Methods, devices, electronic equipment, and storage media for detecting abnormal file download behavior.

Abstract

This application discloses a method, apparatus, electronic device, and storage medium for detecting abnormal file download behavior. The method includes: acquiring the data volume of the file currently to be downloaded and the total number of files downloaded that day; quantifying the data volume of the file currently to be downloaded by performing a behavioral deviation metric based on the median, maximum, and minimum data volumes of single file downloads by the user within a historical period to obtain a data volume metric value; quantifying the total number of files downloaded that day by performing a behavioral deviation metric based on the median, maximum, and minimum file downloads by the user that day within a historical period to obtain a total number of files downloaded that day metric value; and determining whether the user's current file download behavior is abnormal based on the relationship between the data volume metric value and the data volume metric baseline, and the relationship between the total number of files downloaded that day and the total number of files downloaded that day metric baseline. This application embodiment can improve the accuracy of detection.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of Internet, and particularly relate to a file download behavior anomaly detection method and device, electronic equipment and storage medium. BACKGROUND

[0002] The rapid development of the Internet has brought fundamental changes to enterprise management and user office ways. However, behind these changes, there are also huge network security risks, such as a user downloading a large amount of file data from an enterprise confidential database to a local at a certain time, a large amount of confidential data from an internal database to an external database, and the protection of the firewall is separated, which undoubtedly increases the risk of enterprise confidential data leakage.

[0003] In the prior art, when protecting network security, corresponding rules are mainly formulated, such as limiting the size of file download quantity per day and the size of a single download file, to monitor whether the file download behavior is abnormal. This security protection for file download behavior is usually for all users, in addition, the accuracy of the traditional file download behavior security protection depends seriously on the rationality of the static rule library, resulting in low accuracy of anomaly detection. SUMMARY

[0004] Embodiments of the present application provide a file download behavior anomaly detection method, device, electronic equipment and storage medium, which helps to improve the accuracy of detection.

[0005] To solve the above problems, in a first aspect, embodiments of the present application provide a file download behavior anomaly detection method, comprising:

[0006] obtaining a data quantity of a current file to be downloaded by a user and a daily file download quantity of the user;

[0007] quantifying the data quantity of the current file to be downloaded according to a median value, a maximum value and a minimum value of a single file download data quantity of the user in a historical time, to obtain a data quantity measurement value;

[0008] quantifying the daily file download quantity according to a median value, a maximum value and a minimum value of a single day file download quantity of the user in the historical time, to obtain a daily file download quantity measurement value;

[0009] determining whether the current file download behavior of the user is abnormal according to a size relationship between the data quantity measurement value and a data quantity measurement baseline and a size relationship between the daily file download quantity measurement value and a single day file download quantity measurement baseline, wherein the data quantity measurement baseline is determined based on the single file download data quantity of the user in the historical time, and the single day file download quantity measurement baseline is determined based on the single day file download quantity of the user in the historical time.

[0010] In a second aspect, the embodiments of the present application provide a file download behavior anomaly detection device, comprising:

[0011] a data acquisition module, configured to acquire a data amount of a current to-be-downloaded file of a user and a daily file download amount of the user;

[0012] a data amount measurement module, configured to perform behavior deviation measurement quantification on the data amount of the current to-be-downloaded file according to a median value, a maximum value and a minimum value of a single file download data amount of the user in a historical time, to obtain a data amount measurement value;

[0013] a download amount measurement module, configured to perform behavior deviation measurement quantification on the daily file download amount according to a median value, a maximum value and a minimum value of a single day file download amount of the user in the historical time, to obtain a daily file download amount measurement value;

[0014] a download behavior detection module, configured to determine whether a current file download behavior of the user is abnormal according to a size relationship between the data amount measurement value and a data amount measurement baseline and a size relationship between the daily file download amount measurement value and a single day file download amount measurement baseline, wherein the data amount measurement baseline is determined based on the single file download data amount of the user in the historical time, and the single day file download amount measurement baseline is determined based on the single day file download amount of the user in the historical time.

[0015] In a third aspect, the embodiments of the present application further provide an electronic device, comprising a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the file download behavior anomaly detection method provided by the embodiments of the present application.

[0016] In a fourth aspect, the embodiments of the present application provide a computer readable storage medium, having a computer program stored thereon, wherein the program is executable by a processor to implement the file download behavior anomaly detection method disclosed by the embodiments of the present application.

[0017] The file download behavior anomaly detection method, device, electronic equipment and storage medium provided by the embodiments of the present application can quantize the behavior deviation of the data volume of the current file to be downloaded according to the median, maximum value and minimum value of the single file download data volume of the user in the historical time, obtain a data volume measurement value, quantize the behavior deviation of the daily file download volume according to the median, maximum value and minimum value of the single day file download volume of the user in the historical time, obtain a daily file download volume measurement value, and then determine whether the current file download behavior of the user is abnormal according to the size relationship between the data volume measurement value and the data volume measurement baseline and the size relationship between the daily file download volume measurement value and the single day file download volume measurement baseline. Since the data volume measurement baseline is determined based on the single file download data volume of the user in the historical time, and the single day file download volume baseline is determined based on the single day file download volume of the user in the historical time, the baseline can be determined for each user based on the historical file download information of the user, and the download behavior of the user is detected based on the determined baseline. Compared with the prior art of detecting the download behavior of different users based on a unified rule, the safety monitoring mechanism driven by data in the embodiments of the present application avoids the human consumption caused by rule making, and can use different baselines for different users to detect the download behavior, characterize the user download behavior portrait, greatly reduce the number of safety alarms, improve the accuracy of detection, and improve the diversity of file download security protection. BRIEF DESCRIPTION OF DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed in the embodiments or prior art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0019] Figure 1 is a flowchart of a file download behavior anomaly detection method provided by the embodiments of the present application;

[0020] Figure 2 is a flowchart of determining a data volume measurement baseline in the embodiments of the present application;

[0021] Figure 3 is a flowchart of determining a single day file download volume measurement baseline in the embodiments of the present application;

[0022] Figure 4 is a structural block diagram of a file download behavior anomaly detection device provided by the embodiments of the present application. DETAILED DESCRIPTION

[0023] With reference to the drawings of the embodiments of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described. Obviously, the described embodiments are some of the embodiments of the present application, but not all of the embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts should fall within the scope of the present application.

[0024] Figure 1 is a flowchart of a file download behavior anomaly detection method provided by an embodiment of the present application, as shown in the figure, the method comprises the following steps: Figure 1

[0025] Step 110, obtaining a data amount of a current file to be downloaded by a user and a file download amount of the user on the day.

[0026] When the user downloads a file, the data amount of the current file to be downloaded by the user can be determined, and the data amount of the files downloaded by the user on the day can be obtained. The sum of the data amount of the current file to be downloaded and the data amount of the files downloaded on the day is the file download amount of the day. The data amount of the current file to be downloaded is also the size of the current file to be downloaded.

[0027] Step 120, quantifying the behavior deviation of the data amount of the current file to be downloaded according to the median, maximum value and minimum value of the single file download data amount of the user in the historical time, to obtain a data amount measurement value.

[0028] The method of quantile (for example, the method of quartile) can be used to determine the median, maximum value and minimum value of the single file download data amount of the user in the historical time. When the method of quartile is used to determine the median, the obtained median is also the 1 / 2 quantile.

[0029] The behavior deviation of the data amount of the current file to be downloaded is quantified according to the median, maximum value and minimum value of the single file download data amount of the user in the historical time, to obtain a data amount measurement value. The data amount measurement value represents the data amount characteristic of the current file to be downloaded.

[0030] ​In an embodiment of the present application, the behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median, maximum value and minimum value of the single-file download data volume of the user in the historical time comprises: if the data volume is greater than or equal to the median of the single-file download data volume, quantifying the behavior deviation metric of the data volume of the current to-be-downloaded file according to the median and the maximum value of the single-file download data volume to obtain the data volume metric value; if the data volume is less than the median of the single-file download data volume, quantifying the behavior deviation metric of the data volume of the current to-be-downloaded file according to the median and the minimum value of the single-file download data volume to obtain the data volume metric value.

[0031] The data volume of the current to-be-downloaded file is compared with the median, and different manners are adopted based on the size relationship to quantify the behavior deviation metric of the data volume of the current to-be-downloaded file. When the data volume of the current to-be-downloaded file is greater than or equal to the median of the single-file download data volume, the behavior deviation metric of the data volume of the current to-be-downloaded file is quantified based on the median and the maximum value of the single-file download data volume to determine the degree of deviation of the data volume of the current to-be-downloaded file from the median, and the data volume metric value is obtained. When the data volume of the current to-be-downloaded file is less than the median of the single-file download data volume, the behavior deviation metric of the data volume of the current to-be-downloaded file is quantified based on the median and the minimum value of the single-file download data volume to determine the degree of deviation of the data volume of the current to-be-downloaded file from the median, and the data volume metric value is obtained.

[0032] By adopting different behavior deviation metric quantification manners based on the size relationship between the data volume of the current to-be-downloaded file and the median of the single-file download data volume, the accuracy of the data volume metric value can be improved, and the accuracy of the file download behavior anomaly detection can be further improved.

[0033] In an embodiment of the present application, the behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and the maximum value of the single-file download data volume comprises:

[0034] The behavior deviation metric of the data volume of the current to-be-downloaded file is quantified according to the median and the maximum value of the single-file download data volume according to the following formula to obtain the data volume metric value:

[0035]

[0036] wherein, the maximum value of the single-file download data volume, median of the single file download data amount, x represents the data amount of the current file to be downloaded, represents the data amount metric value.

[0037] When the data amount of the current file to be downloaded is greater than or equal to the median of the single file download data amount, the behavior deviation metric quantification of the data amount of the current file to be downloaded according to the above behavior deviation metric quantification formula can accurately reflect the degree of deviation of the data amount from the median.

[0038] In an embodiment of the present application, the behavior deviation metric quantification of the data amount of the current file to be downloaded according to the median and the minimum value of the single file download data amount, to obtain the data amount metric value, comprises:

[0039] The behavior deviation metric quantification of the data amount of the current file to be downloaded according to the median and the minimum value of the single file download data amount, to obtain the data amount metric value, comprises:

[0040]

[0041] wherein, represents the minimum value of the single file download data amount, median of the single file download data amount, x represents the data amount of the current file to be downloaded, represents the data amount metric value.

[0042] When the data amount of the current file to be downloaded is less than the median of the single file download data amount, the behavior deviation metric quantification of the data amount of the current file to be downloaded according to the above behavior deviation metric quantification formula can accurately reflect the degree of deviation of the data amount from the median.

[0043] Step 130, according to the median, maximum value and minimum value of the single day file download amount of the user in the historical time, the behavior deviation metric quantification of the current day file download amount is performed to obtain the current day file download amount metric value.

[0044] The method of quantile (for example, the method of quartile) can be used to determine the median, maximum value and minimum value of the single day file download amount of the user in the historical time. When the method of quartile is used to determine the median, the obtained median is also the 1 / 2 quantile.

[0045] According to the median, maximum value and minimum value of the single day file download amount of the user in the historical time, the behavior deviation metric quantification of the current day file download amount is performed to obtain the current day file download amount metric value. The current day file download amount metric value represents the total data amount characteristic of the current day file download amount.

[0046] In an embodiment of the present application, the quantifying the behavior deviation metric of the current-day file download amount according to the median, the maximum and the minimum of the single-day file download amount of the user in the historical time comprises: if the current-day file download amount is greater than or equal to the median of the single-day file download amount, quantifying the behavior deviation metric of the current-day file download amount according to the median and the maximum of the single-day file download amount to obtain the metric value of the current-day file download amount; if the current-day file download amount is less than the median of the single-day file download amount, quantifying the behavior deviation metric of the current-day file download amount according to the median and the minimum of the single-day file download amount to obtain the metric value of the current-day file download amount.

[0047] The current-day file download amount is compared with the median of the single-day file download amount, and different ways are adopted to quantify the behavior deviation metric of the current-day file download amount based on the size relationship. When the current-day file download amount is greater than or equal to the median of the single-day file download amount, the behavior deviation metric of the current-day file download amount is quantified based on the median and the maximum of the single-day file download amount to determine the degree of deviation of the current-day file download amount from the median, and the metric value of the current-day file download amount is obtained. When the current-day file download amount is less than the median of the single-day file download amount, the behavior deviation metric of the current-day file download amount is quantified based on the median and the minimum of the single-day file download amount to determine the degree of deviation of the current-day file download amount from the median, and the metric value of the current-day file download amount is obtained.

[0048] By adopting different behavior deviation metric quantification ways based on the size relationship between the current-day file download amount and the median of the single-day file download amount, the accuracy of the metric value of the current-day file download amount can be improved, and the accuracy of the file download behavior anomaly detection can be further improved.

[0049] In an embodiment of the present application, the quantifying the behavior deviation metric of the current-day file download amount according to the median and the maximum of the single-day file download amount to obtain the metric value of the current-day file download amount comprises:

[0050] The behavior deviation metric of the current-day file download amount is quantified according to the median and the maximum of the single-day file download amount by the following formula to obtain the metric value of the current-day file download amount:

[0051]

[0052] wherein, the maximum of the single-day file download amount, the median of the single-day file download amount, and y represents the current-day file download amount. represents the data volume metric value of the daily file download volume metric value.

[0053] When the daily file download volume is greater than or equal to the median of the single-day file download volume, the behavior deviation metric quantification of the daily file download volume according to the behavior deviation metric quantification formula can accurately reflect the degree of deviation of the daily file download volume from the median.

[0054] In an embodiment of the present application, the behavior deviation metric quantification of the daily file download volume according to the median and the minimum value of the single-day file download volume obtains the daily file download volume metric value, comprising:

[0055] The behavior deviation metric quantification of the daily file download volume according to the median and the minimum value of the single-day file download volume obtains the daily file download volume metric value according to the following formula:

[0056]

[0057] wherein, represents the minimum value of the single-day file download volume, represents the median of the single-day file download volume, and y represents the daily file download volume, represents the data volume metric value of the daily file download volume metric value.

[0058] When the daily file download volume is less than the median of the single-day file download volume, the behavior deviation metric quantification of the daily file download volume according to the behavior deviation metric quantification formula can accurately reflect the degree of deviation of the daily file download volume from the median.

[0059] Step 140, according to the size relationship between the data volume metric value and the data volume metric baseline and the size relationship between the daily file download volume metric value and the single-day file download volume metric baseline, determine whether the current file download behavior of the user is abnormal.

[0060] Wherein, the data volume metric baseline is determined based on the single file download data volume of the user in the historical time, and the single-day file download volume metric baseline is determined based on the single-day file download volume of the user in the historical time.

[0061] Comparing the size relationship between the data volume metric value and the data volume metric baseline, and comparing the size relationship between the daily file download volume metric value and the single-day file download volume metric baseline, based on the two size relationships, to determine whether the current file download behavior of the user is abnormal.

[0062] In an embodiment of the present application, the determining whether the current file download behavior of the user is abnormal according to the size relationship between the data volume metric value and the data volume metric baseline and the size relationship between the daily file download volume metric value and the single-day file download volume metric baseline comprises: if the data volume metric value is less than or equal to the data volume metric baseline and the daily file download volume metric value is less than or equal to the single-day file download volume metric baseline, determining that the current file download behavior of the user is normal; if the data volume metric value is greater than the data volume metric baseline or the daily file download volume metric value is greater than the single-day file download volume metric baseline, determining that the current file download behavior of the user is abnormal.

[0063] If the data volume metric value is less than or equal to the data volume metric baseline, it is determined that the size of the current file to be downloaded is normal; if the data volume metric value is greater than the data volume metric baseline, it is determined that the size of the current file to be downloaded is abnormal. If the daily file download volume metric value is less than or equal to the single-day file download volume metric baseline, it is determined that the daily file download volume is normal; if the daily file download volume metric value is greater than the single-day file download volume metric baseline, it is determined that the daily file download volume is abnormal. When the size of the current file to be downloaded is normal and the daily file download volume is normal, it is determined that the current file download behavior of the user is normal; when one of the size of the current file to be downloaded and the daily file download volume is abnormal, it is determined that the current file download behavior of the user is abnormal.

[0064] User and Entity Behave Analyse (UEBA) is a method based on basic analysis and advanced analysis, which analyzes and evaluates the abnormal behavior of users or entities by means of feature engineering and artificial intelligence technology. UEBA is based on the difference between normal behavior and abnormal behavior of users or entities, and detects abnormal behavior or potential abnormal behavior by modeling normal behavior and constructing a normal behavior baseline of users or entities. Therefore, UEBA is often used for detecting potential network security threats and predicting typical attack behaviors for network security protection.

[0065] The file download behavior anomaly detection method provided by the embodiments of the present application is a UEBA (User and Entity Behave Analyse) based file download behavior anomaly detection method. According to user file download history data, a behavior deviation measurement formula based on quartiles is used to complete the feature expression of daily file download volume and single download file size (data volume of the current file to be downloaded), and compare with the user file download behavior baseline constructed based on user historical file download behavior information, to realize the anomaly detection of user file download behavior.

[0066] UEBA is a basic analysis method and an advanced analysis method based on feature engineering and artificial intelligence technology, which analyzes and evaluates the abnormal behavior of users or entities. UEBA is based on the difference between normal behavior and abnormal behavior of users or entities, and detects abnormal behavior or potential abnormal behavior by modeling normal behavior and constructing a normal behavior baseline of users or entities. Therefore, UEBA is often used to detect potential network security threats, typical attack behavior prediction, and other network security protection.

[0067] The file download behavior anomaly detection method provided by the embodiment of the application quantifies the behavior deviation of the data volume of the current file to be downloaded according to the median, maximum value and minimum value of the single file download data volume of the user in the historical time, obtains a data volume measurement value, quantifies the behavior deviation of the daily file download volume according to the median, maximum value and minimum value of the single file download volume of the user in the historical time, obtains a daily file download volume measurement value, and then determines whether the current file download behavior of the user is abnormal according to the size relationship between the data volume measurement value and the data volume measurement baseline and the size relationship between the daily file download volume measurement value and the single day file download volume measurement baseline. Since the data volume measurement baseline is determined based on the single file download data volume of the user in the historical time, and the single day file download volume baseline is determined based on the single day file download volume of the user in the historical time, the baseline can be determined for each user based on the historical file download information of the user, and the download behavior of the user can be detected based on the determined baseline. Compared with the prior art of detecting the download behavior of different users based on a unified rule, the data-driven security monitoring mechanism of the embodiment of the application avoids the human consumption caused by rule making, and can use different baselines for different users to detect the download behavior, characterize the user download behavior portrait, greatly reduce the number of security alarms, improve the accuracy of detection, and improve the diversity of file download security protection.

[0068] On the basis of the above technical solution, before the data volume measurement value is obtained by quantifying the behavior deviation of the data volume of the current file to be downloaded according to the median, maximum value and minimum value of the single file download data volume of the user in the historical time, training is required, that is, the data volume measurement baseline is determined based on the single file download data volume of the user in the historical time. Figure 2 The flowchart for determining the data volume measurement baseline in the embodiment of the application is as shown in Figure 2 The data volume measurement baseline can be determined by the following steps:

[0069] Step 210, determine the median, maximum value and minimum value of the single file download data volume of the user in the historical time.

[0070] Obtain a dataset D of user file download behavior logs over a historical period (e.g., within 60 days); detect whether dataset D contains a single file download data volume feature. If it does, extract the single file download data volume from dataset D and denote all single file download data volumes as the data volume set X; the median (i.e., the 1 / 2 quantile) of a user's single file download data volume can be calculated based on quantiles (e.g., quartiles). X middle Maximum value X max and minimum value X min .

[0071] Step 220: Based on the median, maximum, and minimum values ​​of the single file download data volume of the user within the historical time period, perform behavioral deviation quantification on each single file download data volume to obtain a metric value for each single file download data volume, and use each metric value for the single file download data volume as a data volume metric sample.

[0072] The behavioral deviation quantification can be performed on each single file download data volume in the order of the data volume of each single file download in the data volume set, so as to obtain the metric value of each single file download data volume. Each metric value of the single file download data volume is used as a data volume metric sample, and each data volume metric sample can be stored in the first array.

[0073] The specific quantification process can be as follows: from the data set X Extract the data volume of a single file download in sequence. x n , n The initial value is 1; if x n >= X middle Then x n Substitute into the behavioral deviation measurement quantification formula Otherwise, then x n Substitute into the behavioral deviation measurement quantification formula ,Will f 1 is used as a data volume metric sample and stored in the first array. F , n = n+ 1; Then, extract the next single file download data volume and iteratively execute the process of deviating from the quantification of this behavior until all single file download data volumes are processed into data volume quantification samples.

[0074] Step 230, based on the anomaly detection algorithm, all data volume measurement samples are divided into data volume normal samples and data volume anomaly samples.

[0075] The One Class SVM anomaly detection algorithm can be used to divide all data volume measurement samples in the first array F into data volume normal samples and data volume anomaly samples.

[0076] Step 240. Obtain the center of all data volume normal samples, and determine the maximum distance between the data volume normal samples and the center as the data volume measurement baseline.

[0077] All data volume measurement samples are taken as a normal sample cluster, and the center of the normal sample cluster is obtained O F The distance between each data volume normal sample and the center O F is determined, and the maximum distance between the data volume normal sample and the center O F is taken as the data volume measurement baseline L F .

[0078] The data volume measurement baseline of the user is determined based on the historical file download data of the user, which realizes that the data volume measurement baseline of different users can be determined individually, avoids the determination of the file download behavior detection strategy of each user based on manpower in the traditional method, can greatly reduce the labor cost and improve the work efficiency, and at the same time, can make the file download behavior security detection more in line with the file download habits of the user, and improve the diversity and customization of security protection.

[0079] On the basis of the above technical solutions, before the behavior deviation measurement quantification of the daily file download volume based on the median, maximum value and minimum value of the daily file download volume of the user in the historical time, the daily file download volume measurement value is obtained, training is needed, that is, the daily file download volume measurement baseline is determined based on the daily file download volume of the user in the historical time. Figure 3 is the flow chart for determining the daily file download volume measurement baseline in the embodiments of the present application, as Figure 3 shown, the daily file download volume measurement baseline can be determined by the following steps:

[0080] Step 310, according to the single file download data volume of the user in the historical time, the daily file download volume of the user in the historical time is determined.

[0081] The data volume set XStatistically analyze the number of files downloaded by a user in a single transaction to obtain the user's daily file download volume over a historical period. Record all daily file download volume data within the historical period as a download volume set. Y .

[0082] Step 320: Determine the median, maximum, and minimum daily file downloads for the user within the historical time period.

[0083] Calculate the median (i.e., the half quantile) of a user's daily file downloads using a quantile-based method (e.g., quartiles). Y middle Maximum value Y max and minimum value Y min .

[0084] Step 330: Based on the median, maximum, and minimum daily file downloads of the user within the historical time period, perform behavioral deviation quantification on each daily file download volume to obtain a metric value for each daily file download volume, and use the metric value of each daily file download volume as a download volume metric sample.

[0085] The behavior deviation quantification can be performed on the daily file downloads in the order of the download volume in the download volume set to obtain the metric value of each daily file download volume. Each metric value of the daily file download volume is used as a download volume metric sample, and each download volume metric sample can be stored in a second array.

[0086] The specific quantification process can be as follows: from the download volume set Y Extract the daily file download volume in sequence. y n , n The initial value is 1; if y n >= Y middle Then y n Substitute into the behavioral deviation measurement quantification formula Otherwise, then y n Substitute into the behavioral deviation measurement quantification formula ,Will f 2 is used as a sample for measuring download volume and stored in the second array. E , n = n+ 1; Then, retrieve the next daily file download volume and iteratively execute the process of deviating from the quantification of this behavior until all daily file download volumes are processed into download volume quantification samples.

[0087] Step 340, based on the anomaly detection algorithm, all the download metric samples are divided into download normal samples and download anomaly samples.

[0088] The One Class SVM anomaly detection algorithm can be used to divide the second array E of download metric samples into download normal samples and download anomaly samples.

[0089] Step 350, the center of all download normal samples is obtained, and the maximum distance between the download normal samples and the center is determined as the single-day file download metric baseline.

[0090] All download metric samples are taken as a normal sample cluster, and the center of the normal sample cluster is obtained O E The distance between each download normal sample and the center O E is determined, and the maximum distance between the download normal sample and the center O E is taken as the single-day file download metric baseline L E .

[0091] The single-day file download metric baseline of the user is determined based on the historical file download data of the user, which realizes that the corresponding single-day file download metric baseline can be determined for different users, avoids the determination of the file download behavior detection strategy of each user based on manpower in the traditional method, can greatly reduce the labor cost and improve the work efficiency, and at the same time, can make the file download behavior security detection more in line with the file download habits of the user, and improve the diversity and customization of security protection.

[0092] The file download behavior anomaly detection algorithm provided by the embodiment of the application automatically constructs modeling for the file download behavior of each user, greatly reduces the labor cost and improves the work efficiency compared with the artificial rule making in the traditional method; the personal independent modeling manner is adopted, the diversity and customization of security protection are improved, the number of security alarms is greatly reduced; in addition, the user file download behavior baseline (including the data metric baseline and the single-day file download metric baseline) is constructed based on the user file download history data, the user behavior habits are used instead of the detection of the traditional hard rule, the potential and unknown risks of the user file download behavior can be better found, and the problem that the traditional rule cannot make rules for unknown risks is solved.

[0093] Figure 4 is a structural block diagram of a file download behavior anomaly detection device provided by the embodiment of the application, as shown in Figure 4 the file download behavior anomaly detection device comprises:

[0094] The data acquisition module 410 is configured to acquire a data amount of a current file to be downloaded by a user and a daily file download amount.

[0095] The data amount measurement module 420 is configured to measure and quantify the data amount of the current file to be downloaded according to a median value, a maximum value and a minimum value of a single-file download data amount of the user in a historical time, to obtain a data amount measurement value.

[0096] The download amount measurement module 430 is configured to measure and quantify the daily file download amount according to a median value, a maximum value and a minimum value of a single-day file download amount of the user in the historical time, to obtain a daily file download amount measurement value.

[0097] The download behavior detection module 440 is configured to determine whether the current file download behavior of the user is abnormal according to a size relationship between the data amount measurement value and a data amount measurement baseline and a size relationship between the daily file download amount measurement value and a single-day file download amount measurement baseline, wherein the data amount measurement baseline is determined based on the single-file download data amount of the user in the historical time, and the single-day file download amount measurement baseline is determined based on the single-day file download amount of the user in the historical time.

[0098] Optionally, the apparatus further comprises:

[0099] The data amount statistics module is configured to determine a median value, a maximum value and a minimum value of a single-file download data amount of the user in the historical time.

[0100] The data amount measurement sample acquisition module is configured to measure and quantify each single-file download data amount according to the median value, the maximum value and the minimum value of the single-file download data amount of the user in the historical time, to obtain a measurement value of each single-file download data amount, and to take the measurement value of each single-file download data amount as a data amount measurement sample.

[0101] The data amount sample division module is configured to divide all the data amount measurement samples into data amount normal samples and data amount abnormal samples based on an anomaly detection algorithm.

[0102] The data amount measurement baseline determination module is configured to acquire a center of all the data amount normal samples, and to determine a maximum distance between the data amount normal samples and the center as the data amount measurement baseline.

[0103] Optionally, the apparatus further comprises:

[0104] The single-day download amount determination module is configured to determine a single-day file download amount of the user in the historical time according to the single-file download data amount of the user in the historical time.

[0105] a single-day download amount statistics module configured to determine a median value, a maximum value and a minimum value of single-day file download amounts of the user in the historical time;

[0106] a download amount sample obtaining module configured to respectively quantify each of the single-day file download amounts according to the median value, the maximum value and the minimum value of single-day file download amounts of the user in the historical time, to obtain a metric value of each single-day file download amount, and to take the metric value of each single-day file download amount as a download amount metric sample;

[0107] a download amount sample dividing module configured to divide all the download amount metric samples into download amount normal samples and download amount abnormal samples based on an anomaly detection algorithm;

[0108] a download amount metric baseline determining module configured to obtain a center of all the download amount normal samples, and to determine a maximum distance between the download amount normal samples and the center as the single-day file download amount metric baseline.

[0109] Optionally, the data amount metric module comprises:

[0110] a first data amount metric unit configured to, if the data amount is greater than or equal to the median value of the single file download data amount, quantify the data amount of the current to-be-downloaded file according to the median value and the maximum value of the single file download data amount to obtain the data amount metric value;

[0111] a second data amount metric unit configured to, if the data amount is less than the median value of the single file download data amount, quantify the data amount of the current to-be-downloaded file according to the median value and the minimum value of the single file download data amount to obtain the data amount metric value.

[0112] Optionally, the first data amount metric unit is specifically configured to:

[0113] quantify the data amount of the current to-be-downloaded file according to the median value and the maximum value of the single file download data amount according to the following formula to obtain the data amount metric value:

[0114]

[0115] wherein, represents the maximum value of the single file download data amount, represents the median value of the single file download data amount, and x represents the data amount of the current to-be-downloaded file, represents the data amount metric value.

[0116] Optionally, the second data volume measurement unit is specifically configured to:

[0117] According to the median and minimum value of the single file download data volume, the data volume of the current file to be downloaded is quantified by behavior deviation measurement according to the following formula, to obtain the data volume measurement value:

[0118]

[0119] wherein, represents the minimum value of the single file download data volume, represents the median of the single file download data volume, and x represents the data volume of the current file to be downloaded, represents the data volume measurement value.

[0120] Optionally, the download volume measurement module comprises:

[0121] The first download volume measurement unit is configured to, if the daily file download volume is greater than or equal to the median of the single-day file download volume, quantify the daily file download volume by behavior deviation measurement according to the median and maximum value of the single-day file download volume, to obtain a daily file download volume measurement value.

[0122] The second download volume measurement unit is configured to, if the daily file download volume is less than the median of the single-day file download volume, quantify the daily file download volume by behavior deviation measurement according to the median and minimum value of the single-day file download volume, to obtain the daily file download volume measurement value.

[0123] Optionally, the first download volume measurement unit is specifically configured to:

[0124] According to the median and maximum value of the single-day file download volume, the daily file download volume is quantified by behavior deviation measurement according to the following formula, to obtain the daily file download volume measurement value:

[0125]

[0126] wherein, represents the maximum value of the single-day file download volume, represents the median of the single-day file download volume, and y represents the daily file download volume, represents the daily file download volume measurement value.

[0127] Optionally, the second download volume measurement unit is specifically configured to:

[0128] The behavior deviation of the file download amount of the day is quantified according to the median and the minimum of the single-day file download amount according to the following formula, to obtain the file download amount metric value of the day:

[0129]

[0130] wherein, represents the minimum of the single-day file download amount, represents the median of the single-day file download amount, and y represents the file download amount of the day, represents the file download amount metric value of the day, and y represents the data amount metric value.

[0131] Optionally, the download behavior detection module comprises:

[0132] a behavior normal determination unit configured to determine that the current file download behavior of the user is normal if the data amount metric value is less than or equal to the data amount metric baseline and the file download amount metric value of the day is less than or equal to the single-day file download amount metric baseline;

[0133] a behavior abnormal determination unit configured to determine that the current file download behavior of the user is abnormal if the data amount metric value is greater than the data amount metric baseline or the file download amount metric value of the day is greater than the single-day file download amount metric baseline.

[0134] The file download behavior abnormality detection device provided by the embodiments of the present application is used to implement each step of the file download behavior abnormality detection method described in the embodiments of the present application, and the specific implementation manners of each module of the device are described in the corresponding steps, which will not be repeated here.

[0135] The file download behavior anomaly detection device provided in the embodiments of the present application quantifies the data volume of the current file to be downloaded by behavior deviation measurement according to the median, maximum value and minimum value of the single file download data volume of the user in the historical time, obtains a data volume measurement value, quantifies the file download volume of the day by behavior deviation measurement according to the median, maximum value and minimum value of the single day file download volume of the user in the historical time, obtains a single day file download volume measurement value, and then determines whether the current file download behavior of the user is abnormal according to the size relationship between the data volume measurement value and the data volume measurement baseline and the size relationship between the single day file download volume measurement value and the single day file download volume baseline. Since the data volume measurement baseline is determined based on the single file download data volume of the user in the historical time, and the single day file download volume baseline is determined based on the single day file download volume of the user in the historical time, the baseline can be determined for each user based on the historical file download information of the user, and the download behavior of the user is detected based on the determined baseline. Compared with the prior art that detects the download behavior of different users based on a unified rule, the safety monitoring mechanism driven by data in the embodiments of the present application avoids the human consumption caused by rule making, and can use different baselines for different users to detect the download behavior, characterize the user download behavior portrait, greatly reduce the number of safety alarms, improve the accuracy of detection, and improve the diversity of file download security protection.

[0136] Correspondingly, the embodiments of the present application also provide an electronic device, including a memory, a processor and a computer program stored in the memory and executable on the processor, and the processor implements the file download behavior anomaly detection method according to the embodiments of the present application when executing the computer program. The electronic device can be a computer, a server, etc.

[0137] The embodiments of the present application also provide a computer readable storage medium having a computer program stored thereon, and the program is executable on the processor to implement the file download behavior anomaly detection method according to the embodiments of the present application.

[0138] Each of the embodiments in the specification is described in a progressive manner, and each embodiment focuses on the difference from other embodiments. The same and similar parts of each embodiment can be referred to each other. For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the part of the method embodiment.

[0139] The above describes in detail the file download behavior anomaly detection method and device provided by the embodiments of the present application, the principles and implementation manners of the present application are described by applying specific examples, and the above embodiment description is only used to help understand the method of the present application and its core idea; meanwhile, for those skilled in the art, according to the idea of the present application, the specific implementation manners and application ranges will be changed, and the above description should not be understood as a limitation of the present application.

[0140] Through the description of the above embodiments, those skilled in the art can clearly understand that the embodiments can be realized by means of software and the necessary general hardware platform, and of course can also be realized by hardware. Based on such understanding, the above technical solutions or the essential part of the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including a plurality of instructions to make a computer device (which can be a personal computer, server, or network device, etc.) execute the method described in each embodiment or some part of the embodiment.

Claims

1. A file download behavior anomaly detection method, characterized by, The method comprises the following steps: obtaining the data amount of a current file to be downloaded by a user and the daily file download amount of the user; quantifying the data amount of the current file to be downloaded according to the median, maximum and minimum of the single file download data amount of the user in a historical time, to obtain a data amount metric value; quantifying the daily file download amount according to the median, maximum and minimum of the single day file download amount of the user in the historical time, to obtain a daily file download amount metric value; determining whether the current file download behavior of the user is abnormal according to the size relationship between the data amount metric value and a data amount metric baseline and the size relationship between the daily file download amount metric value and a single day file download amount metric baseline, wherein the data amount metric baseline is determined based on the single file download data amount of the user in the historical time, and the single day file download amount metric baseline is determined based on the single day file download amount of the user in the historical time; wherein, before the step of quantifying the data amount of the current file to be downloaded according to the median, maximum and minimum of the single file download data amount of the user in a historical time, to obtain a data amount metric value, the method further comprises the following steps: determining the median, maximum and minimum of the single file download data amount of the user in the historical time; quantifying each single file download data amount according to the median, maximum and minimum of the single file download data amount of the user in the historical time, to obtain a metric value of each single file download data amount, and taking each metric value of the single file download data amount as a data amount metric sample; dividing all the data amount metric samples into data amount normal samples and data amount abnormal samples based on an anomaly detection algorithm; obtaining the center of all data amount normal samples, and determining the maximum distance between the data amount normal samples and the center as the data amount metric baseline.

2. The method of claim 1, wherein, before the step of quantifying the daily file download amount according to the median, maximum and minimum of the single day file download amount of the user in the historical time, to obtain a daily file download amount metric value, the method further comprises the following steps: determining the single day file download amount of the user in the historical time according to the single file download data amount of the user in the historical time; determining the median, maximum and minimum of the single day file download amount of the user in the historical time; quantifying each single day file download amount according to the median, maximum and minimum of the single day file download amount of the user in the historical time, to obtain a metric value of each single day file download amount, and taking each metric value of the single day file download amount as a download amount metric sample; dividing all the download amount metric samples into download amount normal samples and download amount abnormal samples based on an anomaly detection algorithm; obtaining the center of all download amount normal samples, and determining the maximum distance between the download amount normal samples and the center as the single day file download amount metric baseline.

3. The method according to any of claims 1-2, characterized in that, The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median, maximum and minimum of the single-file download data volume of the user in the historical time includes: If the data volume is greater than or equal to the median of the single-file download data volume, the behavior deviation metric quantification of the data volume of the current to-be-downloaded file is performed according to the median and maximum of the single-file download data volume, and the data volume metric value is obtained. If the data volume is less than the median of the single-file download data volume, the behavior deviation metric quantification of the data volume of the current to-be-downloaded file is performed according to the median and minimum of the single-file download data volume, and the data volume metric value is obtained.

4. The method of claim 3, wherein, The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and maximum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and maximum of the single-file download data volume includes: Wherein, X max represents the maximum value of the single file download data volume, X midder represents the median of the single file download data volume, x represents the data volume of the current file to be downloaded, and f1 represents the data volume measurement value.

5. The method of claim 3, wherein, The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: Wherein, X min represents the minimum value of the single file download data volume, X midder represents the median of the single file download data volume, x represents the data volume of the current file to be downloaded, and f1 represents the data volume measurement value.

6. The method according to any one of claims 1-2, characterized in that, The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes:

7. The method of claim 6, wherein, The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: where Y max represents the maximum value of the single-day file download amount, Y midder represents the median value of the single-day file download amount, y represents the single-day file download amount, and f2 represents the single-day file download amount metric value.

8. The method of claim 6, wherein, The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior deviation metric quantification of the data volume of the current to-be-downloaded file according to the median and minimum of the single-file download data volume includes: The behavior where Y min represents the minimum value of the daily file download amount, Y midder represents the median value of the daily file download amount, y represents the daily file download amount, and f2 represents the daily file download amount metric value.

9. The method according to any of claims 1-2, characterized by, The determining whether the current file download behavior of the user is abnormal according to the size relationship between the data quantity metric value and the data quantity metric baseline and the size relationship between the daily file download quantity metric value and the single-day file download quantity metric baseline comprises: If the data quantity metric value is less than or equal to the data quantity metric baseline and the daily file download quantity metric value is less than or equal to the single-day file download quantity metric baseline, it is determined that the current file download behavior of the user is normal. If the data quantity metric value is greater than the data quantity metric baseline or the daily file download quantity metric value is greater than the single-day file download quantity metric baseline, it is determined that the current file download behavior of the user is abnormal.

10. A file download behavior anomaly detection apparatus characterized by comprising: The method comprises: The data acquisition module is configured to acquire the data quantity of a current file to be downloaded by the user and the daily file download quantity of the user; The data quantity metric module is configured to quantitatively measure the behavior deviation of the data quantity of the current file to be downloaded according to the median, maximum value and minimum value of the single file download data quantity of the user in a historical time, to obtain a data quantity metric value; The download quantity metric module is configured to quantitatively measure the behavior deviation of the daily file download quantity according to the median, maximum value and minimum value of the single-day file download quantity of the user in the historical time, to obtain a daily file download quantity metric value; The download behavior detection module is configured to determine whether the current file download behavior of the user is abnormal according to the size relationship between the data quantity metric value and the data quantity metric baseline and the size relationship between the daily file download quantity metric value and the single-day file download quantity metric baseline, wherein the data quantity metric baseline is determined based on the single file download data quantity of the user in the historical time, and the single-day file download quantity metric baseline is determined based on the single-day file download quantity of the user in the historical time; The data quantity statistical module is configured to determine the median, maximum value and minimum value of the single file download data quantity of the user in the historical time; The data quantity metric sample acquisition module is configured to quantitatively measure the behavior deviation of each single file download data quantity according to the median, maximum value and minimum value of the single file download data quantity of the user in the historical time, to obtain a metric value of each single file download data quantity, and to take the metric value of each single file download data quantity as a data quantity metric sample respectively; The data quantity sample division module is configured to divide all the data quantity metric samples into data quantity normal samples and data quantity abnormal samples based on an abnormality detection algorithm; The data quantity metric baseline determination module is configured to acquire the center of all the data quantity normal samples, and to determine the maximum distance between the data quantity normal samples and the center as the data quantity metric baseline.

11. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the computer program to implement the file download behavior abnormality detection method of any one of claims 1 to 9.

12. A computer readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the file download behavior abnormality detection method of any one of claims 1 to 9.

Images