Website Intrusion Detection Methods and Devices

Abstract

This invention provides a website intrusion detection method and apparatus, applied in the Internet field. The method includes: acquiring data to be detected and determining the similarity between the data to be detected and each training data in the detection training dataset; dividing the detection training dataset into two parts according to the similarity, wherein the training data with high similarity constitute a detection data circle; and determining the abnormal behavior detection result of the data to be detected based on the detection data circle. Both the training data and the data to be detected include basic website data and user behavior trajectory data, and the training data also includes abnormal behavior identification results. This method improves the accuracy of the detection results, avoiding the high fitting problem caused by excessive preprocessing in model training and the energy consumption caused by large amounts of computation. By biasing the training data through similarity, it avoids the influence of imbalanced detection data and can be applied to website monitoring with limited data resources.

Description

Technical Field

[0001] This invention relates to the Internet field, and more particularly to a website intrusion detection method and apparatus. Background Technology

[0002] With the rapid development of information technology, websites have become increasingly common in daily office work. However, malicious acts such as damaging website functions and illegally stealing or tampering with personal information and website resources have caused serious network information security problems. Website intrusion detection, as a proactive information security measure, can effectively compensate for the shortcomings of traditional protection technologies and is an important way to solve network information security problems. In website detection, the data that truly represents intrusion behavior is far less than the data on normal behavior. From a data analysis perspective, there is a severe imbalance in the amount of intrusion behavior data and normal behavior data. Therefore, accurately detecting website intrusion behavior under such data conditions becomes even more difficult.

[0003] Currently, the main method involves obtaining the feature vector corresponding to the packet to be detected and inputting it into a trained intrusion detection model to obtain the network intrusion detection result. The intrusion detection model utilizes theories such as feature vectors, dimensionality reduction, nearest neighbor, and density clustering during training.

[0004] However, the training data for this method comes from detection packets. When there is a severe lack of data on intrusion behavior compared to data on normal behavior, it cannot avoid the impact of data imbalance. The current method does not make effective use of information other than basic packet data, resulting in low accuracy. The current method has an excessively long training time. Most intrusion detection methods have low detection accuracy or even cannot complete modeling when data resources are limited. Summary of the Invention

[0005] To address the aforementioned problems in existing technologies, this invention provides a website intrusion detection method and apparatus.

[0006] This invention provides a website intrusion detection method, comprising: acquiring data to be detected and determining the similarity between the data to be detected and each training data in the detection training dataset; dividing the detection training dataset into two parts according to the similarity, wherein the training data with high similarity constitute a detection data circle; determining the abnormal behavior detection result of the data to be detected based on the detection data circle; wherein both the training data and the data to be detected include basic website data and user behavior trajectory data, and the training data also includes abnormal behavior identification results.

[0007] According to an embodiment of the website intrusion detection method of the present invention, the step of dividing the detection training dataset into two parts according to the similarity includes: when the detection training dataset is sorted from largest to smallest similarity, the detection training dataset is divided into two parts according to the boundary between the first abnormal behavior data and the normal behavior data.

[0008] According to an embodiment of the website intrusion detection method of the present invention, the step of determining the abnormal behavior detection result of the data to be detected based on the detection data circle includes: determining the abnormal density and normal density of the data to be detected and each training data in the detection data circle based on the density estimation method; mapping each training data in the detection data circle to a second training dataset according to the similarity, abnormal density and normal density, and mapping the data to be detected to a second data to be detected according to the similarity, abnormal density and normal density; and determining the abnormal behavior detection result of the second data to be detected based on the second training dataset.

[0009] According to a website intrusion detection method of an embodiment of the present invention, the abnormal density and the normal density are determined by combining a multivariate kernel function based on the total number of abnormal behavior data and the total number of normal behavior data in the detection data circle, respectively.

[0010] According to an embodiment of the website intrusion detection method of the present invention, the step of determining the abnormal behavior detection result of the second data to be detected based on the second training dataset includes: determining the similarity between the second data to be detected and each training data in the second detection training dataset; dividing the second detection training dataset into two parts based on the similarity, wherein the training data with high similarity constitutes the second data circle to be detected; and determining the abnormal behavior detection result of the second data to be detected based on the second data circle to be detected.

[0011] According to an embodiment of the website intrusion detection method of the present invention, determining the abnormal behavior detection result of the second data to be detected based on the second data circle to be detected includes: determining a first parameter based on the total number of abnormal behavior data in the second data circle to be detected and the total number of data in the second training dataset; determining a second parameter based on the total number of data in the second data circle to be detected and the total number of data in the second training dataset; and determining the probability that the second data to be detected belongs to abnormal behavior based on the ratio of the first parameter to the first parameter.

[0012] According to an embodiment of the website intrusion detection method of the present invention, before acquiring the data to be detected and determining the similarity between the data to be detected and each training data in the detection training dataset, the method further includes: determining candidate websites that are highly relevant to the websites in the detection training dataset based on the website basic data; supplementing the website basic data in the training data based on the website basic data of the candidate websites, or supplementing the user behavior trajectory data in the training data based on the user behavior trajectory data of the candidate websites.

[0013] The present invention also provides a website intrusion detection device, comprising: an acquisition module for acquiring data to be detected and determining the similarity between the data to be detected and each training data in the detection training dataset; a partitioning module for partitioning the detection training dataset into two parts according to the similarity, wherein the training data with high similarity constitute a detection data circle; and a processing module for determining the abnormal behavior detection result of the data to be detected according to the detection data circle; wherein both the training data and the data to be detected include basic website data and user behavior trajectory data, and the training data also includes abnormal behavior identification results.

[0014] According to an embodiment of the website intrusion detection device of the present invention, the partitioning module is specifically used to: when the detection training dataset is sorted from largest to smallest similarity, divide the detection training dataset into two parts according to the boundary between the first abnormal behavior data and the normal behavior data.

[0015] According to an embodiment of the website intrusion detection device of the present invention, the processing module is specifically configured to: determine the abnormal density and normal density in the detection data circle of the data to be detected and each training data in the detection data circle based on the density estimation method; map each training data in the detection data circle to a second training dataset according to the similarity, abnormal density and normal density, and map the data to be detected to a second data to be detected according to the similarity, abnormal density and normal density; and determine the abnormal behavior detection result of the second data to be detected according to the second training dataset.

[0016] According to an embodiment of the website intrusion detection device of the present invention, the abnormal density and the normal density are determined by combining a multivariate kernel function based on the total number of abnormal behavior data and the total number of normal behavior data in the detection data circle, respectively.

[0017] According to an embodiment of the website intrusion detection device of the present invention, the processing module is specifically configured to: determine the similarity between the second data to be detected and each training data in the second detection training dataset; divide the second detection training dataset into two parts according to the similarity, wherein the training data with high similarity constitutes the second data circle to be detected; and determine the abnormal behavior detection result of the second data to be detected according to the second data circle to be detected.

[0018] According to an embodiment of the website intrusion detection device of the present invention, the processing module is specifically configured to: determine a first parameter based on the total number of abnormal behavior data in the second detection data circle and the total number of data in the second training dataset; determine a second parameter based on the total number of data in the second detection data circle and the total number of data in the second training dataset; and determine the probability that the second detection data belongs to abnormal behavior based on the ratio of the first parameter to the first parameter.

[0019] According to an embodiment of the present invention, a website intrusion detection device further includes a fusion module, configured to: determine candidate websites that are highly correlated with websites in the detection training dataset based on website basic data; supplement the website basic data in the training data based on the website basic data of the candidate websites, or supplement the user behavior trajectory data in the training data based on the user behavior trajectory data of the candidate websites.

[0020] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of any of the website intrusion detection methods described above.

[0021] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the website intrusion detection methods described above.

[0022] The website intrusion detection method and apparatus provided by this invention combine website basic data and user behavior trajectory data, making full use of the correlation between the two, thereby achieving higher accuracy of detection results. It biases abnormal behavior data and normal behavior data to a certain extent through similarity without relying on model training, avoiding the high fitting degree problem and high energy consumption problem caused by excessive preprocessing of model training. Moreover, it can be applied to situations with limited data resources, avoiding the impact of imbalanced detection data. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0024] Figure 1 This is a flowchart illustrating the website intrusion detection method provided by the present invention;

[0025] Figure 2 This is a schematic diagram of the website intrusion detection device provided by the present invention;

[0026] Figure 3 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0028] The following is combined with Figures 1-3 This invention describes a website intrusion detection method and apparatus. Figure 1 This is a flowchart illustrating the website intrusion detection method provided by the present invention, as shown below. Figure 1 As shown, the present invention provides a website intrusion detection method, including:

[0029] 101. Obtain the data to be detected and determine the similarity between the data to be detected and each training data in the detection training dataset; wherein, the training data and the data to be detected both include website basic data and user behavior trajectory data, and the training data also includes abnormal behavior identification results.

[0030] Before conducting the detection, the detection training dataset is determined. The detection training dataset includes multiple training data sets. Each training data set includes basic website data, user behavior trajectory data, and the identification result of whether the behavior trajectory data represents abnormal behavior. Specifically, the detection training dataset includes data related to abnormal behavior and data related to normal behavior, with the relevant databases being the aforementioned basic website data and the corresponding user behavior trajectory data.

[0031] Among them, the website basic data is the static attribute data of the website. This invention does not specifically limit the content of the website basic data. For example, it can be several items from the following: communication message data, communication connection data (related information about the communication connection, such as which protocol is used to connect), system information data (such as whether there are frames and style sheets, and the form of the style sheets, whether they are external or internal styles), security level data (such as security level values), website keywords, keyword frequency (the frequency of keywords appearing in the website), keyword density, and keyword position (such as appearing in the title or in the content).

[0032] User behavior trajectory data is behavioral data generated by users interacting with websites. For example, it can be several items such as the amount of data traffic, memory and CPU usage ratio, login time, logout time, access frequency, and login duration during the user's access process.

[0033] For example, with administrator privileges, website system logs can be collected, and user behavior data can be obtained based on traffic data, system memory and CPU usage, and other data in the system logs.

[0034] The website's basic data constitutes the website's static dataset D1, and the user behavior trajectory data constitutes the website's dynamic dataset D2. The website's static dataset and dynamic dataset together form the detection training dataset D.

[0035] For the data to be detected, the same methods described above can be used to obtain its basic website data and user behavior trajectory data. The results of identifying abnormal user behavior are yet to be determined, i.e., it is necessary to determine whether the user's access behavior constitutes an intrusion. The data to be detected may include multiple records, which together constitute the dataset D3 to be detected.

[0036] The similarity between each piece of data to be detected and each piece of training data in the detection training dataset is calculated. Specifically, the data to be detected and the training data can be processed by feature extraction or index parameter quantization to obtain corresponding feature vectors, and then normalized. The similarity is then calculated from each feature vector.

[0037] For example, Euclidean distance can be used to calculate the similarity between the data to be detected x and each data point in the detection training dataset D:

[0038]

[0039] Where, x i This represents the i-th training data in the training dataset D. Indicates the data to be detected x and x iThe similarity is denoted by , where i is a positive integer not greater than N. Here, N is the total number of data points in the detection training dataset, and N is greater than or equal to 2. Understandably, to improve the accuracy of the detection results, within the computational cost range, the larger N is, the better.

[0040] 102. Based on the similarity, the detection training dataset is divided into two parts, wherein the training data with high similarity constitutes the target detection training dataset.

[0041] Based on similarity, the part of the data to be detected with high similarity is selected from the detection training dataset. This part constitutes the detection data circle and participates in the identification of behavioral anomalies in the data to be detected.

[0042] 103. Based on the aforementioned detection data circle, determine the abnormal behavior detection result of the data to be detected.

[0043] For example, based on the detection data sphere, a detection model is constructed to determine the abnormal behavior detection result of the data to be detected. Specifically, the probability of an anomaly in the data to be detected can be determined based on the number of abnormal behavior data points in the detection data sphere and the detection training dataset, as well as the total number of data points in the detection data sphere and the detection training dataset, and this probability can be used as the abnormal behavior detection result for the data to be detected.

[0044] Of course, it can also be achieved through training using existing models. However, since the data used in the training of this invention is only a portion of the data in the detection data circle, and has been biased to a certain extent between abnormal behavior data and normal behavior data, it can avoid over-preprocessing of model training to a certain extent and reduce computational overhead to a certain extent.

[0045] Finally, based on the detection results of abnormal behavior, such as the predicted probability of abnormality, early warnings or interception are issued for website operations or user behaviors with a high probability of intrusion.

[0046] The website intrusion detection method of the present invention combines basic website data and user behavior trajectory data, making full use of the correlation between the two, thereby achieving higher accuracy of detection results. It biases abnormal behavior data and normal behavior data to a certain extent through similarity without relying on model training, avoiding the problems of high fitting degree and high energy consumption caused by excessive preprocessing of model training. Moreover, it can be applied to situations with limited data resources, avoiding the impact of imbalanced detection data.

[0047] In one embodiment, the detection training dataset is divided into two parts, including: when the detection training dataset is sorted by similarity from largest to smallest, the detection training dataset is divided into two parts according to the boundary between the first abnormal behavior data and the normal behavior data.

[0048] First, the training data in the detection training dataset D are sorted in descending order of their similarity values ​​with the data to be detected, x. Then, the first "abnormal-normal" data boundary in this descending order is used as the boundary of the detection data circle c(x) with high similarity, thus giving a certain bias to anomalous behavior data (rare class). Finally, data in the detection training dataset D with similarity values ​​greater than the boundary of the high similarity data circle c(x) are all assigned to the high similarity detection data circle c(x). This invention calls this method the "Dynamic Rare Class Bias Method".

[0049] In this embodiment of the invention, the abnormal behavior data and normal behavior data are biased to different degrees by means of dynamic rare class bias, which further avoids the high fitting degree problem and high energy consumption problem caused by excessive model preprocessing in the prior art, and can be applied to the case of limited data resources.

[0050] In one embodiment, determining the abnormal behavior detection result of the data to be detected based on the detection data circle includes: determining the abnormal density and normal density of the data to be detected and each training data in the detection data circle based on a density estimation method; mapping each training data in the detection data circle to a second training dataset based on similarity, abnormal density, and normal density, and mapping the data to be detected to a second data to be detected based on similarity, abnormal density, and normal density; and determining the abnormal behavior detection result of the second data to be detected based on the second training dataset.

[0051] For example, for each piece of data to be detected in the dataset D3, the detection data circle in the detection training dataset is selected according to the dynamic rare class bias method in the above steps.

[0052] Then, using a multivariate kernel density estimation method, the anomalous density and normal density of the detection training dataset and each piece of data to be detected within its detection data circle are calculated. This is equivalent to performing data environment density localization, resulting in two derived indices: anomalous density and normal density. Anomalous density and normal density respectively reflect the probability of the training data or the data to be detected being normal or anomalous within the detection data circle.

[0053] Next, the training dataset D in the original data space is mapped to a three-dimensional mapping space Φ consisting of similarity, data circle anomaly density, and data circle normal density for dimensionality reduction, generating a three-dimensional mapped training dataset D′, which is the second training dataset. The data to be detected x is then mapped to the three-dimensional mapping space Φ, resulting in the data to be detected x′, which is the second data to be detected.

[0054] Then, based on the second data to be detected and the second training dataset, the abnormal behavior detection result of the second data to be detected is determined, as described in step 103 of the above embodiment, determining the probability that the second data to be detected is abnormal behavior data. Accordingly, the second data to be detected and the data to be detected are the same data, thereby determining the abnormal behavior detection result of the data to be detected.

[0055] The website intrusion detection method of this invention maps each training data point in the detection data circle to the data to be detected based on similarity, abnormal density, and normal density, thereby achieving dimensionality reduction of the detection data and training data and effectively reducing computational overhead.

[0056] In one embodiment, the abnormal density and the normal density are determined by combining a multivariate kernel function based on the total number of abnormal behavior data and the total number of normal behavior data in the detection data circle, respectively.

[0057] The embodiments of the present invention do not specifically limit the calculation methods for abnormal density and normal density. Examples are given below, where normal density and abnormal density are determined based on multivariate kernel density estimation. The calculation methods for normal density and abnormal density respectively include:

[0058]

[0059]

[0060] Among them, the data to be detected and the N data points in the detection training dataset D together constitute a set of N+1 data; x i or x j This represents the i-th or j-th data point in the set, where i and j are positive integers not greater than N+1, and N is the total number of data points in the training dataset. |c(x i ) 正常 |and|c(x) i ) 异常 | represent the data sphere c(x) respectively i The total amount of data in the normal behavior data and abnormal behavior data. It is a multivariate kernel function, which includes trigonometric kernel functions, gamma kernel functions, and Gaussian kernel functions. In this embodiment of the invention, the Gaussian kernel function is used. Here, h is the bandwidth of the multivariate kernel function.

[0061] In one embodiment, determining the abnormal behavior detection result of the second data to be detected based on the second training dataset includes: determining the similarity between the second data to be detected and each training data in the second detection training dataset; dividing the second detection training dataset into two parts based on the similarity, wherein the training data with high similarity constitute the second data circle to be detected; and determining the abnormal behavior detection result of the second data to be detected based on the second data circle to be detected.

[0062] Specifically, in the second detection training dataset D′, a second detection data circle c(x)′ is selected from the data to be detected x′ according to similarity. Then, based on the above method, the abnormal behavior detection result of the second detection data is determined according to the second detection data circle c(x)′.

[0063] In this embodiment of the invention, based on the second detection training dataset, the abnormal behavior data and normal behavior data are biased again, thereby further avoiding the problem of high fitting degree and computational overhead.

[0064] In one embodiment, determining the abnormal behavior detection result of the second data to be detected based on the second data circle to be detected includes: determining a first parameter based on the total number of abnormal behavior data in the second data circle to be detected and the total number of data in the second training dataset; determining a second parameter based on the total number of data in the second data circle to be detected and the total number of data in the second training dataset; and determining the probability that the second data to be detected belongs to abnormal behavior based on the ratio of the first parameter to the first parameter.

[0065] For example, the probability calculation method for the second piece of data to be detected to belong to abnormal behavior includes the following:

[0066]

[0067] Wherein, |c(x)′| and |D′| represent the total number of data in the data circle c(x)′ (i.e., the second data circle to be detected) of x′ and the total number of data in the three-dimensional mapping training dataset D′ (i.e., the second training dataset), respectively. The numerator and denominator correspond to the first parameter and the second parameter of this embodiment of the invention, respectively.

[0068] In one embodiment, before acquiring the data to be detected and determining the similarity between the data to be detected and each training data in the detection training dataset, the method further includes: determining candidate websites that are highly relevant to the websites in the detection training dataset based on the website basic data; supplementing the website basic data in the training data based on the website basic data of the candidate websites, or supplementing the user behavior trajectory data in the training data based on the user behavior trajectory data of the candidate websites.

[0069] Current intrusion detection methods do not utilize the correlation between similar websites, and when modeling detection, they only perform small-scale modeling for a single website or a single domain. The resulting network security models have strong limitations and lack good generalization ability.

[0070] In this embodiment of the invention, the relevance of each website can be determined based on the correlation coefficient. A relevance matrix for each website is obtained from the static website dataset D1. If there are n websites in the static website dataset D1 and m websites in the other website set D0 participating in the relevance calculation, then the websites belonging to the two sets are considered as follows: i and website web j The relevance is determined by R(web) i web j The correlation matrix can be represented as:

[0071]

[0072] Among them, R (web) i web j In the set D1, i and j represent the i-th website and the j-th website of D0, respectively. n is a positive integer greater than or equal to 2, and m is a positive integer greater than or equal to 1.

[0073] If there is little static website data in the training dataset, then candidate websites with high relevance are identified, and their website information is used to supplement the static website data. If there is little user behavior trajectory information, then user behavior trajectory data from candidate websites with high relevance can be used to supplement it appropriately.

[0074] The website intrusion detection method of this invention improves the generalization ability of the intrusion detection model by integrating the correlation between website data and the similarity between detection samples in similar network environments, increases the applicability of the model in predicting websites with less website data, and further improves its detection accuracy.

[0075] The website intrusion detection device provided by the present invention is described below. The website intrusion detection device described below can be referred to in correspondence with the website intrusion detection method described above.

[0076] Figure 2 This is a schematic diagram of the website intrusion detection device provided by the present invention, as shown below. Figure 2As shown, the website intrusion detection device includes: an acquisition module 201, a segmentation module 202, and a processing module 203. The acquisition module 201 acquires the data to be detected and determines the similarity between the data to be detected and each training data in the detection training dataset. The segmentation module 202 divides the detection training dataset into two parts based on the similarity, where the training data with high similarity constitute a detection data circle. The processing module 203 determines the abnormal behavior detection result of the data to be detected based on the detection data circle. Both the training data and the data to be detected include basic website data and user behavior trajectory data; the training data also includes abnormal behavior identification results.

[0077] In one embodiment of the apparatus, the partitioning module 202 is specifically used to: when the detection training dataset is sorted from largest to smallest similarity, divide the detection training dataset into two parts according to the boundary between the first abnormal behavior data and the normal behavior data.

[0078] In one embodiment, the processing module 203 is specifically configured to: determine the abnormal density and normal density in the detection data circle for each training data in the detection data circle based on the density estimation method; map each training data in the detection data circle to a second training dataset according to the similarity, abnormal density, and normal density, and map the data to be detected to a second data to be detected according to the similarity, abnormal density, and normal density; and determine the abnormal behavior detection result of the second data to be detected based on the second training dataset.

[0079] In one device embodiment, the abnormal density and the normal density are determined based on the total number of abnormal behavior data and the total number of normal behavior data in the detection data circle, respectively, combined with a multivariate kernel function.

[0080] In one embodiment of the apparatus, the processing module 203 is specifically configured to: determine the similarity between the second data to be detected and each training data in the second detection training dataset; divide the second detection training dataset into two parts according to the similarity, wherein the training data with high similarity constitutes the second data circle to be detected; and determine the abnormal behavior detection result of the second data to be detected according to the second data circle to be detected.

[0081] In one embodiment of the apparatus, the processing module 203 is configured to: determine a first parameter based on the total number of abnormal behavior data in the second detection data circle and the total number of data in the second training dataset; determine a second parameter based on the total number of data in the second detection data circle and the total number of data in the second training dataset; and determine the probability that the second detection data belongs to abnormal behavior based on the ratio of the first parameter to the first parameter.

[0082] In one embodiment of the apparatus, a fusion module is further included, configured to: determine candidate websites that are highly correlated with websites in the detection training dataset based on website basic data; supplement the website basic data in the training data based on the website basic data of the candidate websites, or supplement the user behavior trajectory data in the training data based on the user behavior trajectory data of the candidate websites.

[0083] The device embodiments provided by the present invention are for implementing the above-described method embodiments. For specific processes and details, please refer to the above-described method embodiments, which will not be repeated here.

[0084] The website intrusion detection device provided by this invention combines website basic data and user behavior trajectory data, making full use of the correlation between the two, thereby achieving higher accuracy in detection results. It biases abnormal behavior data and normal behavior data to a certain extent through similarity without relying on model training, avoiding the problems of high fitting degree and high energy consumption caused by excessive preprocessing in model training. Moreover, it can be applied to situations with limited data resources, avoiding the impact of imbalanced detection data.

[0085] Figure 3 This is a schematic diagram of the structure of the electronic device provided by the present invention, such as... Figure 3 As shown, the electronic device may include a processor 301, a communications interface 302, a memory 303, and a communication bus 304. The processor 301, communications interface 302, and memory 303 communicate with each other via the communication bus 304. The processor 301 can call logical instructions in the memory 303 to execute a website intrusion detection method. This method includes: acquiring data to be detected and determining the similarity between the data to be detected and each training data in the detection training dataset; dividing the detection training dataset into two parts based on the similarity, wherein the training data with high similarity constitute a detection data circle; and determining the abnormal behavior detection result of the data to be detected based on the detection data circle. Both the training data and the data to be detected include basic website data and user behavior trajectory data, and the training data also includes abnormal behavior recognition results.

[0086] Furthermore, the logical instructions in the aforementioned memory 303 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0087] On the other hand, the present invention also provides a computer program product, the computer program product comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions, wherein when the program instructions are executed by a computer, the computer is able to execute the website intrusion detection method provided by the above methods, the method comprising: acquiring data to be detected and determining the similarity between the data to be detected and each training data in the detection training dataset; dividing the detection training dataset into two parts according to the similarity, wherein the training data with high similarity constitutes a detection data circle; determining the abnormal behavior detection result of the data to be detected according to the detection data circle; wherein both the training data and the data to be detected include website basic data and user behavior trajectory data, and the training data also includes abnormal behavior identification results.

[0088] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the website intrusion detection method provided in the above embodiments. The method includes: acquiring data to be detected and determining the similarity between the data to be detected and each training data in the detection training dataset; dividing the detection training dataset into two parts according to the similarity, wherein the training data with high similarity constitutes a detection data circle; and determining the abnormal behavior detection result of the data to be detected according to the detection data circle; wherein both the training data and the data to be detected include basic website data and user behavior trajectory data, and the training data also includes abnormal behavior identification results.

[0089] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0090] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0091] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A website intrusion detection method, characterized in that, include: Obtain the data to be detected and determine the similarity between the data to be detected and each training data in the detection training dataset; Based on the similarity, the detection training dataset is divided into two parts, wherein the training data with high similarity constitutes the detection data circle; Based on the aforementioned detection data circle, determine the abnormal behavior detection result of the data to be detected; The training data and the data to be detected both include basic website data and user behavior trajectory data, and the training data also includes abnormal behavior identification results; The step of determining the abnormal behavior detection result of the data to be detected based on the detection data circle includes: Based on the density estimation method, the abnormal density and normal density in the detection data circle are determined for the data to be detected and each training data in the detection data circle. Based on similarity, abnormal density, and normal density, each training data in the detection data circle is mapped to a second training dataset, and based on similarity, abnormal density, and normal density, the data to be detected is mapped to the second data to be detected. Based on the second training dataset, determine the abnormal behavior detection results of the second data to be detected.

2. The website intrusion detection method according to claim 1, characterized in that, The detection training dataset is divided into two parts based on the similarity, including: When the detection training dataset is sorted from largest to smallest similarity, it is divided into two parts according to the boundary between the first abnormal behavior data and the normal behavior data.

3. The website intrusion detection method according to claim 1, characterized in that, The abnormal density and the normal density are determined based on the total number of abnormal behavior data and the total number of normal behavior data in the detection data circle, respectively, combined with a multivariate kernel function.

4. The website intrusion detection method according to claim 1, characterized in that, The step of determining the abnormal behavior detection result of the second data to be detected based on the second training dataset includes: Determine the similarity between the second data to be detected and each training data in the second detection training dataset; Based on the similarity, the second detection training dataset is divided into two parts, wherein the training data with high similarity constitutes the second detection data circle; Based on the second data circle to be detected, the abnormal behavior detection result of the second data to be detected is determined.

5. The website intrusion detection method according to claim 4, characterized in that, The step of determining the abnormal behavior detection result of the second data to be detected based on the second data circle to be detected includes: The first parameter is determined based on the total number of abnormal behavior data in the second data circle to be detected and the total number of data in the second training dataset. The second parameter is determined based on the total number of data in the second detection data circle and the total number of data in the second training dataset. The probability that the second data to be detected belongs to abnormal behavior is determined based on the ratio of the first parameter to the first parameter.

6. The website intrusion detection method according to claim 1, characterized in that, Before acquiring the data to be detected and determining the similarity between the data to be detected and each training data in the detection training dataset, the method further includes: Based on the website's basic data, candidate websites that are highly relevant to the websites in the detection training dataset are identified. The basic website data in the training data is supplemented based on the basic website data of the candidate websites, or the user behavior trajectory data in the training data is supplemented based on the user behavior trajectory data of the candidate websites.

7. A website intrusion detection device, characterized in that, include: The acquisition module is used to acquire the data to be detected and determine the similarity between the data to be detected and each training data in the detection training dataset; The partitioning module is used to divide the detection training dataset into two parts based on the similarity, wherein the training data with high similarity constitutes the detection data circle; The processing module is used to determine the abnormal behavior detection result of the data to be detected based on the detection data circle; The training data and the data to be detected both include basic website data and user behavior trajectory data, and the training data also includes abnormal behavior identification results; The processing module is specifically configured to: determine the abnormal density and normal density of the data to be detected and each training data in the detection data circle based on the density estimation method; map each training data in the detection data circle to a second training dataset according to similarity, abnormal density, and normal density, and map the data to be detected to a second data to be detected according to similarity, abnormal density, and normal density; and determine the abnormal behavior detection result of the second data to be detected based on the second training dataset.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the website intrusion detection method as described in any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the website intrusion detection method as described in any one of claims 1 to 6.

Images