An overreach behavior detection method and device, an electronic device, and a storage medium

Abstract

The application relates to the field of network technology security, and in particular to an unauthorized behavior detection method and device, electronic equipment and a storage medium. In the method, a plurality of access behavior information in a preset time period is acquired. According to the plurality of access behavior information, the number of times of accessing a URL by a source IP address is counted. According to the number of times of accessing, a node access relationship graph is established. A community discovery algorithm is used to cluster the nodes in the node access relationship graph, and a plurality of node communities are obtained. According to the URL corresponding to the source IP address, a URL set of each node community is established. According to the number of times of being accessed by the source IP address in the URL set, an unauthorized URL set is determined. When a new access request is received, if the first URL is included in the unauthorized URL set, it is determined that the first source IP address has an unauthorized behavior. The above scheme realizes automatic detection of unauthorized behavior based on the unauthorized URL set, and improves the accuracy of identifying unauthorized behavior.

Description

Technical Field

[0001] This application relates to the field of network technology security, and in particular to a method, apparatus, electronic device, and storage medium for detecting unauthorized behavior. Background Technology

[0002] Unauthorized access is a common vulnerability in World Wide Web (WWW) applications. This vulnerability refers to a flaw in the application's authorization check, which allows attackers to bypass authorization checks after obtaining a low-privilege user account, and then access or manipulate other users or obtain higher privileges to obtain sensitive corporate information.

[0003] Currently, preventing unauthorized user access can be achieved by setting rules for business logic and permissions. However, setting these rules requires staff to possess strong prior knowledge to ensure correct configuration. Furthermore, significant manpower is needed to verify their accuracy. Manually configuring web application access management is also unsuitable for complex systems.

[0004] How to automate the detection of unauthorized behavior and improve its accuracy is a question worth discussing. Summary of the Invention

[0005] This application provides a method, apparatus, electronic device, and storage medium for detecting unauthorized behavior, which can automate the detection of unauthorized behavior and improve the accuracy of detecting unauthorized behavior.

[0006] In a first aspect, embodiments of this application provide a method for detecting unauthorized behavior, comprising: acquiring multiple access behavior information within a preset time period. Each access behavior information includes a correspondence between a source IP address and a URL. Based on the multiple access behavior information, the number of times each source IP address accesses a URL is counted. Based on the number of accesses, a node access relationship graph is established. Each source IP address corresponds one-to-one with a node. Different nodes with access counts greater than or equal to a first threshold have connecting edges. The node access relationship graph is used to represent the association between different source IP addresses. A community detection algorithm is used to cluster the nodes in the node access relationship graph to obtain multiple node communities. Based on the URLs corresponding to the source IP addresses, a URL set is established for each node community, and the URL set includes multiple URLs belonging to the same node community. Based on the number of times the source IP address in the URL set is accessed, an unauthorized URL set is determined, where each URL in the unauthorized URL set corresponds to a source IP address that has engaged in unauthorized behavior. When a new access request is received, if the unauthorized URL set includes a first URL, it is determined that the first source IP address has engaged in unauthorized behavior, and the access request includes the first source IP address and the first URL corresponding to the first source IP address.

[0007] The above method establishes a URL set to determine the association between the node community and the URLs corresponding to the source IP address. This facilitates determining whether a subsequent access request from the source IP address will involve unauthorized behavior based on this association. Furthermore, this application determines a set of unauthorized URLs based on the association between the node community and the URLs corresponding to the source IP address. Upon receiving a new access request, this set of unauthorized URLs can be used to quickly determine whether the first IP address in the access request has engaged in unauthorized behavior. Compared to manually setting business logic rules to check whether the first IP address in an access request has engaged in unauthorized behavior, this method automates the detection of unauthorized behavior, improves the accuracy of unauthorized behavior detection, and enhances the applicability of permission management and allocation in enterprise application systems.

[0008] Optionally, after obtaining multiple access behavior information within a preset time period, the method further includes:

[0009] According to the set data cleaning rules, the access behavior information is cleaned to obtain cleaned data.

[0010] The above method cleans access behavior information according to the set data cleaning rules, thereby eliminating interference and enabling more accurate detection of unauthorized behavior.

[0011] Optionally, according to the set data cleaning rules, the access behavior information is cleaned, and the cleaned data specifically includes:

[0012] Retrieve preset interference type text from the database;

[0013] If there is interfering text in the access behavior information, delete the interfering text to obtain the first information;

[0014] The first piece of information is uniformly encoded into a preset format to obtain cleaned data.

[0015] In the above method, the first information is obtained by deleting interfering text from the access behavior information. Encoding this first information into a preset format results in cleaned data, which eliminates interference from interfering text, standardizes the format, and facilitates more accurate detection of unauthorized behavior.

[0016] Optionally, obtain multiple access behavior information within a preset time period, specifically including:

[0017] Retrieve system access logs within a preset time period. The system access logs include multiple access behavior information.

[0018] The above method can obtain system access logs within a preset time period to acquire multiple access behavior information. Since the preset time period can be set according to the application scenario, the acquired access behavior information is also time-sensitive, which facilitates more accurate detection of unauthorized behavior.

[0019] Optionally, after obtaining the system access logs within a preset time period, the method further includes:

[0020] Compare the system access log with preset exception characters;

[0021] If abnormal characters are found in the system access log, delete the abnormal characters from the system access log.

[0022] And / or, if access failure logs exist in the system access logs, delete the access failure logs, which are determined based on the request parameters.

[0023] The above method, by deleting abnormal characters from the system access log and access failure logs, can eliminate interfering information, making it easier to detect unauthorized behavior more accurately in the future.

[0024] Optionally, the set of URLs that exceed authority can be determined based on the number of times the source IP address in the URL set is accessed. Specifically, this includes:

[0025] When the number of accesses is less than the second threshold, it is determined that the source IP address does not exhibit unauthorized behavior.

[0026] Remove URLs from the URL set whose access count is less than the second threshold corresponding to the source IP address, and obtain the set of unauthorized URLs.

[0027] In the above method, the server can cluster the nodes in the node access relationship graph using a community discovery algorithm to obtain multiple node communities, thus determining the node community to which each source IP belongs. This establishes the correspondence between source IPs and node communities, facilitating the subsequent establishment of the correspondence between user groups (i.e., node communities) and URLs. Based on the set of unauthorized URLs, it can be determined whether the first IP address in the access request exhibits unauthorized behavior.

[0028] Optionally, the above methods also include:

[0029] When the number of times a source IP address is accessed in any URL in the URL set is greater than or equal to the second threshold, it is determined that the source IP address has engaged in unauthorized behavior.

[0030] In the above method, the source IP address exhibiting unauthorized behavior can be identified by comparing the number of times the source IP address is accessed at any URL in the URL set with a second threshold. This facilitates the creation of a set of URLs exhibiting unauthorized behavior. It also facilitates subsequent determination of whether the first IP address in the access request exhibits unauthorized behavior based on this set of URLs.

[0031] Optionally, when a new access request is received, if the first URL is included in the set of URLs that violate privileges, it is determined that the first source IP address has engaged in unauthorized behavior, specifically including:

[0032] When an access request is received, the node community to which the first source IP address belongs is determined based on the first source IP address. The access request includes the first source IP address and the first URL corresponding to the first source IP address.

[0033] Based on the node community to which the first source IP address belongs, determine the set of unauthorized URLs in that node community;

[0034] If the first URL is included in the set of URLs that violate privileges, it is determined that the first source IP address has violated privileges.

[0035] In the above method, upon receiving a new access request, the system detects unauthorized behavior by checking if the set of unauthorized URLs corresponding to the node community to which the first source IP address belongs matches the first URL. Compared to manually setting business logic rules to check for unauthorized behavior by source IP addresses, this method automates the detection of unauthorized behavior, improving the accuracy of identification. It also enhances the applicability of permission management and allocation in enterprise application systems.

[0036] Secondly, embodiments of this application provide an unauthorized behavior detection device, comprising:

[0037] The send / receive module is used to obtain multiple access behavior information within a preset time period. Each access behavior information includes the correspondence between the source IP address and the URL.

[0038] The processing module is used to count the number of times a URL is accessed based on multiple access behavior information;

[0039] The processing module is also used to establish a node access relationship graph based on the number of accesses. The source IP address corresponds one-to-one with the node. There are connecting edges between different nodes whose number of accesses is greater than or equal to the first threshold. The node access relationship graph is used to represent the association between different source IP addresses.

[0040] The processing module is also used to cluster nodes in the node access relationship graph using a community detection algorithm to obtain multiple node communities;

[0041] The processing module is also used to build a set of URLs for each node community based on the URLs corresponding to the source IP addresses. The set of URLs includes multiple URLs belonging to the same node community.

[0042] The processing module is also used to determine the set of unauthorized URLs based on the number of times the source IP address in the URL set is accessed. The source IP address corresponding to each URL in the unauthorized URL set has unauthorized behavior.

[0043] The detection module is used to determine, when a new access request is received, that the first source IP address has engaged in unauthorized behavior if the first URL is included in the set of unauthorized URLs. The access request includes the first source IP address and the first URL corresponding to the first source IP address.

[0044] Thirdly, embodiments of this application also provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the processor implements any of the unauthorized behavior detection methods described in the first aspect above.

[0045] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the unauthorized behavior detection method of the first aspect.

[0046] Fifthly, embodiments of this application also provide a computer program product, including a computer program executed by a processor to implement the unauthorized behavior detection method as described in any of the first aspects above.

[0047] The technical effects of any of the implementation methods in aspects two through five can be found in the technical effects of the corresponding implementation methods in aspect one, and will not be repeated here. Attached Figure Description

[0048] Figure 1 This is a schematic diagram illustrating an application scenario of an unauthorized behavior detection method provided in an embodiment of this application.

[0049] Figure 2 A flowchart of an unauthorized behavior detection method provided in an embodiment of this application;

[0050] Figure 3 A schematic diagram of a node access relationship graph provided in an embodiment of this application;

[0051] Figure 4 A flowchart illustrating an exemplary method for detecting unauthorized behavior provided in this application embodiment;

[0052] Figure 5A schematic diagram of an unauthorized behavior detection device provided in an embodiment of this application;

[0053] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0054] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0055] The application scenarios described in this application are for the purpose of more clearly illustrating the technical solutions of this application, and do not constitute a limitation on the technical solutions provided in this application. Those skilled in the art will understand that with the emergence of new application scenarios, the technical solutions provided in this application are also applicable to similar technical problems. In the description of this application, unless otherwise stated, "multiple" means two or more.

[0056] Currently, unauthorized access is a common vulnerability in global wide area network (WWAN) applications. This vulnerability refers to a flaw in the application's authorization check, which allows attackers to bypass authorization checks after obtaining low-privilege user accounts, and then access or manipulate other users or obtain higher privileges to obtain sensitive corporate information.

[0057] Currently, preventing unauthorized user access can be achieved by setting rules for business logic and permissions. However, this requires staff to possess strong prior knowledge to correctly configure these rules. Furthermore, significant manpower is needed to verify their accuracy. Manually configuring web application permission management is also unsuitable for complex systems.

[0058] To address the aforementioned issues, this application provides a method, apparatus, and electronic device for detecting unauthorized access. For example, it acquires multiple access behavior information within a preset time period. Each access behavior information includes a correspondence between a source IP address and a URL. Based on the multiple access behavior information, it counts the number of times each source IP address accesses a URL. Based on the number of accesses, it establishes a node access relationship graph. Here, each source IP address corresponds one-to-one with a node. Different nodes with access counts greater than or equal to a first threshold have connecting edges. The node access relationship graph represents the association between different source IP addresses. A community detection algorithm is used to cluster the nodes in the node access relationship graph, resulting in multiple node communities. Based on the URLs corresponding to the source IP addresses, it establishes a URL set for each node community, including multiple URLs belonging to the same node community. Based on the number of times the source IP address in the URL set is accessed, it determines an unauthorized URL set, where each URL in the unauthorized URL set corresponds to a source IP address that has engaged in unauthorized access. When a new access request is received, if the unauthorized URL set includes a first URL, it is determined that the first source IP address has engaged in unauthorized access; the access request includes the first source IP address and its corresponding first URL.

[0059] like Figure 1 As shown, this embodiment of the present application illustrates an application scenario of an optional unauthorized behavior detection method, including a server 103 and a terminal 101. The server 103 and the terminal 101 can establish a communicable connection via a network 102 to implement the unauthorized behavior detection method of this application.

[0060] In one possible scenario, server 103 can obtain multiple access behavior information within a preset time period. Each access behavior information includes the mapping between a source IP address and a URL. Based on these multiple access behavior information, the number of times each source IP address accesses a URL is counted. A node access relationship graph is then established based on the access count. Here, each source IP address corresponds one-to-one with a node. Different nodes with access counts greater than or equal to a first threshold have connecting edges. The node access relationship graph represents the association between different source IP addresses. A community detection algorithm is used to cluster the nodes in the node access relationship graph, resulting in multiple node communities. Based on the URLs corresponding to the source IP addresses, a URL set is established for each node community, including multiple URLs belonging to the same node community. Based on the number of times source IP addresses are accessed in the URL set, an unauthorized URL set is determined. Each URL in the unauthorized URL set corresponds to a source IP address that has engaged in unauthorized behavior. When a new access request is received, if the unauthorized URL set includes the first URL, it is determined that the first source IP address has engaged in unauthorized behavior. The access request includes the first source IP address and its corresponding first URL.

[0061] like Figure 2 As shown in the flowchart of an embodiment of this application, an unauthorized behavior detection method may include the following steps.

[0062] S201. Obtain information on multiple access behaviors within a preset time period.

[0063] Each access behavior information includes the mapping between the source Internet Protocol (IP) address and the access interface name (Uniform Resource Locator, URL).

[0064] Optionally, the access behavior information may also include other information such as the access time (timestamp) corresponding to the access behavior information, which is not specifically limited in this application.

[0065] It is understood that the preset time period in the embodiments of this application can be preset by those skilled in the art, and the preset time period can be reasonably set according to specific application scenarios.

[0066] For example, assuming the preset time period is one day, the server can obtain system access logs for that entire day. As another example, assuming the preset time period is 6 hours, the server can obtain system access logs for that entire 6 hours.

[0067] Optionally, to eliminate interference and more accurately detect unauthorized behavior, the server can clean the access behavior information according to the set data cleaning rules after obtaining multiple access behavior information within a preset time period, thus obtaining cleaned data.

[0068] In one optional embodiment, the server can retrieve preset interference type text from the database. If interference type text exists in the access behavior information, it is deleted to obtain first information. The first information is then uniformly encoded into a preset format to obtain cleaned data.

[0069] It is understood that the interference type text and the unified text encoding format in the embodiments of this application can be preset by those skilled in the art, and the interference type text and the unified text encoding format can be reasonably set according to specific application scenarios.

[0070] For example, the preset interference type text can include protocol, IP address, port number, and other similar text. The unified text encoding format can include lowercase font.

[0071] Optionally, embodiments of this application may also obtain system access logs within a preset time period. The system access logs include multiple access behavior information. For example, a probe can be used to obtain the system access logs.

[0072] In one possible scenario, to facilitate subsequent data analysis based on the system access logs, the server can store the aforementioned system access logs in a database.

[0073] After retrieving system access logs for a preset time period, to eliminate interference and more accurately detect unauthorized behavior, the server can compare the system access logs with preset abnormal characters before cleaning the access behavior information according to the set data cleaning rules. If abnormal characters are found in the system access logs, they will be deleted from the logs.

[0074] It is understood that the abnormal characters in the embodiments of this application can be preset by those skilled in the art, and the abnormal characters can be reasonably set according to specific application scenarios.

[0075] In one possible scenario, since the system access log may include access failure logs, the server can also determine the presence of access failure logs in the system access log based on the request parameters to eliminate interference from these logs. If access failure logs are present in the system access log, they can be deleted.

[0076] For example, if the request parameter for a successful access to the system access log is 200, then if the request parameter for the system access log is not 200, the server can determine that the access to the system access log failed.

[0077] S202. Based on multiple access behavior information, count the number of times the source IP address accesses the URL.

[0078] In one optional embodiment, since there is a correspondence between the source IP address and the URL, and the information obtained is from multiple access behaviors within a preset time period, the server can count the number of times the source IP address accesses the URL to determine the number of times the source IP address accesses the URL within the preset time period.

[0079] S203. Based on the number of visits, establish a node access relationship diagram.

[0080] In this system, each source IP address corresponds to a node, and different nodes with access counts greater than or equal to the first threshold have connecting edges. The node access relationship graph is used to represent the association between different source IP addresses.

[0081] In an optional embodiment, since there is a one-to-one correspondence between source IP addresses and nodes, the node access relationship graph includes a node set V = {v i |i=1,2,…,n}, where n is the number of nodes. i For each node.

[0082] The server can count the number of times a source IP address accesses a URL. If the number of times two different nodes access the same URL is greater than or equal to a first threshold, the server can determine that there is a relationship between the two nodes and connect them. That is, there is a connection edge between different nodes whose access counts are both greater than or equal to the first threshold. After the server has determined the number of times all source IP addresses access different URLs and connected all the related nodes, a node access relationship graph can be obtained.

[0083] For example, suppose the node set includes node u and node v. The first threshold is 50. Node u visits URL 1 62 times. Node v visits URL 1 78 times. Therefore, the number of times nodes u and v visit URL 1 both exceed the first threshold. The server can determine that there is a relationship between nodes u and v. The server can connect nodes u and v. Let edge (u,v)∈E, where E is the set of edges. On the server side, the number of visits to different URLs by all source IP addresses in the system access log is determined. After connecting all edges, the node access relationship graph G={V,E} is obtained.

[0084] For example, suppose the node set includes node m and node n. The first threshold is 50. Node m visits URL2 40 times. Node v visits URL2 60 times. Therefore, node m's visits to URL2 exceed the first threshold, while node n's visits to URL2 are less than the first threshold. The server can determine that there is no association between node m and node n. That is, there is no connecting edge between node m and node n in the node access relationship graph.

[0085] For example, suppose the node set includes node a and node b. The first threshold is 50. Node a accesses URL3 35 times. Node b accesses URL3 26 times. Then, the number of times node a accesses URL2 is less than the first threshold. The number of times node b accesses URL2 is less than the first threshold. The server can determine that there is no association between node a and node b. That is, there is no connecting edge between node a and node b in the node access relationship graph.

[0086] like Figure 3 As shown, this application provides a schematic diagram of a node access relationship graph. Figure 3There is an edge connecting node a and node b. There is an edge connecting node b and node c. There is an edge connecting node c and node d. There is an edge connecting node d and node e. There is an edge connecting node d and node g. There is an edge connecting node h and node i. There are no edges connecting node f to any other node.

[0087] The method described above establishes a node access relationship graph based on the number of times a URL is accessed from its source IP address, thus determining the association between different source IP addresses. This facilitates the subsequent creation of a URL set representing the association between node communities and the URLs corresponding to their source IP addresses, based on the number of times a URL is accessed from its source IP address.

[0088] S204. Use a community discovery algorithm to cluster the nodes in the node access relationship graph to obtain multiple node communities.

[0089] Understandably, this application does not impose specific limitations on the community detection algorithm. For example, the Label Propagation Algorithm (LPA) can be used to cluster nodes in the node access graph to obtain multiple node communities. As another example, the Louvain community detection algorithm can be used to cluster nodes in the node access graph to obtain multiple node communities.

[0090] In the above method, the server can cluster nodes in the node access relationship graph using a community discovery algorithm to obtain multiple node communities, thus identifying the node community to which each source IP belongs. This establishes the correspondence between source IPs and node communities, facilitating the subsequent establishment of the correspondence between user groups (i.e., node communities) and URLs. The URL set is then used to determine whether the source IP address exhibits unauthorized behavior.

[0091] S205. Based on the URLs corresponding to the source IP addresses, establish a set of URLs for each node community.

[0092] The URL set includes multiple URLs belonging to the same node community.

[0093] In one alternative embodiment, since there is a correspondence between IP addresses and URLs, the server can, based on the node community to which each source IP address belongs, compile a set of URLs belonging to that node community.

[0094] For example, source IP address 1 corresponds to URL 1. Source IP address 2 corresponds to URL 2. Source IP address 3 corresponds to URL 3. Source IP address 4 corresponds to URL 4. Source IP address 1, source IP address 2, and source IP address 4 all belong to node community 'a'. Therefore, the set of URLs corresponding to node community 'a' includes URL 1, URL 2, and URL 4.

[0095] The above method establishes a correspondence between user groups (node ​​communities) and URLs by clustering nodes in the node access graph to obtain multiple node communities. This facilitates subsequent determination of whether the source IP address has engaged in unauthorized behavior based on the URL set.

[0096] S206. Determine the set of URLs that exceed the privilege limit based on the number of times the source IP address in the URL set is accessed.

[0097] In this set of URLs, each URL corresponds to a source IP address that exhibits unauthorized behavior.

[0098] In one possible scenario, the server can determine the number of times the source IP address corresponding to the node community is accessed for each URL in the URL set. When the number of times the source IP address is accessed for any URL in the URL set is greater than or equal to a second threshold, it is determined that the source IP address has engaged in unauthorized behavior.

[0099] It is understood that the second threshold in the embodiments of this application can be preset by those skilled in the art, and the second threshold can be reasonably set according to specific application scenarios. For example, the second threshold can be 40. Or, for example, the second threshold can be 50.

[0100] In another possible scenario, if the number of times each URL in the URL set accessed by the source IP address corresponding to the node community is less than a second threshold, the server can determine that the source IP address has not engaged in unauthorized behavior. The URLs with access counts less than the second threshold are then removed from the URL set, resulting in the unauthorized URL set. In this set, the source IP address corresponding to each URL exhibits unauthorized behavior.

[0101] The above method establishes a set of URLs that allow unauthorized access, thus defining the association between the node community and the URLs corresponding to the IP addresses exhibiting unauthorized behavior. This facilitates subsequent determination of whether a source IP address's next access behavior is unauthorized, based directly on the set of URLs. Compared to manually setting business logic rules to check for unauthorized behavior by source IP addresses, this method automates the detection of unauthorized behavior, improving the accuracy of identification. It also enhances the applicability of permission management and allocation in enterprise application systems.

[0102] S207. When a new access request is received, if the first URL is included in the set of unauthorized URLs, it is determined that the first source IP address has engaged in unauthorized behavior.

[0103] The access request includes the first source IP address and the first URL corresponding to the first source IP address.

[0104] In one optional embodiment, when a new access request is received, the server can clean the access behavior information included in the access request according to data cleaning rules to obtain cleaned access data. Based on the first source IP address, the server determines the node community to which the first source IP address belongs. The access request includes the first source IP address and its corresponding first URL. The server then determines the set of unauthorized URLs for that node community based on the node community to which the first source IP address belongs. Since each URL in the unauthorized URL set corresponds to a source IP address that exhibits unauthorized behavior, if the first URL is included in the unauthorized URL set, it is determined that the first source IP address exhibits unauthorized behavior.

[0105] In the above method, upon receiving an access request, the system detects unauthorized behavior by checking if the set of unauthorized URLs corresponding to the node community to which the first source IP address belongs matches the first URL. Compared to manually setting business logic rules to check for unauthorized behavior by source IP addresses, this method automates the detection of unauthorized behavior, improving the accuracy of identification. It also enhances the applicability of permission management and allocation in enterprise application systems.

[0106] The following is about Figure 2 Examples are provided for illustration:

[0107] Assuming a preset time period of 10 days, a probe can be used to obtain enterprise system access logs within those 10 days. The log data is then cleaned by comparing the system access logs with preset abnormal characters. If abnormal characters are found in the system access logs, they are deleted. Next, access failure logs are identified in the system access logs based on request parameters. If access failure logs are found, they are deleted. The server can also retrieve text of protocol, IP address, and port number types from the database. If these interfering text types are present in the access behavior information, they are deleted to obtain the first information. This first information is then uniformly encoded into a preset lowercase font format to obtain cleaned data.

[0108] Assume the node set includes nodes u and v. The first threshold is 50. Node u visits URL 1 62 times, and node v visits URL 1 78 times. Therefore, the number of times nodes u and v visit URL 1 both exceed the first threshold. The server can determine that there is a relationship between nodes u and v. The server can connect nodes u and v. Let edge (u,v)∈E, where E is the edge set. On the server side, the number of visits to different URLs by all source IP addresses in the system access log is determined. After connecting all edges, the node access relationship graph G={V,E} is obtained.

[0109] The server can use the Label Propagation Algorithm (LPA) to cluster nodes in the node access graph, resulting in multiple node communities. Then, based on the URLs corresponding to the source IP addresses, a URL set is established for each node community. The server can determine the number of times each URL in the URL set is accessed by the source IP address corresponding to the node community. When the number of times a source IP address is accessed by any URL in the URL set is greater than or equal to a second threshold, the server determines that the source IP address has engaged in unauthorized behavior. If the number of times a source IP address is accessed by any URL in the URL set is less than the second threshold, the server determines that the source IP address has not engaged in unauthorized behavior. URLs with access counts less than the second threshold are deleted from the URL set, resulting in a set of URLs with unauthorized behavior. In this set, the source IP address corresponding to each URL has engaged in unauthorized behavior. When a new access request is received, the server can clean the access behavior information included in the access request according to data cleaning rules, obtaining cleaned access data. Based on the first source IP address, the node community to which the first source IP address belongs is determined. The access request includes the first source IP address and its corresponding first URL. The server then determines the set of unauthorized URLs within the node community to which the first source IP address belongs. Since each URL in the unauthorized URL set corresponds to a source IP address that has engaged in unauthorized behavior, the server determines that the first source IP address has engaged in unauthorized behavior when the first URL is included in the unauthorized URL set.

[0110] Optionally, after determining that the source IP address has engaged in unauthorized behavior, the server can also send an alert to the user. The alert information includes the source IP address where the unauthorized behavior occurred, and the time the unauthorized behavior was detected, etc., which are not specifically limited in this application. This application does not specifically limit the form of the alert information. For example, the alert information can be sent via SMS. Or, for example, the alert information can be sent via email.

[0111] like Figure 4 As shown, this application provides an exemplary flowchart for detecting unauthorized behavior. It includes the following steps:

[0112] S401. Obtain system access logs within a preset time period;

[0113] S402. Compare the system access log with the preset exception characters;

[0114] S403. If abnormal characters are found in the system access log, delete the abnormal characters from the system access log.

[0115] S404. If access failure logs exist in the system access logs, delete the access failure logs.

[0116] S405. Retrieve preset interference type text from the database;

[0117] S406. If there is interfering text in the access behavior information, delete the interfering text to obtain the first information.

[0118] S407. Encode the first information into a preset format to obtain cleaned data;

[0119] S408. Based on multiple access behavior information, count the number of times the source IP address accesses the URL;

[0120] S409. Based on the number of visits, establish a node access relationship diagram;

[0121] S410. Use a community detection algorithm to cluster the nodes in the node access relationship graph to obtain multiple node communities;

[0122] S411. Based on the URL corresponding to the source IP address, establish a URL set for each node community. The URL set includes multiple URLs belonging to the same node community.

[0123] S412. Determine the set of URLs that exceed authority based on the number of times the source IP address in the URL set is accessed;

[0124] S413. When an access request is received, determine the node community to which the first source IP address belongs based on the first source IP address, wherein the access request includes the first source IP address and the first URL corresponding to the first source IP address;

[0125] S414. Determine the set of unauthorized URLs in the node community based on the node community to which the first source IP address belongs;

[0126] S415. If the first URL is included in the set of URLs that exceed the authority, determine that the first source IP address has exceeded the authority.

[0127] Figure 5 This is a schematic diagram of the structure of an unauthorized behavior detection device provided in an embodiment of this application, as shown below. Figure 5 As shown, the device includes: a transceiver module 501, a processing module 502, and a detection module 503.

[0128] The transceiver module 501 is used to obtain multiple access behavior information within a preset time period. Each access behavior information includes the correspondence between the source IP address and the URL.

[0129] Processing module 502 is used to count the number of times the source IP address accesses the URL based on multiple access behavior information;

[0130] The processing module 502 is also used to establish a node access relationship graph based on the number of accesses. The source IP address corresponds one-to-one with the node. There are connecting edges between different nodes whose number of accesses is greater than or equal to the first threshold. The node access relationship graph is used to represent the association between different source IP addresses.

[0131] The processing module 502 is also used to cluster the nodes in the node access relationship graph using a community detection algorithm to obtain multiple node communities;

[0132] The processing module 502 is also used to establish a URL set for each node community based on the URL corresponding to the source IP address. The URL set includes multiple URLs belonging to the same node community.

[0133] The processing module 502 is also used to determine the set of unauthorized URLs based on the number of times the source IP address in the URL set is accessed. The source IP address corresponding to each URL in the set of unauthorized URLs has unauthorized behavior.

[0134] The detection module 503 is also used to determine, when a new access request is received, that the first source IP address has engaged in unauthorized behavior if the first URL is included in the unauthorized URL set. The access request includes the first source IP address and the first URL corresponding to the first source IP address.

[0135] Optionally, after retrieving multiple access behavior information within a preset time period, the processing module 502 is further configured to:

[0136] According to the set data cleaning rules, the access behavior information is cleaned to obtain cleaned data.

[0137] Optionally, according to the set data cleaning rules, the access behavior information is cleaned. When the cleaned data is obtained, the processing module 502 is specifically used for:

[0138] Retrieve preset interference type text from the database;

[0139] If there is interfering text in the access behavior information, delete the interfering text to obtain the first information;

[0140] The first piece of information is uniformly encoded into a preset format to obtain cleaned data.

[0141] Optionally, when obtaining multiple access behavior information within a preset time period, the transceiver module 501 is specifically used for:

[0142] Retrieve system access logs within a preset time period. The system access logs include multiple access behavior information.

[0143] Optionally, after obtaining the system access logs within a preset time period, the processing module 502 is further used for:

[0144] Compare the system access log with preset exception characters;

[0145] If abnormal characters are found in the system access log, delete the abnormal characters from the system access log.

[0146] And / or, if access failure logs exist in the system access logs, delete the access failure logs, which are determined based on the request parameters.

[0147] Optionally, based on the number of times the source IP address in the URL set is accessed, the set of URLs that exceed the authority is determined. Specifically, processing module 502 is used for:

[0148] When the number of accesses is less than the second threshold, it is determined that the source IP address does not exhibit unauthorized behavior.

[0149] Remove URLs from the URL set whose access count is less than the second threshold corresponding to the source IP address, resulting in the unauthorized URL set. Each URL in the unauthorized URL set corresponds to a source IP address that has engaged in unauthorized behavior.

[0150] Optionally, the processing module 502 is also used for:

[0151] When the number of times a source IP address is accessed in any URL in the URL set is greater than or equal to the second threshold, it is determined that the source IP address has engaged in unauthorized behavior.

[0152] Optionally, when a new access request is received, if the first URL is included in the set of unauthorized URLs, and the first source IP address is determined to have engaged in unauthorized behavior, the processing module 502 is further configured to:

[0153] When an access request is received, the node community to which the first source IP address belongs is determined based on the first source IP address. The access request includes the first source IP address and the first URL corresponding to the first source IP address.

[0154] Based on the node community to which the first source IP address belongs, determine the set of unauthorized URLs in that node community;

[0155] The detection module 503 is also used for:

[0156] If the first URL is included in the set of URLs that violate privileges, it is determined that the first source IP address has violated privileges.

[0157] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0158] At least one processor 601 and a memory 602 connected to at least one processor 601. In this embodiment, the specific connection medium between the processor 601 and the memory 602 is not limited. Figure 6 The example shown is the connection between processor 601 and memory 602 via bus 600. Bus 600 is... Figure 6 The connections between other components are indicated by thick lines and are for illustrative purposes only, not as limiting information. The 600 bus can be divided into address bus, data bus, control bus, etc., for ease of representation. Figure 6 The term is represented by a single thick line, but this does not imply that there is only one bus or one type of bus. Alternatively, the processor 601 can also be called a controller; there is no restriction on the name.

[0159] In this embodiment, memory 602 stores instructions executable by at least one processor 601. By executing the instructions stored in memory 602, at least one processor 601 can perform the unauthorized access detection method discussed above. Processor 601 can implement... Figure 6 or Figure 6 The functions of each module in the device shown.

[0160] The processor 601 is the control center of the device. It can connect to various parts of the control device through various interfaces and lines. By running or executing instructions stored in memory 602 and calling data stored in memory 602, the processor can perform various functions and process data, thereby monitoring the device as a whole.

[0161] In one possible design, processor 601 may include one or more processing units. Processor 601 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, driver interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may also not be integrated into processor 601. In some embodiments, processor 601 and memory 602 may be implemented on the same chip; in some embodiments, they may also be implemented on separate chips.

[0162] Processor 601 can be a general-purpose processor, such as a central processing unit (CPU), digital signal processor, application-specific integrated circuit, field-programmable gate array or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the unauthorized behavior detection method disclosed in the embodiments of this application can be directly manifested as execution by a hardware processor, or execution by a combination of hardware and software modules within the processor.

[0163] Memory 602, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory 602 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic storage, magnetic disk, optical disk, etc. Memory 602 can be any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. In the embodiments of this application, memory 602 may also be a circuit or any other device capable of implementing storage functions for storing program instructions and / or data.

[0164] By designing and programming the processor 601, the code corresponding to the unauthorized behavior detection method described in the foregoing embodiments can be embedded into the chip, thereby enabling the chip to execute the code during runtime. Figure 2 The embodiment shown illustrates an unauthorized behavior detection method. How to design and program the processor 601 is a technique well-known to those skilled in the art and will not be described further here.

[0165] It should be noted that the electronic device provided in this application embodiment can implement all the method steps implemented in the above method embodiment and can achieve the same technical effect. Here, the parts that are the same as those in the method embodiment and the beneficial effects will not be described in detail.

[0166] This application also provides a computer-readable storage medium storing computer-executable instructions for causing a computer to execute the unauthorized behavior detection method described in the above embodiments.

[0167] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0168] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the function specified in one or more boxes.

[0169] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0170] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0171] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for detecting unauthorized behavior, characterized in that, The method includes: Obtain multiple access behavior information within a preset time period. Each access behavior information includes the correspondence between the source IP address and the URL. Based on the multiple access behavior information, count the number of times the source IP address accesses the URL; Based on the number of visits, a node access relationship graph is established, in which the source IP address corresponds one-to-one with the node, and there are connecting edges between different nodes whose number of visits is greater than or equal to a first threshold. The node access relationship graph is used to represent the association between different source IP addresses. A community detection algorithm is used to cluster the nodes in the node access relationship graph to obtain multiple node communities. Based on the URL corresponding to the source IP address, establish a URL set for each node community, wherein the URL set includes multiple URLs belonging to the same node community; Based on the number of times the source IP address in the URL set is accessed, an unauthorized URL set is determined, wherein the source IP address corresponding to each URL in the unauthorized URL set has unauthorized behavior; When a new access request is received, if the first URL is included in the set of unauthorized URLs, it is determined that the first source IP address has engaged in unauthorized behavior. The access request includes the first source IP address and the first URL corresponding to the first source IP address.

2. The method according to claim 1, characterized in that, After obtaining multiple access behavior information within a preset time period, the method further includes: The access behavior information is cleaned according to the set data cleaning rules to obtain cleaned data.

3. The method according to claim 2, characterized in that, The process of cleaning the access behavior information according to the set data cleaning rules to obtain cleaned data specifically includes: Retrieve preset interference type text from the database; If the interference type text exists in the access behavior information, delete the interference type text to obtain the first information; The first information is uniformly encoded into a preset format to obtain cleaned data.

4. The method according to claim 1, characterized in that, The acquisition of multiple access behavior information within a preset time period specifically includes: Obtain system access logs within a preset time period, the system access logs including the multiple access behavior information.

5. The method according to claim 4, characterized in that, After obtaining the system access logs within the preset time period, the method further includes: The system access log is compared with preset abnormal characters; If the abnormal character exists in the system access log, delete the abnormal character from the system access log. And / or, if an access failure log exists in the system access log, delete the access failure log, which is determined based on the request parameters.

6. The method according to claim 1, characterized in that, The step of determining the set of URLs that exceed authority based on the number of times the source IP address in the URL set is accessed specifically includes: When the number of accesses is less than the second threshold, it is determined that the source IP address does not exhibit any unauthorized behavior. The URLs corresponding to the source IP addresses whose access counts are less than the second threshold are deleted from the URL set to obtain the unauthorized URL set.

7. The method according to claim 1, characterized in that, The method further includes: When the number of times the source IP address is accessed by any URL in the URL set is greater than or equal to the second threshold, it is determined that the source IP address has engaged in unauthorized behavior.

8. The method according to claim 1, characterized in that, When a new access request is received, if the first URL is included in the set of unauthorized URLs, it is determined that the first source IP address has engaged in unauthorized behavior, specifically including: When an access request is received, the node community to which the first source IP address belongs is determined based on the first source IP address. The access request includes the first source IP address and the first URL corresponding to the first source IP address. Based on the node community to which the first source IP address belongs, determine the set of unauthorized URLs in the node community; If the first URL is included in the set of unauthorized URLs, it is determined that the first source IP address has engaged in unauthorized behavior.

9. A device for detecting unauthorized behavior, characterized in that, include: The send / receive module is used to obtain multiple access behavior information within a preset time period. Each access behavior information includes the correspondence between the source IP address and the URL. The processing module is used to count the number of times the source IP address accesses the URL based on the multiple access behavior information; The processing module is also used to establish a node access relationship graph based on the number of accesses, wherein the source IP address corresponds one-to-one with the node, and there are connecting edges between different nodes whose number of accesses is greater than or equal to a first threshold. The node access relationship graph is used to represent the association between different source IP addresses. The processing module is also used to cluster the nodes in the node access relationship graph using a community detection algorithm to obtain multiple node communities; The processing module is also used to establish a URL set for each node community based on the URL corresponding to the source IP address, wherein the URL set includes multiple URLs belonging to the same node community; The processing module is further configured to determine an unauthorized URL set based on the number of times the source IP address in the URL set is accessed, wherein the source IP address corresponding to each URL in the unauthorized URL set has unauthorized behavior; The detection module is used to determine, when a new access request is received, that a first source IP address has engaged in unauthorized behavior if the first URL is included in the set of unauthorized URLs. The access request includes the first source IP address and the first URL corresponding to the first source IP address.

10. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method as described in any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1 to 8.

12. A computer program product, characterized in that, When the computer program product is invoked by a computer, it causes the computer to perform the steps of the method as described in any one of claims 1 to 8.

Images