A behavior subject correlation analysis method, system, device and medium

Abstract

The application belongs to the technical field of communication networks, and discloses a behavior subject correlation analysis method, system, device and medium, the behavior subject correlation analysis method comprises the following steps: obtaining HTTP communication data to be analyzed in terms of behavior subject correlation; based on the HTTP communication data, obtaining a behavior subject initiative behavior; based on the behavior subject initiative behavior, obtaining a direct correlation item and an indirect correlation item; based on a five-tuple, the direct correlation item and the indirect correlation item, performing correlation analysis on the behavior subject initiative behavior to obtain a behavior subject correlation analysis result. The behavior subject correlation analysis method provided by the application can determine the behavior subject of each behavior data in the HTTP communication data, and can be used for tracing potential abnormal behaviors in a network.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of communication network, and particularly relates to a behavior subject association analysis method, system, device and medium. BACKGROUND

[0002] Information security audit is an important mechanism for protecting information system security, and is an important evaluation factor for security evaluation; in the CC standard (ISO / IEC 15408), information security audit is defined as: "Security audit involves identifying, recording, storing and analyzing information about security-related activities. The audit records thus generated can be checked to determine which security-related activities and who (which user) is responsible for these activities". It can be seen that information security audit not only needs to generate records, but also needs to include the user responsible for the related activities in the records.

[0003] The log system is the main data source of information security audit, and usually the log is generated by the operating system, platform software and application software. These software generally contains the subject information of the related behavior (for example, user name or user identifier, program file name or process identifier, etc.) when generating the log. Therefore, it is relatively easy to associate the related behavior and the subject implementing the behavior in the log information, and in many cases, a line of log contains both the behavior subject identifier and the behavior description, and such association is natural.

[0004] Network traffic is another important information source for information security audit. For applications based on network to provide services, all user operations need to be implemented through the network. Network traffic contains all user behaviors in principle, and therefore it is a reliable data source that faithfully records all information. Network traffic can be captured by a sniffer, and the information obtained by the sniffer is represented as a series of packet records, each of which has an accurate timestamp at the time of capture (for example, reference can be made to the current mainstream sniffing tools such as wireshark, libpcap, packetbeat in ELK, etc.). HTTP protocol is an application layer protocol commonly used in current network applications, which is usually built on TCP protocol, and the data packets captured by the sniffer usually adopt the nested format of Ethernet-IP-TCP-HTTP; interpretatively, there can be other nested formats in some special networks, but basically HTTP is nested in the transport layer protocol; some online applications use HTTPS protocol, but usually a device form SSL gateway is deployed, and after the SSL gateway, the decrypted HTTP traffic can still be obtained. HTTP protocol is a text-based protocol, and after connection recombination, the content in the captured data packet can be directly understood; therefore, HTTP traffic is relatively easy to capture, and contains rich information that can be directly understood.

[0005] After connection recombination, the traffic of HTTP is composed of Request and Response operations, Request is generally an instruction sent by a browser to a WEB Server, and Response is an answer returned by the WEB Server to the browser; wherein the data of each Request and Response operation can cross multiple data packets, and current sniffer tools generally support extracting the Request and the corresponding Response operation content on the basis of data packets; generally, a Request and the corresponding Response represent an interaction between the browser and the WEB Server, and can be understood as an operation "behavior" (explanatory, Response can be understood as the "result" of the operation behavior). However, for the above-mentioned "behavior", the behavior subject responsible for the "behavior" cannot be stably obtained by a simple method; most of the current online applications are provided with a "user login" mechanism, and user information should be contained in the HTTP traffic, and the subject of the HTTP operation behavior should be associated with the "user" at the application layer, but such association needs to be realized through a suitable method.

[0006] In summary, associating the HTTP operation behavior with the behavior subject responsible for the behavior (as far as possible, to the application user) still has the following technical problems:

[0007] 1) IP address-port number and MAC address cannot be used as the behavior subject identifier;

[0008] 2) Not all Request-Response pairs are generated by user active behavior;

[0009] 3) Not all HTTP operation behaviors contain behavior subject information. SUMMARY

[0010] The present application aims to provide a behavior subject association analysis method, system, device and medium to solve one or more of the above technical problems. The behavior subject association analysis method provided by the present application can determine the behavior subject of each behavior data in the HTTP communication data, and can be used for tracing the potential abnormal behavior in the network.

[0011] To achieve the above-mentioned purpose, the present application adopts the following technical solutions:

[0012] The first aspect of the present application provides a behavior subject association analysis method, comprising the following steps:

[0013] Obtaining HTTP communication data to be subjected to behavior subject association analysis;

[0014] Based on the HTTP communication data, obtain the active behavior of the behavior subject;

[0015] Based on the active behavior of the behavior subject, obtain the direct association item and the indirect association item;

[0016] Based on the five-tuple, the direct association item and the indirect association item, perform association analysis on the active behavior of the behavior subject, and obtain the association analysis result of the behavior subject.

[0017] The method further improves that the step of obtaining the HTTP communication data for the behavior subject association analysis specifically comprises:

[0018] Using a sniffer tool to collect the original traffic of the target network;

[0019] Based on the rules preset according to the behavior subject data characteristics, the network traffic containing HTTP in the original traffic of the target network is extracted to obtain the HTTP communication data for the behavior subject association analysis.

[0020] The method further improves that the step of obtaining the active behavior of the behavior subject based on the HTTP communication data specifically comprises:

[0021] Based on the HTTP communication data, the time interval ΔT between the previous and subsequent behavior operations related to Referer in the same connection is calculated and obtained after removing the timing polling information;

[0022] The time interval ΔT is compared with a preset time interval threshold value, and the behavior corresponding to the time interval ΔT exceeding the preset time interval threshold value is the active behavior of the behavior subject.

[0023] The method further improves that the step of obtaining the direct association item and the indirect association item based on the active behavior of the behavior subject specifically comprises:

[0024] Based on a preset scoring condition, the fields of the active behavior of the behavior subject are scored, and the scores obtained by the fields are compared with a preset threshold score; wherein, in the fields exceeding the preset threshold score, the field with the highest score is the direct association item, and the remaining fields are the indirect association items.

[0025] The method further improves that in the preset scoring condition, the fields meeting the scoring condition include one or more of the following fields:

[0026] The fields contained in Cookie and Set-Cookie in head;

[0027] The first N fields in Request and Response; N is a preset field item threshold value;

[0028] a field containing user naming habits;

[0029] The fields other than the fixed fields contained in the HTTP and having a frequency of occurrence exceeding a preset frequency threshold.

[0030] The method further improves that the step of associating and analyzing the active behavior of the behavior subject based on the five-tuple, the direct association item and the indirect association item comprises:

[0031] The data is processed in a hierarchical manner for the active behavior of the behavior subject, and is classified into a behavior level, a connection level and a behavior subject level.

[0032] Based on the hierarchical processing result, the behaviors with the same five-tuple are associated to the same connection, and the connection containing the direct association item in the behavior data is associated to the same behavior subject; if the behavior data in the connection does not contain the direct association item, the connection is associated to the behavior subject according to the indirect association item.

[0033] The whole behavior data of the same behavior subject is set as a task behavior set, the task behavior set is labeled, and the behavior subject association analysis result is obtained.

[0034] The method further improves that in the step of setting the whole behavior data of the same behavior subject as a task behavior set, labeling the task behavior set and obtaining the behavior subject association analysis result,

[0035] The label content is the value of the direct association item.

[0036] The second aspect of the application provides a behavior subject association analysis system, comprising:

[0037] A first acquisition module is configured to acquire HTTP communication data to be analyzed in association with a behavior subject.

[0038] A second acquisition module is configured to acquire active behavior of a behavior subject based on the HTTP communication data.

[0039] A third acquisition module is configured to acquire a direct association item and an indirect association item based on the active behavior of the behavior subject.

[0040] An analysis result acquisition module is configured to associate and analyze the active behavior of the behavior subject based on the five-tuple, the direct association item and the indirect association item, and obtain a behavior subject association analysis result.

[0041] The third aspect of the application provides an electronic device, comprising:

[0042] at least one processor; and

[0043] A memory in communication connection with the at least one processor; wherein

[0044] The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the behavior subject association analysis method according to any one of the first aspect of the application.

[0045] The fourth aspect of the application provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to realize the behavior subject association analysis method according to any one of the first aspect of the application.

[0046] Compared with the prior art, the application has the following beneficial effects:

[0047] The behavior subject association analysis method provided by the application can determine the behavior subject of each behavior data in HTTP communication data, and can be used for tracing potential abnormal behaviors in a network.

[0048] 1) In view of the problem that IP address-port number and MAC address cannot be used as behavior subject identification, the technical scheme of the application uses a method combining direct association items, indirect association items and five tuples to realize behavior subject association, and the method has the characteristics of wide application, and can bring significant progress in dynamic tracking of behavior subjects when used to solve the above problem; network behaviors initiated by the same user using different IP addresses and MAC addresses can be associated to the same behavior subject, and IP address hopping of the user during operation of network applications does not affect the behavior subject association analysis of network traffic;

[0049] 2) In view of the problem that not all Request-Response pairs in HTTP traffic are user active behaviors, the technical scheme of the application obtains behavior subject active behaviors based on HTTP communication data, and performs association based on active behaviors, so that interference behaviors can be filtered out;

[0050] 3) In view of the problem that not all HTTP operation behaviors contain behavior subject information, the technical scheme of the application uses a method of establishing contact between five tuples, indirect association items and network traffic containing direct association items, and has the characteristics of strong adaptability to network traffic.

[0051] Further, in view of the problem that not all Request-Response pairs in HTTP traffic are user active behaviors, the technical scheme of the present application adopts the method of removing the periodic polling information generated by Applet and the like first, and then calculating the time interval ΔT of the previous and subsequent behavior operations related to Referer in the same connection, and determining whether it is an active behavior based on ΔT, which has the characteristic of high accuracy, and can bring progress in accurately positioning the active behavior, and can automatically identify the traffic caused by user active behavior from the mixed network traffic, filter out the traffic caused by automatic contact of the browser, App and other clients with the server, and realize the behavior subject association of the traffic caused by user active behavior on this basis.

[0052] Further, in view of the problem that not all HTTP operation behaviors contain behavior subject information, the technical scheme of the present application adopts the method of establishing contact between the network traffic containing direct association items and indirect association items and the five-tuple, which has the characteristic of strong adaptability to network traffic, and can bring progress in adapting to various network traffic, and can associate the behavior subject as long as the behavior has indirect association items or belongs to the same connection as the behavior with direct association items and indirect association items.

[0053] Further, in view of the problem that there is no uniform agreement on the behavior subject information contained in HTTP load, the technical scheme of the present application automatically identifies the fields that can be used as association items through statistical analysis of network traffic, and adopts the scoring mechanism to automatically select the field that is most suitable as a direct association item in the network traffic, and the remaining fields can be used as indirect association item fields, which has the characteristic of greatly reducing the labor cost, and can bring progress in improving the degree of automation, and does not need the participation of application software programmers in setting, and does not need to specify the corresponding fields through manual analysis. BRIEF DESCRIPTION OF DRAWINGS

[0054] In order to more clearly illustrate the technical scheme in the embodiments of the present application or the prior art, the following briefly introduces the drawings needed to be used in the embodiments or prior art description; obviously, the drawings in the following description are some embodiments of the present application, and those skilled in the art can obtain other drawings according to these drawings without creative labor.

[0055] Figure 1 is a flow diagram of a behavior subject association analysis method provided by an embodiment of the present application;

[0056] Figure 2is a specific flow schematic diagram of the behavior subject correlation analysis method in the HTTP communication data in the embodiment of the present application.

[0057] Figure 3 is a schematic diagram of a behavior subject correlation analysis system provided in the embodiment of the present application. DETAILED DESCRIPTION

[0058] In order for those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should belong to the scope of protection of the present application.

[0059] It should be noted that the terms "first", "second", and the like in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily have to be used to describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not have to be limited to only those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to the process, method, product or device.

[0060] The present application will be described in further detail below in conjunction with the drawings:

[0061] In the embodiments of the present application, the further explanation of the technical problems is as follows,

[0062] 1) Regarding the IP address-port number and MAC address cannot be used as the behavior subject identification, the specific explanatory is as follows:

[0063] In many network traffic-based security audit functions, the source IP address and source port number, and even the MAC address are used as "behavior subjects", and it is considered that as long as the online behavior is corresponded to the IP address and MAC address, the subject correlation task is completed. The network traffic captured by the sniffer generally contains "five tuples" (source IP, destination IP, source port, destination port, TCP / UDP) in each data packet, and the five tuples can uniquely identify and TCP "flow" / connection, so such correlation naturally exists and does not need to be analyzed; the MAC address can uniquely correspond to the network interface of the user client and can be used as the identification of the user device, and is contained in each data packet.

[0064] The above natural association can only be effective in a local area network with fixed client addresses, and is difficult to apply in the current complex Internet environment. The current NAT technology is widely used, and the export device converts multiple internal IP addresses into one or a few IP addresses, so that one source IP address can serve multiple users at the same time, and the IP address and port are flexibly allocated according to the occupation at that time. In this case, the combination of source IP and port cannot correspond to the related user.

[0065] The MAC address is only valid in the same network segment, and the source MAC will be changed to the MAC address of the specific interface of the network device after passing through the router.

[0066] TCP flow / connection and operation behavior have a many-to-many relationship. The same page may contain several frames or embedded pictures, and the behavior content of a page browsing may be transmitted through multiple TCP flows at the same time, and the same TCP flow may be used to transmit multiple operation behaviors (for example, long link using Keep-Alive Tag), so the flow identification (five-tuple) cannot be one-to-one corresponding to the operation behavior.

[0067] The use of proxy mechanism makes the IP address of the proxy server the IP address of the final access to the WEB server, and not all proxy servers retain the original user's IP address in the HTTP header. The HTTP traffic intercepted on the server usually loses the real IP address of the user's client.

[0068] Because of the limited IPv4 address resources, using dynamic IP address has become the main way at present. DHCP mechanism is widely used on local area network to allocate internal IP address, and Radius protocol is widely used on the access end of Internet to dynamically allocate public network IP address. Therefore, in the data packet intercepted on the server, the IP address cannot be directly bound to the user.

[0069] 2) Not all Request-Response pairs are user-initiated behaviors, and the specific explanation is,

[0070] The network traffic intercepted by the sniffer contains all the operation instructions and returned results between the browser and the WEB server, but these HTTP operations and the user's actual active behavior do not form a one-to-one corresponding relationship, and the HTTP operation behavior intercepted by the sniffer contains a large amount of "non-active" behavior triggered traffic.

[0071] Multiple pictures and multiple Frame contents contained in a page can be transmitted simultaneously through multiple connections using HTTP 1.1 protocol. Therefore, when a user enters the main page, the browser will issue a large number of TCP connections to transmit the related contents. For the user, it may only be through the click of a hyperlink or button to implement an active behavior, and the user should only be responsible for the behavior of accessing the main page. The rest of the HTTP operations intercepted by the sniffer are automatically initiated by the browser and are uncontrollable by the user.

[0072] Many network applications use Applet to enhance the functionality of the client. Some HTTP operations are automatically initiated by the Applet, for example, some network applications use Applet to implement a timing polling refresh or heartbeat mechanism. The user is unaware of such HTTP operations and cannot control them.

[0073] Some network applications use APP and do not provide services based on browsers. These APPs also generally use HTTP protocol, and a large number of HTTP operations will be transmitted when the user does not open the browser. It is not reasonable to attribute the subject of these non-active behaviors to the user.

[0074] 3) Regarding the fact that not all HTTP operation behaviors contain subject information, the specific explanation is as follows:

[0075] In theory, the information that can directly represent the user in online applications is the username (login name). Some systems use a number to identify the user internally, which is usually referred to as the user ID. The user ID is usually used only within the system, and the username is usually used in the interaction with the user. Not all applications will have both a username and a user ID, but if there is both a username and a user ID, the system will usually maintain a correspondence between them (for example, through a user table in the database). In general, in an application, the username and user ID have the characteristics of uniqueness and stability, so the username or user ID is usually used as the target subject information that needs to be associated. However, such "high-quality" subject information is not contained in all HTTP operation behaviors.

[0076] Different types of operations require different necessary information for interaction. For common online applications, the above-mentioned user name or user identification and other behavior subject information with unique and stable characteristics only appear in the registration, login or identity authentication links. In the remaining types of operations, these behavior subject information are not indispensable necessary interaction information. Exemplarily, network applications usually have their own state maintenance mechanism to ensure that the implemented operations are implemented for specific objects, and it is not the best choice to pass the user name or user identification in each HTTP interaction. Some network applications only need identity authentication or login when performing important operations, and the operation information before that does not necessarily have identity identification information. From the analysis of the actual intercepted content, HTTP operations that do not contain high-quality behavior subjects such as user name and user identification account for the majority.

[0077] 4) There is no uniform agreement on the behavior subject information contained in the HTTP load, and the specific explanation is,

[0078] For HTTP operations that do not contain high-quality behavior subjects such as user name and user identification, some indirect association fields (exemplarily, such as SessionID, TransactionID, Token, etc.) that can be used to infer behavior subjects may be contained; however, the format of the above-mentioned indirect association fields and the information that can directly represent the behavior subject such as user name and user identification is determined by the network application itself (exemplarily, for B-S structure, it is mainly determined by the WEB server side; in APP mode, it is determined by the client and server together). There is no uniform format or rule for different network applications.

[0079] Different locations contain behavior subject information: user name, user identification and association fields can be contained in URI (such as URL with specific variable method), can be contained in Cookie in HTTP header, can be contained in a form variable in HTTP operation body, or can be embedded in a DOM object as page content (if contained in Response). Therefore, behavior subject information may be contained in each location.

[0080] Different names of behavior subjects: if the behavior subject information is contained in the variable form, the Key-Value form is the universally accepted mode. Key is usually used as the name of the variable, and the value can be extracted as the behavior subject through the name. However, the name of the behavior subject information is not explicitly specified in the standard, and network applications can design various names. Most network applications will use more intuitive names such as login_name and user_name in order to enhance code readability and improve debugging efficiency, but different applications will usually be different.

[0081] Many network applications will have multiple variable names that may contain information about the subject of the behavior in the interaction process, but in fact they represent the same semantic information about the subject of the behavior. For example, user, username, login, login_name. There are multiple different behavior subject information in some network applications, but they may point to the same behavior subject (one behavior subject may have multiple identification attributes), for example, in a user operation process, there is login_name = abc in a certain HTTP operation behavior, and there is wechatID = xyz in another operation behavior. If a user's login_name is abc and wechatID is xyz, login_name and wechatID can both be used as the name of the extracted behavior subject information, but we must select one (the best) and cannot associate one behavior subject as abc and another behavior subject as xyz. Associating the same user's behavior subject with different subject behavior information will cause ambiguity.

[0082] Embodiment 1

[0083] Referring to Figure 1 In view of the defects of the prior art, the embodiment of the present application provides a behavior subject association analysis method, which comprises the following steps:

[0084] Step 1, obtaining HTTP communication data to be analyzed for behavior subject association;

[0085] Step 2, obtaining a behavior subject active behavior based on the HTTP communication data obtained in step 1;

[0086] Step 3, obtaining direct association items and indirect association items based on the behavior subject active behavior obtained in step 2;

[0087] Step 4, performing association analysis on the behavior subject active behavior based on the five-tuple, the direct association items and the indirect association items, to obtain a behavior subject association analysis result.

[0088] The behavior subject association analysis method provided by the embodiment of the present application can determine the behavior subject of each behavior data in the HTTP communication data, and can be used for tracing the potential abnormal behavior in the network.

[0089] Embodiment 2

[0090] Referring to Figure 2 The embodiment of the present application specifically provides a behavior subject association analysis method in HTTP communication data, which comprises the following steps:

[0091] Step 1: Collect the original traffic of the target network as the original data set; wherein, the collected initial data set is preprocessed to remove data irrelevant to HTTP communication; specifically, the data can be collected using a sniffer tool, rules are set according to the behavior subject data characteristics, network traffic containing HTTP is extracted, only fields containing necessary information such as quintuple, Request, Response, URL, etc. are retained; according to the statistics of the fields contained in the user data, new matching rules are added for extraction;

[0092] Step 2: Analyze the time interval of the generated behavior, Referer, data type, etc. to establish a data source discrimination formula to distinguish between the active behavior of the network behavior subject and the automatic behavior of the browser or APP; specifically, according to the data content format, information such as Applet generated periodic polling is preliminarily removed; the time interval ΔT of the previous and subsequent behavior operations related to Referer in the same connection is calculated, a threshold is set, and if the threshold is exceeded, it is active behavior, and if the threshold is less than the threshold, it is automatic behavior;

[0093] Step 3: Score the fields in the active behavior of the behavior subject, determine the best associated field and the candidate associated field, and respectively as the direct association item and the indirect association item; specifically, the following conditions are met for the field item to score: (1) the fields contained in Cookie and Set-Cookie in head; (2) the first 5 fields in Request and Response; (3) fields containing user naming habits, such as containing id, name, user, etc. keywords; (4) remove the fixed fields contained in HTTP, the remaining fields with high frequency; score the field items that meet these conditions, set a threshold, and for the fields exceeding the threshold, the highest score is the direct association item, and the rest are indirect association items;

[0094] Step 4: For the active behavior of the behavior subject, the data is processed in stages, and the behavior is associated with the connection by using the five-tuple, the direct association item and the indirect association item, and then the connection is associated with the behavior subject, a task behavior set is established, the behavior data of the same behavior subject is labeled, and the association of the behavior subject in the HTTP communication data is completed; specifically, for the active behavior of the behavior subject, the data is processed in stages, and is divided into the behavior level, the connection level and the behavior subject level; first, the behaviors with the same five-tuple are associated with the same connection, then the connection containing the direct association item in the behavior data is associated with the same behavior subject according to the association item elected in step 3, and if the behavior data in the connection does not contain the direct association item, the connection is associated with the behavior subject according to the indirect association item; all the behavior data of the same behavior subject is set as a task behavior set, the task behavior set is labeled, and the label content is the value of the direct association item, and the association of the behavior subject in the HTTP communication data is completed.

[0095] In the method of the embodiment of the application, a series of HTTP operation behavior sequences labeled with a behavior subject label are outputted from a series of inputted original data packets.

[0096] Embodiment 3

[0097] The behavior subject association analysis method for HTTP communication data provided by the embodiment of the application can be used for user behavior association analysis of the WeChat public platform of State Grid Shanghai Electric Power (explanatorily, hereinafter referred to as the WeChat platform of Shanghai Electric Power), and mainly includes the following steps.

[0098] Step 1: Collecting the original network traffic of the WeChat platform of Shanghai Electric Power as an original data set; pre-processing the collected initial data set to remove the data irrelevant to the HTTP communication; wherein the original data set in step 1 is collected by packetbeat in ELK, and the network traffic containing HTTP is extracted according to the behavior subject data characteristics and the setting rules, and only the fields containing necessary information are reserved, such as the five-tuple, Request, Response, URL, etc., and new matching rules are added for extraction according to the statistics of the fields contained in the user data of the WeChat platform; the size of the finally collected HTTP communication data is 2G, and a total of 398810 data are contained;

[0099] Step 2: Analyzing the time interval, Referer, data type, etc. of the user behavior data generated by the WeChat platform of Shanghai, establishing a data source discrimination formula, and distinguishing the active behavior of the WeChat platform user as a network behavior subject and the automatic behavior of the browser or APP;

[0100] Step 3: The user of the WeChat platform is taken as a behavior subject, the fields in the active behavior are scored, the best associated field and the candidate associated field are determined, and the best associated field and the candidate associated field are taken as a direct associated item and an indirect associated item respectively;

[0101] Step 4: The data is processed in stages for the active behavior of the WeChat platform user, the behavior is associated to the connection by using a five-tuple, a direct associated item and an indirect associated item, the connection is associated to the behavior subject, a task behavior set is established, the behavior data of the same behavior subject is labeled, and the behavior subject association in the HTTP communication data is completed.

[0102] The above step 2 of the embodiment of the application specifically comprises:

[0103] Step 201: The data collected in step 1 is filtered according to the data content format of the Shanghai Power WeChat platform, only the WeChat public platform related data is retained, and the data such as timing polling is removed, the remaining data size is 746M, and a total of 131224 data are contained;

[0104] Step 202: According to the data processed in step 201, the URL is extracted as a reference of user behavior, a total of 9911 complete URL types are extracted;

[0105] Step 203: Since some data operations are the same, only the parameters contained are different, in the URL syntax format, the resource address before the "?" is the same, only the parameter value after the "?" is different, so the URL extracted in step 202 needs to be further processed, the parameters after the "?" in the URL are removed, and a total of 800 URL types without parameters are obtained;

[0106] Step 204: The time interval ΔT of the previous and subsequent behavior operations related to Referer in the same connection is calculated, a threshold value is set, the active behavior is greater than the threshold value, and the automatic behavior is less than the threshold value, after removing the automatic behavior, a total of 153 URL types without parameters are obtained, and a total of 117316 data containing these URL types are contained in the total data, that is, the active behavior data accounts for 89.40% of the total amount;

[0107] For the association analysis process of the above steps, the embodiment of the application specifically lists several common data for interpretation:

[0108] 1) / wechat / order / payCheck?huhao=1234567890

[0109] / wechat / pay / payment?code=1234567890&ym=202211

[0110] / wechat / dzzd / creatBarcode?msg=12345678901234567890

[0111] The above is a complete URL example related to the WeChat public platform.

[0112] 2) / ddhy / image / uniteBill / unitePay / logo1.png

[0113] / wechat / image / jfcz / payAndRecharge / loading.gif

[0114] / wechat / image / myElectricPoint / new / shouqi_icon.png

[0115] The above is a URL example determined as an automatic behavior.

[0116] 3) / wechat / dzzd / checkDzzd

[0117] / wechat / payRecharge

[0118] / wechat / addvTaxInvoice / loginInInvoice

[0119] The above is a URL example determined as an active behavior.

[0120] In the above step 3 of the embodiment of the present application, the following field items are given points for meeting the following conditions:

[0121] (1) The fields contained in Cookie and Set-Cookie in head are given 15 points, such as JSESSIONID, f5avrbbbbbbbbbbbbbbbb, FSSBBIl1UgzbN7NT, FSSBBIl1UgzbN7NS, etc.

[0122] (2) The first 5 fields in Request and Response are given 5 points;

[0123] (3) The fields containing user naming habits are given 20 points, such as openid, huhao, etc.

[0124] (4) Remove the fixed field contained in HTTP, the rest of the top 5 fields, plus 10 points; Give the field item that meets these conditions a score, set the threshold to 15 points, the fields with scores exceeding 15 points are openid, JSESSIONID, f5avrbbbbbbbbbbbbbbbb, FSSBBIl1UgzbN7NT, FSSBBIl1UgzbN7NS, huhao, and their scores are 30, 25, 25, 25, 25, 20 respectively, so openid is selected as the direct association item, and the rest are indirect association items.

[0125] In the above step 4 of the embodiment of the application, the behavior subject in the WeChat public platform of State Grid Shanghai Electric Power is a user of State Grid Shanghai Electric Power, and according to the direct association item openid elected in step 3, the connection containing openid in the behavior data is associated to the same user, if the behavior data in the connection does not contain openid, the connection is associated to the user according to the indirect association items JSESSIONID, f5avrbbbbbbbbbbbbbbbb, FSSBBIl1UgzbN7NT, FSSBBIl1UgzbN7NS, etc. All behavior data of the same user is set as a task behavior set, and the task behavior set is labeled, and the label content is the value of the direct association item openid field, and the user association analysis in the HTTP communication data of the WeChat public platform of State Grid Shanghai Electric Power is completed.

[0126] Embodiment 4

[0127] The following is an apparatus embodiment of the application, which can be used to execute the method embodiment of the application. For details not disclosed in the apparatus embodiment, please refer to the method embodiment of the application.

[0128] Please refer to Figure 3 The behavior subject association analysis system provided by the embodiment of the application comprises:

[0129] A first acquisition module is configured to acquire HTTP communication data to be subjected to behavior subject association analysis.

[0130] A second acquisition module is configured to acquire behavior subject active behavior based on the HTTP communication data.

[0131] A third acquisition module is configured to acquire direct association items and indirect association items based on the behavior subject active behavior.

[0132] An analysis result acquisition module is configured to perform association analysis on the behavior subject active behavior based on the five-tuple, the direct association items and the indirect association items, and obtain a behavior subject association analysis result.

[0133] Embodiment 5

[0134] In another embodiment of the present application, a computer device is provided, which comprises a processor and a memory, the memory is used to store a computer program, the computer program comprises program instructions, and the processor is used to execute the program instructions stored in the computer storage medium. The processor can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc., which are the computing core and control core of the terminal, and are suitable for implementing one or more instructions, and are particularly suitable for loading and executing one or more instructions in the computer storage medium to implement a corresponding method process or a corresponding function; the processor in the embodiments of the present application can be used for the operation of the behavior subject association analysis method.

[0135] Embodiment 6

[0136] In another embodiment of the present application, the present application further provides a storage medium, specifically a computer readable storage medium (Memory), which is a memory device in a computer device, and is used to store programs and data. It can be understood that the computer readable storage medium herein can include an internal storage medium in the computer device, and of course can also include an extended storage medium supported by the computer device. The computer readable storage medium provides a storage space, and the storage space stores an operating system of the terminal. Moreover, one or more instructions suitable for being loaded and executed by the processor are also stored in the storage space, and the instructions can be one or more computer programs (including program codes). It should be noted that the computer readable storage medium herein can be a high-speed RAM memory, or a non-volatile memory such as at least one disk memory. One or more instructions stored in the computer readable storage medium can be loaded and executed by the processor to implement the corresponding steps of the behavior subject association analysis method in the above embodiments.

[0137] Those skilled in the art will appreciate that embodiments of the application can be devised for a method, a system, or a computer program product. Accordingly, the present application can be embodied in the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) embodying computer readable program code.

[0138] The present application is described in reference to the flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams.

[0139] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams.

[0140] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams.

[0141] Finally, it should be noted that the above-mentioned embodiments are merely intended for describing the technical solutions of the present application, but not for limiting it. Although the present application has been described in detail with reference to the above-mentioned embodiments, those skilled in the art should understand that the technical solutions of the present application can still be modified or equivalent replaced without departing from the spirit and scope of the present application, and any modification or equivalent replacement should be covered in the protection scope of the claims of the present application.

Claims

1. A method for analyzing the correlation between behavioral subjects, characterized in that, Includes the following steps: Obtain HTTP communication data for the entity to be analyzed in relation to the target behavior; Based on the HTTP communication data, the active behavior of the subject is obtained; Based on the active behavior of the subject, obtain direct and indirect related items; Based on the five-tuple, direct correlation items, and indirect correlation items, the association analysis of the active behavior of the subject is performed to obtain the association analysis results of the subject. in, The steps of obtaining direct and indirect related items based on the active behavior of the subject specifically include: scoring the fields of the active behavior of the subject based on preset scoring conditions, and comparing the scores obtained by the fields with preset threshold scores; wherein, among the fields that exceed the preset threshold scores, the field with the highest score is the direct related item, and the remaining fields are indirect related items. The preset bonus conditions include fields that meet the bonus conditions, such as one or more of the following fields: fields contained in Cookie and Set-Cookie in the header; the first N fields in Request and Response; N being a preset field threshold; fields containing user naming habits; and fields that appear more frequently than a preset frequency threshold, excluding fixed fields contained in HTTP. The steps for performing association analysis on the proactive behaviors of the behavioral subject based on quintuples, direct associations, and indirect associations to obtain the behavioral subject association analysis results specifically include: classifying the proactive behaviors of the behavioral subject into behavior-level, connection-level, and behavioral subject-level data; based on the classification results, associating behaviors with the same quintuple to the same connection, and associating connections containing direct associations to the same behavioral subject; wherein, if the behavior data in a connection does not contain direct associations, then associating the connection to the behavioral subject based on indirect associations; setting all behavior data of the same behavioral subject as a task behavior set, labeling the task behavior set, and obtaining the behavioral subject association analysis results; wherein, the label content is the value of the direct association.

2. The behavioral subject association analysis method according to claim 1, characterized in that, The steps for obtaining HTTP communication data for the subject association analysis specifically include: Use a sniffer tool to collect raw traffic from the target network; Based on pre-defined rules according to the characteristics of the behavioral subject data, the network traffic containing HTTP in the original target network traffic is extracted to obtain the HTTP communication data to be analyzed for the association of the behavioral subject.

3. The behavioral subject association analysis method according to claim 1, characterized in that, The steps for obtaining the active behavior of the subject based on the HTTP communication data specifically include: Based on the HTTP communication data, after removing the timed polling information, the time interval ΔT between the preceding and following actions related to Referer in the same connection is calculated. The time interval ΔT is compared with a preset time interval threshold. The behavior corresponding to the time interval ΔT that exceeds the preset time interval threshold is the active behavior of the subject.

4. A behavioral subject association analysis system, characterized in that, include: The first acquisition module is used to acquire HTTP communication data for the subject association analysis to be performed; The second acquisition module is used to acquire the active behavior of the subject based on the HTTP communication data; The third acquisition module is used to acquire direct and indirect related items based on the active behavior of the subject. The analysis result acquisition module is used to perform association analysis on the active behavior of the behavioral subject based on the five-tuple, direct association items and indirect association items, and obtain the association analysis results of the behavioral subject. in, The steps of obtaining direct and indirect related items based on the active behavior of the subject specifically include: scoring the fields of the active behavior of the subject based on preset scoring conditions, and comparing the scores obtained by the fields with preset threshold scores; wherein, among the fields that exceed the preset threshold scores, the field with the highest score is the direct related item, and the remaining fields are indirect related items. The preset bonus conditions include fields that meet the bonus conditions, such as one or more of the following fields: fields contained in Cookie and Set-Cookie in the header; the first N fields in Request and Response; N being a preset field threshold; fields containing user naming habits; and fields that appear more frequently than a preset frequency threshold, excluding fixed fields contained in HTTP. The steps for performing association analysis on the proactive behaviors of the behavioral subject based on quintuples, direct associations, and indirect associations to obtain the behavioral subject association analysis results specifically include: classifying the proactive behaviors of the behavioral subject into behavior-level, connection-level, and behavioral subject-level data; based on the classification results, associating behaviors with the same quintuple to the same connection, and associating connections containing direct associations to the same behavioral subject; wherein, if the behavior data in a connection does not contain direct associations, then associating the connection to the behavioral subject based on indirect associations; setting all behavior data of the same behavioral subject as a task behavior set, labeling the task behavior set, and obtaining the behavioral subject association analysis results; wherein, the label content is the value of the direct association.

5. An electronic device, characterized in that, include: At least one processor; as well as, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the behavioral subject association analysis method as described in any one of claims 1 to 3.

6. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the behavioral subject association analysis method as described in any one of claims 1 to 3.

Images