Abnormal message identification method and device, equipment and storage medium

Abstract

The present disclosure provides an abnormal message identification method, device and equipment and a storage medium, relates to the technical field of Internet, and in particular to the technical field of data security, big data, cloud computing and the like. The abnormal message identification method comprises: receiving a target access request message, wherein the target access request message contains target identification information of multiple dimensions; performing matching processing on target identification information of each dimension in the multiple dimensions and intelligence information of the each dimension which is obtained in advance, to obtain a matching result of the each dimension; wherein the intelligence information is obtained based on an abnormal identification result of a historical access request message; obtaining target coding information of the target access request message based on the matching result of the each dimension; and obtaining an abnormal identification result of the target access request message based on the target coding information. The present disclosure can improve the identification accuracy.

Description

Technical Field

[0001] This disclosure relates to the field of Internet technology, specifically to the fields of data security, big data, cloud computing, etc., and in particular to a method, apparatus, device, and storage medium for identifying abnormal messages. Background Technology

[0002] Web crawlers or malicious attacks can cause abnormal network traffic. To protect data security, it is necessary to promptly identify abnormal access request messages. Summary of the Invention

[0003] This disclosure provides a method, apparatus, device, and storage medium for identifying abnormal messages.

[0004] According to one aspect of this disclosure, a method for identifying abnormal messages is provided, comprising: receiving a target access request message, the target access request message containing target identification information of multiple dimensions; performing matching processing on the target identification information of each dimension and pre-acquired intelligence information of each dimension to obtain matching results of each dimension; wherein the intelligence information is obtained based on the abnormal identification results of historical access request messages; obtaining target encoding information of the target access request message based on the matching results of each dimension; and obtaining the abnormal identification result of the target access request message based on the target encoding information.

[0005] According to another aspect of this disclosure, an anomalous message identification device is provided, comprising: a receiving module for receiving a target access request message, the target access request message containing target identification information of multiple dimensions; a matching module for matching the target identification information of each dimension of the multiple dimensions with pre-acquired intelligence information of each dimension to obtain matching results of each dimension; wherein the intelligence information is obtained based on the anomalous identification results of historical access request messages; an encoding module for obtaining target encoding information of the target access request message based on the matching results of each dimension; and a determining module for obtaining the anomalous identification result of the target access request message based on the target encoding information.

[0006] According to another aspect of this disclosure, an electronic device is provided, comprising: at least one processor; and a memory communicatively connected to said at least one processor; wherein the memory stores instructions executable by said at least one processor, said instructions being executed by said at least one processor to enable said at least one processor to perform the method as described in any of the foregoing aspects.

[0007] According to another aspect of this disclosure, a non-transitory computer-readable storage medium is provided storing computer instructions, wherein the computer instructions are configured to cause the computer to perform the method according to any of the preceding aspects.

[0008] According to another aspect of this disclosure, a computer program product is provided, comprising a computer program that, when executed by a processor, implements the method according to any of the preceding aspects.

[0009] According to the technical solution disclosed herein, the accuracy of identification can be improved.

[0010] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0011] The accompanying drawings are provided to better understand this solution and do not constitute a limitation of this disclosure. Wherein:

[0012] Figure 1 This is a schematic diagram based on the first embodiment of the present disclosure;

[0013] Figure 2 This is a schematic diagram illustrating an application scenario provided according to embodiments of this disclosure;

[0014] Figure 3 This is a schematic diagram of the overall architecture provided according to embodiments of this disclosure;

[0015] Figure 4 This is a schematic diagram according to the second embodiment of the present disclosure;

[0016] Figure 5 This is a schematic diagram according to the third embodiment of the present disclosure;

[0017] Figure 6 This is a schematic diagram according to the fourth embodiment of the present disclosure;

[0018] Figure 7 This is a schematic diagram of an electronic device used to implement the abnormal message identification method of the embodiments of this disclosure. Detailed Implementation

[0019] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0020] By analyzing historical access request messages (e.g., using statistical information or algorithmic models), the status of these messages can be determined, including either abnormal or normal. Abnormal historical access request messages contain identifiers (IDs) represented by black IDs, while normal historical access request messages contain identifiers represented by white IDs.

[0021] Intelligence, a term in the field of cybersecurity, refers to useful information that can be collected, processed, and analyzed to assist decision-makers in making the right decisions.

[0022] In this embodiment of the disclosure, the intelligence information includes the aforementioned black ID and / or white ID.

[0023] In related technologies, anomaly identification is performed directly based on the identification information contained in the access request message. For example, if the identification information contained in the access request message belongs to a pre-determined black ID, then the access request message is considered an abnormal message.

[0024] However, this method suffers from insufficient recognition accuracy.

[0025] To improve recognition accuracy, the present disclosure provides the following embodiments.

[0026] Figure 1 Based on a schematic diagram of the first embodiment of this disclosure, this embodiment provides a method for identifying abnormal messages, the method comprising:

[0027] 101. Receive a target access request message, wherein the target access request message contains target identification information in multiple dimensions.

[0028] 102. Match the target identification information of each dimension in the multiple dimensions with the intelligence information of each dimension obtained in advance to obtain the matching result of each dimension; wherein, the intelligence information is obtained based on the anomaly identification result of historical access request messages.

[0029] 103. Based on the matching results of each dimension, obtain the target encoding information of the target access request message.

[0030] 104. Based on the target encoding information, obtain the anomaly identification result of the target access request message.

[0031] The target access request message refers to the network access request message to be identified, such as a Hypertext Transfer Protocol (HTTP) request message.

[0032] Target identification information refers to the identification information (referred to as ID) contained in the target access request.

[0033] Target identification information is multi-dimensional identification information.

[0034] Multiple dimensions of identification information include at least two of the following: Internet Protocol (IP) address, IPC segment address, User Agent (UA) information, and JA3 fingerprint.

[0035] In this context, the IPC segment address refers to a Class C IP address, specifically where the first three segments are the network address, and the remaining segment is the local computer's address. If represented in binary, a Class C IP address consists of 3 bytes of network address and 1 byte of host address.

[0036] User-Agent (UA) information is a special string header that website servers use to determine the user's operating system version, Central Processing Unit (CPU) type, browser version, and other information. Additionally, website servers can use UA information to send different pages to clients.

[0037] JA3 fingerprints, also known as browser fingerprints, can be used to identify browsers and will not change as the user updates their IP address or UA information.

[0038] By analyzing historical access request messages (e.g., using statistical information or algorithmic models), the status of these messages can be determined, including either abnormal or normal. Abnormal historical access request messages contain identifiers (IDs) represented by black IDs, while normal historical access request messages contain identifiers represented by white IDs.

[0039] Intelligence, a term in the field of cybersecurity, refers to useful information that can be collected, processed, and analyzed to assist decision-makers in making the right decisions.

[0040] In this embodiment of the disclosure, the intelligence information includes the aforementioned black ID and / or white ID.

[0041] Since the identification information is multi-dimensional, the corresponding intelligence information is also multi-dimensional. Each dimension can include the corresponding black ID and / or white ID. Taking the example that the intelligence information in each dimension includes the corresponding black ID, if the multiple dimensions include IP dimension and UA dimension, then the multi-dimensional intelligence information includes: black IP and black UA.

[0042] During the matching process, matching can be performed on various dimensions. For example, target identification information includes target IP and target UA, and intelligence information includes black IP and black UA. The target IP can be matched with the black IP to obtain the matching result at the IP dimension, and the target UA can be matched with the black UA to obtain the matching result at the UA dimension.

[0043] Each dimension of intelligence information includes at least one historical identifier. For example, for the IP dimension, a black IP specifically includes at least one IP address. Similarly, a black UA includes at least one UA information.

[0044] Taking IP-level matching as an example, assuming the target IP is represented by IP0, and the black IPs include IP1 and IP2, the matching process can be based on whether IP0 is the same as either IP1 or IP2. If IP0 is the same as IP1, or IP0 is the same as IP2, the IP-level matching result is a match, represented by 1; otherwise, if IP0 is different from both IP1 and IP2, the IP-level matching result is a mismatch, represented by 0. Alternatively, the matching results of IP0 and IP1, and IP0 and IP2 can be obtained and combined to form the IP-level matching result. For example, if IP0 is the same as IP1, the matching result of IP0 and IP1 is a match, represented by 1; similarly, if IP0 is different from IP2, the matching result of IP0 and IP2 is a mismatch, represented by 0. Therefore, the IP-level matching result can be represented by 10.

[0045] After obtaining the matching results, target encoding information can be obtained based on the matching results of each dimension. Encoding strategies can be pre-configured, and the matching results of each dimension can be encoded according to these strategies.

[0046] For example, taking three dimensions as an example, assuming the matching results for the three dimensions are 1, 0, and 1 respectively, and the encoding strategy is, for example, combination, then the combined data (i.e., 101) can be used as the target encoded information. Alternatively, the encoding strategy can include combination and hash operation. The three matching results can be combined first, and then the combined data (i.e., 101) can be hashed, with the hash value obtained as the target encoded information.

[0047] Hash operations, also known as hashing, refer to operations performed using hash functions. The input to a hash operation is a set of information of arbitrary length. The hash function transforms this information into a fixed-length data set and outputs it as a combination of letters and numbers; this output is the "hash value." Examples of hash functions include Message-Digest Algorithm (MD) and Secure Hash Algorithm (SHA).

[0048] After obtaining the target encoding information, anomaly identification can be performed on the target access request message based on the target encoding information.

[0049] Anomaly identification can be performed offline, for example, by obtaining multiple target access request messages from log data and identifying abnormal target access request messages among them based on target encoding information; or, anomaly identification can be performed online, that is, by identifying a single target access request message in real time to determine whether the target access request message is abnormal.

[0050] In this embodiment, by obtaining the matching results of target identification information and intelligence information in various dimensions, target encoding information is generated based on the matching results of various dimensions, and the abnormal identification results of target access requests are obtained based on the target encoding information. Since the target encoding information integrates information from multiple dimensions, it can improve the identification accuracy compared to the method of directly identifying based on target identification information.

[0051] To better understand the embodiments of this disclosure, the application scenarios to which these embodiments are applicable are described below. This embodiment uses a web crawler as an example.

[0052] A web crawler (also known as a web spider, web robot, or web crawler) is a program or script that automatically retrieves information from the World Wide Web according to certain rules. Other less common names include ant, auto-indexer, simulator, or worm.

[0053] Taking the crawling target as a web page resource of a certain business party as an example, such as Figure 2As shown, the crawler program or script can be deployed on user terminal 201, and the web page resources can be deployed on server 202. User terminal 201 uses the program or script to automatically send access request messages to server 202 to crawl the web page resources on server 202. The access request message is, for example, an HTTP request message. User terminals include, for example, personal computers, laptops, mobile devices (such as mobile phones), etc. The server can be a local server or a cloud server. User terminals and servers can communicate through wired networks and / or wireless networks.

[0054] Web crawlers generate a large number of access request messages in a short period of time. Excessive network traffic can seriously interfere with the normal business processing of the business and also endanger the data security of the business. Therefore, it is necessary to identify abnormal messages (such as access request messages generated by web crawlers).

[0055] In related technologies, the processing is usually done directly based on the target identification information (target ID) contained in the target access request message. For example, after obtaining black IDs based on historical data (there are usually multiple black IDs, which can form a black ID list), if the target ID contained in the target access request message belongs to the black ID list, the target access request message is considered an abnormal message. Then, a preset abnormal handling strategy can be used to process the abnormal message, such as denying access to the abnormal message.

[0056] Furthermore, for multi-dimensional identification information, related technologies typically pre-configure rules that each dimension's ID must satisfy, and then use these rules to identify whether a target access request message is an abnormal message. For example, if the multiple dimensions of IDs include a first ID and a second ID, the pre-configured rule is that the first ID satisfies a first condition, and the second ID satisfies a second condition. If the first ID in the target access request message satisfies the first condition, and the second ID in the target access request message satisfies the second condition, then the target access request message is determined to be an abnormal message. Although considering multiple dimensions of IDs can improve identification accuracy compared to a single dimension, the configuration workload is quite cumbersome because rules need to be configured separately for each dimension. In addition, comparisons also need to be performed separately for each dimension, which is inefficient; moreover, since the IDs of each dimension are compared separately, the different dimensions are relatively independent and cannot integrate information from various dimensions, resulting in a need to improve identification accuracy.

[0057] In this embodiment, such as Figure 3As shown, the target access request message contains target identification information in multiple dimensions, and can also obtain intelligence information in multiple dimensions. In each dimension, the target identification information can be matched with the corresponding intelligence information to obtain matching results. After encoding the matching results, the target encoding information of the target access request message can be obtained. Then, anomaly identification can be performed based on the target encoding information to obtain the anomaly identification results of the target access request message.

[0058] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in the technical solution disclosed herein comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0059] In this embodiment, anomaly identification is performed based on target encoding information. The target encoding information is obtained by encoding the matching results of each dimension. Therefore, information from each dimension can be fused to improve the accuracy of identification. Furthermore, since the target encoding information is the result of fusing information from multiple dimensions, it is not necessary to configure a strategy for each dimension's identifier information. Instead, a unified strategy needs to be configured for the target encoding information. Compared to configuring multiple strategies, this approach improves efficiency and accuracy in terms of simplifying workload.

[0060] In conjunction with the above application scenarios, this disclosure also provides a method for identifying abnormal messages.

[0061] Figure 4 Based on a schematic diagram of the second embodiment of this disclosure, this embodiment provides a method for identifying abnormal messages, the method comprising:

[0062] 401. Obtain historical access request messages, wherein the historical access request messages contain historical identification information in multiple dimensions.

[0063] This can be achieved by periodically retrieving historical access request messages from log data. For example, today we can retrieve yesterday's log data, which contains yesterday's access request messages, and these messages can be used as today's historical access request messages.

[0064] The identification information contained in the historical access request message can be called historical identification information.

[0065] The retrieved historical access request messages are usually numerous (multiple). Different historical access request messages may contain the same or different identification information, and the same historical access request message may contain one or more identification information.

[0066] For example, the first historical access request message contains the first historical IP address and the first historical UA information, the second historical access request message contains the second historical IP address, and the third historical access request message contains the third historical IP address, the second historical UA information, the first JA3 fingerprint, etc.

[0067] Based on the aforementioned historical access request messages, three dimensions of historical identification information can be obtained: historical identification information in the IP dimension (specifically including the first historical IP address, the second historical IP address, and the third historical IP address), historical identification information in the UA dimension (specifically including the first historical UA information and the second historical UA information), and historical identification information in the JA3 fingerprint dimension (specifically including the first JA3 fingerprint).

[0068] 402. Obtain the anomaly identification result of the historical access request message, wherein the anomaly identification result includes: normal or abnormal.

[0069] Among these methods, existing anomaly detection strategies can be used to identify anomalies in historical access request messages. These strategies can be based on statistical information or algorithm models.

[0070] For example, when identifying based on statistical information, one could obtain historical access request messages within a preset time period (such as every hour). If the number of historical access request messages with the same identifier (such as the same IP address) within that time period is greater than a preset number, and the percentage of logged-in users corresponding to these historical access request messages (the historical access request messages may contain the user's login status, and the percentage of the number can be obtained based on the login status) is less than a preset ratio, then the abnormal identification result of these historical access request messages is determined to be abnormal.

[0071] For example, when using an algorithmic model, an anomaly detection model can be pre-trained. This model is a deep neural network model, whose input is identification information and output is the anomaly detection result. Therefore, by using this anomaly detection model to process the historical identification information contained in the input historical access request message, the anomaly detection result of the historical access request message can be obtained.

[0072] 403. For each of the multiple dimensions, based on the historical identification information contained in the normal historical access request messages of each dimension, and / or the historical identification information contained in the abnormal historical access request messages of each dimension, generate intelligence information for each dimension.

[0073] After obtaining the anomaly identification results of historical access request messages using statistical information or algorithm models, if the historical access request message is an abnormal message, the historical identification information contained in the abnormal historical access request message is used as the black ID, and the historical identification information contained in the normal historical access request message is used as the white ID.

[0074] Because a large number of historical access request messages contain multi-dimensional identification information, it is possible to obtain black IDs and / or white IDs across multiple dimensions. For example, the number of black IPs is 15219, the number of white IPs is 1937, the number of black IPCs is 3259, the number of white IPCs is 5187, the number of black UAs is 3658, and the number of white UAs is 3903, etc.

[0075] Multiple dimensions of black IDs and / or white IDs can form multi-dimensional intelligence information; that is, intelligence information in each dimension includes the corresponding black ID and / or white ID.

[0076] Assuming multiple dimensions include IP, IPC, UA, and JA3 fingerprint, and each dimension's intelligence information includes the corresponding black ID, then the intelligence information across multiple dimensions includes: black IP, black IPC, black UA, and black JA3 fingerprint. Each dimension contains one or more black IDs.

[0077] The 401-403 errors mentioned above can be executed offline, that is, before the target access request message is received.

[0078] In this embodiment, intelligence information of multiple dimensions is generated based on the anomaly identification results of historical access request messages, which can provide basic data for the generation of subsequent target encoding information, thereby enabling efficient and convenient acquisition of target encoding information.

[0079] 404. Receive a target access request message, wherein the target access request message contains target identification information in multiple dimensions.

[0080] The target access request message refers to the network access request message to be identified. The identification information contained in the target access request message can be called target identification information.

[0081] Assuming multiple dimensions include IP and UA dimensions, the target identification information of multiple dimensions can be represented as target IP and target UA.

[0082] 405. Perform matching processing on the target identification information of each dimension in the multiple dimensions and the intelligence information of each dimension obtained in advance to obtain the matching results of each dimension.

[0083] The intelligence information in each dimension includes at least one historical identification information;

[0084] The matching process of the target identification information of each dimension in the multiple dimensions and the pre-acquired intelligence information of each dimension to obtain the matching results of each dimension includes:

[0085] Regarding the target dimension, which is any one of the multiple dimensions, if the target identifier information of the target dimension is the same as any one of the historical identifier information included in the intelligence information of the target dimension, the matching result of the target dimension is determined to be a match; or,

[0086] For a target dimension, which is any one of the multiple dimensions, the target identifier information of the target dimension is sequentially matched with each historical identifier information included in the intelligence information of the target dimension to obtain the matching result of the target identifier information and each historical identifier information. Based on the matching result of the target identifier information and each historical identifier information, the matching result of the target dimension is obtained.

[0087] During the matching process, matching can be performed on various dimensions. For example, target identification information includes target IP and target UA, and intelligence information includes black IP and black UA. The target IP can be matched with the black IP to obtain the matching result at the IP dimension, and the target UA can be matched with the black UA to obtain the matching result at the UA dimension.

[0088] Each dimension of intelligence information includes at least one historical identifier. For example, for the IP dimension, a black IP specifically includes at least one IP address. Similarly, a black UA includes at least one UA information.

[0089] Taking IP-level matching as an example, assuming the target IP is represented by IP0, and the black IPs include IP1 and IP2, the matching process can be based on whether IP0 is the same as either IP1 or IP2. If IP0 is the same as IP1, or IP0 is the same as IP2, the IP-level matching result is a match, represented by 1; otherwise, if IP0 is different from both IP1 and IP2, the IP-level matching result is a mismatch, represented by 0. Alternatively, the matching results of IP0 and IP1, and IP0 and IP2 can be obtained and combined to form the IP-level matching result. For example, if IP0 is the same as IP1, the matching result of IP0 and IP1 is a match, represented by 1; similarly, if IP0 is different from IP2, the matching result of IP0 and IP2 is a mismatch, represented by 0. Therefore, the IP-level matching result can be represented by 10.

[0090] In some embodiments, for each dimension, the target identification information can be matched with the overall intelligence information of the corresponding dimension. That is, the target identification information is compared with any item in the intelligence information of the corresponding dimension to obtain the matching result of the corresponding dimension. This method can reduce the amount of data of the matching results of each dimension and improve processing efficiency.

[0091] In some embodiments, for each dimension, the target identification information can be matched with each piece of intelligence information in the corresponding dimension, and the matching result of the corresponding dimension can be obtained based on the matching result of the target identification information and each piece of intelligence information, which can improve the accuracy of the matching result.

[0092] 406. Based on the matching results of each dimension, obtain the target encoding information of the target access request message.

[0093] Among them, 404-406 can be executed online, that is, executed in real time after receiving the target access request message.

[0094] After obtaining the matching results for each dimension, the matching results for each dimension can be combined to obtain combined data; based on the combined data, the target encoding information can be obtained.

[0095] Among them, the combination processing refers to concatenating the matching results of each dimension together. For example, if the matching results of two dimensions are 1 and 0 respectively, the combined data is 10.

[0096] In this embodiment, by combining the matching results of each dimension, the target encoding information is obtained based on the combined data. This allows the target encoding information to be integrated with information from each dimension, thereby improving the accuracy of anomaly identification based on the target encoding information.

[0097] Furthermore, the combined data can be directly used as the target encoding information. Alternatively, a hash operation can be performed on the combined data to obtain a hash value, which can then be used as the target encoding information.

[0098] For example, if the combined data is 10, a hash operation can be performed on the data 10, and the resulting hash value can be used as the target encoded information.

[0099] In this embodiment, by performing a hash operation on the combined data and using the hash value as the target encoded information, the uniqueness of the target encoded information can be guaranteed and encoding conflicts can be avoided.

[0100] 407. Based on the target encoding information, obtain the anomaly identification result of the target access request message.

[0101] Anomaly identification can be performed offline or online.

[0102] When performing anomaly identification offline, it is possible to process a large number (multiple) target access request messages and identify the abnormal messages among them.

[0103] Specifically, this may include: performing deduplication processing on the target encoded information within a preset time period to obtain deduplicated encoded information; and, based on a preset offline identification strategy and the deduplicated encoded information, identifying abnormal target access request messages among the multiple target access request messages.

[0104] For example, if the preset duration is 3 days, the target encoding information generated within those 3 days can be deduplicated to obtain the deduplicated encoding information. Then, based on the offline identification strategy and the deduplicated encoding information, abnormal target access request messages can be identified among multiple target access request messages.

[0105] Offline identification strategies can be similar to those used for anomaly identification of historical access request messages; for example, they can be based on statistical information or algorithmic models. However, unlike the processing of historical access request messages, which is based on historical identification information, target access request messages are based on target encoding information.

[0106] Taking an algorithm-based model as an example, a recognition model can be pre-trained. The input of this recognition model is encoded information, and the output is the anomaly recognition result. When processing a target access request message, the target encoded information contained in the target access request message can be input into the recognition model to obtain the anomaly recognition result of the target access request message.

[0107] In this embodiment, by deduplicating the target encoded information within a preset time period to obtain deduplicated encoded information, and then performing anomaly identification based on the deduplicated encoded information, resource waste can be avoided and processing efficiency can be improved.

[0108] When performing anomaly identification online, it can be done on a single target access request message to identify whether it is an abnormal message in real time.

[0109] Specifically, it may include: obtaining a preset online identification strategy, the online identification strategy being used to identify abnormal coding information online; if the target coding information conforms to the online identification strategy, determining that the target access request message is an abnormal target access request message.

[0110] One online identification strategy is to pre-obtain a blacklist containing at least one abnormal encoded message. If the target encoded message belongs to the blacklist, the access request message is considered abnormal. Alternatively, if a blacklist cannot be obtained, an online algorithm model can be used to identify whether the access request message is abnormal. The algorithm model is pre-trained, with encoded information as input and anomaly identification results as output.

[0111] Once the target access request message is determined to be an abnormal message online, it can be handled online based on the handling strategy, such as denying access to the abnormal message.

[0112] In this embodiment, by performing anomaly identification on a single target access request message based on an online identification strategy, online anomaly identification can be achieved, thereby enabling timely handling of abnormal messages.

[0113] Figure 5 This is a schematic diagram based on the third embodiment of the present disclosure. This embodiment provides an abnormal request identification device 500, which includes: a receiving module 501, a matching module 502, an encoding module 503, and a determining module 504.

[0114] The receiving module 501 is used to receive a target access request message, which contains target identification information in multiple dimensions; the matching module 502 is used to perform matching processing on the target identification information in each of the multiple dimensions and the intelligence information in each of the pre-acquired dimensions to obtain the matching results of each dimension; wherein, the intelligence information is obtained based on the anomaly identification results of historical access request messages; the encoding module 503 is used to obtain the target encoding information of the target access request message based on the matching results of each dimension; the determining module 504 is used to obtain the anomaly identification result of the target access request message based on the target encoding information.

[0115] In this embodiment, by obtaining the matching results of target identification information and intelligence information in various dimensions, target encoding information is generated based on the matching results of various dimensions, and the abnormal identification results of target access requests are obtained based on the target encoding information. Since the target encoding information integrates information from multiple dimensions, it can improve the identification accuracy compared to the method of directly identifying based on target identification information.

[0116] In some embodiments, the encoding module 503 is further configured to:

[0117] The matching results of each dimension are combined to obtain the combined data;

[0118] Based on the combined data, the target encoding information is obtained.

[0119] In this embodiment, by combining the matching results of each dimension, the target encoding information is obtained based on the combined data. This allows the target encoding information to be integrated with information from each dimension, thereby improving the accuracy of anomaly identification based on the target encoding information.

[0120] In some embodiments, the encoding module 503 is further configured to:

[0121] The combined data is hashed to obtain a hash value, which is then used as the target encoded information.

[0122] In this embodiment, by performing a hash operation on the combined data and using the hash value as the target encoded information, the uniqueness of the target encoded information can be guaranteed and encoding conflicts can be avoided.

[0123] In some embodiments, the intelligence information of each dimension includes at least one historical identifier; the matching module 502 is further configured to: for a target dimension, which is any one of the multiple dimensions, if the target identifier information of the target dimension is the same as any one of the historical identifier information included in the intelligence information of the target dimension, determine the matching result of the target dimension as a match.

[0124] In this embodiment, for each dimension, the target identification information can be matched with the overall intelligence information of the corresponding dimension. That is, the target identification information is compared with any item in the intelligence information of the corresponding dimension to obtain the matching result of the corresponding dimension. This method can reduce the amount of data of the matching results of each dimension and improve processing efficiency.

[0125] In some embodiments, the intelligence information of each dimension includes at least one historical identifier; the matching module 502 is further configured to: for a target dimension, which is any one of the plurality of dimensions, sequentially perform matching processing on the target identifier information of the target dimension and each historical identifier information included in the intelligence information of the target dimension, to obtain the matching result of the target identifier information and each historical identifier information, and obtain the matching result of the target dimension based on the matching result of the target identifier information and each historical identifier information.

[0126] In this embodiment, for each dimension, the target identification information can be matched with each piece of intelligence information in the corresponding dimension. The matching result of the target identification information and each piece of intelligence information is used to obtain the matching result of the corresponding dimension, which can improve the accuracy of the matching result.

[0127] In some embodiments, there are multiple target access request messages; the determining module 504 is further configured to: perform deduplication processing on the target encoding information within a preset time period to obtain deduplicated encoding information; and, based on a preset offline identification strategy and the deduplicated encoding information, determine the abnormal target access request message among the multiple target access request messages.

[0128] In this embodiment, by deduplicating the target encoded information within a preset time period to obtain deduplicated encoded information, and then performing anomaly identification based on the deduplicated encoded information, resource waste can be avoided and processing efficiency can be improved.

[0129] In some embodiments, the target access request message is a single message; the determining module 504 is further configured to: obtain a preset online identification strategy, the online identification strategy being used to identify abnormal encoding information online; if the target encoding information conforms to the online identification strategy, determine that the target access request message is an abnormal target access request message.

[0130] In this embodiment, by performing anomaly identification on a single target access request message based on an online identification strategy, online anomaly identification can be achieved, thereby enabling timely handling of abnormal messages.

[0131] Figure 6 This is a schematic diagram based on the fourth embodiment of the present disclosure. This embodiment provides an abnormal request identification device 600, which includes: a receiving module 601, a matching module 602, an encoding module 603, and a determining module 604. It also includes: an acquisition module 605, an identification module 606, and a generation module 607.

[0132] For a description of the receiving module 601, matching module 602, encoding module 603 and determining module 604, please refer to the above-mentioned related embodiments.

[0133] The acquisition module 605 is used to acquire historical access request messages, which contain historical identification information in multiple dimensions; the identification module 606 is used to acquire the anomaly identification results of the historical access request messages, which include: normal or abnormal; the generation module 607 is used to generate intelligence information for each of the multiple dimensions based on the historical identification information contained in the normal historical access request messages of each dimension, and / or the historical identification information contained in the abnormal historical access request messages of each dimension.

[0134] In this embodiment, intelligence information of multiple dimensions is generated based on the anomaly identification results of historical access request messages, which can provide basic data for the generation of subsequent target encoding information, thereby enabling efficient and convenient acquisition of target encoding information.

[0135] It is understood that the same or similar content in different embodiments of this disclosure can be referred to each other.

[0136] It is understood that the terms "first" and "second" in the embodiments of this disclosure are only used for distinction and do not indicate the degree of importance or the order of events.

[0137] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in the technical solution disclosed herein comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0138] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0139] Figure 7 A schematic block diagram of an example electronic device 700 that can be used to implement embodiments of the present disclosure is shown. Electronic device 700 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, servers, blade servers, mainframe computers, and other suitable computers. Electronic device 700 may also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0140] like Figure 7 As shown, the electronic device 700 includes a computing unit 701, which can perform various appropriate actions and processes based on a computer program stored in a read-only memory (ROM) 702 or a computer program loaded from a storage unit 707 into a random access memory (RAM) 703. The RAM 703 may also store various programs and data required for the operation of the electronic device 700. The computing unit 701, ROM 702, and RAM 703 are interconnected via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0141] Multiple components in electronic device 700 are connected to I / O interface 705, including: input unit 706, such as keyboard, mouse, etc.; output unit 707, such as various types of displays, speakers, etc.; storage unit 708, such as disk, optical disk, etc.; and communication unit 709, such as network card, modem, wireless transceiver, etc. Communication unit 709 allows electronic device 700 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0142] The computing unit 701 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 701 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 701 performs the various methods and processes described above, such as the method for identifying abnormal messages. For example, in some embodiments, the method for identifying abnormal messages can be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 708. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 700 via ROM 702 and / or communication unit 709. When the computer program is loaded into RAM 703 and executed by the computing unit 701, one or more steps of the method for identifying abnormal messages described above can be performed. Alternatively, in other embodiments, the computing unit 701 can be configured to perform the method for identifying abnormal messages by any other suitable means (e.g., by means of firmware).

[0143] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0144] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable retrieval device, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0145] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0146] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0147] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with embodiments of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0148] Computer systems can include clients and servers. Clients and servers are generally geographically separated and typically interact via communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. A server can be a cloud server, also known as a cloud computing server or cloud host, a hosting product within the cloud computing service ecosystem, addressing the shortcomings of traditional physical hosts and VPS (Virtual Private Server, or simply "VPS") services, such as high management difficulty and weak business scalability. Servers can also be servers for distributed systems or servers incorporating blockchain technology.

[0149] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0150] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A method for identifying abnormal messages, comprising: Receive a target access request message, wherein the target access request message contains target identification information in multiple dimensions; The target identifier information of each dimension in the multiple dimensions is matched with the pre-acquired intelligence information of each dimension to obtain the matching result of each dimension; wherein, the intelligence information is obtained based on the anomaly identification result of historical access request messages; the matching result is obtained by comparing whether the target identifier information is the same as any item in the intelligence information of the corresponding dimension, or by matching it with each piece of intelligence information of the corresponding dimension; the anomaly identification result is determined after anomaly identification of the historical access request messages using an anomaly identification strategy, and the anomaly identification result includes: normal or abnormal; the intelligence information of each dimension includes the black ID and / or white ID of the corresponding dimension, wherein the black ID is the historical identifier information contained in the abnormal historical access request message, and the white ID is the historical identifier information contained in the normal historical access request message. Based on the matching results of each dimension, the target encoding information of the target access request message is obtained, including: combining the matching results of each dimension to obtain combined data, and using the combined data as the target encoding information; or, performing a hash operation on the combined data and using the hash value obtained as the target encoding information; the combining process includes: concatenating the matching results of each dimension. Based on the target encoding information, the abnormal identification result of the target access request message is obtained, including: when performing abnormal identification offline, deduplicating the target encoding information within a preset time period to obtain deduplicated encoding information; based on a preset offline identification strategy and the deduplicated encoding information, identifying an abnormal target access request message among multiple target access request messages; or, when performing abnormal identification online, obtaining a preset online identification strategy, the online identification strategy being used to identify abnormal encoding information online; if the target encoding information matches the online identification strategy, determining that the target access request message is an abnormal target access request message.

2. An abnormal message identification device, comprising: The receiving module is used to receive a target access request message, wherein the target access request message contains target identification information in multiple dimensions; A matching module is used to match the target identification information of each dimension in the multiple dimensions with the pre-acquired intelligence information of each dimension to obtain the matching results of each dimension; wherein, the intelligence information is obtained based on the anomaly identification results of historical access request messages; the matching results are obtained by comparing whether the target identification information is the same as any item in the intelligence information of the corresponding dimension, or by matching it with each piece of intelligence information of the corresponding dimension; the anomaly identification results are determined after anomaly identification of the historical access request messages using an anomaly identification strategy, and the anomaly identification results include: normal or abnormal; the intelligence information of each dimension includes the black ID and / or white ID of the corresponding dimension, wherein the black ID is the historical identification information contained in the abnormal historical access request message, and the white ID is the historical identification information contained in the normal historical access request message. An encoding module is used to obtain target encoding information of the target access request message based on the matching results of each dimension, including: performing combination processing on the matching results of each dimension to obtain combined data, and using the combined data as target encoding information; or, performing a hash operation on the combined data and using the hash value obtained as target encoding information; the combination processing includes: concatenating the matching results of each dimension. The determination module is used to obtain the anomaly identification result of the target access request message based on the target encoding information, including: when performing anomaly identification offline, performing deduplication processing on the target encoding information within a preset time period to obtain deduplicated encoding information; based on a preset offline identification strategy and the deduplicated encoding information, determining an abnormal target access request message among multiple target access request messages; or, when performing anomaly identification online, obtaining a preset online identification strategy, the online identification strategy being used to identify abnormal encoding information online; if the target encoding information matches the online identification strategy, determining the target access request message as an abnormal target access request message.

3. An electronic device, comprising: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method of claim 1.

4. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to cause the computer to perform the method according to claim 1.

5. A computer program product comprising a computer program that, when executed by a processor, implements the method according to claim 1.

Images