A method, apparatus and terminal device for user behavior analysis

Abstract

The application discloses a method, device and terminal equipment for user behavior analysis. The method comprises the following steps: obtaining a real-time access behavior operation of a user to obtain a real-time behavior chain of the user; calculating a behavior deviation degree of the user according to the real-time behavior chain of the user and a pre-set reference behavior chain; obtaining a trust degree of the user through the behavior deviation degree of the user and at least one target parameter associated with the access behavior; and determining whether to block an access request of the user according to the trust degree of the user in real time, so as to realize accurate analysis on the user behavior.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, apparatus and terminal device for user behavior analysis. Background Technology

[0002] In existing technologies, the focus is typically on analyzing user behavior after a visit, and then providing guidance for the user's next visit based on the analysis results. For example, by collecting and analyzing user access behavior within a specified time period, if allowing a user to access website A results in data leakage from website A during that specified time period, then the user will be prohibited from accessing website A again. However, this approach has a time lag and cannot accurately assess user access requests in a timely manner. Summary of the Invention

[0003] This application provides a method, apparatus, and terminal device for user behavior analysis, which can achieve accurate analysis of user behavior.

[0004] In a first aspect, one embodiment of this application provides a method for user behavior analysis, the method comprising:

[0005] Obtain the user's real-time access behavior operations and the pre-set reference behavior chain corresponding to the user, and generate the user's real-time behavior chain based on the user's real-time access behavior operations;

[0006] The user's behavioral deviation is determined based on the user's real-time behavior chain and the user's reference behavior chain;

[0007] The user's trust level is determined based on the user's behavioral deviation and at least one target parameter associated with the user's access behavior.

[0008] Whether to block a user's access request is determined in real time based on the user's level of trust.

[0009] Compared to existing technologies, this application determines the user's behavioral deviation degree by using the user's real-time behavior chain and reference behavior chain. The user's behavioral deviation degree can map the user's true operation purpose. The user trust degree obtained by combining the user's behavioral deviation degree with the target parameters associated with the access behavior operation can further reflect the user's operation purpose, thereby enabling accurate analysis of user behavior.

[0010] In one possible design, the user's real-time behavior chain includes the duration of this access and the traffic volume of this access, and the user's reference behavior chain includes the reference access duration and the reference access traffic volume.

[0011] The determination of the user's behavioral deviation based on the user's real-time behavior chain and the user's reference behavior chain includes:

[0012] Based on the length of the user's real-time behavior chain, the first calculation result, and the second calculation result, the user's behavior deviation is calculated; wherein, the first calculation result is determined based on the current access duration and the reference access duration, and the second calculation result is determined based on the current access traffic and the reference access traffic.

[0013] This application sets different parameters in the real-time behavior chain and the reference behavior chain, and determines the degree of behavior deviation through different parameters, so that the user's true operation purpose can be mapped according to the user's behavior deviation.

[0014] In one possible design, the first calculation result is determined in the following way:

[0015] Calculate the absolute value of the first difference between the current access duration and the reference access duration;

[0016] The ratio between the absolute value of the first difference and the reference access duration is determined as the first calculation result.

[0017] This application can obtain an accurate first calculation result by calculating the duration of the current visit and the reference visit duration, so that the user's behavior deviation can accurately reflect the user's behavioral operation purpose.

[0018] In one possible design, the second calculation result is determined in the following way:

[0019] Calculate the absolute value of the second difference between the current access traffic and the reference access traffic;

[0020] The ratio between the absolute value of the second difference and the reference access traffic is determined as the second calculation result.

[0021] This application can obtain an accurate second calculation result by calculating the current access traffic and the reference access traffic, so that the user's behavior deviation can accurately reflect the user's behavioral operation purpose.

[0022] In one possible design, the at least one target parameter includes the user's access frequency and the user's access content;

[0023] Determining the user's trust level based on the user's behavioral deviation and at least one target parameter associated with the user's access behavior includes:

[0024] Determine the weight ratio of the behavioral deviation, the access frequency, and the accessed content;

[0025] The user's trust level is calculated based on the behavioral deviation, the access frequency, and the weight ratio of the accessed content.

[0026] This application, by setting multiple target parameters, can accurately determine the level of trust through different associated target parameters, thereby accurately mapping the user's true operational purpose based on the user's level of trust.

[0027] Secondly, one embodiment of this application provides a user behavior analysis apparatus, the apparatus comprising:

[0028] The acquisition module is used to acquire the user's real-time access behavior operations and the pre-set reference behavior chain corresponding to the user, and generate the user's real-time behavior chain based on the user's real-time access behavior operations.

[0029] The first determining module is used to determine the user's behavioral deviation based on the user's real-time behavior chain and the user's reference behavior chain;

[0030] The second determining module is used to determine the user's trust level based on the user's behavioral deviation degree and at least one target parameter associated with the user's access behavior operation;

[0031] The third determining module is used to determine in real time whether to block the user's access request based on the user's level of trust.

[0032] In one possible design, the user's real-time behavior chain includes the duration of this access and the traffic volume of this access, and the user's reference behavior chain includes the reference access duration and the reference access traffic volume.

[0033] The first determining module is specifically used for:

[0034] Based on the length of the user's real-time behavior chain, the first calculation result, and the second calculation result, the user's behavior deviation is calculated; wherein, the first calculation result is determined based on the current access duration and the reference access duration, and the second calculation result is determined based on the current access traffic and the reference access traffic.

[0035] In one possible design, the first calculation result is determined in the following way:

[0036] Calculate the absolute value of the first difference between the current access duration and the reference access duration;

[0037] The ratio between the absolute value of the first difference and the reference access duration is determined as the first calculation result.

[0038] In one possible design, the second calculation result is determined in the following way:

[0039] Calculate the absolute value of the second difference between the current access traffic and the reference access traffic;

[0040] The ratio between the absolute value of the second difference and the reference access traffic is determined as the second calculation result.

[0041] In one possible design, the at least one target parameter includes the user's access frequency and the user's access content;

[0042] The second determining module is specifically used for:

[0043] Determine the weight ratio of the behavioral deviation, the access frequency, and the accessed content;

[0044] The user's trust level is calculated based on the behavioral deviation, the access frequency, and the weight ratio of the accessed content.

[0045] Thirdly, one embodiment of this application provides a terminal device, including:

[0046] Processor and display;

[0047] The display is used to show the user interface;

[0048] The processor is configured to perform any of the methods provided in the first aspect above.

[0049] Fourthly, one embodiment of this application also provides a computer-readable storage medium that, when the instructions in the computer-readable storage medium are executed by a processor of a terminal device, enables the terminal device to perform any of the methods provided in the first aspect above.

[0050] Fifthly, one embodiment of this application provides a computer program product including a computer program / instructions that, when executed by a processor, implement any of the methods provided in the first aspect of this application.

[0051] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0052] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the embodiments of this application will be briefly introduced below. Obviously, the drawings introduced below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0053] Figure 1 This application provides an illustration of an application scenario for a user behavior analysis system.

[0054] Figure 2 A flowchart illustrating a user behavior analysis method provided in an embodiment of this application;

[0055] Figure 3 A schematic diagram of the structure of a user behavior analysis device provided in an embodiment of this application;

[0056] Figure 4 This is a schematic diagram of a terminal device provided in an embodiment of this application. Detailed Implementation

[0057] To enable those skilled in the art to better understand the technical solutions of this application, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.

[0058] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data used can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0059] The following explanations of some terms used in the embodiments of this application are provided to facilitate understanding by those skilled in the art.

[0060] (1) In the embodiments of this application, the term "multiple" refers to two or more, and other quantifiers are similar.

[0061] (2) "And / or" describes the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can represent three cases: A alone, A and B at the same time, and B alone. The character " / " generally indicates that the related objects before and after it are in an "or" relationship.

[0062] (3) A server is a service for terminal devices. The services include determining the degree of deviation of user behavior or the degree of trust of users. A server is a counterpart to the application installed on the terminal device and works in conjunction with the application on the terminal device.

[0063] (4) Terminal devices can refer to both software applications (APPs) and client devices. They have a visual display interface that allows interaction with the user; they correspond to the server and provide local services to the customer. For software applications, except for some applications that only run locally, they are generally installed on ordinary client terminals and need to work in conjunction with the server.

[0064] In existing technologies, the focus is typically on analyzing user behavior after a visit, and then providing guidance for the user's next visit based on the analysis results. For example, by collecting and analyzing user access behavior within a specified time period, if allowing a user to access website A results in data leakage from website A during that specified time period, then the user will be prohibited from accessing website A again. However, this approach has a time lag and cannot accurately assess user access requests in a timely manner.

[0065] Therefore, this application provides a method, apparatus, and terminal device for user behavior analysis. By acquiring real-time access behavior operations of users, a real-time behavior chain of users is obtained. Then, the user's behavior deviation degree is calculated based on the user's real-time behavior chain and a pre-set reference behavior chain. Then, the user's trust degree is obtained through the user's deviation degree and at least one target parameter associated with the access behavior. Finally, based on the user's trust degree, it is determined in real time whether to block the user's access request, thereby achieving accurate analysis of user behavior.

[0066] After introducing the design concept of the embodiments of this application, the following is a brief introduction to the application scenarios to which the technical solutions of the embodiments of this application can be applied. It should be noted that the application scenarios described below are only for illustrating the embodiments of this application and are not intended to limit the scope. In specific implementation, the technical solutions provided by the embodiments of this application can be flexibly applied according to actual needs.

[0067] refer to Figure 1This is a schematic diagram illustrating an application scenario of a user behavior analysis system provided in this application embodiment. The application scenario includes: multiple terminal devices 101 (including terminal device 101-1, terminal device 101-2, ..., terminal device 101-n) and a server 102. The terminal devices 101 and the server 102 are connected via a wireless or wired network. The terminal devices 101 include, but are not limited to, desktop computers, mobile phones, mobile computers, tablets, media players, smart wearable devices, smart TVs, and other electronic devices. The server 102 can be a single server, a server cluster consisting of several servers, or a cloud computing center. The server 102 can be an independent physical server, a server cluster consisting of multiple physical servers, or a distributed system. It can also be a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms.

[0068] Taking the interaction between terminal device 101-1 and server 102 as an example, user 1 sends an access request to server 102 through terminal device 101-1. Server 102 obtains user 1's real-time behavior chain by acquiring user 1's real-time access behavior operations. Then, in server 102, based on user 1's real-time behavior chain and a pre-set reference behavior chain for user 1, it determines user 1's behavior deviation degree. Based on user 1's behavior deviation degree and at least one target parameter associated with user 1's access behavior operations, it determines user 1's trust level. Finally, based on user 1's trust level, it determines in real time whether to block user 1's access request. Simultaneously, the result of whether to block user 1's access request is displayed to user 1 through terminal device 101-1.

[0069] Here, the determination of whether to block a user's access request can also be performed in the terminal device 101-1, or it can be performed partly in the terminal device 101-1 and partly in the server 102. This application does not limit the specific execution method of determining whether to block a user's access request.

[0070] Of course, the methods provided in the embodiments of this application are not limited to... Figure 1 The application scenarios shown can also be used in other possible scenarios, and this application does not impose any limitations. Figure 1 The functions that each device in the application scenario shown can achieve will be described in subsequent method embodiments, and will not be elaborated on here.

[0071] To further illustrate the technical solutions provided in the embodiments of this application, a detailed description is provided below in conjunction with the accompanying drawings and specific implementation methods. Although the embodiments of this application provide method operation steps as shown in the following embodiments or drawings, the method may include more or fewer operation steps based on conventional or non-inventive methods. In steps where there is no logically necessary causal relationship, the execution order of these steps is not limited to the execution order provided in the embodiments of this application.

[0072] The following is combined Figure 1 The application scenarios shown illustrate the technical solutions provided in the embodiments of this application.

[0073] like Figure 2 As shown in the figure, an embodiment of this application discloses a flowchart of a user behavior analysis method, which includes the following steps:

[0074] S201, obtain the user's real-time access behavior operations and the pre-set reference behavior chain corresponding to the user, and generate the user's real-time behavior chain based on the user's real-time access behavior operations.

[0075] For example, it can also obtain user account information, source IP, destination IP, target type of access, and duration of access actions. Suppose third-party developer A accesses the development interface of company B's development system through access action 1-access action 2-access action 3, then a real-time action chain is generated based on these actions. Here, the weights can also be assigned according to the accessed objects of access action 1, access action 2, and access action 3; this is just an example.

[0076] Here, users' access behavior within a specified time period can also be defined as the same real-time behavior chain based on their account information or source IP.

[0077] S202, based on the user's real-time behavior chain and the user's reference behavior chain, determine the user's behavior deviation.

[0078] Optionally, when the user's real-time behavior chain includes the duration and traffic of the current access, and the user's reference behavior chain includes a reference access duration and reference access traffic, the user's behavior deviation is calculated based on the length of the user's real-time behavior chain, a first calculation result, and a second calculation result. The first calculation result is determined based on the current access duration and the reference access duration, and the second calculation result is determined based on the current access traffic and the reference access traffic. This is merely an example illustrating how to calculate the deviation when the real-time behavior chain includes the current access duration and traffic. The calculation method will differ depending on the parameters included in the real-time behavior chain and can be adjusted according to the actual situation.

[0079] Here, the first calculation result can be determined using method one, and the second calculation result can be determined using method two:

[0080] Method 1: Calculate the absolute value of the first difference between the current access duration and the reference access duration, and determine the ratio between the absolute value of the first difference and the reference access duration as the first calculation result.

[0081] Method 2: Calculate the absolute value of the second difference between the current access traffic and the reference access traffic, and determine the ratio between the absolute value of the second difference and the reference access traffic as the second calculation result.

[0082] For example, the deviation is represented by D, and the user's current access behavior is represented by X. i This indicates that the user's reference access behavior is operated using X. i rec The length of the user's real-time behavior chain is represented by N, and the first calculation result is represented by P(T). i The second calculation result is represented by P(L). i The duration of this visit is indicated by T. i The reference access duration is indicated in T. i rec This indicates that the traffic for this access was measured in L. i This indicates that the reference access traffic is represented by L. i rec The deviation D is calculated using Formula 1, and the first calculation result P(T) is calculated using Formula 2. i The second calculation result P(L) is obtained by calculating using the following formula three. i ).

[0083]

[0084]

[0085]

[0086] After determining the user's behavioral deviation, proceed to step S203 to determine the user's trust level based on the user's behavioral deviation and at least one target parameter associated with the user's access behavior operation.

[0087] Optionally, when at least one target parameter includes the user's access frequency and the user's access content, the weight ratio of each of the behavior deviation, access frequency, and access content is first determined, and then the user's trust level is calculated based on the weight ratio of each of the behavior deviation, access frequency, and access content.

[0088] Here, target parameters can also include the user's device environment, recent security incidents involving the user, and system security feedback. Similarly, this is just an example illustrating the method for calculating trust level when the target parameters are the user's access frequency and access content. The method for determining trust level can differ for different target parameters and can be adjusted according to the actual situation.

[0089] S204 determines in real time whether to block a user's access request based on the user's level of trust.

[0090] If it is determined that a user's access request is blocked, the user's access permissions may be reduced or the user's next access request may be denied.

[0091] After determining that a user's access request has been blocked, the user's real-time behavior chain can be defined as an abnormal behavior chain. Then, by comparing the time period in which the abnormal behavior chain of the abnormal user occurs, other behaviors or operations of the same time period, the same behavior, or the same IP address can be compared to ensure that other users accessing the site are not abnormal.

[0092] For example, suppose a third-party developer, C, using a new device environment, repeatedly requests authentication through node M, attempting to access Company B's development system. Based on C's device environment and abnormal behavior, C is marked as an abnormal user, and C's access permissions are reduced, but C is still allowed to access Company B's development system. After C accesses Company B's development system, when C accesses node N, which is unrelated to the development system, because C has already been marked as an abnormal user, multiple abnormal operations will trigger a trust warning, C's access permissions will be revoked, and the matter will be reported to the superior administrator for handling.

[0093] This application enables timely control of abnormal user access behavior by monitoring user access actions in real time. This application can be applied to zero-trust systems or other security systems.

[0094] refer to Figure 3 This application provides a user behavior analysis apparatus, the apparatus 300 including:

[0095] The acquisition module 301 is used to acquire the user's real-time access behavior operations and the pre-set reference behavior chain corresponding to the user, and generate the user's real-time behavior chain based on the user's real-time access behavior operations.

[0096] The first determining module 302 is used to determine the user's behavioral deviation based on the user's real-time behavioral chain and the user's reference behavioral chain;

[0097] The second determining module 303 is used to determine the user's trust level based on the user's behavioral deviation degree and at least one target parameter associated with the user's access behavior operation;

[0098] The third determining module 304 is used to determine in real time whether to block the user's access request based on the user's level of trust.

[0099] In one possible design, the user's real-time behavior chain includes the duration and traffic of this access, while the user's reference behavior chain includes the reference duration and reference traffic.

[0100] The first determining module 302 is specifically used for:

[0101] The user's behavior deviation is calculated based on the length of the user's real-time behavior chain, the first calculation result, and the second calculation result. The first calculation result is determined based on the duration of the current access and the reference access duration, and the second calculation result is determined based on the traffic of the current access and the reference access traffic.

[0102] In one possible design, the first calculation result is determined in the following way:

[0103] Calculate the absolute value of the first difference between the current access duration and the reference access duration;

[0104] The ratio between the absolute value of the first difference and the reference access duration is determined as the first calculation result.

[0105] In one possible design, the second calculation result is determined in the following way:

[0106] Calculate the absolute value of the second difference between the current access traffic and the reference access traffic;

[0107] The ratio between the absolute value of the second difference and the reference access traffic is determined as the second calculation result.

[0108] In one possible design, at least one target parameter includes the user's access frequency and the content the user accesses;

[0109] The second determining module 303 is specifically used for:

[0110] Determine the weighting of behavioral deviation, access frequency, and access content.

[0111] The user's trust level is calculated based on the weighted proportions of behavioral deviation, access frequency, and accessed content.

[0112] After introducing a user behavior analysis method and related apparatus according to an exemplary embodiment of this application, the following describes a terminal device according to another exemplary embodiment of this application.

[0113] Those skilled in the art will understand that various aspects of this application can be implemented as a system, method, or program product. Therefore, various aspects of this application can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software implementations, collectively referred to herein as a "circuit," "module," or "system."

[0114] In some possible implementations, the terminal device according to this application may include at least one processor and at least one memory. The memory stores program code that, when executed by the processor, causes the processor to perform the steps of the user behavior analysis method according to the various exemplary embodiments of this application described above. For example, the processor may perform steps such as those in the user behavior analysis method.

[0115] The following reference Figure 4 To describe a terminal device 40 according to this embodiment of the present application. Figure 4 The terminal device 40 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0116] like Figure 4 As shown, terminal device 40 is presented in the form of a general-purpose terminal device. The components of terminal device 40 may include, but are not limited to: at least one processor 41, at least one memory 42, and a bus 43 connecting different system components (including memory 42 and processor 41).

[0117] Bus 43 represents one or more of several bus structures, including a memory bus or memory controller, peripheral bus, processor, or a local bus using any of the multiple bus structures.

[0118] The memory 42 may include a readable medium in the form of volatile memory, such as random access memory (RAM) 421 and / or cache memory 422, and may further include read-only memory (ROM) 423.

[0119] The memory 42 may also include a program / utility 425 having a set (at least one) of program modules 424, including but not limited to: an operating system, one or more application programs, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.

[0120] Terminal device 40 can also communicate with one or more external devices 44 (e.g., keyboard, pointing device, etc.), one or more devices that enable a user to interact with terminal device 40, and / or any device that enables terminal device 40 to communicate with one or more other terminal devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 45. Furthermore, terminal device 40 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 46. As shown, network adapter 46 communicates with other modules used in terminal device 40 via bus 43. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with terminal device 40, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0121] In an exemplary embodiment, a computer-readable storage medium including instructions is also provided, such as a memory 42 including instructions, which can be executed by a processor 41 to perform the above-described method. Optionally, the computer-readable storage medium may be a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device, etc.

[0122] In an exemplary embodiment, a computer program product is also provided, including a computer program / instructions that, when executed by a processor 41, implement any of the methods of user behavior analysis provided in this application.

[0123] In an exemplary embodiment, various aspects of the user behavior analysis method provided in this application can also be implemented in the form of a program product, which includes program code. When the program product is run on a computer device, the program code is used to cause the computer device to perform the steps of the user behavior analysis method according to the various exemplary embodiments of this application described above.

[0124] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0125] The program product for unlocking a terminal device according to embodiments of this application can employ a portable compact disc read-only memory (CD-ROM) and include program code, and can run on a terminal device. However, the program product of this application is not limited thereto. In this document, the readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0126] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying readable program code. This propagated data signal may take many forms, including—but not limited to—electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0127] The program code contained on the readable medium may be transmitted using any suitable medium, including—but not limited to—wireless, wired, fiber optic, RF, etc., or any suitable combination thereof.

[0128] Program code for performing the operations of this application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user terminal device, partially on the user device, as a standalone software package, partially on the user terminal device and partially on a remote terminal device, or entirely on a remote terminal device or server. In cases involving remote terminal devices, the remote terminal device can be connected to the user terminal device via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external terminal device (e.g., via the Internet using an Internet service provider).

[0129] It should be noted that although several units or sub-units of the device have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of this application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided and embodied by multiple units.

[0130] Furthermore, although the operations of the method of this application are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0131] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0132] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable terminal device, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0133] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable terminal device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0134] These computer program instructions can also be loaded onto a computer or other programmable terminal device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable device for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0135] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0136] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for user behavior analysis, characterized in that, The method includes: The system acquires the user's real-time access behavior operations and a pre-set reference behavior chain corresponding to the user, and generates the user's real-time behavior chain based on the user's real-time access behavior operations; the user's real-time behavior chain includes the duration of this access and the traffic of this access, and the user's reference behavior chain includes the reference access duration and the reference access traffic. The user's behavioral deviation is determined based on the user's real-time behavior chain and the user's reference behavior chain; The user's trust level is determined based on the user's behavioral deviation and at least one target parameter associated with the user's access behavior. Based on the user's level of trust, determine in real time whether to block the user's access request; If it is determined that the user's access request is blocked, the user's real-time behavior chain is set as an abnormal behavior chain. Based on the time period in which the abnormal behavior chain is located, other behaviors or operations in the same time period or with the same IP address are compared to determine whether there are other abnormal access users.

2. The method according to claim 1, characterized in that, The determination of the user's behavioral deviation based on the user's real-time behavior chain and the user's reference behavior chain includes: Based on the length of the user's real-time behavior chain, the first calculation result, and the second calculation result, the user's behavior deviation is calculated; wherein, the first calculation result is determined based on the current access duration and the reference access duration, and the second calculation result is determined based on the current access traffic and the reference access traffic.

3. The method according to claim 2, characterized in that, The first calculation result is determined in the following manner: Calculate the absolute value of the first difference between the current access duration and the reference access duration; The ratio between the absolute value of the first difference and the reference access duration is determined as the first calculation result.

4. The method according to claim 2 or 3, characterized in that, The second calculation result is determined in the following manner: Calculate the absolute value of the second difference between the current access traffic and the reference access traffic; The ratio between the absolute value of the second difference and the reference access traffic is determined as the second calculation result.

5. The method according to claim 1, characterized in that, The at least one target parameter includes the user's access frequency and the user's access content; Determining the user's trust level based on the user's behavioral deviation and at least one target parameter associated with the user's access behavior includes: Determine the weight ratio of the behavioral deviation, the access frequency, and the accessed content; The user's trust level is calculated based on the behavioral deviation, the access frequency, and the weight ratio of the accessed content.

6. A device for user behavior analysis, characterized in that, The device includes: The acquisition module is used to acquire the user's real-time access behavior operations and the pre-set reference behavior chain corresponding to the user, and generate the user's real-time behavior chain based on the user's real-time access behavior operations; the user's real-time behavior chain includes the duration of this access and the traffic of this access, and the user's reference behavior chain includes the reference access duration and the reference access traffic. The first determining module is used to determine the user's behavioral deviation based on the user's real-time behavior chain and the user's reference behavior chain; The second determining module is used to determine the user's trust level based on the user's behavioral deviation degree and at least one target parameter associated with the user's access behavior operation; The third determining module is used to determine in real time whether to block the user's access request based on the user's level of trust. If it is determined that the user's access request is blocked, the user's real-time behavior chain is set as an abnormal behavior chain. Based on the time period in which the abnormal behavior chain is located, other behaviors or operations in the same time period or with the same IP address are compared to determine whether there are other abnormal access users.

7. The apparatus according to claim 6, characterized in that, The first determining module is specifically used for: Based on the length of the user's real-time behavior chain, the first calculation result, and the second calculation result, the user's behavior deviation is calculated; wherein, the first calculation result is determined based on the current access duration and the reference access duration, and the second calculation result is determined based on the current access traffic and the reference access traffic.

8. The apparatus according to claim 6, characterized in that, The at least one target parameter includes the user's access frequency and the user's access content; The second determining module is specifically used for: Determine the weight ratio of the behavioral deviation, the access frequency, and the accessed content; The user's trust level is calculated based on the behavioral deviation, the access frequency, and the weight ratio of the accessed content.

9. A terminal device, characterized in that, include: Processor and display; The display is used to show the user interface; The processor is configured to perform the method as described in any one of claims 1-5.

10. A computer-readable storage medium, characterized in that, When the instructions in the computer-readable storage medium are executed by the processor of the terminal device, the terminal device is able to perform the method as described in any one of claims 1-5.

Images