Attack identification method and device based on mouse trajectory data in network traffic

Abstract

Embodiments of the present disclosure provide a method and apparatus for attack identification based on mouse trajectory data in network traffic. The method includes: collecting and parsing mouse trajectory data from network traffic; preprocessing the mouse trajectory data; analyzing and extracting features from the preprocessed mouse trajectory data, and normalizing the features; generating a training sample set based on the normalized features for model training, generating a logistic regression classification model for automated attack identification; and using the logistic regression classification model to identify mouse trajectory data in web pages. This method effectively identifies automated attacks while minimizing the impact on user experience.

Description

Technical Field

[0001] The present disclosure relates to the field of information security technology, and in particular to an attack identification method and device based on mouse trajectory data in network traffic. Background Art

[0002] With the rapid development of internet technology, cybercrime techniques are constantly being optimized and matured. The internet is flooded with an increasing number of automated attack traffic, potentially from automated attacks and web crawlers within the black and gray industry chains. A successful attack can cause immeasurable damage to users or businesses.

[0003] Traditional automated attack detection methods primarily rely on verification codes. If a user correctly completes the verification code, they are considered a real person; otherwise, they are considered an automated attack and intercepted. However, this method significantly impacts the user experience, especially for older users less familiar with the internet, who are often unable to use features due to their inability to correctly complete the verification code within the specified time. Furthermore, the availability of manual verification code generation or machine learning methods to help automated tools correctly complete verification codes has gradually reduced the effectiveness of verification codes.

[0004] Therefore, it is crucial to effectively identify automated attacks without affecting user experience. Summary of the Invention

[0005] The present disclosure provides an attack identification method and device based on mouse trajectory data in network traffic, which can effectively identify automated attacks.

[0006] According to a first aspect of the present disclosure, a method for identifying attacks based on mouse trajectory data in network traffic is provided. The method comprises:

[0007] Collect and analyze mouse trajectory data in network traffic; the mouse trajectory data includes mouse trajectory data generated by automated attacks and mouse trajectory data generated by users;

[0008] Preprocess the mouse trajectory data; analyze and extract the features of the preprocessed mouse trajectory data, and standardize the features;

[0009] Generate a training sample set based on the standardized features for model training, and generate a logistic regression classification model for automated attack identification;

[0010] Use logistic regression classification model to identify mouse trajectory data in web pages.

[0011] In some implementations of the first aspect, preprocessing the mouse trajectory data includes:

[0012] Filter and delete abnormal data in mouse trajectory data;

[0013] Perform trajectory integration on the filtered mouse trajectory data;

[0014] Draw a trajectory map based on the results of trajectory integration.

[0015] In some implementations of the first aspect, analyzing and extracting features of the preprocessed mouse trajectory data and normalizing the features include:

[0016] Analyze the differences between the mouse trajectory data generated by automated attacks and the mouse trajectory data generated by users in the trajectory graph;

[0017] Extract differential features and represent them using vectors;

[0018] The z-score algorithm is used to standardize the features.

[0019] In some implementations of the first aspect, generating a training sample set based on the standardized features for model training to generate a logistic regression classification model for automated attack identification includes:

[0020] According to the standardized features;

[0021] The preprocessed mouse trajectory data is used as samples;

[0022] The sample type corresponding to each sample is used as the sample label, and a training sample set is generated based on each sample and its corresponding label;

[0023] Determine the evaluation indicators of the model, use the training sample set to train the model, and generate a logistic regression classification model for automated attack identification.

[0024] In some implementations of the first aspect, the sample type includes:

[0025] Mouse tracking data generated by automated attacks and mouse tracking data generated by users.

[0026] In some implementations of the first aspect, using a logistic regression classification model to identify mouse trajectory data in a webpage includes:

[0027] Preprocess the mouse trajectory data in the web page;

[0028] Analyze and extract the features of the preprocessed data and standardize the features;

[0029] The standardized features are input into the logistic regression classification model for identification.

[0030] According to a second aspect of the present disclosure, an attack identification device based on mouse trajectory data in network traffic is provided. The device includes:

[0031] Collection module, collects mouse trajectory data in network traffic;

[0032] Parsing module, which parses the mouse trajectory data in network traffic;

[0033] Preprocessing module, preprocesses the mouse trajectory data;

[0034] Feature extraction module, which analyzes and extracts the features of the preprocessed mouse trajectory data and standardizes the features;

[0035] Model training module, which performs model training based on the standardized features;

[0036] Model generation module, which generates a logistic regression classification model for automated attack identification.

[0037] According to a third aspect of the present disclosure, an electronic device is provided. The electronic device includes: at least one processor; and a memory communicatively connected to the at least one processor; the memory storing instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the method described above.

[0038] According to a fourth aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, where the computer instructions are used to cause a computer to execute the method described above.

[0039] In this disclosure, a logistic regression classification model capable of identifying automated attacks is trained using mouse traces generated by automated attacks and mouse traces generated by normal users as samples. This method increases the difficulty of bypassing automated attacks and can effectively protect the interests of other users and enterprises.

[0040] It should be understood that the contents described in the Summary of the Invention section are not intended to limit the key or important features of the embodiments of the present disclosure, nor are they intended to limit the scope of the present disclosure. Other features of the present disclosure will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. The accompanying drawings are provided for a better understanding of the present disclosure and do not constitute a limitation of the present disclosure. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements, among which:

[0042] Figure 1A flowchart of an attack identification method based on mouse trajectory data in network traffic provided by an embodiment of the present disclosure is shown;

[0043] Figure 2 A schematic diagram of the overall process of an attack identification method based on mouse trajectory data in network traffic provided by an embodiment of the present disclosure is shown;

[0044] Figure 3 A data preprocessing flow chart of an attack identification method based on mouse trajectory data in network traffic provided by an embodiment of the present disclosure is shown;

[0045] Figure 4 A feature extraction flow chart of an attack identification method based on mouse trajectory data in network traffic provided by an embodiment of the present disclosure is shown;

[0046] Figure 5-Figure 7 An exemplary mouse trajectory diagram generated by an automated attack provided by an embodiment of the present disclosure is shown;

[0047] Figure 8 An exemplary mouse trajectory diagram generated by a user according to an embodiment of the present disclosure is shown;

[0048] Figure 9 shows a mouse trajectory diagram generated according to mouse data provided by an embodiment of the present disclosure;

[0049] Figure 10 A block diagram of an attack identification device based on mouse trajectory data in network traffic provided by an embodiment of the present disclosure is shown;

[0050] Figure 11 A block diagram of an exemplary electronic device capable of implementing embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0051] To make the purpose, technical solutions, and advantages of the embodiments of the present disclosure more clear, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments of the present disclosure, all other embodiments obtained by ordinary technicians in this field without making any creative efforts are within the scope of protection of the present disclosure.

[0052] In this document, the term "and / or" simply describes a relationship between related objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A exists alone, A and B exist simultaneously, or B exists alone. Furthermore, the character " / " in this document generally indicates that the related objects are in an "or" relationship.

[0053] In response to the problems mentioned in the background technology, the embodiments of the present disclosure provide an attack identification method and device based on mouse trajectory data in network traffic, which can effectively identify automated attacks.

[0054] Specifically, combined Figure 2 To explain, Figure 2 FIG. 1 shows a schematic diagram of the overall process of an attack identification method based on mouse trajectory data in network traffic provided by an embodiment of the present disclosure. Figure 2 As shown, the mouse trajectory data in the network traffic is collected and parsed; the mouse trajectory data is preprocessed; the features of the preprocessed mouse trajectory data are analyzed and extracted, and the features are standardized; a training sample set is generated based on the standardized features for model training, and a logistic regression classification model for automated attack identification is generated; the trained logistic regression classification model is used to identify the mouse trajectory data in the web page, determine whether it is an automated attack, and output a judgment structure.

[0055] In this way, it is possible to increase the difficulty of bypassing automated attacks and effectively identify automated attacks without affecting the user experience.

[0056] The attack identification method based on mouse trajectory data in network traffic provided by the embodiment of the present disclosure is described in detail below with reference to the accompanying drawings through specific embodiments.

[0057] Figure 1 FIG. 1 shows a flow chart of an attack identification method based on mouse trajectory data in network traffic provided by an embodiment of the present disclosure; FIG. Figure 1 As shown, the attack identification method 100 based on mouse trajectory data in network traffic may include the following steps:

[0058] S110: Collect and analyze mouse trajectory data in network traffic.

[0059] The mouse track data includes the mouse track data generated by automated attacks and the mouse track data generated by users.

[0060] Specifically, the following information can be collected in sections:

[0061] track_id, ip, and the number of each track.

[0062] track_id is a unique identifier of a user's track, which may be composed of multiple track segments.

[0063] ip, access path, log_time, obtain ip information.

[0064] Each trajectory segment is a time series data consisting of trajectory points of varying lengths, and the number of each trajectory segment can be recorded according to log_time.

[0065] For example, it can be set to collect trajectory points every 15ms, and each trajectory point collects mouse events (including: single-click press, single-click pop-up, double-click press, double-click pop-up, movement, etc.), the x-axis coordinate of the mouse on the screen, the y-axis coordinate of the mouse on the screen, the time difference between the time when the event occurs and the first point, and other similar mouse information.

[0066] S120 , preprocessing the mouse trajectory data; analyzing and extracting features of the preprocessed mouse trajectory data, and performing standardization on the features.

[0067] The following combination Figure 3 The preprocessing of mouse trajectory data is described in detail. Figure 3 FIG. 1 shows a data preprocessing flow chart of an attack identification method based on mouse trajectory data in network traffic provided by an embodiment of the present disclosure. Figure 3 As shown, preprocessing the mouse trajectory data may include:

[0068] Filter and delete abnormal data in mouse trajectory data.

[0069] Specifically, it is difficult for a mouse to accurately touch the [0,0] point on the screen under normal circumstances. The trajectory points with coordinates at [0,0] are mostly abnormal data, and such abnormal data is deleted.

[0070] The filtered mouse trajectory data is integrated.

[0071] Specifically, multiple tracks for each track_id are integrated into a complete track. During the integration process, segmentation is required in the following situations:

[0072] When the mouse moves in / out of the window: When the time interval between two track points exceeds a certain length of time and the distance between the two points is large, the mouse is likely to be moving in / out of the window. The point where the coordinate spacing of the x-axis and y-axis exceeds the preset range is the track point of the mouse moving in / out of the window. This point is used as a marker to divide the entire track into two segments.

[0073] For example, if the time interval between two points exceeds 500ms, and the coordinate spacing of the x-axis and y-axis exceeds 200, then the point is the trajectory point where the mouse moves in / out of the window, and the entire trajectory is divided into two segments using this point as a mark.

[0074] When the time difference between two trajectories is greater than 5 minutes, the entire trajectory is divided into two segments.

[0075] After the last click event of an entire track, all mouse operations will not be submitted to the server, and the track will be deleted without further analysis.

[0076] Draw a trajectory map based on the results of trajectory integration, tile the data and output the trajectory map.

[0077] Specifically, each integrated trajectory is drawn into an image of the same size, such as Figure 5-Figure 8 As shown, Figure 5-Figure 7 An exemplary mouse trajectory diagram generated by an automated attack provided by an embodiment of the present disclosure is shown; Figure 8 An exemplary mouse trajectory diagram generated by a user provided by an embodiment of the present disclosure is shown.

[0078] In some embodiments, analyzing and extracting features of the preprocessed mouse trajectory data and normalizing the features may include:

[0079] Analyze the differences between the mouse trajectory data generated by automated attacks and the mouse trajectory data generated by users in the trajectory graph.

[0080] Specifically, if Figure 5-Figure 7 As shown in Figure 2, most automated attacks use tool-generated trajectories to access web pages. The generated trajectories are simple, with many straight lines and broken lines. Figure 8 As shown, user-generated mouse data generates numerous trajectory curves, and different people's trajectories vary significantly. We can analyze the differences between automated attack trajectories and user trajectories through images and extract discriminative features using vector representations.

[0081] Extract differential features and represent them using vectors.

[0082] The following combination Figure 4 A detailed explanation of extracting difference features and using vectors to represent features is provided. Figure 4 FIG. 4 shows a feature extraction flow chart of an attack identification method based on mouse trajectory data in network traffic provided by an embodiment of the present disclosure; FIG. Figure 4 As shown, feature extraction can include:

[0083] Calculate entropy.

[0084] Specifically, if Figure 5 As shown in the figure, when the mouse moves, the coordinates jitter like a sawtooth, and the ratio of the jitter to the entire trajectory is counted as entropy.

[0085] Definition of jitter: If the mouse suddenly moves in the opposite direction or stops moving forward, and then returns to the original direction within a few track points, the number of jitters is +1. The number of jitters in the x-axis and y-axis directions is calculated separately.

[0086] Definition of jitter ratio: number of jitters / (2*number of track points).

[0087] It should be noted that the trajectory segment is calculated only when it exceeds a certain number of trajectory points. If the trajectory is too short, the default value is 0.

[0088] Calculate diffLastAngleRatio.

[0089] Specifically, if Figure 6 As shown in , if the trajectory turns multiple times but moves in a straight line after each turn, the ratio of the number of turns to the entire trajectory is counted as diffLastAngleRatio.

[0090] Regarding the angle definition: When the Manhattan distance between two trajectory points is greater than 10, it is a vector, and the angle between the vector and the x-axis is calculated.

[0091] Definition of a turn: If the current angle is different from the previous angle, the number of turns is +1.

[0092] Definition of turn ratio: 100*number of turns / total number of angles.

[0093] Calculate timeStampSmallerCount.

[0094] Specifically, the number of times the timestamp of a track point in the entire track is smaller than the timestamp of the previous track point is counted to calculate timeStampSmallerCount.

[0095] Calculate moveSkipCount.

[0096] Specifically, if Figure 7 As shown, multiple curves in the trajectory are connected by a straight line, which means there is no trajectory point on the straight line. The number of skip points during the mouse movement is counted as moveSkipCount.

[0097] Definition of jump point: For mouse movement events, the next movement distance suddenly increases compared to the previous movement distance. The condition for the distance to suddenly increase is: last_dis<5, remember last_dis=5, last_dis*100 <cur_dis。

[0098] Finally, the trajectory represented by the feature vector is output.

[0099] The z-score algorithm is used to standardize the features.

[0100] Specifically, the z-score algorithm is used to normalize the trajectory represented by the feature vector.

[0101] S130, generating a training sample set based on the standardized features for model training, and generating a logistic regression classification model for automated attack identification;

[0102] In some embodiments, a training sample set is generated based on the standardized features to perform model training, thereby generating a logistic regression classification model for automated attack identification, including:

[0103] According to the standardized features;

[0104] The preprocessed mouse trajectory data is used as samples;

[0105] The sample type corresponding to each sample is used as the sample label, and a training sample set is generated based on each sample and its corresponding label;

[0106] Determine the evaluation indicators of the model, use the training sample set to train the model, and generate a logistic regression classification model for automated attack identification.

[0107] Among them, sample types include:

[0108] Mouse tracking data generated by automated attacks and mouse tracking data generated by users.

[0109] In some embodiments, the preprocessed mouse trajectory data can be divided into a training set, a validation set, and a test set in a ratio of 7:1:2. The training set is used to train the desired model, the validation set is used to verify the effectiveness of the model training, and the test set is used to evaluate the model's final generalization ability. If the generalization ability meets the expectation, the model training is completed. If the generalization ability does not meet the expectation, the cause needs to be analyzed. The model can be retrained by adjusting model hyperparameters, collecting more complete data, adjusting the model, etc. until the model's generalization ability meets the expectation.

[0110] S140: Using a logistic regression classification model to identify mouse trajectory data in the web page.

[0111] Specifically, new mouse trajectory data from a web page is collected, preprocessed, and features of the preprocessed data are extracted. The features are standardized, and the standardized features are input into a trained logistic regression classification model for recognition.

[0112] In some embodiments, 1 is used to represent a trajectory generated by an automated tool, and 0 is used to represent a trajectory generated by a real person using a mouse.

[0113] In some embodiments, using a logistic regression classification model to identify mouse trajectory data in a web page includes:

[0114] Preprocess the mouse trajectory data in the web page;

[0115] Analyze and extract the features of the preprocessed data and standardize the features;

[0116] The standardized features are input into the logistic regression classification model for identification.

[0117] The following combination Figure 2 and Figure 9 Another specific embodiment of the present disclosure is described in detail.

[0118] Figure 2 A schematic diagram of the overall process of an attack identification method based on mouse trajectory data in network traffic provided by an embodiment of the present disclosure is shown; Figure 9 A mouse trajectory diagram generated according to mouse data provided in an embodiment of the present disclosure is shown.

[0119] like Figure 2 As shown, the mouse track data of the page is collected, wherein the collected mouse track data can be shown in Table 1:

[0120] Table 1

[0121]

[0122] As shown in Table 1, at 01:00 on September 15, 2020, when user ID 104823581047924 accessed page paht1 on a machine with IP 60.182.71.6, a short mouse track was generated, and its track_id was 8KNhXkuj9nWoNSYS5bjP6ADNgIB.

[0123] The first column of Table 1 above records the relevant mouse events, where 3 indicates moving into the window, 0 indicates moving the mouse, and 4 indicates moving out of the window; the second column records the x-axis coordinate of the mouse during movement; the third column records the y-axis coordinate of the mouse during movement; and the fourth column records the time difference between the occurrence of the current event and the occurrence of the first track point.

[0124] like Figure 2 As shown in FIG, the mouse trajectory data is collected and preprocessed.

[0125] Specifically, all track segments with track_id 8KNhXkuj9nWoNSYS5bjP6ADNgIB are integrated into a complete track as shown below:

[0126] {"track_id":"8KNhXkuj9nWoNSYS5bjP6ADNgIB","item":[[3,301,302,6750],[0,301,302,6750],[0,318,319, 6769],[0,336,307,6939],[0,355,307,7042],[0,373,307,7063],[0,392,307,7079],[4,412,307,7096],…]}.

[0127] Draw the corresponding trajectory diagram based on the integrated data. The completed trajectory diagram is as follows: Figure 9 shown.

[0128] like Figure 2 As shown, the features of the drawn trajectory graph are extracted, and the extracted features are represented by the vector method. The z-score algorithm is used to standardize all features.

[0129] By calculating and extracting features, we can obtain the following data:

[0130] entropy=8.

[0131] diffLastAngleRatio=14.

[0132] timeStampSmallerCount=0.

[0133] moveSkipCount=0.

[0134] The four features are represented by the vector method as [8, 14, 0, 0] and are standardized using the z-score algorithm.

[0135] like Figure 2 As shown in the figure, after feature extraction and processing, user trajectory vectors are marked as 0, and automated attack trajectory vectors are marked as 1. All feature vectors are stratified and sampled in a 7:1:2 ratio, and all sample data is divided into training, validation, and test sets. The training and validation sets are used to train the logistic regression classification model, while the test set is used to test the trained logistic regression model and evaluate its generalization ability. If the generalization ability meets the expectation, model training is completed. If the generalization ability does not meet the expectation, the cause is analyzed and the model is retrained by adjusting model hyperparameters, collecting more complete data, and adjusting the model until the model's generalization ability reaches the expected level.

[0136] If the generalization ability reaches the expected level, the model training is completed and the required logistic regression classification model is generated. Then, the features of the mouse trajectory shown in Table 1 are standardized and input into the logistic regression classification model that has achieved the expected level.

[0137] If the model prediction probability is greater than 0.5, the trajectory is predicted to be an attack trajectory of an automated tool. If the model prediction probability is less than or equal to 0.5, the trajectory is predicted to be a normal trajectory generated by the user.

[0138] If the predicted result is an attack trajectory of an automated tool, the user's access request can be intercepted by adding the user's ID and IP to a blacklist, denying access to protect the interests of other users and enterprises.

[0139] According to the embodiments of the present disclosure, the following technical effects are achieved:

[0140] A logistic regression classification model capable of identifying automated attacks was trained using mouse traces generated by automated attacks and normal users as samples. This model can effectively identify automated attacks without affecting the user experience, effectively protecting the interests of other users and enterprises.

[0141] It should be noted that for the aforementioned method embodiments, for simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present disclosure is not limited by the order of the actions described, because according to the present disclosure, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present disclosure.

[0142] The above is an introduction to the method embodiment. The following is a further explanation of the solution disclosed in the present disclosure through an apparatus embodiment.

[0143] Figure 10 FIG. 1 shows a block diagram of an attack identification device based on mouse trajectory data in network traffic provided by an embodiment of the present disclosure. Figure 10 As shown, the apparatus 1000 includes:

[0144] The acquisition module collects mouse trajectory data in network traffic.

[0145] Parsing module, parses mouse trajectory data in network traffic.

[0146] Preprocessing module,preprocesses the mouse trajectory data.

[0147] The feature extraction module analyzes and extracts the features of the preprocessed mouse trajectory data and standardizes the features.

[0148] The model training module performs model training based on the standardized features.

[0149] Model generation module, which generates a logistic regression classification model for automated attack identification.

[0150] In some embodiments, the apparatus 1000 may further include:

[0151] The filtering module filters and deletes abnormal data in the mouse trajectory data.

[0152] The trajectory integration module integrates the filtered mouse trajectory data.

[0153] The trajectory map drawing module draws the trajectory map based on the results of trajectory integration.

[0154] It is understandable that Figure 10 The various modules / units in the attack identification device 1000 based on mouse trajectory data in network traffic shown have the functions of implementing the various steps in the attack identification method 100 based on mouse trajectory data in network traffic provided by the embodiment of the present disclosure and can achieve its corresponding technical effects. For the sake of brevity, they are not described here in detail.

[0155] According to an embodiment of the present disclosure, the present disclosure further provides an electronic device and a readable storage medium.

[0156] Figure 11 An exemplary block diagram of an electronic device that can be used to implement an embodiment of the present disclosure is shown. The electronic device 1100 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0157] Electronic device 1100 includes a computing unit 1101, which can perform various appropriate actions and processes according to a computer program stored in ROM 1102 or a computer program loaded from storage unit 1108 into RAM 1103. RAM 1103 may also store various programs and data required for the operation of electronic device 1100. Computing unit 1101, ROM 1102, and RAM 1103 are connected to each other via bus 1104. I / O interface 1105 is also connected to bus 1104.

[0158] Multiple components in the electronic device 1100 are connected to the I / O interface 1105, including an input unit 1106, such as a keyboard, a mouse, etc.; an output unit 1107, such as various types of displays, speakers, etc.; a storage unit 1108, such as a magnetic disk, an optical disk, etc.; and a communication unit 1109, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 1109 allows the electronic device 1100 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0159] The computing unit 1101 may be a variety of general-purpose and / or specialized processing components with processing and computing capabilities. Some examples of the computing unit 1101 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units that run machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The computing unit 1101 performs the various methods and processes described above, such as method 100. For example, in some embodiments, method 100 may be implemented as a computer software program that is tangibly contained in a machine-readable medium, such as a storage unit 1108. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 1100 via the ROM 1102 and / or the communication unit 1109. When the computer program is loaded into the RAM 1103 and executed by the computing unit 1101, one or more steps of the method 100 described above may be performed. Alternatively, in other embodiments, the computing unit 1101 may be configured to execute the method 100 in any other appropriate manner (eg, by means of firmware).

[0160] Various embodiments of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system comprising at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0161] The program code for implementing the method of the present disclosure can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device so that when the program code is executed by the processor or controller, the functions / operations specified in the flow chart and / or block diagram are implemented. The program code can be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0162] In the context of the present disclosure, a machine-readable medium can be a tangible medium that can contain or store a program for use by or in conjunction with an instruction execution system, device or equipment. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium can include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0163] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0164] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), and the Internet.

[0165] A computer system may include a client and a server. The client and server are generally remote from each other and typically interact through a communication network. The client-server relationship arises through computer programs running on the respective computers and having a client-server relationship with each other. The server may be a cloud server, a server in a distributed system, or a server integrated with a blockchain.

[0166] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this disclosure can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved. This is not limited herein.

[0167] The above specific embodiments do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure shall be included within the scope of protection of this disclosure.

Claims

1. An attack identification method based on mouse trajectory data in network traffic, characterized in that: The method comprises: Collecting and parsing mouse track data in network traffic; wherein the mouse track data includes mouse track data generated by automated attacks and mouse track data generated by users; Preprocessing the mouse trajectory data; wherein, the process includes: Filtering and deleting abnormal data in the mouse trajectory data; Perform trajectory integration on the filtered mouse trajectory data; drawing a trajectory map according to the result of the trajectory integration; Analyzing the differences between the mouse trajectory data generated by the automated attack and the mouse trajectory data generated by the user in the trajectory graph; Extracting differential features and representing the features using vectors; The features are normalized using the z-score algorithm; wherein the feature extraction includes: Calculate entropy; the entropy is the ratio of jitter to the entire trajectory; Calculate diffLastAngleRatio; the diffLastAngleRatio is the ratio of the number of turns to the entire trajectory; Calculate timeStampSmallerCount; the timeStampSmallerCount is the number of times the timestamp of a track point in the entire track is smaller than the timestamp of the previous track point; Calculate moveSkipCount; the moveSkipCount is the number of jumps during the mouse movement; Output the trajectory represented by the feature vector; According to the standardized features, the pre-processed mouse trajectory data is used as a sample; The sample type corresponding to each sample is used as the sample label, and a training sample set is generated based on each sample and its corresponding label; Determine the model's evaluation metrics, use the training sample set to train the model, and generate a logistic regression classification model for automated attack identification; The logistic regression classification model is used to identify mouse trajectory data in the web page.

2. The method according to claim 1, characterized in that The sample types include: The mouse track data generated by the automated attack and the mouse track data generated by the user.

3. The method according to claim 1, characterized in that The identifying of mouse trajectory data in a web page using the logistic regression classification model includes: Preprocessing the mouse trajectory data in the web page; Analyze and extract features of the preprocessed data, and perform standardization on the features; The standardized features are input into the logistic regression classification model for identification.

4. An attack identification device based on mouse trajectory data in network traffic, characterized in that: include: Collection module, collects mouse trajectory data in network traffic; A parsing module, for parsing mouse trajectory data in the network traffic; A preprocessing module preprocesses the mouse trajectory data; wherein the preprocessing module includes: Filtering and deleting abnormal data in the mouse trajectory data; Perform trajectory integration on the filtered mouse trajectory data; drawing a trajectory map according to the result of the trajectory integration; A feature extraction module, which analyzes the differences between the mouse trajectory data generated by the automated attack and the mouse trajectory data generated by the user in the trajectory graph; Extracting differential features and representing the features using vectors; The features are normalized using the z-score algorithm; wherein the feature extraction includes: Calculate entropy; the entropy is the ratio of jitter to the entire trajectory; Calculate diffLastAngleRatio; the diffLastAngleRatio is the ratio of the number of turns to the entire trajectory; Calculate timeStampSmallerCount; the timeStampSmallerCount is the number of times the timestamp of a track point in the entire track is smaller than the timestamp of the previous track point; Calculate moveSkipCount; the moveSkipCount is the number of jumps during the mouse movement; Output the trajectory represented by the feature vector; A model training module, which uses the pre-processed mouse trajectory data as a sample according to the standardized features; The sample type corresponding to each sample is used as the sample label, and a training sample set is generated based on each sample and its corresponding label; Determine the evaluation indicators of the model and use the training sample set to train the model; Model generation module, which generates a logistic regression classification model for automated attack identification.

5. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 3.

6. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-3.

Images