An abnormal access behavior detection method and device, a storage medium and an electronic device

Abstract

The application discloses an abnormal access behavior detection method and device, a storage medium and electronic equipment, and relates to the technical field of abnormal access behavior detection. The application discloses an abnormal access behavior detection method and device, a storage medium and electronic equipment, and relates to the technical field of abnormal access behavior detection. The application discloses an abnormal access behavior detection method and device, a storage medium and electronic equipment, and relates to the technical field of abnormal access behavior detection. The application discloses an abnormal access behavior detection method and device, a storage medium and electronic equipment, and relates to the technical field of abnormal access behavior detection. The application discloses an abnormal access behavior detection method and device, a storage medium and electronic equipment, and relates to the technical field of abnormal access behavior detection. The application discloses an abnormal access behavior detection method and device, a storage medium and electronic equipment, and relates to the technical field of abnormal access behavior detection. The application discloses an abnormal access behavior detection method and device, a storage medium and electronic equipment, and relates to the technical field of abnormal access behavior detection. The application discloses an abnormal access behavior detection method and device, a storage medium and electronic equipment, and relates to the technical field of abnormal access behavior detection. The application discloses an abnormal access behavior detection method and device, a storage medium and electronic equipment, and relates to the technical field of abnormal access behavior detection. The application discloses an abnormal access behavior detection method and device, a storage medium and electronic equipment, and relates to the technical field of abnormal access behavior detection. The application discloses an abnormal access behavior detection method and device, a storage medium and electronic equipment, and relates to the technical field of abnormal access behavior detection. The application discloses an abnormal access behavior detection method and device, a storage medium and electronic equipment, and relates to the technical field

Description

Technical Field

[0001] This invention relates to the field of electric mobile technology, and more specifically to a method, apparatus, storage medium, and electronic device for detecting abnormal access behavior. Background Technology

[0002] With the advent of the "Internet+" era, the rapid development of mobile communication and internet technologies, and the widespread application of various smart terminals, mobile internet is profoundly impacting the business models and operational efficiency of power grid companies. Power mobile terminals, as a specific application of mobile internet in power grid companies and power engineering, have greatly promoted the development and technological innovation of power grid companies. Currently, mobile application technology has been implemented and used in some field operations of power grid companies' production, marketing, OA collaborative office, and enterprise information portal business systems, improving the office efficiency of power grid company employees, promoting productivity, and reducing cost input. Mobile application devices have become indispensable productivity tools in people's work. However, as an extension of internal operations and external services of power companies, mobile terminals and mobile applications inevitably face security risks such as malicious attacks and sensitive data leakage during use. Therefore, while promoting the widespread application of mobile terminals in power grid companies, considering the large amount of sensitive information such as geographic coordinate data and office document data in power mobile business, further research is needed on power mobile terminal data security protection technology to ensure the security of access to sensitive power data. Currently, some technologies and methods exist for terminal data security protection, but some problems still need to be solved:

[0003] (1) The identification of existing abnormal data access behavior relies on the acquisition of prior knowledge, which is quite difficult. Most studies on abnormal data access behavior are based on obtaining prior knowledge of malicious insiders (such as the attacker's capabilities, attack steps, and attack costs). Only by fully understanding the knowledge of insider attackers can data abuse behavior be detected. However, in practical applications, obtaining the attacker's prior knowledge before successful detection is a difficult problem. Therefore, the practicality of these methods is hard to guarantee, which limits the use of these analytical methods.

[0004] (2) Access to sensitive data related to mobile power systems is usually closely related to business logic, making it difficult to extract clear and general attack rules. For the behavior of using mobile devices to access mobile power business systems, it is difficult to extract clear and general attack rules. Even the same attack purpose often manifests different behaviors in different business systems. Even by combining seemingly normal behaviors, the same malicious purpose can be achieved. Therefore, existing IDS, firewalls and other devices cannot specify effective rules for defense. Summary of the Invention

[0005] In view of this, embodiments of the present invention provide a method, apparatus, storage medium and electronic device for detecting abnormal access behavior, in order to solve the technical problem that the identification of abnormal data access behavior in the prior art is not very practical.

[0006] The technical solution proposed in this invention is as follows:

[0007] The first aspect of this invention provides a method for detecting abnormal access behavior, comprising: acquiring a detection alarm log generated by a target object and a machine sub-pattern generated by the target object during automatic runtime; performing periodic anomaly detection on the machine sub-pattern based on a detection algorithm using a dynamic histogram to obtain a first detection result; performing anomaly detection based on the detection alarm log after removing the machine sub-pattern, according to the number of operations, operation time, and operation mode, to obtain a second detection result; and outputting anomaly detection results based on the first detection result and the second detection result.

[0008] Optionally, the detection algorithm based on dynamic histograms performs periodic anomaly detection on the machine sub-pattern to obtain a first detection result, including: performing similarity calculation on the first histogram of the machine sub-pattern generated by the detection algorithm based on dynamic histograms to obtain a uniform detection result; when the uniform detection result is anomaly, generating a second histogram corresponding to the horizontal coordinate of the histogram based on the detection algorithm based on dynamic histograms, and obtaining a non-uniform detection result using the similarity calculation result of the second histogram; and obtaining the first detection result based on the uniform detection result and the non-uniform detection result.

[0009] Optionally, similarity calculation is performed on the first histogram of the machine sub-pattern generated by the detection algorithm based on dynamic histograms to obtain a uniform detection result, including: clustering the time intervals of the machine sub-patterns, generating a first histogram based on the clustering results and a preset width; generating a first constructed histogram based on bars in the first histogram whose height is greater than half of the maximum value in the first histogram; and performing periodic anomaly detection based on the similarity between the first histogram and the first constructed histogram to obtain a uniform detection result.

[0010] Optionally, when the uniform detection result is abnormal, a second histogram corresponding to the horizontal coordinate of the first histogram is generated based on a detection algorithm based on a dynamic histogram, and a non-uniform detection result is obtained by calculating the similarity of the second histogram. This includes: when the uniform detection result is abnormal, clustering the intervals of the horizontal coordinates in the first histogram, generating a second histogram based on the clustering results and a preset width; generating a second constructed histogram based on bars in the second histogram whose height is greater than half of the maximum value in the second histogram; and performing periodic anomaly detection based on the similarity between the second histogram and the second constructed histogram to obtain a non-uniform detection result.

[0011] Optionally, clustering the time intervals of machine sub-patterns and generating a first histogram based on the clustering results and a preset width includes: sorting the machine sub-patterns based on the alarm time and calculating the time interval between two adjacent machine sub-patterns; clustering the time intervals to obtain multiple clusters; determining the width of each bar in the first histogram based on the center of each cluster and the preset width; counting the number of times the machine sub-patterns occur based on the time interval corresponding to the width of each bar, with the number of occurrences serving as the length of each bar; and constructing the first histogram based on the width and length of each bar.

[0012] Optionally, based on the alarm logs to be detected after removing the machine sub-patterns, anomaly detection is performed according to the number of operations, operation time, and operation mode to obtain a second detection result, including: using the three-standard-deviation method to perform anomaly detection on the number of operations in the alarm logs to be detected after removing the machine sub-patterns, to obtain a number detection result; using the relative entropy algorithm to perform anomaly detection on the operation time in the alarm logs to be detected after removing the machine sub-patterns, to obtain a time detection result; using the Jaccard distance algorithm to perform anomaly detection on the operation mode of the alarm logs to be detected, to obtain a pattern detection result; and merging the number detection result, time detection result, and pattern detection result to obtain the second detection result.

[0013] Optionally, before obtaining the second detection result by performing anomaly detection based on the number of operations, operation time, and operation mode according to the alarm log to be detected after removing the machine sub-patterns, the process includes: acquiring historical detection alarm logs generated by the target object and historical machine sub-patterns generated by the target object during automatic operation; performing statistics on the historical detection alarm logs after removing historical machine sub-patterns to obtain the parameters of the three-standard-deviation method and the parameters of the relative entropy algorithm; and performing statistics on the historical detection alarm logs to obtain the parameters of the Jaccard distance algorithm.

[0014] A second aspect of this invention provides an abnormal access behavior detection device, comprising: a data acquisition module for acquiring a target object's alarm logs to be detected and a machine sub-pattern generated by the target object during automatic runtime; a first detection module for performing periodic anomaly detection on the machine sub-patterns based on a dynamic histogram detection algorithm to obtain a first detection result; a second detection module for performing anomaly detection based on the target alarm logs after removing the machine sub-patterns, according to the number of operations, operation time, and operation mode, to obtain a second detection result; and a result output module for outputting anomaly detection results based on the first detection result and the second detection result.

[0015] A third aspect of the present invention provides a computer-readable storage medium storing computer instructions for causing the computer to perform the abnormal access behavior detection method as described in the first aspect and any one of the first aspects of the present invention.

[0016] A fourth aspect of the present invention provides an electronic device, including: a memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the abnormal access behavior detection method as described in the first aspect and any one of the first aspects of the present invention.

[0017] The technical solution provided by this invention has the following effects:

[0018] The abnormal access behavior detection method, apparatus, storage medium, and electronic device provided in this invention extract alarm logs and machine sub-patterns to detect and judge abnormal behavior from four aspects: abnormal operation frequency, abnormal operation time, abnormal operation mode, and periodic activity detection. Compared with general detection methods, this method is specifically designed for abnormal detection scenarios, which is more in line with the actual operation of power business and meets actual needs. Furthermore, this detection method uses a dynamic histogram detection algorithm for periodic anomaly detection, which improves the accuracy of detection compared to existing periodic detection algorithms. Attached Figure Description

[0019] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0020] Figure 1 This is a flowchart of an abnormal access behavior detection method according to an embodiment of the present invention;

[0021] Figure 2 This is a flowchart of an abnormal access behavior detection method according to another embodiment of the present invention;

[0022] Figure 3 This is a flowchart of an abnormal access behavior detection method according to another embodiment of the present invention;

[0023] Figure 4 This is a schematic diagram illustrating the number of alarms generated daily by Mobile QQ according to an embodiment of the present invention;

[0024] Figure 5This is a schematic diagram of the historical alarm data of Mobile QQ and the time distribution of alarms to be detected according to an embodiment of the present invention;

[0025] Figure 6 This is a structural block diagram of an abnormal access behavior detection device according to an embodiment of the present invention;

[0026] Figure 7 This is a schematic diagram of the structure of a computer-readable storage medium provided according to an embodiment of the present invention;

[0027] Figure 8 This is a schematic diagram of the structure of an electronic device provided according to an embodiment of the present invention. Detailed Implementation

[0028] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0029] The terms "first," "second," "third," "fourth," etc., used in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0030] According to an embodiment of the present invention, an abnormal access behavior detection method is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0031] This embodiment provides a method for detecting abnormal access behavior, which can be used in electronic devices such as computers, mobile phones, and tablets. Figure 1 This is a flowchart of an abnormal access behavior detection method according to an embodiment of the present invention, such as... Figure 1 As shown, the method includes the following steps:

[0032] Step S101: Obtain the alarm logs to be detected generated by the target object and the machine sub-modes generated by the target object during automatic runtime. The target object can be a power mobile terminal or mobile application, or other information systems vulnerable to attack or sensitive information theft. To avoid the problems of existing technologies relying on prior knowledge or requiring general attack rules with poor practicality, the detection method of this embodiment analyzes the alarm data generated by the target object to detect abnormal behavior.

[0033] Alarm logs or machine sub-modes to be detected mainly include two types of data: tag type and numerical type. Tag type data contains information such as the type of alarm. The values ​​of this type of attribute have no order, magnitude, or other correlation. These attributes can be described as sets. Numeric type attributes are represented by real numbers, such as the number of a certain type of alarm or the amount of network traffic.

[0034] Furthermore, since some applications generate alerts automatically while running in the background, and these alerts exhibit certain patterns, they can be termed machine sub-patterns. For anomaly detection within machine sub-patterns, the application's automatically generated alert behavior can be mined by extracting frequently occurring subsequences of alerts. Specifically, to obtain machine sub-patterns, the application under test can be started on a test machine and allowed to run automatically for a period of time. Then, based on the alert data it generates, machine sub-patterns can be generated. Therefore, the alert logs to be tested and the machine sub-patterns obtained in this step have an inclusion relationship; that is, the alert logs to be tested may contain machine sub-patterns. However, to extract the machine sub-patterns separately for anomaly detection, they can be extracted individually using the method described above.

[0035] Step S102: Perform periodic anomaly detection on the machine sub-pattern based on the dynamic histogram detection algorithm to obtain the first detection result. Specifically, if the machine sub-pattern is generated periodically, it indicates that it is automatically generated by the target object and is a normal phenomenon; if it is not generated periodically, it indicates that the machine sub-pattern is generated manually and is malicious or abnormal. Therefore, periodic detection of the machine sub-pattern is required. Among them, for the periodic machine sub-patterns automatically generated by the target, this type of machine sub-pattern can be called a frequent alarm subsequence, that is, multiple alarm messages appear frequently in stages, such as alarm 1, alarm 2, alarm 3... alarm 1, alarm 2, alarm 3..., where alarm 1, alarm 2, alarm 3 is the frequent alarm subsequence. To determine whether it is a frequent alarm subsequence, a time window can be taken, and the sequence within the time window can be selected for frequent subsequence mining.

[0036] Existing periodicity detection methods, such as detectors designed based on the standard deviation of time intervals (marking the requested time series as periodic if the standard deviation of the connection interval is small), can cause a sharp increase in the standard deviation when a single outlier occurs. Another approach is histogram-based detection, which generates a histogram of adjacent connection intervals and compares it to a periodically distributed histogram using similarity comparison. However, similarity is highly sensitive to the width of each bin in the histogram. Setting a large width leads to over-smoothing, causing many normal cases to be incorrectly identified; while a small width increases the adoption error, and some periodic sequences caused by environmental factors such as network latency may be misclassified. When the starting points of the bins are statically defined, relatively close values ​​may fall into different bins, affecting the similarity comparison.

[0037] Therefore, this embodiment of the invention employs a detection algorithm based on dynamic histograms. By clustering the time intervals of machine sub-patterns, and generating the histogram from the clusters, this dynamic method can adapt to the timing randomization that attackers typically introduce between connections and the errors caused by network latency, thereby improving the accuracy of anomaly detection and reducing false positives.

[0038] Step S103: Based on the alarm log to be detected after removing the machine sub-pattern, perform anomaly detection according to the number of operations, operation time, and operation mode to obtain a second detection result. Specifically, apart from alarms automatically generated by the application, most others are caused by user or attacker operations. For these types of alarms, manual operation anomaly detection is required, for example, anomaly detection from three aspects: number of operations, operation time, and operation mode. In addition, to avoid the influence of machine sub-patterns, when performing anomaly detection, the machine sub-patterns in the alarm log to be detected are removed first, and then anomaly detection is performed on the remaining data.

[0039] Step S104: Output an anomaly detection result based on the first detection result and the second detection result. Specifically, when an anomaly is found in either the first or second detection result, the corresponding anomaly result is output, along with the corresponding anomaly type, such as machine sub-mode anomaly, operation count anomaly, operation time anomaly, or operation mode anomaly.

[0040] The abnormal access behavior detection method provided in this invention extracts alarm logs and machine sub-patterns to detect and judge abnormal behavior from four aspects: abnormal operation frequency, abnormal operation time, abnormal operation mode, and periodic activity detection. Compared with general detection methods, this method is specifically designed for abnormal detection scenarios, which is more in line with the actual operation of power business and meets actual needs. Furthermore, this detection method uses a dynamic histogram detection algorithm for periodic anomaly detection, which improves the accuracy of detection compared to existing periodic detection algorithms.

[0041] In one embodiment, a detection algorithm based on dynamic histograms performs periodic anomaly detection on the machine sub-pattern to obtain a first detection result, including: performing similarity calculation on a first histogram of the machine sub-pattern generated by the detection algorithm based on dynamic histograms to obtain a uniform detection result; when the uniform detection result is anomaly, generating a second histogram corresponding to the horizontal coordinate of the histogram using the detection algorithm based on dynamic histograms, and obtaining a non-uniform detection result using the similarity calculation result of the second histogram; and obtaining the first detection result based on the uniform detection result and the non-uniform detection result.

[0042] Specifically, for periodic anomaly detection, a uniform detection is performed first. This stage detects attack patterns where the attacker's selectable time intervals are either multiples of a fixed number or elements from a finite set, with elements selected uniformly. If the uniform detection result is anomaly, a non-uniform detection is performed. This non-uniform detection detects attack patterns where the attacker's selectable time intervals are consecutive multiples of a fixed number, with elements selected non-uniformly. If the non-uniform detection result is normal, the first detection result is normal; if the non-uniform detection result is anomaly, the first detection result is anomaly. Thus, through these two stages of detection, comprehensive and accurate detection of machine sub-patterns can be achieved. It should be noted that if the uniform detection result is normal, non-uniform detection is unnecessary, and the first detection result is normal in this case.

[0043] In one embodiment, similarity calculation is performed on the first histogram of the machine sub-pattern generated using a detection algorithm based on dynamic histograms to obtain a uniform detection result, including the following steps:

[0044] Step S201: Cluster the time intervals of the machine sub-patterns, and generate a first histogram based on the clustering results and a preset width. Specifically, clustering the time intervals of the machine sub-patterns and generating a first histogram based on the clustering results and a preset width includes: sorting the machine sub-patterns based on the alarm time, calculating the time interval between two adjacent machine sub-patterns; clustering the time intervals to obtain multiple clusters; determining the width of each bar in the first histogram based on the center of each cluster and the preset width; counting the number of times the machine sub-pattern appears based on the time interval corresponding to the width of each bar, and using the number of times as the length of each bar; and constructing a first histogram based on the width and length of each bar.

[0045] The acquired machine sub-patterns include corresponding alarm times. Based on these alarm times, the machine sub-patterns are sorted, resulting in the following sorting: time t1, corresponding alarm sequence l1 (this alarm sequence can be understood as the machine sub-pattern corresponding to the alarm time); time t2, corresponding alarm sequence l2… where t1 < t2 < … . The time interval between adjacent sequences is the difference between the alarm times of the two adjacent sequences, specifically represented as t2 - t1. This yields a sample set composed of time intervals. During clustering, a sample in the sample set is first used as the center of the first cluster. The remaining samples are then sequentially checked to see if they fall within the preset range of the cluster center. If they do, the sample is assigned to the first cluster; otherwise, a second cluster center is generated based on the corresponding sample. Specifically, this clustering algorithm can be implemented as follows:

[0046] Given N pattern samples {x1, x2, ..., xN} to be classified, classify them into cluster centers z1, z2, ... according to a distance threshold T.

[0047] first step:

[0048] Choose any sample xi as the initial value for a cluster center, for example, let z1 = x1.

[0049] Calculate D21 = ||x2 - z1||

[0050] If D21 > T, then a new cluster center z2 = x2 is determined.

[0051] Otherwise, x2 belongs to the cluster centered at z1.

[0052] Step Two:

[0053] Assume that cluster centers z1 and z2 already exist.

[0054] Calculate D31 = ||x3 - z1||

[0055] D32=||x3-z2||

[0056] If D31 > T and D32 > T, then a new cluster center z3 = x3 is obtained.

[0057] Otherwise, x3 is the closest one to z1 and z2. ......

[0059] This process is repeated until all N pattern samples have been classified.

[0060] For time interval clustering, the clustering algorithm described above can be followed to obtain multiple clusters. When converting multiple clusters into histograms, each cluster corresponds to a bar in the histogram. The width of each bar is twice the distance threshold T used in the clustering algorithm. Then, the cluster center is used as the center of the horizontal coordinate of each bar. The time interval corresponding to each bar is the difference between the cluster center minus the distance threshold and the cluster center plus the distance threshold. For example, if the center of the horizontal coordinate of a bar is x1, then the time interval corresponding to that bar is X1+T-(X1-T). Then, the number of machine sub-patterns appearing in this time interval is counted, and this number is used as the length of each histogram.

[0061] Step S202: Generate a first constructed histogram based on bars in the first histogram whose height is greater than half of the maximum value in the first histogram; specifically, after obtaining the first histogram, first select the longest bar in the first histogram, divide the length of the longest bar by 2 to obtain a comparison value, compare the length of all bars in the first histogram with the comparison value, retain the bars in the first histogram whose length is greater than the comparison value, and delete the bars whose length is less than or equal to the comparison value. The retained bars constitute the first constructed histogram.

[0062] Step S203: Perform periodic anomaly detection based on the similarity between the first histogram and the first constructed histogram to obtain a uniform detection result. Specifically, calculate the similarity between the first histogram and the first constructed histogram. If the calculation result is less than a threshold, it indicates that the machine sub-pattern is a periodic operation of the application and not an abnormal access behavior. The similarity calculation can employ any existing similarity calculation algorithm, which will not be elaborated here. It should be noted that, depending on the algorithm selected for similarity calculation, the obtained first histogram can be sorted in descending order of length to facilitate subsequent similarity calculation.

[0063] In one embodiment, when the uniform detection result is abnormal, a second histogram corresponding to the horizontal coordinate of the first histogram is generated based on a detection algorithm using a dynamic histogram, and a non-uniform detection result is obtained by calculating the similarity of the second histogram, including the following steps:

[0064] Step S301: When the uniform detection result is abnormal, cluster the intervals of the horizontal coordinates in the first histogram, and generate a second histogram based on the clustering results and a preset width. Specifically, the clustering process of the horizontal coordinate intervals and the generation process of the second histogram are similar to the clustering of time intervals and the formation process of the first histogram in step S201, the only difference being that in this step, the horizontal coordinate intervals are used as the clustering samples. For example, if the horizontal coordinate of the first bar in the first histogram is X1, the horizontal coordinate of the second bar is X2, the horizontal coordinate of the third bar is X3, and so on, then the clustering samples can be represented as X2-X1, X3-X2, etc.

[0065] Step S302: Generate a second constructed histogram based on bars in the second histogram whose height is greater than half the maximum value in the second histogram. Specifically, after obtaining the second histogram, first select the longest bar in the second histogram, divide the length of the longest bar by 2 to obtain two comparison values, compare the length of all bars in the second histogram with these comparison values, retain bars in the second histogram whose length is greater than the comparison value, and delete bars whose length is less than or equal to the comparison value. The retained bars constitute the second constructed histogram.

[0066] Step S303: Perform periodic anomaly detection based on the similarity between the second histogram and the second constructed histogram to obtain a non-uniform detection result. Specifically, calculate the similarity between the second histogram and the second constructed histogram. If the calculation result is less than a threshold, it indicates that the machine sub-pattern is a periodic operation of the application and not an abnormal access behavior. The similarity calculation can employ any existing similarity calculation algorithm, which will not be elaborated upon here.

[0067] In one embodiment, to achieve accurate detection of the alarm logs to be detected, parameters of an anomaly detection model based on historical data, including the number of operations, operation time, and operation mode, can be generated first. Subsequent detection can then be directly implemented based on the corresponding model. Therefore, before obtaining the second detection result by performing anomaly detection based on the alarm logs to be detected after removing the machine sub-patterns, according to the number of operations, operation time, and operation mode, the process includes: acquiring historical alarm logs generated by the target object and historical machine sub-patterns generated during the target object's automatic runtime; performing statistical analysis on the historical alarm logs after removing historical machine sub-patterns to obtain the parameters of the three-standard-deviation method and the relative entropy algorithm; and performing statistical analysis on the historical alarm logs to obtain the parameters of the Jaccard distance algorithm.

[0068] Specifically, the acquisition of historical detection alarm logs and historical machine sub-patterns is similar to the acquisition of alarm logs and machine sub-patterns to be detected, and will not be repeated here. Through statistical analysis of historical detection alarm logs based on the removal of historical machine sub-patterns, the number of operations approximately follows a normal distribution. Therefore, the three-standard-deviation method is used as an anomaly detection model to detect the number of operations. Thus, the mean and standard deviation of the number of alarms in historical detection alarm logs based on the removal of historical machine sub-patterns are calculated as parameters for the three-standard-deviation method.

[0069] For operation time detection, in certain attack scenarios, attackers often perform operations at inappropriate times, such as when a user downloads internal company files via a remote terminal outside of office hours. This behavior manifests as an anomaly in the timing of the operation. Therefore, a relative entropy algorithm is used to determine whether the operation time is abnormal. After removing historical machine sub-patterns from historical detection alarm logs, the empirical probability distribution of the target object is statistically calculated and used as parameters for the relative entropy algorithm.

[0070] Anomaly in user operation patterns primarily refers to application actions that generate alarm types not found in historical alarm data, indirectly indicating abnormal operation. Therefore, the Jaccard distance algorithm is used to calculate the similarity between the user's operation pattern and historical patterns. When the similarity is less than a threshold, it is determined that an abnormal operation pattern has occurred. Thus, the types of alarms in historical alarm detection logs can be directly statistically analyzed and used as parameters for the Jaccard distance algorithm.

[0071] When calculating the empirical probability distribution, if the target corresponds to an application, the empirical probability distribution of the number of operations performed by the application on the device during three time periods throughout the day is calculated. These three time periods can be a period each from morning, afternoon, and evening.

[0072] In one embodiment, based on the alarm logs to be detected after removing the machine sub-mode, anomaly detection is performed according to the number of operations, operation time, and operation mode to obtain a second detection result, including the following steps:

[0073] Step S401: The three-standard-deviation method is used to perform anomaly detection on the number of operations performed to remove the machine sub-mode from the alarm logs to be detected, and the result of the number of operations is obtained. Specifically, the three-standard-deviation method is expressed by the following formula:

[0074] N-μ>3σ

[0075] Where N represents the number of user operations (number of alarms) in the alarm log to be detected, μ represents the mean number of alarms in the historical alarm logs after removing historical machine sub-modes, and σ represents the standard deviation of the number of alarms in the historical alarm logs after removing historical machine sub-modes. If the number of operations satisfies the above formula, it indicates that the number of operations is abnormal.

[0076] Step S402: Based on the relative entropy algorithm, perform anomaly detection on the operation time of the alarm log to be detected after removing the machine sub-mode, and obtain the time detection result. Specifically, the relative entropy algorithm is expressed by the following formula:

[0077]

[0078] s2=1-e -L

[0079] Where n is 3, p i (x) represents the empirical probability of the alarm log to be detected, q i (x) represents the empirical probability obtained from historical alarm logs. The larger the value of s2 [0, 1], the more abnormal the behavior. It should be noted that the empirical probability obtained from historical alarm logs within the same time period can be selected based on the time period in which the empirical probability of the alarm log to be detected is located.

[0080] Step S403: Perform anomaly detection on the operation patterns of the alarm logs to be detected using the Jaccard distance algorithm to obtain the pattern detection results. Specifically, based on the Jaccard distance algorithm, the proportion of the number of elements in the intersection of two sets A and B in the union of A and B is called the Jaccard coefficient of these two sets, denoted by J(A, B). The Jaccard similarity coefficient is an indicator that measures the similarity between two sets. Here, A represents the alarm types statistically obtained from the alarm logs to be detected, and B represents the alarm types statistically obtained from the historical alarm logs.

[0081]

[0082] Step S404: Combine the count detection result, time detection result, and pattern detection result to obtain the second detection result.

[0083] In one implementation, such as Figure 2 As shown, the abnormal access behavior detection method specifically includes: acquiring historical detection alarm logs, historical machine sub-modes, alarm logs to be detected, and the current machine sub-mode; by comparison, extracting and filtering out machine sub-modes from the historical detection alarm logs and the alarm logs to be detected; then using the historical detection alarm logs for statistical analysis to determine the parameters of the anomaly detection model for operation count, operation time, and operation mode; performing detection for human operation anomalies and application periodic activity anomalies on the alarm logs to be detected and the machine sub-modes, respectively. Human operation anomalies are detected by using the anomaly detection model to check the operation count, operation time, and operation mode of the alarm logs to be detected after removing machine sub-modes. Application periodic activity anomaly detection is equivalent to periodic anomaly detection of machine sub-modes. Finally, the anomaly detection model is updated based on the detection results, and the detection results are output.

[0084] In one implementation, such as Figure 3 As shown, the abnormal access behavior detection method can be implemented according to the following process: acquire alarm data containing alarm logs to be detected and the current machine sub-mode; extract and filter the machine sub-modes from the alarm logs to be detected; perform application cycle behavior detection on the machine sub-modes; perform anomaly detection on the number of operations (operation quantity), operation time, and operation mode based on the alarm logs to be detected; finally, output the final result based on the respective detection results, and update the model in the human operation anomaly detection based on the results.

[0085] In one implementation, the abnormal access behavior detection method is specifically applied as follows:

[0086] (1) Experimental data

[0087] Regarding the specific implementation of data collection, 1752 alarm logs were collected from 10 terminals on the existing endpoint security monitoring platform at different time periods. These alarm logs involve 43 applications, and the format of the alarm logs is shown in Table 1.

[0088] Table 1 Alarm Data Format

[0089]

[0090] After preprocessing the alarm data, the experimental data consists of 30 days of data. Therefore, N days of data are randomly selected as training data (i.e., historical data), and the data from the next 30 to N days are used as detection data (i.e., data to be detected).

[0091] (2) Detection of abnormal access behavior to sensitive data

[0092] First, we extracted automatic sub-mode (machine sub-mode) data from the alarm data. By starting the application under test and allowing it to run automatically for a period of time, we extracted the alarms generated during this period and identified frequent sub-sequences. In the experiment, we used a one-minute time window, with a sub-sequence length of 2. For example, for the mobile QQ application, we obtained 9 automatically generated sub-sequences. These consecutive sub-sequences mostly consisted of permission requests generated consecutively during the application's automatic operation, such as requesting location permission first and then requesting notification bar message permission.

[0093] Then, the corresponding alarm data is checked for human error and periodic application errors.

[0094] (3) Analysis of test results

[0095] Anomaly detection results were obtained through both human error handling and periodic application monitoring. Some anomalies were identified by detection algorithms from existing alert data, while others were generated from samples simulated in corresponding attack scenarios. The following sections analyze the results of different anomalies.

[0096] 1) Abnormal operation count detection

[0097] The operation count detection measures the number of times a user performs operations outside of normal operating patterns within a specified time period. Specifically, it determines whether the number of times a user accesses sensitive data follows a normal distribution. This is done by using the mean and standard deviation obtained from the training data, and employing the statistically common method of three times the standard deviation for anomaly detection. The detection results are based on statistics derived from alarm data generated by Mobile QQ, such as... Figure 4 As shown, most of the daily average number of alarms generated is in the range of [0, 50], while the alarms to be detected exceed 100 times, which is significantly different from normal behavior. Therefore, they can be detected by the abnormal operation count module.

[0098] 2) Operation mode anomaly detection

[0099] By statistically analyzing operation types based on alarm data, a set of common operation patterns can be obtained. When a user's operation behavior generates a significantly different set of alarm types, it can be determined that the user may have performed an operation that does not fall within their role's permissions. During the detection process, we randomly selected alarms generated by the application com.tencent.mobileqq on certain days as data to be tested. We found that the alarm types generated by the device (ecd69e64ad8b62b679f16f753a6d953e9cba2eea) on a certain day were different from those generated at other times (see Table 2). Further analysis revealed that the following two types of alarms generated on that day did not appear on other times on the device where the application was installed, indicating abnormal permission requests.

[0100] Table 2 Abnormal Permissions

[0101]

[0102] 3) Operation time anomaly detection

[0103] Operation time anomaly detection refers to detecting user actions within the data to be tested, occurring outside of normal time periods. For normal business operations, user operation times are typically relatively fixed each day, resulting in a certain regularity in their daily access behavior. When users operate during unusual times, it causes a significant anomaly in the distribution of operation times within the detection date. This is determined using empirical probabilities for the corresponding time periods. In the detected data, Mobile QQ exhibits a clear daytime pattern, meaning that most alarms are generated during working hours, such as... Figure 5 As shown, due to background running tests of Mobile QQ on some mobile phones, some alarm events occurred during the early morning hours. However, the operation distribution still shows that normal operations are mainly concentrated during working hours. For the alarms to be detected, since the alarms frequently occurred in periods with less normal operation, such as the early morning hours, there were significant differences between the alarms to be detected and historical alarms.

[0104] 4) Application cycle activity detection

[0105] This paper proposes a periodic detection algorithm based on dynamic histograms for detecting periodic anomalies. The effectiveness of the algorithm is demonstrated using three scenarios: P1, P2, and P3. Given a total time range and time granularity, the algorithm simulates and generates attack time series. The time range spans one day, and the time granularity is in seconds. The generated datasets are divided into three classes: P1, P2, and P3.

[0106] Table 3 shows the time series simulation results and the detection results of the detection algorithm.

[0107]

[0108]

[0109] As shown in Table 3, the first three time series were generated in scenario P1, and two of them were marked as periodic. Time series No. 3 is very short, and the detection algorithm marked it as aperiodic. However, if the time series were long enough, the algorithm would mark it as periodic. The next three time series were generated in scenario P2, and time series No. 6 was marked as aperiodic because its time range was too short. The last three time series were generated in scenario P3, indicating that the detection algorithm can mark these three time series as periodic. Based on the analysis of the above results, it can be seen that this periodicity detection algorithm can cover most single-period and multi-period periodic behaviors, achieving the expected research objectives.

[0110] This invention also provides an abnormal access behavior detection device, such as... Figure 6 As shown, the device includes:

[0111] The data acquisition module is used to acquire the alarm logs to be detected generated by the target object and the machine sub-modes generated by the target object during automatic runtime; for details, please refer to the corresponding part of the above method embodiment, which will not be repeated here.

[0112] The first detection module is used to perform periodic anomaly detection on the machine sub-pattern based on a dynamic histogram detection algorithm to obtain a first detection result; for details, please refer to the corresponding part of the above method embodiment, which will not be repeated here.

[0113] The second detection module is used to perform anomaly detection based on the number of operations, operation time, and operation mode of the alarm log to be detected after removing the machine sub-mode, and obtain the second detection result; for details, please refer to the corresponding part of the above method embodiment, which will not be repeated here.

[0114] The result output module is used to output anomaly detection results based on the first detection result and the second detection result. For details, please refer to the corresponding sections of the above method embodiments, which will not be repeated here.

[0115] The abnormal access behavior detection device provided in this invention extracts alarm logs and machine sub-patterns to detect and judge abnormal behavior from four aspects: abnormal operation frequency, abnormal operation time, abnormal operation mode, and periodic activity detection. Compared with general detection methods, this method is designed with specific abnormal detection scenarios, which are more in line with the actual operation of power business and meet actual needs. At the same time, this detection method uses a dynamic histogram detection algorithm for periodic anomaly detection, which improves the accuracy of detection compared with existing periodic detection algorithms.

[0116] For a detailed description of the functions of the abnormal access behavior detection device provided in this embodiment of the invention, please refer to the description of the abnormal access behavior detection method in the above embodiments.

[0117] This invention also provides a storage medium, such as... Figure 7 As shown, a computer program 601 is stored on it. When executed by a processor, this program implements the steps of the abnormal access behavior detection method in the above embodiments. The storage medium also stores audio and video stream data, feature frame data, interactive request signaling, encrypted data, and a preset data size. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk drive (HDD), or solid-state drive (SSD), etc.; the storage medium may also include combinations of the above types of memory.

[0118] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk drive (HDD), or solid-state drive (SSD), etc.; the storage medium can also include combinations of the above types of memory.

[0119] This invention also provides an electronic device, such as... Figure 8 As shown, the electronic device may include a processor 51 and a memory 52, wherein the processor 51 and the memory 52 may be connected via a bus or other means. Figure 8 Taking the example of a connection between China and Israel via a bus.

[0120] Processor 51 can be a central processing unit (CPU). Processor 51 can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or combinations of the above types of chips.

[0121] The memory 52, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer-executable programs, and modules, such as the corresponding program instructions / modules in the embodiments of the present invention. The processor 51 executes various functional applications and data processing of the processor by running the non-transitory software programs, instructions, and modules stored in the memory 52, thereby implementing the abnormal access behavior detection method in the above method embodiments.

[0122] The memory 52 may include a program storage area and a data storage area. The program storage area may store applications required for operating the device and at least one function; the data storage area may store data created by the processor 51, etc. Furthermore, the memory 52 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory 52 may optionally include memory remotely located relative to the processor 51, and these remote memories may be connected to the processor 51 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0123] The one or more modules are stored in the memory 52, and when executed by the processor 51, they perform the following: Figure 1 -2 shows the abnormal access behavior detection method in the embodiment.

[0124] For specific details regarding the aforementioned electronic devices, please refer to the relevant documentation. Figures 1 to 2 The relevant descriptions and effects in the illustrated embodiments are for understanding purposes only and will not be repeated here.

[0125] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A method for detecting abnormal access behavior, characterized in that, include: Obtain the alarm logs to be detected generated by the target object and the machine sub-modes generated automatically when the target object runs. The machine sub-modes are alarm behavior patterns automatically generated by the application in the background. The detection algorithm based on dynamic histograms performs periodic anomaly detection on the machine sub-pattern to obtain the first detection result; Based on the alarm logs to be detected after removing the machine sub-mode, anomaly detection is performed according to the number of operations, operation time, and operation mode to obtain a second detection result; Output the anomaly detection result based on the first detection result and the second detection result; A detection algorithm based on dynamic histograms is used to perform periodic anomaly detection on the machine sub-pattern, resulting in a first detection result, including: Similarity calculation is performed on the first histogram of the machine sub-pattern generated by the detection algorithm based on dynamic histogram to obtain a uniform detection result; When the uniform detection result is abnormal, a detection algorithm based on dynamic histogram is used to generate a second histogram corresponding to the horizontal coordinate of the histogram, and the similarity calculation result of the second histogram is used to obtain the non-uniform detection result. The first detection result is obtained based on the uniform detection result and the non-uniform detection result.

2. The abnormal access behavior detection method according to claim 1, characterized in that, Similarity calculation is performed on the first histogram of the machine sub-pattern generated by the detection algorithm based on dynamic histograms to obtain a uniform detection result, including: Cluster the time intervals of the machine sub-patterns, and generate a first histogram based on the clustering results and a preset width; A first constructed histogram is generated based on bars in the first histogram whose height is greater than half of the maximum value in the first histogram; Periodic anomaly detection is performed based on the similarity between the first histogram and the first constructed histogram to obtain uniform detection results.

3. The abnormal access behavior detection method according to claim 1, characterized in that, When the uniform detection result is abnormal, a detection algorithm based on dynamic histograms is used to generate a second histogram corresponding to the horizontal coordinate of the first histogram. The similarity calculation result of the second histogram is then used to obtain a non-uniform detection result, including: When the uniform detection result is abnormal, the intervals of the horizontal coordinates in the first histogram are clustered, and a second histogram is generated based on the clustering results and a preset width. A second constructed histogram is generated based on bars in the second histogram whose height is greater than half of the maximum value in the second histogram; Periodic anomaly detection is performed based on the similarity between the second histogram and the second constructed histogram to obtain non-uniform detection results.

4. The abnormal access behavior detection method according to claim 2, characterized in that, Clustering the time intervals of machine sub-patterns and generating a first histogram based on the clustering results and a preset width includes: The machine sub-modes are sorted based on the alarm time, and the time interval between two adjacent machine sub-modes is calculated. The time intervals are clustered to obtain multiple clusters; The width of each bar in the first histogram is determined based on the center of each cluster and the preset width; The number of times the machine sub-pattern appears is counted based on the time period corresponding to the width of each bar, and the number of times is used as the length of each bar; Construct the first histogram based on the width and length of each bar.

5. The abnormal access behavior detection method according to claim 1, characterized in that, Based on the alarm logs to be detected after removing the machine sub-mode, anomaly detection is performed according to the number of operations, operation time, and operation mode to obtain a second detection result, including: The three-standard-deviation method is used to detect anomalies in the number of operations to remove the machine sub-mode from the alarm logs to be detected, and the number of operations is obtained. Anomaly detection is performed on the operation time of the alarm log to be detected after removing the machine sub-mode based on the relative entropy algorithm, and the time detection result is obtained. Anomaly detection is performed on the operation mode of the alarm log to be detected based on the Jaccard distance algorithm, and the pattern detection result is obtained. The second detection result is obtained by merging the count detection result, time detection result, and pattern detection result.

6. The abnormal access behavior detection method according to claim 5, characterized in that, Based on the alarm logs to be detected after removing the machine sub-mode, anomaly detection is performed according to the number of operations, operation time, and operation mode. Before obtaining the second detection result, the process includes: Obtain historical detection alarm logs generated by the target object and historical machine sub-patterns generated during the automatic runtime of the target object; Statistical analysis was performed on historical detection alarm logs after removing historical machine sub-patterns to obtain the parameters of the three-standard-deviation method and the parameters of the relative entropy algorithm. The parameters of the Jaccard distance algorithm are obtained by statistically analyzing the historical detection and alarm logs.

7. An abnormal access behavior detection device, characterized in that, include: The data acquisition module is used to acquire the alarm logs to be detected generated by the target object and the machine sub-mode generated by the target object during automatic runtime. The machine sub-mode is the alarm behavior mode automatically generated by the application in the background. The first detection module is used to perform periodic anomaly detection on the machine sub-pattern using a detection algorithm based on dynamic histograms to obtain a first detection result. Specifically, the first detection module is used to perform similarity calculation on the first histogram of the machine sub-pattern generated by the detection algorithm based on dynamic histograms to obtain a uniform detection result; when the uniform detection result is anomaly, a second histogram corresponding to the horizontal coordinate of the histogram is generated using the detection algorithm based on dynamic histograms, and a non-uniform detection result is obtained by using the similarity calculation result of the second histogram. A first detection result is obtained based on the uniform detection result and the non-uniform detection result; The second detection module is used to perform anomaly detection based on the number of operations, operation time and operation mode of the alarm log to be detected after removing the machine sub-mode, and to obtain the second detection result. The result output module is used to output anomaly detection results based on the first detection result and the second detection result.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to perform the abnormal access behavior detection method as described in any one of claims 1-6.

9. An electronic device, characterized in that, include: A memory and a processor are communicatively connected, the memory stores computer instructions, and the processor executes the computer instructions to perform the abnormal access behavior detection method as described in any one of claims 1-6.

Images