicate with each other via the communication bus 540. The processor 510 can call logical instructions in the memory 530 to execute a method for early warning of abnormal mobile internet behavior, the method including:

[0124] Collect massive amounts of mobile internet traffic data;

[0125] Based on the first identification database, the massive traffic data is identified to determine abnormal traffic data;

[0126] Based on the first extraction library, extract the value information elements of the abnormal traffic data;

[0127] Based on the aforementioned value information elements, early warnings are issued for abnormal behaviors on the mobile Internet.

[0128] Furthermore, the logical instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0129] On the other hand, the present invention also provides a computer program product, the computer program product comprising a computer program that can be stored on a non-transitory computer-readable storage medium, wherein when the computer program is executed by a processor, the computer is able to execute the mobile Internet abnormal behavior early warning method provided by the above methods, the method comprising:

[0130] Collect massive amounts of mobile internet traffic data;

[0131] Based on the first identification database, the massive traffic data is identified to determine abnormal traffic data;

[0132] Based on the first extraction library, extract the value information elements of the abnormal traffic data;

[0133] Based on the aforementioned value information elements, early warnings are issued for abnormal behaviors on the mobile Internet.

[0134] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the mobile Internet abnormal behavior early warning method provided by the above methods, the method comprising:

[0135] Collect massive amounts of mobile internet traffic data;

[0136] Based on the first identification database, the massive traffic data is identified to determine abnormal traffic data;

[0137] Based on the first extraction library, extract the value information elements of the abnormal traffic data;

[0138] Based on the aforementioned value information elements, early warnings are issued for abnormal behaviors on the mobile Internet.

[0139] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0140] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0141] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for early warning of abnormal behavior in mobile internet, characterized in that, include: Collect massive amounts of mobile internet traffic data; Based on the first identification database, the massive traffic data is identified to determine abnormal traffic data; Based on the first extraction library, extract the value information elements of the abnormal traffic data; Based on the aforementioned value information elements, early warnings are issued for abnormal behaviors on the mobile Internet. Unidentified traffic data is sent to the training unit for intelligent learning. The training unit trains an XGBOOST classification model based on the unidentified traffic data to obtain a second identification library and a second extraction library. The training unit calculates the scores of the rules in the second identification library and the second extraction library according to the pre-set weights. The rules in the second identification library and the second extraction library are then displayed in the judgment unit according to the ranking of scores from high to low. The judgment unit is used to determine whether the second identification library and the second extraction library are valid, and sends the valid second identification library and the second extraction library to the identification unit and the extraction unit for a new round of data identification.

2. The method for early warning of abnormal behavior in mobile internet according to claim 1, characterized in that, The value information element includes at least one of the following: Withdrawal password, user login name, login password, real name, bank name, bank card number, and withdrawal amount.

3. The method for early warning of abnormal behavior in mobile internet according to claim 1, characterized in that, The step of identifying abnormal traffic data based on the first identification database includes: Based on the first identification library and the AC multi-mode matching algorithm, the massive traffic data is identified to determine abnormal traffic data.

4. A mobile internet abnormal behavior early warning device, characterized in that, include: The data collection module is used to collect massive amounts of mobile internet traffic data. The identification module is used to identify the massive traffic data based on the first identification library and determine abnormal traffic data; The extraction module is used to extract value information elements from the abnormal traffic data based on the first extraction library; The early warning module is used to provide early warnings for abnormal behaviors of the mobile Internet based on the value information element. The determination module is used to send unidentified traffic data to the training unit for intelligent learning. The training unit trains an XGBOOST classification model based on the unidentified traffic data to obtain a second identification library and a second extraction library. It calculates the scores of the rules in the second identification library and the second extraction library according to the pre-set weights, and displays the rules in the second identification library and the second extraction library in the judgment unit according to the ranking of scores from high to low. The judgment unit is used to determine whether the second identification library and the second extraction library are valid, and sends the valid second identification library and the second extraction library to the identification unit and the extraction unit for a new round of data identification.

5. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the early warning method for abnormal mobile internet behavior as described in any one of claims 1 to 3.

6. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the early warning method for abnormal mobile Internet behavior as described in any one of claims 1 to 3.

7. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the early warning method for abnormal mobile Internet behavior as described in any one of claims 1 to 3.

Images