4a abnormal detouring detection method and device, electronic equipment and storage medium

Abstract

Embodiments of the present application provide a 4A abnormal bypass detection method and device, electronic equipment and storage medium. The method comprises: obtaining attribute feature data sets of a target device in multiple dimensions associated with 4A abnormal bypass; performing multiple clustering processing on the attribute feature data sets in the multiple dimensions to obtain multiple clustering results; performing secondary clustering processing on the multiple clustering results to obtain attribute label values of the attribute feature data sets in each dimension; calling a pre-trained anomaly detection model to process the attribute label values to predict a 4A abnormal bypass detection result corresponding to the target device. The embodiments of the present application can improve the efficiency of 4A bypass anomaly detection, avoid problems such as management firewall configuration confusion, misoperation causing business damage, etc.

Description

Technical Field

[0001] The present application relates to the field of anomaly detection technology, and in particular to a 4A abnormal detour detection method, device, electronic device and storage medium. Background Art

[0002] The 4A (Authentication, Account, Authorization, Audit) unified security management platform solution concept formally establishes identity authentication as the foundation and indispensable component of network security. This led to the emergence of the 4A system, which is now widely deployed by major enterprises in my country.

[0003] National regulations on information system security clearly require security audits for information systems at level 2 and above, including network security, host security, and application security. Log auditing (the process of verifying the legality and compliance of network operations based on various operational data, operational logs, and other information to ensure network information and network security) is a key method for this. This led to the emergence of security audit products such as log audit systems. Audit logs often include logs logged into the 4A system.

[0004] In the production and operation management process, traditional 4A bypass analysis is mostly manually maintained and set up, and post-audits reveal problems such as confusing manual firewall configuration and business damage caused by misoperation. Summary of the Invention

[0005] The technical problem to be solved by the embodiments of the present application is to provide a 4A abnormal bypass detection method, device, electronic device and storage medium to solve the problem in the prior art of manual management of firewall configuration confusion and service damage caused by erroneous operation.

[0006] In a first aspect, an embodiment of the present application provides a 4A abnormal detour detection method, the method comprising:

[0007] Obtaining a dataset of attribute features of a target device in multiple dimensions that is associated with the 4A abnormal detour;

[0008] Performing multiple clustering processes on the attribute feature data sets under the multiple dimensions to obtain multiple clustering results;

[0009] Performing secondary clustering processing on the multiple clustering results to obtain attribute label values ​​of the attribute feature data set under each dimension;

[0010] A pre-trained anomaly detection model is called to process the attribute label value and predict a 4A anomaly bypass detection result corresponding to the target device.

[0011] Optionally, the step of obtaining a target device's attribute feature dataset in multiple dimensions associated with the 4A abnormal detour includes:

[0012] Obtaining login logs recorded by the 4A system and device logs of the target device;

[0013] The login log and the device log are parsed to obtain a data set of attribute features of the target device in multiple dimensions that is associated with the 4A abnormal detour.

[0014] Optionally, performing multiple clustering processes on the attribute feature datasets under the multiple dimensions to obtain multiple clustering results includes:

[0015] Performing clustering processing on the attribute feature data sets under the multiple dimensions to obtain a first clustering result;

[0016] performing clustering processing on the attribute feature datasets under the multiple dimensions after each lack of one of the attribute feature datasets in the different dimensions, to obtain second clustering results; the number of the second clustering results is the same as the number of the multiple dimensions;

[0017] The first clustering result and the second clustering result are used as the multiple clustering results.

[0018] Optionally, performing secondary clustering processing on the multiple clustering results to obtain attribute label values ​​of the attribute feature dataset under each dimension includes:

[0019] Using the K-means clustering algorithm to perform clustering processing on the attribute feature data sets corresponding to the multiple clustering results, and obtain a clustering evaluation index corresponding to each clustering result;

[0020] According to the clustering evaluation index, the attribute label value corresponding to the attribute feature data set under each dimension is determined.

[0021] Optionally, the calling of a pre-trained anomaly detection model to process the attribute label value and predict a 4A anomaly bypass detection result corresponding to the target device includes:

[0022] Calling the anomaly detection model to perform factor analysis on the attribute label values, and determining a target attribute label value among the attribute label values ​​whose influence coefficient on the 4A abnormal detour is greater than a threshold;

[0023] The target attribute label value is processed based on the isolation forest algorithm to obtain a 4A abnormal bypass detection result corresponding to the target device.

[0024] Optionally, after calling the pre-trained anomaly detection model to process the attribute label value and predicting a 4A anomaly bypass detection result corresponding to the target device, the method further includes:

[0025] Generate firewall configuration information based on the 4A abnormal bypass detection result;

[0026] Based on the firewall configuration information, the firewall configuration of the 4A system is adjusted.

[0027] Optionally, the multiple dimensions include: at least two of: access source address dimension, access destination address dimension, access protocol dimension, access port dimension, access account dimension and access number dimension.

[0028] In a second aspect, an embodiment of the present application provides a 4A abnormal detour detection device, the device comprising:

[0029] A data set acquisition module is used to acquire attribute feature data sets of a target device in multiple dimensions that are associated with the 4A abnormal detour;

[0030] A clustering result acquisition module is used to perform multiple clustering processes on the attribute feature data sets under the multiple dimensions to obtain multiple clustering results;

[0031] An attribute label acquisition module is used to perform secondary clustering processing on the multiple clustering results to obtain attribute label values ​​of the attribute feature data set under each dimension;

[0032] The detection result acquisition module is used to call a pre-trained anomaly detection model to process the attribute label value and predict the 4A anomaly bypass detection result corresponding to the target device.

[0033] Optionally, the data set acquisition module includes:

[0034] A log acquisition unit, configured to acquire login logs recorded by the 4A system and device logs of the target device;

[0035] The data set acquisition unit is used to parse the login log and the device log to obtain the attribute feature data set of the target device in multiple dimensions associated with the 4A abnormal detour.

[0036] Optionally, the clustering result acquisition module includes:

[0037] A first result acquisition unit, configured to perform clustering processing on the attribute feature data sets under the multiple dimensions to obtain a first clustering result;

[0038] a second result obtaining unit, configured to perform clustering processing on the attribute feature datasets under the multiple dimensions after each lack of an attribute feature dataset of a different dimension, to obtain second clustering results; the number of the second clustering results is the same as the number of the multiple dimensions;

[0039] A clustering result obtaining unit is configured to use the first clustering result and the second clustering result as the multiple clustering results.

[0040] Optionally, the attribute tag acquisition module includes:

[0041] An evaluation index obtaining unit is used to perform clustering processing on the attribute feature data sets corresponding to the multiple clustering results using a K-means clustering algorithm to obtain a clustering evaluation index corresponding to each clustering result;

[0042] The attribute label determination unit is used to determine the attribute label value corresponding to the attribute feature data set under each dimension according to the cluster evaluation index.

[0043] Optionally, the detection result acquisition module includes:

[0044] a target label determination unit, configured to call the anomaly detection model to perform factor analysis on the attribute label values, and determine a target attribute label value whose influence coefficient on the 4A abnormal detour is greater than a threshold value among the attribute label values;

[0045] The detection result acquisition unit is used to process the target attribute label value based on the isolation forest algorithm to obtain the 4A abnormal detour detection result corresponding to the target device.

[0046] Optionally, the device further comprises:

[0047] A configuration information generation module, configured to generate firewall configuration information based on the 4A abnormal bypass detection result;

[0048] The firewall configuration adjustment module is used to adjust the firewall configuration of the 4A system based on the firewall configuration information.

[0049] Optionally, the multiple dimensions include: at least two of: access source address dimension, access destination address dimension, access protocol dimension, access port dimension, access account dimension and access number dimension.

[0050] In a third aspect, an embodiment of the present application provides an electronic device, including:

[0051] A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements any one of the above-mentioned 4A abnormal detour detection methods when executing the program.

[0052] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium. When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute any of the 4A abnormal detour detection methods described above.

[0053] Compared with the prior art, the embodiments of the present application have the following advantages:

[0054] In an embodiment of the present application, by obtaining a target device's attribute feature data set in multiple dimensions associated with 4A abnormal detours, performing multiple clustering processes on the attribute feature data set in multiple dimensions to obtain multiple clustering results, performing secondary clustering processes on the multiple clustering results to obtain attribute label values ​​for the attribute feature data set in each dimension, calling a pre-trained anomaly detection model to process the attribute label values, and predicting the 4A abnormal detour detection result corresponding to the target device. The embodiment of the present application can improve the efficiency of 4A bypass anomaly detection by combining the anomaly detection model to detect and analyze 4A abnormal detours, and can avoid problems such as chaotic management firewall configuration and service damage caused by misoperation.

[0055] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 A flowchart of the steps of a 4A abnormal detour detection method provided in an embodiment of the present application;

[0057] Figure 2 A schematic diagram of a log collection process provided in an embodiment of the present application;

[0058] Figure 3 A schematic diagram of a log analysis process provided in an embodiment of the present application;

[0059] Figure 4 A schematic diagram of a 4A abnormal detour detection system provided in an embodiment of the present application;

[0060] Figure 5 A schematic diagram of a 4A abnormal detour detection process provided in an embodiment of the present application;

[0061] Figure 6 A schematic diagram of a clustering result provided in an embodiment of the present application;

[0062] Figure 7 A schematic structural diagram of a 4A abnormal detour detection device provided in an embodiment of the present application;

[0063] Figure 8A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0064] In order to make the above-mentioned purposes, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0065] The terms used in the embodiments of the present application are for the purpose of describing specific embodiments only and are not intended to limit the present application. The singular forms "a", "an", "the" and "the" used in the embodiments of the present application and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise.

[0066] Reference Figure 1 , shows a flowchart of the steps of a 4A abnormal detour detection method provided by an embodiment of the present application, such as Figure 1 As shown, the 4A abnormal detour detection method may include: step 101, step 102, step 103 and step 104.

[0067] Step 101: Acquire a data set of attribute features of a target device in multiple dimensions that is associated with a 4A abnormal detour.

[0068] The embodiments of the present application can be applied to a scenario where a 4A abnormal detour is detected for a target device in combination with an abnormality detection model.

[0069] The training process of the anomaly detection model can be described in detail in conjunction with the following implementation method.

[0070] Training an anomaly detection model can include the following steps:

[0071] Step S1: Obtain a training data set.

[0072] When building a model training dataset, you can collect login logs recorded by the 4A system and device logs of the login devices. In the specific implementation, such as Figure 2 As shown in the figure, after an unknown bypass event is captured, the platform analyzes whitelist policies and log source information, adding suspicious accesses to the unknown access list for management and control. Combined with IP source analysis, it generates a firewall configuration to block access from non-telecom operators. The platform also collaborates with the 4A Management Center to collect business department asset information and generate alerts for unknown cross-disciplinary access events.

[0073] After collecting login logs and device logs, they can be normalized to convert logs with different expressions into a unified description form to provide basic data for the subsequent clustering algorithm. Then, the data can be preprocessed, including but not limited to removing missing values, discretizing the data set, and other preprocessing. Finally, multidimensional attribute information is extracted. In this example, the multidimensional attribute information may include: access source address, access destination address, access protocol, access port, access account, access number, and other multidimensional attribute information, and a training data set is constructed based on the multidimensional attribute information. Figure 3 shown.

[0074] Specifically, a dataset can be established through rough sets. In rough set theory, an information system S can be represented by an ordered quintuple, namely S = (U, A, V, f). U is a non-empty set, which can be expressed as U = {x1, x2, x3, ..., xn}. The attribute set can include seven items: access account, source IP address, destination IP address, protocol, destination port, number of visits, and access status. The access status is a decision attribute, and the others are conditional attributes. Different attributes can be used to divide the domain into subsets containing one or more objects. Each subset contains a V. Using different information functions f, linguistic information can be converted into subsets contained in S.

[0075] Information Sheet S:

[0076]

[0077] 2. Data Clustering

[0078] It is found in experiments that in the results of a single clustering, suspicious points with a lower degree of suspicion are usually masked by suspicious points with a higher degree of suspicion. This embodiment improves accuracy through secondary clustering.

[0079] Cluster analysis of qualitative data. Qualitative data clustering methods utilize clustering to partition the data in a dataset into several sets, such as U = {u1,u2,u3,...,un}. Here, un is a subset containing several data points, representing a cluster in the clustering results. Attribute importance is calculated based on the quotient of the clustering results with different attributes missing, the number of data points in the same subset u in the original dataset clustering results (card(POSR(D))), and the cardinality of the set U in the original dataset clustering results (card(U)). The dataset is partitioned using the equivalence relation in rough sets, meaning that two data samples are clustered into the same cluster only when they are identical. Following the method used to calculate attribute importance in qualitative data clustering, the dataset is clustered by reducing one attribute at a time. When the dataset has n dimensions, n label values ​​for different clustering results are obtained.

[0080] The limitations of single k-means++ clustering: In the experiment, it was found that in the results of single clustering, the suspicious degree of the suspicious points was usually covered by the suspicious degree of the suspicious points. In this case, the accuracy is improved by two clustering.

[0081] The clustering results of n+1 times are stored in the same matrix. The first record is the clustering result label without attribute missing, the second record is the clustering result label without the first attribute, and so on. The similarity between different records and the first record is calculated, and a threshold is used to determine the similar missing attribute records of the first record. This method first determines to divide the instances into K clusters, and then selects a sample point from the data set as the initial clustering center, and calculates the shortest distance between each sample and the existing clustering center. The distance between each sample xi and the nearest clustering center cen is denoted by D(xi). Then, the probability of each sample point xi being selected as the next clustering center can be calculated. After K clusters are obtained, the internal evaluation method can be used to calculate the clustering evaluation index.

[0082] 3. Factor analysis of attribute characteristic values

[0083] (1) Factor model construction: Each variable can be represented as the sum of a linear function of common factors and special factors, that is:

[0084] X i =a i1 F1+...+a im F m +ε i ,(i=1,2,...,p) (1)

[0085] In the above formula (1), F1,..., F m are common factors, and ε i is a special factor of X i . The model can be represented by a matrix as follows:

[0086] The matrix A in the model is called the factor loading matrix, and aij is called the factor "load", which is the load of the ith variable on the jth factor. If Xi is regarded as a point in an m-dimensional space, a ij represents its projection on the coordinate axis F j .

[0087] (2) Solution of factor loading matrix: principal component method is adopted, then the correlation matrix between variables, the characteristic root and characteristic vector of the matrix are calculated, and finally the characteristic roots are arranged in descending order, and the corresponding principal components are calculated.

[0088] The variance contribution rate of the principal component is calculated by the formula:

[0089]

[0090] Cumulative contribution rate: the cumulative contribution rate of the first K principal components is defined as follows, which represents how much information the first K principal components extract from the original variables.

[0091] (3) Cumulative contribution rate: when the cumulative contribution rate of the first k principal components reaches a certain value, the first k principal components are retained.

[0092] 4. Isolation forest training isolates trees when selecting attributes, and removes the previous column name from the selection range. After isolation forest processing, the prediction label of the test data by the isolation forest is output

[0093] (1) Select attributes that have a greater impact on the label to construct an isolation tree for anomaly detection. The specific processing process is as follows:

[0094] Step 1, initialize data, set sample size and other parameters, and output the isolation tree.

[0095] The creation pseudocode of the isolation tree is as follows:

[0096]

[0097] The growth of each isolation tree, i.e. the training pseudocode, is as follows:

[0098]

[0099]

[0100] Step 2, continuously loop through the data until there is only one data on the leaf node (cannot be cut further) or the tree has grown to the set height.

[0101] The isolation forest prediction score pseudocode can be as follows:

[0102] Algorithm 2:PathLength(x,T,e)

[0103] Inputs:x-an instance,T-an iTree,e-current patn length;

[0104] to be initialized to zero when first called

[0105] Output:path length of x

[0106] if T is an external node then

[0107] return e+c(T.size){c(.)is defined in Epuation 1}

[0108] end if

[0109] a←T. splitAtt

[0110] if x a <T.splitValue then

[0111] return PathLength(x,T.left,e+1)

[0112] else{x a ≤T.splitValue}

[0113] return PathLength(x,T.right,e+1)

[0114] end if

[0115] Step 3: Calculate the height integration of each sample point to analyze the outliers.

[0116] The above training process is iterated until the model converges to obtain an anomaly detection model, which can be applied to subsequent 4A anomaly detour detection scenarios.

[0117] When performing 4A anomaly bypass detection on a target device, a dataset of attribute features associated with the 4A anomaly bypass across multiple dimensions can be obtained. Specifically, login logs recorded by the 4A system and the target device's device logs can be obtained. The login logs and device logs are then parsed to obtain a dataset of attribute features associated with the 4A anomaly bypass across multiple dimensions.

[0118] After acquiring the attribute feature datasets of the target device in multiple dimensions associated with the 4A abnormal detour, step 102 is executed.

[0119] Step 102: performing multiple clustering processes on the attribute feature datasets under the multiple dimensions to obtain multiple clustering results.

[0120] After obtaining the attribute feature data set of the target device in multiple dimensions associated with the 4A abnormal bypass, the attribute feature data set in multiple dimensions can be clustered multiple times to obtain multiple clustering results. Specifically, the attribute feature data set in multiple dimensions can be clustered, and the other attribute feature data sets after missing one attribute feature data set in each dimension can be clustered to obtain a second clustering result. The display of multiple clustering results can be as shown in Figure 6 The implementation process can be described in detail in combination with the specific implementation manners described below.

[0121] In an implementation manner of the present application, the step 102 can include:

[0122] Sub-step A1: clustering the attribute feature data set in multiple dimensions to obtain a first clustering result.

[0123] In the embodiment of the present application, after obtaining the attribute feature data set in multiple dimensions, the attribute feature data set in multiple dimensions can be clustered to obtain a first clustering result.

[0124] After clustering the attribute feature data set in multiple dimensions to obtain a first clustering result, sub-step A2 is executed.

[0125] Sub-step A2: clustering the other attribute feature data sets after missing one attribute feature data set in each different dimension each time to obtain a second clustering result; the number of the second clustering results is the same as the number of the multiple dimensions.

[0126] After clustering the attribute feature data set in multiple dimensions to obtain a first clustering result, the other attribute feature data sets after missing one attribute feature data set in each dimension each time can be clustered to obtain a second clustering result. The number of the second clustering results is the same as the number of the multiple dimensions. For example, when the multiple dimensions are five dimensions, the five dimensions are dimension 1, dimension 2, dimension 3, dimension 4, and dimension 5. When clustering, the data in the other four dimensions can be clustered after missing dimension 1. Then the data in the other four dimensions can be clustered after missing dimension 2. The data in the other four dimensions can be clustered after missing dimension 3. The data in the other four dimensions can be clustered after missing dimension 4. The data in the other four dimensions can be clustered after missing dimension 5. Thus, five clustering results, i.e., the second clustering results, etc., can be obtained.

[0127] It can be understood that the above examples are only examples for better understanding the technical solutions of the embodiments of the present application, and are not the only limitation of the embodiments.

[0128] After obtaining the first clustering result and the second clustering result, a sub-step A3 is performed.

[0129] Sub-step A3: taking the first clustering result and the second clustering result as the plurality of clustering results.

[0130] After obtaining the first clustering result and the second clustering result, the first clustering result and the second clustering result can be taken as the clustering results obtained by the plurality of clustering processes.

[0131] After obtaining the plurality of clustering results by performing the plurality of clustering processes on the attribute feature data sets in the plurality of dimensions, a step 103 is performed.

[0132] Step 103: performing a secondary clustering process on the plurality of clustering results to obtain the attribute label value of the attribute feature data set in each dimension.

[0133] After obtaining the plurality of clustering results by performing the plurality of clustering processes on the attribute feature data sets in the plurality of dimensions, a secondary clustering process can be performed on the plurality of clustering results to obtain the attribute label value of the attribute feature data set in each dimension. In the embodiment, the K-means clustering algorithm can be used to perform a clustering process on the attribute feature data sets corresponding to the plurality of clustering results to obtain a clustering evaluation index corresponding to each clustering result. Further, the attribute label value corresponding to the attribute feature data set in each dimension can be determined according to the clustering evaluation index.

[0134] After performing the secondary clustering process on the plurality of clustering results to obtain the attribute label value of the attribute feature data set in each dimension, a step 104 is performed.

[0135] Step 104: calling a pre-trained anomaly detection model to process the attribute label value to predict the 4A anomaly bypass detection result corresponding to the target device.

[0136] After performing the secondary clustering process on the plurality of clustering results to obtain the attribute label value of the attribute feature data set in each dimension, a pre-trained anomaly detection model can be called to process the attribute label value to predict the 4A anomaly bypass detection result corresponding to the target device. The implementation process can be described in detail in combination with the specific implementation manner described below.

[0137] In another specific implementation manner of the present application, the above step 104 can include:

[0138] Sub-step B1: calling the anomaly detection model to perform factor analysis on the attribute label values, and determining target attribute label values ​​among the attribute label values ​​whose influence coefficient on the 4A abnormal detour is greater than a threshold.

[0139] In an embodiment of the present application, after obtaining the attribute label value, the anomaly detection model can be called to perform factor analysis on the attribute label value to determine the target attribute label value whose influence coefficient on the 4A abnormal detour is greater than the threshold.

[0140] After determining the target attribute label value whose influence coefficient on the 4A abnormal detour is greater than the threshold value among the attribute label values, sub-step B2 is executed.

[0141] Sub-step B2: Processing the target attribute label value based on the isolation forest algorithm to obtain a 4A abnormal detour detection result corresponding to the target device.

[0142] After determining the target attribute label value whose influence coefficient on the 4A abnormal detour is greater than the threshold in the attribute label value, the target attribute label value can be processed based on the isolation forest algorithm to obtain the 4A abnormal detour detection result corresponding to the target device.

[0143] This embodiment of the application uses algorithms such as K-means clustering, isolation forest, and factor analysis as the basis, using the access source address, access destination address, access protocol, access port, access account, and access count as attribute feature values ​​to create a port profile for port access. It also uses AI technology to analyze access logs and accurately predict 4A devices with abnormal detours based on discrete point information.

[0144] In the embodiment of the present application, when the 4A abnormal bypass detection result indicates that the target device has an abnormal bypass, firewall configuration information can be generated based on the 4A abnormal bypass detection result to adjust the firewall configuration of the 4A system. This implementation process can be described in detail in conjunction with the following specific implementation methods.

[0145] In another specific implementation of the present application, after the above step 104, the following steps may be further included:

[0146] Step C1: Generate firewall configuration information based on the 4A abnormal bypass detection result.

[0147] In this embodiment, when the 4A abnormal circumvention detection result indicates that a 4A abnormal circumvention behavior exists, firewall configuration information may be generated based on the 4A abnormal circumvention detection result.

[0148] After the firewall configuration information is generated based on the 4A abnormal circumvention detection result, step C2 is performed.

[0149] Step C2: Based on the firewall configuration information, adjust the firewall configuration of the 4A system.

[0150] After the firewall configuration information is generated based on the 4A abnormal bypass detection result, the firewall configuration of the 4A system may be adjusted based on the firewall configuration information.

[0151] The process of 4A abnormal detour and disposal can be as follows Figure 5 Specifically, it may include:

[0152] Step 1: Data collection, processing and normalization.

[0153] Step 2: Extract multi-dimensional port portraits.

[0154] Step 3: Cluster the multidimensional data and obtain attribute label values.

[0155] Step 4: Perform secondary data clustering and calculate attribute importance.

[0156] Step 5: The extracted attribute importance includes attribute importance under different dimensions such as access account and access source IP.

[0157] Step 6: Build an anomaly detection model and perform factor analysis on the attribute eigenvalues.

[0158] Step 7: Perform isolation forest anomaly detection on important attributes.

[0159] Step 8: Calculate the firewall configuration after removing the bypass configuration.

[0160] Step 9: Issue and implement the detour measures.

[0161] The above technical solutions provided in the embodiments of the present application can be described in conjunction with the following examples. Figure 4 shown.

[0162] In order to verify the effectiveness of the method proposed in the embodiment of this application, the detection capability of the algorithm in this paper is verified through a real detection scenario data set. The relevant test code is written in Python. In some log data sets, there is information such as source address, access destination address, access protocol, access port, access account, access number, etc., which is used to detect the 4A system bypass behavior. In this process, it is necessary to preprocess the attributes in the data set, including removing missing values, mapping discrete values, etc. The implementation process may include:

[0163] 1. Data analysis and preprocessing. This dataset uses 10,000 intranet log data. After normalization, the isolation forest algorithm is implemented using a Python script.

[0164] 2. Sample and cluster the data set multiple times, and use sampling to obtain sub-datasets to calculate the importance of attributes. At the same time, in order to make the sampled data more accurately describe the importance of different attributes.

[0165] 3. Combined with the 4A managed resources, the importance of the seven attributes in the table below is calculated using multiple clustering algorithms for each scenario. The results are accumulated to determine the impact of different attributes on the label. The attributes are ranked and the attributes with the greatest impact on the label are selected to construct an isolation forest for anomaly detection. The attribute importance ranking calculated by the 4A managed resources and the managed content can be shown in the following table:

[0166]

[0167] 4. After training on live network samples, we set a threshold of 50 to select attributes with larger scores, and finally determine the attributes that have a greater impact on sample labels in different resource scenarios.

[0168] 5. Perform anomaly detection on the dataset. Finally, when constructing the isolation tree, the isolation forest selects the partition column from the above attributes. The outliers with short isolation tree paths are extracted.

[0169] 6. Automatically generate and implement firewall business processing. Using the anomaly detection results calculated by the isolation forest algorithm above, a whitelist of logins suspected of bypassing is generated. Using Python code, a difference calculation is performed between the pre-calculation whitelist and the suspected bypass whitelist to generate an adaptive policy that matches the business management scenario. This allows for increasingly refined firewall policies for various resources in daily cloud network security operations. The 4A system transmits the firewall policies after anomaly detection via a third-party interface to the professional integrated network management system for each managed resource. The professional integrated network management system automatically verifies the configuration and then automatically issues the policies, enabling precise analysis and processing of 4A bypasses.

[0170] 7. Demonstration of identification effect - accurate detection of bypass. Randomly select a network environment, based on fixed detection objects, enable fixed whitelist mode and coupled port traffic intelligent analysis detection respectively. By collecting normal access at the same time and observing for a period of time, the log analysis using the whitelist mode shows a large number of bypasses. After adopting the coupled port traffic intelligent analysis detection function, after a period of detection and analysis, it can be concluded that the threshold is constantly undergoing obvious dynamic adjustment. The system continuously optimizes the firewall configuration and no bypass occurs.

[0171] When a 4A detour anomaly occurs, the alarm management module can push alarm information, such as access protocol display, access frequency display, access source display, access analysis display, etc. Figure 4 shown.

[0172] The 4A abnormal bypass detection method provided by the embodiments of this application can drill down into firewall information to generate bypass reinforcement configurations, which can be directly distributed. This configuration can typically resolve bypass issues within 5 minutes, effectively improving bypass handling efficiency. As the model is continuously trained, the bypass misjudgment rate can be continuously reduced. Furthermore, it can respond to configuration policies and automatically generate configurations that can be distributed to the firewall for direct blocking.

[0173] This application example uses algorithms such as K-means clustering, isolation forest, and factor analysis as the basis, using the access source address, access destination address, access protocol, access port, access account, and access count as attribute feature values ​​to create a port profile for port access. It also uses AI technology to analyze access logs and accurately analyze firewall range information using discrete point information.

[0174] The 4A anomaly bypass detection method provided in the embodiment of the present application obtains attribute feature data sets associated with 4A anomaly bypass in multiple dimensions of the target device, performs multiple clustering processes on the attribute feature data sets in multiple dimensions to obtain multiple clustering results, performs secondary clustering processes on the multiple clustering results to obtain attribute label values ​​of the attribute feature data sets in each dimension, calls a pre-trained anomaly detection model to process the attribute label values, and predicts the 4A anomaly bypass detection result corresponding to the target device. The embodiment of the present application improves the efficiency of 4A anomaly bypass detection by combining the anomaly detection model to detect and analyze 4A anomaly bypass, and can avoid problems such as chaotic management firewall configuration and service damage caused by misoperation.

[0175] Reference Figure 7 , shows a schematic structural diagram of a 4A detour anomaly detection device provided in an embodiment of the present application, such as Figure 7 As shown, the 4A detour anomaly detection device 700 may include the following modules:

[0176] The data set acquisition module 710 is used to acquire attribute feature data sets of the target device in multiple dimensions associated with the 4A abnormal detour;

[0177] The clustering result acquisition module 720 is configured to perform multiple clustering processes on the attribute feature data sets under the multiple dimensions to obtain multiple clustering results;

[0178] The attribute label acquisition module 730 is used to perform secondary clustering processing on the multiple clustering results to obtain the attribute label value of the attribute feature data set under each dimension;

[0179] The detection result acquisition module 740 is used to call a pre-trained anomaly detection model to process the attribute label value and predict the 4A anomaly detour detection result corresponding to the target device.

[0180] Optionally, the data set acquisition module includes:

[0181] A log acquisition unit, configured to acquire login logs recorded by the 4A system and device logs of the target device;

[0182] The data set acquisition unit is used to parse the login log and the device log to obtain the attribute feature data set of the target device in multiple dimensions associated with the 4A abnormal detour.

[0183] Optionally, the clustering result acquisition module includes:

[0184] A first result acquisition unit, configured to perform clustering processing on the attribute feature data sets under the multiple dimensions to obtain a first clustering result;

[0185] a second result obtaining unit, configured to perform clustering processing on the attribute feature datasets under the multiple dimensions after each lack of an attribute feature dataset of a different dimension, to obtain second clustering results; the number of the second clustering results is the same as the number of the multiple dimensions;

[0186] A clustering result obtaining unit is configured to use the first clustering result and the second clustering result as the multiple clustering results.

[0187] Optionally, the attribute tag acquisition module includes:

[0188] An evaluation index obtaining unit is used to perform clustering processing on the attribute feature data sets corresponding to the multiple clustering results using a K-means clustering algorithm to obtain a clustering evaluation index corresponding to each clustering result;

[0189] The attribute label determination unit is used to determine the attribute label value corresponding to the attribute feature data set under each dimension according to the cluster evaluation index.

[0190] Optionally, the detection result acquisition module includes:

[0191] a target label determination unit, configured to call the anomaly detection model to perform factor analysis on the attribute label values, and determine a target attribute label value whose influence coefficient on the 4A abnormal detour is greater than a threshold value among the attribute label values;

[0192] The detection result acquisition unit is used to process the target attribute label value based on the isolation forest algorithm to obtain the 4A abnormal detour detection result corresponding to the target device.

[0193] Optionally, the device further comprises:

[0194] A configuration information generation module, configured to generate firewall configuration information based on the 4A abnormal bypass detection result;

[0195] The firewall configuration adjustment module is used to adjust the firewall configuration of the 4A system based on the firewall configuration information.

[0196] Optionally, the multiple dimensions include: at least two of: access source address dimension, access destination address dimension, access protocol dimension, access port dimension, access account dimension and access number dimension.

[0197] The 4A bypass anomaly detection device provided in the embodiment of the present application obtains attribute feature data sets in multiple dimensions associated with 4A abnormal bypass of the target device, performs multiple clustering processes on the attribute feature data sets in multiple dimensions to obtain multiple clustering results, performs secondary clustering processes on the multiple clustering results to obtain attribute label values ​​of the attribute feature data sets in each dimension, calls a pre-trained anomaly detection model to process the attribute label values, and predicts the 4A abnormal bypass detection result corresponding to the target device. The embodiment of the present application can improve the efficiency of 4A bypass anomaly detection by combining the anomaly detection model to detect and analyze 4A abnormal bypass, and can avoid problems such as chaotic management firewall configuration and service damage caused by misoperation.

[0198] An embodiment of the present application also provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program implements the above-mentioned 4A bypass anomaly detection method when executed by the processor.

[0199] Figure 8 FIG. 8 is a schematic structural diagram of an electronic device 800 according to an embodiment of the present invention. Figure 8 As shown, the electronic device 800 includes a central processing unit (CPU) 801, which can perform various appropriate actions and processes according to computer program instructions stored in a read-only memory (ROM) 802 or computer program instructions loaded from a storage unit 808 into a random access memory (RAM) 803. In the RAM 803, various programs and data required for the operation of the electronic device 800 can also be stored. The CPU 801, ROM 802, and RAM 803 are connected to each other via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0200] Multiple components in the electronic device 800 are connected to the I / O interface 805, including: an input unit 806, such as a keyboard, a mouse, a microphone, etc.; an output unit 807, such as various types of displays, speakers, etc.; a storage unit 808, such as a magnetic disk, an optical disk, etc.; and a communication unit 809, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 809 allows the electronic device 800 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0201] The various processes and procedures described above may be executed by the processing unit 801. For example, the method of any of the above embodiments may be implemented as a computer software program, which is tangibly contained in a computer-readable medium, such as the storage unit 808. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 800 via the ROM 802 and / or the communication unit 809. When the computer program is loaded into the RAM 803 and executed by the CPU 801, one or more actions in the method described above may be performed.

[0202] In addition, an embodiment of the present application further provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the above-mentioned 4A bypass anomaly detection method is implemented.

[0203] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0204] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, devices, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0205] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, terminals (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal generate instructions for implementing the steps in the flowchart and / or block diagram. Figure 1a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0206] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing terminal to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0207] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal so that a series of operational steps are executed on the computer or other programmable terminal to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable terminal for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0208] Although preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they become aware of the basic inventive concepts. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0209] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or terminal. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or terminal comprising the element.

[0210] The above is a detailed introduction to a 4A bypass anomaly detection method, a 4A bypass anomaly detection device, an electronic device and a computer-readable storage medium provided by the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for those skilled in the art, according to the ideas of the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A 4A abnormal detour detection method, characterized in that: The method comprises: Obtaining a dataset of attribute features of a target device in multiple dimensions that is associated with the 4A abnormal detour; Performing multiple clustering processes on the attribute feature data sets under the multiple dimensions to obtain multiple clustering results; Performing secondary clustering processing on the multiple clustering results to obtain attribute label values ​​of the attribute feature data set under each dimension; Invoking a pre-trained anomaly detection model to process the attribute label value and predict a 4A anomaly bypass detection result corresponding to the target device; The clustering process is performed multiple times on the attribute feature datasets under the multiple dimensions to obtain multiple clustering results, including: Performing clustering processing on the attribute feature data sets under the multiple dimensions to obtain a first clustering result; performing clustering processing on the attribute feature datasets under the multiple dimensions after each lack of one of the attribute feature datasets in the different dimensions, to obtain second clustering results; the number of the second clustering results is the same as the number of the multiple dimensions; The first clustering result and the second clustering result are used as the multiple clustering results.

2. The method according to claim 1, characterized in that The step of obtaining a target device's attribute feature dataset in multiple dimensions associated with the 4A abnormal detour includes: Obtaining login logs recorded by the 4A system and device logs of the target device; The login log and the device log are parsed to obtain a data set of attribute features of the target device in multiple dimensions that is associated with the 4A abnormal detour.

3. The method according to claim 1, characterized in that The performing secondary clustering processing on the multiple clustering results to obtain the attribute label value of the attribute feature data set under each dimension includes: Using the K-means clustering algorithm to perform clustering processing on the attribute feature data sets corresponding to the multiple clustering results, and obtain a clustering evaluation index corresponding to each clustering result; According to the clustering evaluation index, the attribute label value corresponding to the attribute feature data set under each dimension is determined.

4. The method according to claim 1, wherein The calling of a pre-trained anomaly detection model to process the attribute label value and predict a 4A anomaly bypass detection result corresponding to the target device includes: Calling the anomaly detection model to perform factor analysis on the attribute label values, and determining a target attribute label value among the attribute label values ​​whose influence coefficient on the 4A abnormal detour is greater than a threshold; The target attribute label value is processed based on the isolation forest algorithm to obtain a 4A abnormal bypass detection result corresponding to the target device.

5. The method according to claim 1, wherein After calling the pre-trained anomaly detection model to process the attribute label value and predicting a 4A anomaly bypass detection result corresponding to the target device, the method further includes: Generate firewall configuration information based on the 4A abnormal bypass detection result; Based on the firewall configuration information, the firewall configuration of the 4A system is adjusted.

6. The method according to any one of claims 1 to 5, characterized in that The multiple dimensions include: at least two of: an access source address dimension, an access destination address dimension, an access protocol dimension, an access port dimension, an access account dimension, and an access count dimension.

7. A 4A abnormal detour detection device, characterized in that: The device comprises: A data set acquisition module is used to acquire attribute feature data sets of a target device in multiple dimensions that are associated with the 4A abnormal detour; A clustering result acquisition module is used to perform multiple clustering processes on the attribute feature data sets under the multiple dimensions to obtain multiple clustering results; An attribute label acquisition module is used to perform secondary clustering processing on the multiple clustering results to obtain attribute label values ​​of the attribute feature data set under each dimension; A detection result acquisition module is used to call a pre-trained anomaly detection model to process the attribute label value and predict a 4A anomaly detour detection result corresponding to the target device; Wherein, the clustering result acquisition module includes: A first result acquisition unit, configured to perform clustering processing on the attribute feature data sets under the multiple dimensions to obtain a first clustering result; a second result obtaining unit, configured to perform clustering processing on the attribute feature datasets under the multiple dimensions after each lack of an attribute feature dataset of a different dimension, to obtain second clustering results; the number of the second clustering results is the same as the number of the multiple dimensions; A clustering result obtaining unit is configured to use the first clustering result and the second clustering result as the multiple clustering results.

8. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the 4A abnormal detour detection method according to any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium, characterized in that When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the 4A abnormal detour detection method according to any one of claims 1 to 6.

Images