Method and device for analyzing user behavior, electronic device and storage medium

Abstract

The application discloses a user behavior analysis method and device, an electronic device and a storage medium, and relates to the field of information security. The analysis method comprises the following steps: receiving a service request initiated by a target account, obtaining service data based on the service request, processing the service data by using a preset measurement model, obtaining a behavior value of each behavior label and a total behavior value, comparing a historical value and the behavior value of the same behavior label in the case that the total behavior value is less than a preset suspicious threshold, determining that the user behavior of the target account is a normal behavior in the case that the behavior value is less than the historical value, and returning a service processing result sent by an application interface server to the target account. The application solves the technical problem that the related art analyzes the user behavior through the application interface server, which leads to low recognition accuracy and easy interruption of normal services.

Description

Technical Field

[0001] This invention relates to the field of information security, and more specifically, to a method, apparatus, electronic device, and storage medium for analyzing user behavior. Background Technology

[0002] Currently, API (Application Programming Interface) security mechanisms are primarily handled by the API provider, with decisions relying on data elements such as tokens, keys, timestamps, and digital signatures provided by the API caller. Since API providers cannot directly access user behavior data, and API callers are reluctant to provide additional data unrelated to the API's business logic for risk identification, in order to reduce communication data volume and protect user privacy, they are also hesitant to do so.

[0003] In related technologies, API providers typically use metrics such as frequency, legality, and completeness to identify risks. When risks occur, they can only take measures such as interrupting the service of the API caller as the main means, which has a significant impact on the business's survival.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] This invention provides a method, apparatus, electronic device, and storage medium for analyzing user behavior, in order to at least solve the technical problem in related technologies where analyzing user behavior through an application interface server results in low identification accuracy and easy interruption of normal business operations.

[0006] According to one aspect of the present invention, a method for analyzing user behavior is provided, comprising: receiving a business request initiated by a target account, wherein the target account corresponds to a historical measurement database, the historical measurement database comprising: multiple behavior tags, each behavior tag corresponding to a historical value; acquiring business data based on the business request; processing the business data using a preset measurement model to obtain a behavior value and a total behavior value for each behavior tag; if the total behavior value is less than a preset suspicious threshold, comparing the historical value of the same behavior tag with the behavior value; if the behavior value is less than the historical value, determining that the user behavior of the target account is normal behavior, and returning a business processing result sent by an application interface server to the target account.

[0007] Optionally, the step of obtaining business data based on the business request includes: parsing the business request to obtain first data and adding the first data to the business data, wherein the first data includes at least one of the following: account source address, browser characteristics, and business request tags; processing the first data using the preset metric model to obtain a first processing result; after the first processing result indicates that the analysis of the first data has passed, responding to the business request to obtain second data and adding the second data to the business data, wherein the second data includes at least one of the following: business exception data, program exception data, and performance evaluation data; processing the second data using the preset metric model to obtain a second processing result; after the second processing result indicates that the analysis of the second data has passed, calling the application interface associated with the business request, wherein the application interface calls the application interface server to process the business request and returns the business processing result; parsing the business processing result to obtain third data and adding the third data to the business data, wherein the third data includes at least one of the following: account access business complexity and account historical business scope.

[0008] Optionally, the step of processing the first data using the preset measurement model includes: processing the first data using the preset measurement model to obtain a first suspicious behavior value and a total first suspicious behavior value for each first suspicious behavior; if the total first suspicious behavior value is less than the preset suspicious threshold, querying first behavior tags that match the first suspicious behavior based on the historical measurement database; comparing the first suspicious behavior value with the first historical value associated with the first behavior tag, and if the first suspicious behavior value is less than the first historical value, sending a verification request to the target account, wherein the target account returns a verification result based on the verification request; if the verification result passes, determining that the analysis of the first data is successful, and updating the historical measurement database.

[0009] Optionally, the step of processing the second data using the preset measurement model includes: processing the second data using the preset measurement model to obtain a second suspicious behavior value and a total value of second suspicious behaviors for each second suspicious behavior; if the total value of the second suspicious behavior is less than the preset suspicious threshold, querying second behavior tags that match the second suspicious behavior based on the historical measurement database; comparing the second suspicious behavior value with the second historical value associated with the second behavior tag, and if the second suspicious behavior value is less than the second historical value, sending a verification request to the target account, wherein the target account returns a verification result based on the verification request; if the verification result passes, determining that the analysis of the second data is successful, and updating the historical measurement database.

[0010] Optionally, after processing the business data using a preset measurement model to obtain the behavior value and total behavior value of each behavior tag, the method further includes: comparing the total behavior value with the preset suspicious threshold to obtain a first comparison result; if the first comparison result indicates that the total behavior value is greater than or equal to the preset suspicious threshold, determining that the user behavior of the target account is an attack behavior; and using a preset blocking strategy to block the attack behavior.

[0011] Optionally, after comparing the total value of the behavior with the preset suspicious threshold to obtain a first comparison result, the method further includes: if the first comparison result indicates that the total value of the behavior is less than the preset suspicious threshold, comparing the historical value of the same behavior tag with the behavior value based on the historical measurement database to obtain a second comparison result; if the second comparison result indicates that the behavior value is less than the historical value, sending a verification request to the target account, and if the target account fails the verification request, determining that the user behavior of the target account is the attack behavior, wherein the verification request includes at least one of the following: password authentication, email verification, SMS verification; or, if the second comparison result indicates that the behavior value is greater than or equal to the historical value, determining that the user behavior of the target account is the attack behavior.

[0012] Optionally, the step of blocking the attack by employing a preset blocking strategy includes: obtaining the initiation timestamp of the attack; encoding the initiation timestamp to obtain an initiation number; querying a preset blocking strategy library for a blocking strategy number that matches the initiation number, wherein the preset blocking strategy library pre-stores multiple blocking strategies, each of which corresponds to a blocking strategy number; and employing the blocking strategy corresponding to the blocking strategy number to block the attack initiated by the target account.

[0013] Optionally, if multiple attack behaviors initiated by the same account are obtained within a preset time period, the environmental parameters of all the attack behaviors are compared to obtain the environmental parameter change value; if the environmental parameter change value does not exceed the preset change threshold, the same blocking strategy is used to block all the attack behaviors.

[0014] According to another aspect of the present invention, a user behavior analysis apparatus is also provided, comprising: a receiving unit, configured to receive a business request initiated by a target account, wherein the target account corresponds to a historical measurement database, the historical measurement database comprising: a plurality of behavior tags, each behavior tag corresponding to a historical value; an acquisition unit, configured to acquire business data based on the business request; a processing unit, configured to process the business data using a preset measurement model to obtain a behavior value and a total behavior value for each behavior tag; a comparison unit, configured to compare the historical value and the behavior value of the same behavior tag when the total behavior value is less than a preset suspicious threshold; and a determination unit, configured to determine that the user behavior of the target account is normal behavior when the behavior value is less than the historical value, and return a business processing result sent by the application interface server to the target account.

[0015] Optionally, the acquisition unit includes: a first parsing module, configured to parse the business request, obtain first data, and add the first data to the business data, wherein the first data includes at least one of the following: account source address, browser characteristics, and business request tags; a first processing module, configured to process the first data using the preset metric model to obtain a first processing result; a first response module, configured to respond to the business request after the first processing result indicates that the analysis of the first data has passed, obtain second data, and add the second data to the business data, wherein the second data includes at least one of the following: business exception data, program exception data, and performance evaluation data; a second processing module, configured to process the second data using the preset metric model to obtain a second processing result; a first call processing module, configured to call the application interface associated with the business request after the second processing result indicates that the analysis of the second data has passed, wherein the application interface calls the application interface server to process the business request and returns the business processing result; and a second parsing module, configured to parse the business processing result, obtain third data, and add the third data to the business data, wherein the third data includes at least one of the following: account access business complexity and account historical business scope.

[0016] Optionally, the first processing module includes: a first processing submodule, configured to process the first data using the preset measurement model to obtain a first suspicious behavior value and a total first suspicious behavior value for each first suspicious behavior; a first query submodule, configured to query, based on the historical measurement database, first behavior tags matching the first suspicious behavior when the total first suspicious behavior value is less than the preset suspicious threshold; a first comparison submodule, configured to compare the first suspicious behavior value with a first historical value associated with the first behavior tag, and send a verification request to the target account when the first suspicious behavior value is less than the first historical value, wherein the target account returns a verification result based on the verification request; and a first determination submodule, configured to determine that the analysis of the first data is successful when the verification result is verified, and update the historical measurement database.

[0017] Optionally, the second processing module includes: a second processing submodule, used to process the second data using the preset measurement model to obtain a second suspicious behavior value for each second suspicious behavior and a total value of second suspicious behaviors; a second query submodule, used to query second behavior tags matching the second suspicious behavior based on the historical measurement database when the total value of the second suspicious behavior is less than the preset suspicious threshold; a second comparison submodule, used to compare the second suspicious behavior value with the second historical value associated with the second behavior tag, and send a verification request to the target account when the second suspicious behavior value is less than the second historical value, wherein the target account returns a verification result based on the verification request; and a second determination submodule, used to determine that the analysis of the second data is passed when the verification result is verified, and update the historical measurement database.

[0018] Optionally, the analysis device further includes: a first comparison module, configured to, after processing the business data using a preset metric model to obtain the behavior value and total behavior value of each behavior tag, compare the total behavior value with the preset suspicious threshold to obtain a first comparison result; a first determination module, configured to determine that the user behavior of the target account is an attack behavior when the first comparison result indicates that the total behavior value is greater than or equal to the preset suspicious threshold; and a first blocking module, configured to block the attack behavior using a preset blocking strategy.

[0019] Optionally, the analysis device further includes: a second comparison module, configured to, after comparing the total behavior value with the preset suspicious threshold to obtain a first comparison result, and if the first comparison result indicates that the total behavior value is less than the preset suspicious threshold, compare the historical value of the same behavior tag with the behavior value based on the historical measurement database to obtain a second comparison result; a first sending module, configured to, if the second comparison result indicates that the behavior value is less than the historical value, send a verification request to the target account, and if the target account fails the verification request, determine that the user behavior of the target account is the attack behavior, wherein the verification request includes at least one of the following: password authentication, email verification, and SMS verification; and a second determining module, configured to, if the second comparison result indicates that the behavior value is greater than or equal to the historical value, determine that the user behavior of the target account is the attack behavior.

[0020] Optionally, the first blocking module includes: a first acquisition submodule, used to acquire the initiation timestamp of the attack behavior; a first encoding submodule, used to encode the initiation timestamp to obtain an initiation number; a third query submodule, used to query a blocking strategy number matching the initiation number in a preset blocking behavior strategy library, wherein the preset blocking behavior strategy library pre-stores multiple blocking strategies, each of the blocking strategies corresponding to a blocking strategy number; and a first blocking submodule, used to use the blocking strategy corresponding to the blocking strategy number to block the attack behavior initiated by the target account.

[0021] Optionally, the analysis device further includes: a third comparison module, used to compare the environmental parameters of all the attack behaviors when multiple attack behaviors initiated by the same account are obtained within a preset time period, and obtain the environmental parameter change value; and a second blocking module, used to block all the attack behaviors using the same blocking strategy when the environmental parameter change value does not exceed a preset change threshold.

[0022] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored computer program, wherein the computer program, when running, controls the device where the computer-readable storage medium is located to perform the above-described user behavior analysis method.

[0023] According to another aspect of the present invention, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the above-described user behavior analysis method.

[0024] In this disclosure, a business request initiated by a target account is received, business data is obtained based on the business request, the business data is processed using a preset measurement model, and the behavior value and total behavior value of each behavior tag are obtained. If the total behavior value is less than a preset suspicious threshold, the historical value and behavior value of the same behavior tag are compared. If the behavior value is less than the historical value, the user behavior of the target account is determined to be normal behavior, and the business processing result sent by the application interface server is returned to the target account. In this disclosure, the API caller (i.e., the front end) can obtain business data based on the received business request. After processing the business data through a preset measurement model, it obtains the behavior value and total behavior value of each behavior tag of the target account. If the total behavior value is less than a preset suspicious threshold, it can compare the historical value of the same behavior tag with the behavior value. If the behavior value is less than the historical value, it can be determined that the user behavior of the target account is normal behavior. The business processing result sent by the application interface server (i.e., the API provider) can be sent to the target account. By performing pre-analysis of user behavior, the application interface can be protected covertly. By leveraging the API caller's full control over user behavior data, risky behaviors can be identified more accurately, effectively preventing the interruption of normal business. This solves the technical problem in related technologies where analyzing user behavior through the application interface server leads to low identification accuracy and easy interruption of normal business. Attached Figure Description

[0025] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0026] Figure 1 This is a flowchart of an optional user behavior analysis method according to an embodiment of the present invention;

[0027] Figure 2 This is a schematic diagram of an optional covert API protection process based on user behavior analysis according to an embodiment of the present invention;

[0028] Figure 3 This is a schematic diagram of an optional user behavior analysis device according to an embodiment of the present invention;

[0029] Figure 4 This is a hardware structure block diagram of an electronic device (or mobile device) for a user behavior analysis method according to an embodiment of the present invention. Detailed Implementation

[0030] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0031] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0032] It should be noted that the user behavior analysis method and apparatus disclosed herein can be used in the field of information security for analyzing user behavior, and can also be used in any field other than information security for analyzing user behavior. This disclosure does not limit the application field of the user behavior analysis method and apparatus.

[0033] It should be noted that all information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, and displayed data) disclosed herein are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use, and processing of such data must comply with the relevant laws, regulations, and standards of the relevant countries and regions, and corresponding access points are provided for users to choose to authorize or refuse. For example, this system has interfaces with relevant users or organizations. Before obtaining relevant information, a request to obtain the information must be sent to the aforementioned user or organization through the interface, and the relevant information will be obtained only after receiving consent from the aforementioned user or organization.

[0034] The following embodiments of the present invention can be applied to various systems / applications / devices that analyze user behavior. The present invention proposes a method for pre-deploying security protection techniques to API callers and providing covert protection based on user behavior analysis. By leveraging the API caller's comprehensive understanding of user behavior data, it more accurately identifies risky users or risky access behaviors. Covert blocking methods precisely restrict access to API caller functions for certain users or terminals, thereby blocking potential attacks on the API provider and preventing attackers from analyzing specific blocking responses of the API caller.

[0035] The present invention will now be described in detail with reference to various embodiments.

[0036] Example 1

[0037] According to an embodiment of the present invention, an embodiment of a user behavior analysis method is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0038] Figure 1 This is a flowchart of an optional user behavior analysis method according to an embodiment of the present invention, such as... Figure 1 As shown, the method includes the following steps:

[0039] Step S101: Receive a business request initiated by the target account. The target account corresponds to a historical measurement database, which includes multiple behavior tags, each of which corresponds to a historical value.

[0040] Step S102: Obtain business data based on the business request.

[0041] Step S103: Process business data using a preset measurement model to obtain the behavior value of each behavior tag and the total behavior value.

[0042] Step S104: If the total value of the behavior is less than the preset suspicious threshold, compare the historical value of the same behavior label with the behavior value.

[0043] Step S105: If the behavior value is less than the historical value, determine that the user behavior of the target account is normal behavior, and return the business processing result sent by the application interface server to the target account.

[0044] Through the above steps, business requests initiated by the target account can be received. Based on the business requests, business data can be obtained. The business data can be processed using a preset measurement model to obtain the behavior value and total behavior value of each behavior tag. If the total behavior value is less than the preset suspicious threshold, the historical value and behavior value of the same behavior tag can be compared. If the behavior value is less than the historical value, the user behavior of the target account can be determined to be normal behavior, and the business processing result sent by the application interface server can be returned to the target account. In this embodiment of the invention, the API caller (i.e., the front end) can obtain business data based on the received business request. After processing the business data through a preset measurement model, the behavior value and total behavior value of each behavior tag of the target account are obtained. If the total behavior value is less than a preset suspicious threshold, the historical value of the same behavior tag can be compared with the behavior value. If the behavior value is less than the historical value, the user behavior of the target account can be determined to be normal behavior. The business processing result sent by the application interface server (i.e., the API provider) can be sent to the target account. By performing pre-analysis of user behavior, the application interface can be protected covertly. By taking advantage of the API caller's full grasp of user behavior data, risky behaviors can be identified more accurately, effectively avoiding the interruption of normal business. This solves the technical problem in related technologies where the analysis of user behavior through the application interface server leads to low identification accuracy and easy interruption of normal business.

[0045] The embodiments of the present invention will now be described in detail with reference to the steps described above.

[0046] Step S101: Receive a business request initiated by the target account. The target account corresponds to a historical measurement database, which includes multiple behavior tags, each of which corresponds to a historical value.

[0047] In this embodiment of the invention, the front end (i.e., the API caller) can receive business requests initiated by the target account and directly analyze the behavior of the target account based on the data collected from the business requests, so as to more accurately analyze risky behaviors.

[0048] In this embodiment, each account corresponds to a historical measurement database, which includes multiple behavior tags, each of which corresponds to a historical value. If the account is making a business request for the first time, the corresponding historical measurement database can be established first.

[0049] Step S102: Obtain business data based on the business request.

[0050] Optionally, the step of obtaining business data based on a business request includes: parsing the business request to obtain first data and adding the first data to the business data, wherein the first data includes at least one of the following: account source address, browser characteristics, and business request tags; processing the first data using a preset metric model to obtain a first processing result; after the first processing result indicates that the analysis of the first data has passed, responding to the business request to obtain second data and adding the second data to the business data, wherein the second data includes at least one of the following: business exception data, program exception data, and performance evaluation data; processing the second data using a preset metric model to obtain a second processing result; after the second processing result indicates that the analysis of the second data has passed, calling the application interface associated with the business request, wherein the application interface calls the application interface server to process the business request and returns the business processing result; parsing the business processing result to obtain third data and adding the third data to the business data, wherein the third data includes at least one of the following: account access business complexity and account historical business scope.

[0051] In this embodiment of the invention, data collection can be performed on business requests before (including but not limited to user source IP address, browser characteristics, business request tags, etc.), during (including but not limited to business anomalies, program anomalies, real-time performance evaluation, etc.), and after (including but not limited to user access business complexity, user historical business scope, etc.) (i.e., business data can be obtained based on business requests). The business data includes at least: first data (i.e., data collected before the event). After the first data is analyzed and passed, the business data also includes: second data (i.e., data collected during the event). After the second data is analyzed and passed, the business data also includes: third data (i.e., data collected after the event). Specifically, the business request can be parsed first to obtain data such as user source address, browser characteristics, and business request tags (i.e., parsing the business request to obtain first data, which includes: account source address, browser characteristics, business request tags, etc.), and the first data can be added to the business data. Then, the first data is processed using a preset metric model to obtain a first processing result. If the first processing result indicates that the analysis of the first data has passed, the front end can accept the business request to analyze the business behavior of the target account and obtain data such as business anomalies, program anomalies, and real-time performance evaluation (i.e., responding to the business request and obtaining second data, which includes: business anomaly data, program anomaly data, performance evaluation data, etc.), and add the second data to the business data. The second data is then processed using the preset metric model to obtain a second processing result. If the second processing result indicates that the analysis of the second data has passed, the application interface associated with the business request can be called. Through this application interface, the business related to the business request is sent to the application interface server for processing. After the application interface server completes processing, it returns the business processing result. The front end then parses the business processing result to obtain data such as user access business complexity and user historical business scope (i.e., parsing the business processing result to obtain third data, which includes: account access business complexity and account historical business scope, etc.), and adds the third data to the business data. By collecting data before, during, and after an event, risky behaviors can be accurately identified, enabling precise interception of such behaviors in the future.

[0052] Optionally, the step of processing the first data using a preset measurement model includes: processing the first data using the preset measurement model to obtain a first suspicious behavior value and a total first suspicious behavior value for each first suspicious behavior; if the total first suspicious behavior value is less than a preset suspicious threshold, querying first behavior tags that match the first suspicious behavior based on a historical measurement database; comparing the first suspicious behavior value with the first historical value associated with the first behavior tag, and if the first suspicious behavior value is less than the first historical value, sending a verification request to the target account, wherein the target account returns a verification result based on the verification request; if the verification result passes, determining that the analysis of the first data is successful, and updating the historical measurement database.

[0053] In this embodiment of the invention, the collected prior data (i.e., the first data) is sent to the user behavior suspicious measurement model (i.e., the preset measurement model) for processing, and finally outputs the suspicious main category and suspicious measurement value (i.e., the first data is processed by the preset measurement model to obtain the first suspicious behavior value of each first suspicious behavior and the total value of the first suspicious behavior), and the user suspicious behavior historical measurement data is updated synchronously.

[0054] In this embodiment, when a user's behavior does not reach or exceeds a preset suspicious threshold under a specific suspicious main category, it will be compared with the user's historical suspicious behavior measurement data (that is, when the total value of the first suspicious behavior is less than the preset suspicious threshold, based on the historical measurement database, the first behavior tag matching the first suspicious behavior is queried respectively, and the first suspicious behavior value is compared with the first historical value associated with the first behavior tag). If it does not exceed the historical value, the business process is interrupted and enhanced verification methods are inserted (including but not limited to: user password authentication, email verification, SMS verification, etc.). If the user passes the enhanced verification, the business processing process continues (that is, when the first suspicious behavior value is less than the first historical value, a verification request is sent to the target account, the target account returns the verification result based on the verification request, and if the verification result is verified, the first data analysis is determined to be passed).

[0055] Optionally, the step of processing the second data using a preset measurement model includes: processing the second data using the preset measurement model to obtain the second suspicious behavior value and the total value of the second suspicious behavior for each second suspicious behavior; if the total value of the second suspicious behavior is less than a preset suspicious threshold, querying the second behavior tags that match the second suspicious behavior based on the historical measurement database; comparing the second suspicious behavior value with the second historical value associated with the second behavior tag, and if the second suspicious behavior value is less than the second historical value, sending a verification request to the target account, wherein the target account returns a verification result based on the verification request; if the verification result passes, determining that the analysis of the second data is successful, and updating the historical measurement database.

[0056] In this embodiment of the invention, the collected real-time data (i.e., the second data) is sent to the user behavior suspicious measurement model (i.e., the preset measurement model) for processing, and finally outputs the main suspicious category and suspicious measurement value (i.e., the second suspicious behavior value and the total value of the second suspicious behavior are obtained by processing the second data using the preset measurement model), and the historical measurement data of user suspicious behavior are updated synchronously.

[0057] In this embodiment, when a user's behavior does not reach or exceeds a preset suspicious threshold under a specific suspicious main category, it will be compared with the user's historical suspicious behavior measurement data (that is, when the total value of the second suspicious behavior is less than the preset suspicious threshold, based on the historical measurement database, the second behavior tag that matches the second suspicious behavior is queried respectively, and the second suspicious behavior value is compared with the second historical value associated with the second behavior tag). If it does not exceed the historical value, the business process is interrupted and enhanced verification methods are inserted (including but not limited to: user password authentication, email verification, SMS verification, etc.). If the user passes the enhanced verification, the business processing process continues (that is, when the value of the second suspicious behavior is less than the second historical value, a verification request is sent to the target account, the target account returns the verification result based on the verification request, and if the verification result is verified, the second data analysis is determined to be passed).

[0058] Step S103: Process business data using a preset measurement model to obtain the behavior value of each behavior tag and the total behavior value.

[0059] In this embodiment of the invention, business data can be input into a preset measurement model for processing, which can obtain the behavior value of each behavior tag of the target account and the total behavior value.

[0060] In this embodiment, if risky behavior is detected in the pre-collected data, the business request will be directly blocked and not processed. If risky behavior is detected in the data collected during the process, the relevant application interface will not be invoked to process the business request, and the request will be directly blocked. If risky behavior is detected in the data collected after the event, the actual business processing result will not be returned to the target account. Instead, the corresponding result will be returned according to the selected blocking strategy to prevent the attacking account from analyzing the reason for the blocking of the business request, thereby achieving a covert protection effect for the API.

[0061] Optionally, after processing business data using a preset measurement model to obtain the behavior value and total behavior value of each behavior tag, the method further includes: comparing the total behavior value with a preset suspicious threshold to obtain a first comparison result; if the first comparison result indicates that the total behavior value is greater than or equal to the preset suspicious threshold, determining that the user behavior of the target account is an attack behavior; and using a preset blocking strategy to block the attack behavior.

[0062] In this embodiment of the invention, a first comparison result is obtained by comparing the total value of the behavior with a preset suspicious threshold. If the first comparison result indicates that the total value of the behavior is greater than or equal to the preset suspicious threshold, it is determined to be a potential attacker and suspicious behavior covert blocking is triggered (that is, the user behavior of the target account is determined to be an attack behavior, and a preset blocking strategy is adopted to block the attack behavior).

[0063] Optionally, after comparing the total value of behaviors with a preset suspicious threshold to obtain a first comparison result, the method further includes: if the first comparison result indicates that the total value of behaviors is less than the preset suspicious threshold, comparing the historical value of the same behavior tag with the behavior value based on a historical measurement database to obtain a second comparison result; if the second comparison result indicates that the behavior value is less than the historical value, sending a verification request to the target account, and if the target account fails the verification request, determining that the user behavior of the target account is an attack behavior, wherein the verification request includes at least one of the following: password authentication, email verification, SMS verification; or, if the second comparison result indicates that the behavior value is greater than or equal to the historical value, determining that the user behavior of the target account is an attack behavior.

[0064] In this embodiment of the invention, when a user's behavior does not reach or exceeds a preset suspicious threshold under a specific suspicious main category, it will be compared with the user's historical suspicious behavior measurement data (i.e., if the first comparison result indicates that the total value of the behavior is less than the preset suspicious threshold, the historical value of the same behavior tag is compared with the behavior value based on the historical measurement database to obtain a second comparison result). If it does not exceed the historical value, the business process is interrupted and enhanced verification measures (including but not limited to user password authentication, email verification, SMS verification, etc.) are inserted (i.e., if the second comparison result indicates that the behavior value is less than the historical value, a verification request is sent to the target account, which includes: password authentication, email verification, SMS verification, etc.). If the user passes the enhanced verification, the business processing process continues; otherwise, the user is identified as a potential attacker and a covert blocking of suspicious behavior is triggered (i.e., if the target account fails the verification request, the user behavior of the target account is determined to be an attack). If the user's behavior exceeds the historical suspicious behavior measurement data, the user is identified as a potential attacker and a covert blocking of suspicious behavior is triggered (i.e., if the second comparison result indicates that the behavior value is greater than or equal to the historical value, the user behavior of the target account is determined to be an attack).

[0065] Optionally, the steps of using a preset blocking strategy to block the attack include: obtaining the timestamp of the attack; encoding the timestamp to obtain an initiation number; querying a blocking strategy number that matches the initiation number in a preset blocking strategy library, wherein the preset blocking strategy library stores multiple blocking strategies in advance, and each blocking strategy corresponds to a blocking strategy number; and using the blocking strategy corresponding to the blocking strategy number to block the attack initiated by the target account.

[0066] In this embodiment of the invention, a corresponding preset blocking strategy can be selected from the blocking behavior strategy library to block the attack behavior. Specifically, based on information such as the timestamp of the potential attacker's access, a corresponding blocking method (including but not limited to: HTTP (Hypertext Transfer Protocol) exception, page redirection, communication layer connection dropping, etc.) can be extracted from the blocking behavior strategy library (i.e., first obtain the initiation timestamp of the attack behavior, encode the initiation timestamp to obtain the initiation number, and query the preset blocking behavior strategy library for the blocking strategy number that matches the initiation number. The preset blocking behavior strategy library pre-stores multiple blocking strategies, each of which corresponds to a blocking strategy number). The strategy is then used to block the user's business request (i.e., the blocking strategy corresponding to the blocking strategy number is used to block the attack behavior initiated by the target account).

[0067] Step S104: If the total value of the behavior is less than the preset suspicious threshold, compare the historical value of the same behavior label with the behavior value.

[0068] Step S105: If the behavior value is less than the historical value, determine that the user behavior of the target account is normal behavior, and return the business processing result sent by the application interface server to the target account.

[0069] In this embodiment of the invention, if the total value of the behavior is less than a preset suspicious threshold, the historical value of the same behavior tag is compared with the behavior value. If all behavior values ​​are less than the corresponding historical value, it can be determined that the user behavior of the target account is normal behavior, and the actual business processing result sent by the application interface server can be returned to the target account.

[0070] Optionally, if multiple attack behaviors initiated by the same account are obtained within a preset time period, the environmental parameters of all attack behaviors are compared to obtain the environmental parameter change value; if the environmental parameter change value does not exceed the preset change threshold, the same blocking strategy is used to block all attack behaviors.

[0071] In this embodiment of the invention, the blocking behavior caused by a potential attacker making suspicious requests within any time range is not unique (i.e., the timestamps of the requests are different, and the selected blocking strategies are also different). Furthermore, if the same blocking behavior (i.e., attack behavior) is obtained within a short period (i.e., within a preset time), and the business environment parameters of each blocking behavior do not change significantly, the same blocking strategy can be used to intercept the behavior (i.e., when multiple attack behaviors initiated by the same account are obtained within a preset time, the environment parameters of all attack behaviors are compared to obtain the change value of the environment parameters; if the change value of the environment parameters does not exceed a preset change threshold, the same blocking strategy is used to block all attack behaviors). However, if the business environment parameters change significantly, the blocking behavior may also change (i.e., when the business environment parameters change, the corresponding behavior is also different), and the corresponding blocking strategy can be selected based on the timestamp of the behavior's initiation. In this way, the cost for potential attackers to analyze, guess, and probe backend API requests is increased, and the business requests are effectively blocked at the caller level without penetrating to the API provider, achieving a covert protection effect for the API.

[0072] The following describes in detail another optional implementation method.

[0073] Figure 2 This is a schematic diagram of an optional covert API protection process based on user behavior analysis according to an embodiment of the present invention, such as... Figure 2 As shown, the process includes the following:

[0074] (1) The business system can collect user characteristics in advance for the business requests initiated by users and input them into the user behavior suspicious measurement model.

[0075] (2) The business system responds, collects user characteristics during the event, and inputs them into the user behavior suspicious measurement model.

[0076] (3) After the business system responds, post-event user feature collection is carried out and input into the user behavior suspicious measurement model.

[0077] (4) The user behavior suspicious measurement model outputs the suspicious main category and suspicious measurement value, and updates the user suspicious measurement historical data.

[0078] (5) Determine whether the suspicious metric value has reached the threshold of the business system. If so, determine a hidden blocking method from the hidden blocking behavior strategy library (e.g., HTTP exception, page redirection, communication layer dropped connection, etc.) based on the suspicious behavior timestamp to block the suspicious user's business and encounter uncertain blocking behavior.

[0079] (6) If the suspicious measurement value does not reach the threshold of the business system, then determine whether the behavior value of each suspicious main category behavior exceeds the user's historical average threshold. If so, then determine a hidden blocking method from the hidden blocking behavior strategy library (e.g., HTTP exception, page redirection, communication layer dropped connection, etc.) based on the suspicious behavior timestamp to block the suspicious user's business and encounter uncertain blocking behavior.

[0080] (7) If the user's historical average threshold is not exceeded, an enhanced authentication method is inserted, the subsequent business process is interrupted, and it is determined whether the enhanced authentication is successful. If it is successful, the subsequent process continues and the processing result is returned. Otherwise, a covert blocking method is determined from the covert blocking behavior strategy library (e.g., HTTP exception, page redirection, communication layer dropped connection, etc.) based on the suspicious behavior timestamp to implement blocking, so that the suspicious user's business is blocked and encounters uncertain blocking behavior.

[0081] In this embodiment of the invention, using API caller data rather than provider user data as the basis for security policies improves analysis accuracy. Furthermore, suspicious behavior is analyzed through a model to provide a primary classification and suspiciousness metric, which can be compared with the user's own data, minimizing the impact of security policies on individual user differences. In addition, by analyzing behavior proactively, blocking actions have no impact on normal business users and do not penetrate the API provider. Moreover, because blocking behavior is based on changes in time and environmental factors, it is more difficult for potential attackers to guess or analyze the strategy, significantly increasing the cost of attacks.

[0082] The following is a detailed description with reference to another embodiment.

[0083] Example 2

[0084] The user behavior analysis device provided in this embodiment includes multiple implementation units, each of which corresponds to a specific implementation step in Embodiment 1 above.

[0085] Figure 3 This is a schematic diagram of an optional user behavior analysis device according to an embodiment of the present invention, such as... Figure 3 As shown, the analysis device may include: a receiving unit 30, an acquisition unit 31, a processing unit 32, a comparison unit 33, and a determination unit 34, wherein...

[0086] The receiving unit 30 is used to receive business requests initiated by the target account, wherein the target account corresponds to a historical measurement database, and the historical measurement database includes: multiple behavior tags, each behavior tag corresponding to a historical value;

[0087] Acquisition unit 31 is used to acquire business data based on business requests;

[0088] Processing unit 32 is used to process business data using a preset measurement model to obtain the behavior value of each behavior tag and the total behavior value;

[0089] The comparison unit 33 is used to compare the historical value of the same behavior label with the behavior value when the total behavior value is less than a preset suspicious threshold.

[0090] The determination unit 34 is used to determine that the user behavior of the target account is normal behavior when the behavior value is less than the historical value, and to return the business processing result sent by the application interface server to the target account.

[0091] The aforementioned analysis device can receive business requests initiated by the target account through the receiving unit 30, acquire business data based on the business requests through the acquisition unit 31, process the business data using a preset measurement model through the processing unit 32 to obtain the behavior value and total behavior value of each behavior tag, compare the historical value and behavior value of the same behavior tag through the comparison unit 33 when the total behavior value is less than a preset suspicious threshold, determine that the user behavior of the target account is normal behavior through the determination unit 34 when the behavior value is less than the historical value, and return the business processing result sent by the application interface server to the target account. In this embodiment of the invention, the API caller (i.e., the front end) can obtain business data based on the received business request. After processing the business data through a preset measurement model, the behavior value and total behavior value of each behavior tag of the target account are obtained. If the total behavior value is less than a preset suspicious threshold, the historical value of the same behavior tag can be compared with the behavior value. If the behavior value is less than the historical value, the user behavior of the target account can be determined to be normal behavior. The business processing result sent by the application interface server (i.e., the API provider) can be sent to the target account. By performing pre-analysis of user behavior, the application interface can be protected covertly. By taking advantage of the API caller's full grasp of user behavior data, risky behaviors can be identified more accurately, effectively avoiding the interruption of normal business. This solves the technical problem in related technologies where the analysis of user behavior through the application interface server leads to low identification accuracy and easy interruption of normal business.

[0092] Optionally, the acquisition unit includes: a first parsing module, configured to parse the business request, obtain first data, and add the first data to the business data, wherein the first data includes at least one of the following: account source address, browser characteristics, and business request tags; a first processing module, configured to process the first data using a preset metric model to obtain a first processing result; a first response module, configured to respond to the business request after the first processing result indicates that the analysis of the first data has passed, obtain second data, and add the second data to the business data, wherein the second data includes at least one of the following: business exception data, program exception data, and performance evaluation data; a second processing module, configured to process the second data using a preset metric model to obtain a second processing result; a first call processing module, configured to call the application interface associated with the business request after the second processing result indicates that the analysis of the second data has passed, wherein the application interface calls the application interface server to process the business request and returns the business processing result; and a second parsing module, configured to parse the business processing result, obtain third data, and add the third data to the business data, wherein the third data includes at least one of the following: account access business complexity and account historical business scope.

[0093] Optionally, the first processing module includes: a first processing submodule, used to process the first data using a preset measurement model to obtain a first suspicious behavior value and a total value of first suspicious behaviors for each first suspicious behavior; a first query submodule, used to query first behavior tags that match the first suspicious behaviors based on a historical measurement database when the total value of the first suspicious behaviors is less than a preset suspicious threshold; a first comparison submodule, used to compare the first suspicious behavior value with the first historical value associated with the first behavior tag, and send a verification request to the target account when the first suspicious behavior value is less than the first historical value, wherein the target account returns a verification result based on the verification request; and a first determination submodule, used to determine that the analysis of the first data is successful and update the historical measurement database when the verification result is successful.

[0094] Optionally, the second processing module includes: a second processing submodule, used to process the second data using a preset measurement model to obtain the second suspicious behavior value and the total value of the second suspicious behavior for each second suspicious behavior; a second query submodule, used to query the second behavior tags that match the second suspicious behavior based on the historical measurement database when the total value of the second suspicious behavior is less than a preset suspicious threshold; a second comparison submodule, used to compare the second suspicious behavior value with the second historical value associated with the second behavior tag, and send a verification request to the target account when the second suspicious behavior value is less than the second historical value, wherein the target account returns a verification result based on the verification request; and a second determination submodule, used to determine that the analysis of the second data is successful and update the historical measurement database when the verification result is successful.

[0095] Optionally, the analysis device further includes: a first comparison module, used to compare the total value of the behavior with a preset suspicious threshold after processing business data using a preset measurement model to obtain the behavior value of each behavior tag and the total value of the behavior, and obtain a first comparison result; a first determination module, used to determine that the user behavior of the target account is an attack behavior if the first comparison result indicates that the total value of the behavior is greater than or equal to the preset suspicious threshold; and a first blocking module, used to block the attack behavior using a preset blocking strategy.

[0096] Optionally, the analysis device further includes: a second comparison module, configured to, after comparing the total value of behaviors with a preset suspicious threshold to obtain a first comparison result, and if the first comparison result indicates that the total value of behaviors is less than the preset suspicious threshold, compare the historical value of the same behavior tag with the behavior value based on a historical measurement database to obtain a second comparison result; a first sending module, configured to, if the second comparison result indicates that the behavior value is less than the historical value, send a verification request to the target account, and if the target account fails the verification request, determine that the user behavior of the target account is an attack behavior, wherein the verification request includes at least one of the following: password authentication, email verification, and SMS verification; and a second determining module, configured to, if the second comparison result indicates that the behavior value is greater than or equal to the historical value, determine that the user behavior of the target account is an attack behavior.

[0097] Optionally, the first blocking module includes: a first acquisition submodule, used to acquire the initiation timestamp of the attack behavior; a first encoding submodule, used to encode the initiation timestamp to obtain an initiation number; a third query submodule, used to query a blocking strategy number matching the initiation number in a preset blocking behavior strategy library, wherein the preset blocking behavior strategy library pre-stores multiple blocking strategies, each blocking strategy corresponding to a blocking strategy number; and a first blocking submodule, used to use the blocking strategy corresponding to the blocking strategy number to block the attack behavior initiated by the target account.

[0098] Optionally, the analysis device further includes: a third comparison module, used to compare the environmental parameters of all attack behaviors when multiple attack behaviors initiated by the same account are obtained within a preset time period, and obtain the environmental parameter change value; and a second blocking module, used to block all attack behaviors using the same blocking strategy when the environmental parameter change value does not exceed a preset change threshold.

[0099] The aforementioned analysis device may also include a processor and a memory. The receiving unit 30, the acquisition unit 31, the processing unit 32, the comparison unit 33, the determination unit 34, etc., are all stored in the memory as program units, and the processor executes the aforementioned program units stored in the memory to realize the corresponding functions.

[0100] The aforementioned processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured; by adjusting kernel parameters, if the behavior value is less than the historical value, the user behavior of the target account is determined to be normal, and the business processing result sent by the application interface server is returned to the target account.

[0101] The aforementioned memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0102] This application also provides a computer program product that, when executed on a data processing device, is suitable for executing an initialization program with the following method steps: receiving a business request initiated by a target account; obtaining business data based on the business request; processing the business data using a preset measurement model to obtain the behavior value and total behavior value of each behavior tag; if the total behavior value is less than a preset suspicious threshold, comparing the historical value of the same behavior tag with the behavior value; if the behavior value is less than the historical value, determining that the user behavior of the target account is normal behavior; and returning the business processing result sent by the application interface server to the target account.

[0103] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored computer program, wherein, when the computer program is running, it controls the device where the computer-readable storage medium is located to perform the above-described user behavior analysis method.

[0104] According to another aspect of the present invention, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the above-described user behavior analysis method.

[0105] Figure 4 This is a hardware structure block diagram of an electronic device (or mobile device) for a user behavior analysis method according to an embodiment of the present invention. Figure 4 As shown, an electronic device may include one or more ( Figure 4The processor 402 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and the memory 404 for storing data may also be included. In addition, it may include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, a keyboard, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 4 The structure shown is for illustrative purposes only and does not limit the structure of the electronic device described above. For example, the electronic device may also include components that are more... Figure 4 The more or fewer components shown, or having the same Figure 4 The different configurations shown.

[0106] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0107] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0108] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0109] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0110] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0111] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0112] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for analyzing user behavior, characterized in that, include: Receive a business request initiated by a target account, wherein the target account corresponds to a historical measurement database, and the historical measurement database includes: multiple behavior tags, each of which corresponds to a historical value; Based on the aforementioned business request, obtain business data; The business data is processed using a preset measurement model to obtain the behavior value and total behavior value for each behavior tag. If the total value of the behavior is less than a preset suspicious threshold, compare the historical value of the same behavior tag with the behavior value. If the behavior value is less than the historical value, the user behavior of the target account is determined to be normal behavior, and the business processing result sent by the application interface server is returned to the target account. The steps for obtaining business data based on the business request include: The business request is parsed to obtain first data, and the first data is added to the business data, wherein the first data includes at least one of the following: account source address, browser characteristics, and business request tags; The first data is processed using the preset metric model to obtain the first processing result; After the first processing result indicates that the first data analysis is passed, the system responds to the business request, obtains the second data, and adds the second data to the business data. The second data includes at least one of the following: business exception data, program exception data, and performance evaluation data. The second data is processed using the preset metric model to obtain the second processing result; After the second processing result indicates that the second data analysis is passed, the application interface associated with the business request is called, wherein the application interface calls the application interface server to process the business request and returns the business processing result; The business processing result is parsed to obtain third data, and the third data is added to the business data. The third data includes at least one of the following: account access business complexity and account historical business scope.

2. The analytical method according to claim 1, characterized in that, The step of processing the first data using the preset metric model includes: The first data is processed using the preset measurement model to obtain the first suspicious behavior value for each first suspicious behavior and the total value of the first suspicious behaviors. If the total value of the first suspicious behavior is less than the preset suspicious threshold, based on the historical measurement database, query the first behavior tag that matches the first suspicious behavior; The first suspicious behavior value is compared with a first historical value associated with the first behavior tag. If the first suspicious behavior value is less than the first historical value, a verification request is sent to the target account, wherein the target account returns a verification result based on the verification request. If the verification result passes, the analysis of the first data is deemed successful, and the historical measurement database is updated.

3. The analytical method according to claim 1, characterized in that, The step of processing the second data using the preset metric model includes: The second data is processed using the preset measurement model to obtain the second suspicious behavior value for each second suspicious behavior and the total value of the second suspicious behaviors. If the total value of the second suspicious behavior is less than the preset suspicious threshold, based on the historical measurement database, query the second behavior tags that match the second suspicious behavior respectively; The second suspicious behavior value is compared with the second historical value associated with the second behavior tag. If the second suspicious behavior value is less than the second historical value, a verification request is sent to the target account, wherein the target account returns a verification result based on the verification request. If the verification result passes, the second data analysis is deemed successful, and the historical measurement database is updated.

4. The analytical method according to claim 1, characterized in that, After processing the business data using a preset measurement model to obtain the behavior value and total behavior value for each behavior tag, the process further includes: The total value of the behavior is compared with the preset suspicious threshold to obtain a first comparison result; If the first comparison result indicates that the total value of the behavior is greater than or equal to the preset suspicious threshold, the user behavior of the target account is determined to be an attack behavior; The attack was blocked using a preset blocking strategy.

5. The analytical method according to claim 4, characterized in that, After comparing the total value of the behaviors with the preset suspicious threshold to obtain a first comparison result, the method further includes: If the first comparison result indicates that the total value of the behavior is less than a preset suspicious threshold, a second comparison result is obtained by comparing the historical value of the same behavior label with the behavior value based on the historical measurement database. If the second comparison result indicates that the behavior value is less than the historical value, a verification request is sent to the target account. If the target account fails the verification request, the user behavior of the target account is determined to be the attack behavior. The verification request includes at least one of the following: password authentication, email verification, SMS verification; or... If the second comparison result indicates that the behavior value is greater than or equal to the historical value, the user behavior of the target account is determined to be the attack behavior.

6. The analytical method according to claim 4, characterized in that, The steps of blocking the attack using a preset blocking strategy include: Obtain the timestamp of the attack initiation; Encode the initiation timestamp to obtain the initiation number; The system queries a preset blocking behavior strategy library for a blocking strategy number that matches the initiation number. The preset blocking behavior strategy library stores multiple blocking strategies in advance, and each blocking strategy corresponds to a blocking strategy number. The attack initiated by the target account is blocked by the blocking policy corresponding to the blocking policy number.

7. The analytical method according to claim 1, characterized in that, Also includes: If multiple attack behaviors initiated by the same account are obtained within a preset time period, the environmental parameters of all the attack behaviors are compared to obtain the environmental parameter change values. If the change in the environmental parameters does not exceed the preset change threshold, the same blocking strategy is used to block all the attack behaviors.

8. A user behavior analysis device, characterized in that, include: A receiving unit is used to receive a business request initiated by a target account, wherein the target account corresponds to a historical measurement database, and the historical measurement database includes: multiple behavior tags, each of which corresponds to a historical value; The acquisition unit is used to acquire business data based on the business request; The processing unit is used to process the business data using a preset measurement model to obtain the behavior value of each behavior tag and the total behavior value. A comparison unit is used to compare the historical value of the same behavior tag with the behavior value when the total value of the behavior is less than a preset suspicious threshold. The determining unit is configured to determine that the user behavior of the target account is normal behavior when the behavior value is less than the historical value, and return the business processing result sent by the application interface server to the target account; The acquisition unit comprises: a first parsing module, configured to parse a business request, obtain first data, and add the first data to the business data, wherein the first data includes at least one of the following: account source address, browser characteristics, and business request tags; a first processing module, configured to process the first data using a preset metric model to obtain a first processing result; a first response module, configured to respond to the business request after the first processing result indicates that the analysis of the first data has passed, obtain second data, and add the second data to the business data, wherein the second data includes at least one of the following: business exception data, program exception data, and performance evaluation data; a second processing module, configured to process the second data using a preset metric model to obtain a second processing result; a first invocation module, configured to invoke an application interface associated with the business request after the second processing result indicates that the analysis of the second data has passed, wherein the application interface invokes an application interface server to process the business request and returns a business processing result; and a second parsing module, configured to parse the business processing result, obtain third data, and add the third data to the business data, wherein the third data includes at least one of the following: account access business complexity and account historical business scope.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device on which the computer-readable storage medium is located to perform the user behavior analysis method according to any one of claims 1 to 7.

10. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the user behavior analysis method according to any one of claims 1 to 7.

Images