Method and apparatus for analyzing traversal page behavior based on dynamic data source

Abstract

The embodiment discloses a method and device for analyzing traversal page behavior based on dynamic data sources. The method comprises: obtaining traffic log data of a user in a target time period; performing offline analysis on the traffic log data to obtain target data; wherein the target data comprises a plurality of characteristic data for indicating the user's traversal page behavior; calculating the latest characteristic value of the user's traversal page behavior corresponding to each characteristic data respectively; establishing a characteristic baseline according to the historical characteristic value of each characteristic data; and obtaining an analysis result of the user's traversal page behavior based on the comparison result of the latest characteristic value and the characteristic baseline. The method can realize the comparison and determination of individual behavior and group behavior, improve the rationality and credibility of the security analysis of the user's traversal page behavior, intelligently identify and dynamically monitor abnormal traversal page behavior, and protect network information security.

Description

Technical Field

[0001] This disclosure relates to the field of big data information security technology, and in particular to a method and apparatus for analyzing page traversal behavior based on dynamic data sources. Background Technology

[0002] In the field of information security technology, internal information system users exhibit varying degrees of abnormal access and malicious collection and crawling (page traversal) behaviors on information system pages in order to obtain a large amount of classified data. During the process of information system users accessing information system pages, a series of data exchange traces are formed by the information system users' access to information system resources.

[0003] In related technologies, the rationality and credibility of security analysis of users' access actions (page traversal behavior) in order to ensure information security and prevent internal security threats are poor, and abnormal page traversal behavior cannot be identified and dynamically monitored in a timely manner. Summary of the Invention

[0004] In view of this, the present disclosure provides a method and apparatus for analyzing page traversal behavior based on dynamic data sources, which improves the rationality and credibility of security analysis of user page traversal behavior, can intelligently identify and dynamically monitor abnormal page traversal behavior, and ensure network information security.

[0005] In a first aspect, embodiments of this disclosure provide a method for analyzing page traversal behavior based on dynamic data sources, employing the following technical solution:

[0006] Obtain user traffic log data within the target time period;

[0007] Offline analysis is performed on the traffic log data to obtain target data; wherein, the target data includes several types of feature data used to indicate user page traversal behavior;

[0008] Calculate the latest feature value of the user's page traversal behavior corresponding to each type of feature data;

[0009] Establish a feature baseline based on the historical feature values ​​of each type of feature data obtained;

[0010] Based on the comparison results between the latest feature value and the feature baseline, the analysis results of user page traversal behavior are obtained.

[0011] In some embodiments, a feature baseline is established based on the historical feature values ​​of each acquired feature data, including:

[0012] The mean and standard deviation of each historical feature value are calculated using the following formula to obtain the feature baseline:

[0013]

[0014] In the formula, M represents the average value; n represents the number of historical feature values; and x1, x2, x3...xn represent the historical feature values.

[0015] σ=sqrt(((x1-M)^2+(x2-M)^2+...(xn-M)^2) / n);

[0016] In the formula, σ represents the standard deviation; sqrt represents the square root calculation function.

[0017] In some embodiments, offline analysis of the traffic log data to obtain target data includes at least:

[0018] The access frequency is obtained by calculating the ratio of the total number of access requests to the effective access duration in the traffic log data.

[0019] The invalid access frequency is obtained by calculating the ratio of the number of invalid requests in the traffic log data to the total number of access requests.

[0020] The resource purity is obtained by calculating the ratio of the number of accesses to non-static resources in the traffic log data to the total number of access requests.

[0021] In some embodiments, the method further includes:

[0022] The access sequence consisting of a series of HTTP requests generated when a user operates a business function in an information system or calls a service interface is divided into different conceptual abstraction levels.

[0023] Extract the functional sequence from the conceptual abstraction level;

[0024] Calculate the duration of the functional sequence;

[0025] Calculate the total duration of all the functional sequences within the target time period to obtain the effective access duration;

[0026] The conceptual abstraction hierarchy includes: a business concept-level sequence at the upper level, a system module-level sequence at the middle level, and a communication technology-level sequence at the lower level; the functional sequence represents the business concept-level sequence.

[0027] In some embodiments, extracting the functional sequence from the conceptual abstraction level includes:

[0028] Obtain several request URLs and access times;

[0029] Sort the obtained request URLs and access times;

[0030] Based on the preset session duration, the total duration of several access times is divided starting from the first access request to obtain several sets of function sequences;

[0031] The data of each group of functional sequences is divided into several groups of operation sequences according to a preset operation time.

[0032] In some embodiments, calculating the duration of the functional sequence includes:

[0033] Calculate the time difference between the first and last access requests of each group of operation sequences to obtain the operation sequence duration of each group of operation sequences;

[0034] The duration of a function sequence is obtained by summing the durations of all operation sequences in each group of function sequences.

[0035] In some embodiments, based on the comparison result between the latest feature value and the feature baseline, the analysis result of user page traversal behavior is obtained, including:

[0036] If the difference between the latest feature value and the feature baseline is less than a preset threshold, the feature value is determined to be normal, and an analysis result showing that the user's page traversal behavior is normal is output.

[0037] If the difference between the latest feature value and the feature baseline is greater than or equal to a preset threshold, the feature value is determined to be abnormal, the analysis result of abnormal user page traversal behavior is output, and an alarm message is issued.

[0038] Secondly, this disclosure also provides an apparatus for analyzing page traversal behavior based on dynamic data sources, employing the following technical solution:

[0039] The acquisition unit is configured to acquire user traffic log data within a target time period;

[0040] The analysis unit is configured to perform offline analysis on the traffic log data to obtain target data; wherein the target data includes several types of feature data used to indicate user page traversal behavior;

[0041] The calculation unit is configured to calculate the latest feature value of the user's page traversal behavior corresponding to each type of feature data;

[0042] The establishment unit is configured to establish a feature baseline based on the historical feature values ​​of each type of feature data acquired;

[0043] The comparison unit is configured to obtain the analysis results of the user's page traversal behavior based on the comparison results between the latest feature value and the feature baseline.

[0044] Thirdly, this disclosure also provides an electronic device that adopts the following technical solution:

[0045] The electronic device includes:

[0046] At least one processor; and,

[0047] A memory communicatively connected to the at least one processor; wherein,

[0048] The memory stores instructions that can be executed by the at least one processor, which enable the at least one processor to perform any of the above-described methods for analyzing page traversal behavior based on dynamic data sources.

[0049] Fourthly, embodiments of this disclosure also provide a computer-readable storage medium storing computer instructions for causing a computer to perform any of the methods described above for analyzing page traversal behavior based on dynamic data sources.

[0050] This disclosure provides a method for analyzing page traversal behavior based on dynamic data sources. It utilizes characteristic data of page traversal behavior, combined with the structural characteristics of server-side traffic log data, and employs offline analysis technology based on dynamic data sources to calculate the latest characteristic values ​​of the characteristic data. It also establishes a characteristic baseline for normal sequences and compares the latest characteristic values ​​with the latest characteristic baseline to compare and determine individual and group user behavior. This improves the rationality and reliability of security analysis of user page traversal behavior, and can intelligently identify and dynamically monitor abnormal page traversal behavior, thus ensuring network information security.

[0051] The above description is merely an overview of the technical solution disclosed herein. In order to better understand the technical means of this disclosure and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this disclosure more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0052] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0053] Figure 1 A flowchart illustrating a method for analyzing page traversal behavior based on dynamic data sources, provided in an embodiment of this disclosure;

[0054] Figure 2A schematic diagram illustrating the division of conceptual abstraction levels provided for embodiments of this disclosure;

[0055] Figure 3 A schematic diagram of the structure of an apparatus for analyzing page traversal behavior based on dynamic data sources, provided in an embodiment of this disclosure;

[0056] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure. Detailed Implementation

[0057] The embodiments of this disclosure will now be described in detail with reference to the accompanying drawings.

[0058] It should be understood that the following specific examples illustrate the implementation of this disclosure, and those skilled in the art can easily understand other advantages and effects of this disclosure from the content disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of this disclosure, and not all of them. This disclosure can also be implemented or applied through other different specific implementation methods, and the details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this disclosure. It should be noted that, in the absence of conflict, the following embodiments and features in the embodiments can be combined with each other. Based on the embodiments in this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0059] It should be noted that various aspects of embodiments within the scope of the appended claims are described below. It will be apparent that the aspects described herein can be embodied in a wide variety of forms, and any particular structure and / or function described herein is merely illustrative. Based on this disclosure, those skilled in the art will understand that one aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects set forth herein can be used to implement the device and / or practice the method. Additionally, this device and / or method can be implemented using structures and / or functionalities other than one or more of the aspects set forth herein.

[0060] It should also be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of this disclosure. The drawings only show the components related to this disclosure and are not drawn according to the number, shape and size of the components in actual implementation. In actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0061] Furthermore, specific details are provided in the following description to facilitate a thorough understanding of the examples. However, those skilled in the art will understand that the described aspects can be practiced without these specific details.

[0062] Figure 1 This is a flowchart illustrating a method for analyzing page traversal behavior based on a dynamic data source, as provided in this embodiment of the disclosure. The method includes the following steps:

[0063] S101. Obtain user traffic log data within the target time period.

[0064] Optionally, based on the timer configuration information, the server-side traffic log data from the last data analysis time to the current time can be retrieved from the entire network database at regular intervals. The timer supports manual maintenance and can be configured for nearly half an hour, an hour, or a day to obtain traffic log data for the configured time period for analysis.

[0065] S102. Perform offline analysis on the traffic log data to obtain target data; the target data includes several types of feature data used to indicate user behavior when traversing pages.

[0066] For example, characteristic data may include: access frequency, invalid access efficiency, resource purity, etc. From massive traffic log data, characteristic data matching the criteria is extracted using big data algorithms, and a dynamically updated characteristic baseline is established to quantify and standardize group behavior; this provides a basis for comparison and reference for individual or random behavior, enabling the identification and dynamic monitoring of page traversal behavior.

[0067] S103. Calculate the latest feature value of the user's page traversal behavior corresponding to each feature data.

[0068] S104. Establish a feature baseline based on the historical feature values ​​of each feature data obtained.

[0069] S105. Based on the comparison results between the latest feature values ​​and the feature baseline, obtain the analysis results of user page traversal behavior.

[0070] Optionally, this embodiment of the disclosure, taking into account the structural characteristics of server-side traffic log data, employs offline analysis technology to calculate the latest feature values ​​of the above three types of feature data, establishes a feature baseline for the normal sequence, and compares the latest feature values ​​with the latest feature baseline to achieve comparative judgment of individual user behavior and group behavior. This embodiment of the disclosure, by dynamically updating the feature baseline, can further ensure the rationality and reliability of the analysis results of user page traversal behavior.

[0071] This disclosure applies to information security auditing and related business application systems. It utilizes big data analytics to perform frequent mining and correlation analysis on the massive and complex server-side traffic log data, establishing feature baselines to monitor abnormal user page traversal behavior. This enables timely detection of abnormal user resource access behavior, improving the system's ability to identify and monitor abnormal user behavior and further enhancing the system's security and reliability.

[0072] This disclosure provides a method for analyzing page traversal behavior based on dynamic data sources. It utilizes characteristic data of page traversal behavior, combined with the structural characteristics of server-side traffic log data, and employs offline analysis technology based on dynamic data sources to calculate the latest characteristic values ​​of the characteristic data. It also establishes a characteristic baseline for normal sequences and compares the latest characteristic values ​​with the latest characteristic baseline to compare and determine individual and group user behavior. This improves the rationality and reliability of security analysis of user page traversal behavior, intelligently identifies and dynamically monitors abnormal page traversal behavior, reduces the risk of leaking large amounts of confidential data due to malicious users within the network collecting and crawling information system pages, and safeguards network information security.

[0073] In some embodiments, a feature baseline is established based on the historical feature values ​​of each acquired feature data, including:

[0074] The mean and standard deviation of each historical feature value are calculated using the following formula to obtain the feature baseline:

[0075]

[0076] In the formula, M represents the average value; n represents the number of historical feature values; and x1, x2, x3...xn represent the historical feature values.

[0077] σ=sqrt(((x1-M)^2+(x2-M)^2+...(xn-M)^2) / n);

[0078] In the formula, σ represents the standard deviation; sqrt represents the square root calculation function.

[0079] Optionally, the analysis of page traversal behavior involves comparing and judging individual user behavior and group behavior, thus requiring the establishment of a characteristic baseline for normal sequences of group behavior.

[0080] In some embodiments, offline analysis of traffic log data to obtain target data includes at least:

[0081] The access frequency is obtained by calculating the ratio of the total number of access requests to the effective access duration in the traffic log data.

[0082] Calculate the ratio of invalid requests to total access requests in the traffic log data to obtain the invalid access frequency;

[0083] The resource purity is obtained by calculating the ratio of the number of accesses to non-static resources in the traffic log data to the total number of access requests.

[0084] Optionally, if a user accesses a large number of resources in a short period of time, it will generate high traffic. Therefore, the access frequency is obtained by calculating the ratio of the total number of access requests to the effective access duration in the traffic log data.

[0085] Optionally, crawlers and other machine behaviors may attempt to access potentially existing pages through resource sniffing in order to crawl more data. This will generate a lot of STATUS response status codes such as 404 and 403. Therefore, it is necessary to calculate the ratio of the number of invalid requests to the total number of access requests in the traffic log data to obtain the invalid access frequency.

[0086] In some embodiments, the method further includes:

[0087] The access sequence consisting of a series of HTTP requests generated when a user operates a business function in an information system or calls a service interface is divided into different conceptual abstraction levels.

[0088] Extract the functional sequence from the conceptual abstraction level;

[0089] Calculate the duration of the functional sequence;

[0090] Calculate the total duration of all functional sequences within the target time period to obtain the effective access duration;

[0091] The conceptual abstraction hierarchy includes: a business concept-level sequence at the upper level, a system module-level sequence at the middle level, and a communication technology-level sequence at the lower level; the functional sequence represents the business concept-level sequence.

[0092] Figure 2 This is a schematic diagram illustrating the division of conceptual abstraction levels provided in the embodiments of this disclosure. The upper-level business concept-level sequence includes business processes and links in the business processes; the middle-level system module-level sequence includes functional modules and operation instructions; and the lower-level communication technology-level sequence includes HTTP requests, response lists, network sequences, etc.

[0093] In some embodiments, extracting the functional sequence from the conceptual abstraction level includes:

[0094] Obtain several request URLs and access times;

[0095] Sort the obtained request URLs and access times;

[0096] Based on the preset session duration, the total duration of several access times is divided starting from the first access request to obtain several sets of function sequences;

[0097] The data for each functional sequence is divided into several operation sequences according to the preset operation time.

[0098] Optionally, a function sequence consists of multiple user operation sequences. Each operation sequence is composed of request URLs for that group of operations. An operation time (e.g., 3 seconds) can be defined. A group of URL requests within the same operation time is defined as an operation sequence, and a group of operation sequences within the same session time (e.g., 10 minutes) is a function sequence. Thus, we divide the request URLs into multiple operation sequences according to the operation time (e.g., 3 seconds), and then divide the operation sequences into function sequences according to the session time.

[0099] In some embodiments, calculating the duration of a function sequence includes:

[0100] Calculate the time difference between the first and last access requests in each operation sequence to obtain the operation sequence duration for each operation sequence.

[0101] Calculate the sum of the operation sequence durations of all operation sequences in each group of function sequences to obtain the duration of the function sequence.

[0102] Optionally, the duration of an operation sequence can be expressed as S(o) = tn - t0, where tn represents the last access request of each operation sequence and t0 represents the first access request of each operation sequence; the duration of a function sequence can be expressed as S(f) = S(o)1 + S(o)2 + S(o)3 + ... + S(o)n; and the effective access duration can be expressed as S(total) = S(f)1 + S(f)2 + S(f)3 + ... + S(f)n.

[0103] In some embodiments, based on the comparison results between the latest feature values ​​and the feature baseline, the analysis results of user page traversal behavior are obtained, including:

[0104] If the difference between the latest feature value and the feature baseline is less than a preset threshold, the feature value is determined to be normal, and the analysis result of normal user page traversal behavior is output.

[0105] If the difference between the latest feature value and the feature baseline is greater than or equal to a preset threshold, the feature value is determined to be abnormal. The analysis results of abnormal user page traversal behavior are output, and an alarm message is issued.

[0106] It should be noted that the preset threshold is used to represent the difference benchmark between the latest feature value and the feature baseline, and can be set according to actual business needs. This disclosure does not limit this.

[0107] Figure 3 This is a schematic diagram of a device for analyzing page traversal behavior based on a dynamic data source, provided in an embodiment of this disclosure. The device includes:

[0108] Acquisition unit 31 is configured to acquire user traffic log data within a target time period;

[0109] Analysis unit 32 is configured to perform offline analysis on traffic log data to obtain target data; wherein, the target data includes several types of feature data used to indicate user behavior when traversing pages;

[0110] The calculation unit 33 is configured to calculate the latest feature value of the user's page traversal behavior corresponding to each type of feature data;

[0111] Establishment unit 34 is configured to establish a feature baseline based on the historical feature values ​​of each type of feature data acquired;

[0112] The comparison unit 35 is configured to obtain the analysis results of the user's page traversal behavior based on the comparison results of the latest feature values ​​and the feature baseline.

[0113] An electronic device according to embodiments of the present disclosure includes a memory and a processor. The memory is used to store non-transitory computer-readable instructions. Specifically, the memory may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may, for example, include random access memory (RAM) and / or cache memory. The non-volatile memory may, for example, include read-only memory (ROM), a hard disk, flash memory, etc.

[0114] The processor may be a central processing unit (CPU) or other form of processing unit with data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device to perform desired functions. In one embodiment of this disclosure, the processor is used to execute computer-readable instructions stored in the memory, causing the electronic device to perform all or part of the steps of the methods for analyzing page traversal behavior based on dynamic data sources in the foregoing embodiments of this disclosure.

[0115] Those skilled in the art will understand that, in order to solve the technical problem of how to achieve a good user experience, this embodiment may also include well-known structures such as communication buses and interfaces, and these well-known structures should also be included within the protection scope of this disclosure.

[0116] like Figure 4This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure. It illustrates a structural schematic diagram suitable for implementing the electronic device in the embodiment of the present disclosure. Figure 4 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0117] like Figure 4 As shown, an electronic device may include a processing unit (such as a central processing unit, graphics processing unit, etc.) that can perform various appropriate actions and processes based on a program stored in read-only memory (ROM) or a program loaded from a storage device into random access memory (RAM). The RAM also stores various programs and data required for the operation of the electronic device. The processing unit, ROM, and RAM are interconnected via a bus. Input / output (I / O) interfaces are also connected to the bus.

[0118] Typically, the following devices can be connected to the I / O interface: input devices, such as sensors or visual information acquisition devices; output devices, such as displays; storage devices, such as magnetic tapes or hard drives; and communication devices. Communication devices allow electronic devices to communicate wirelessly or wiredly with other devices (such as edge computing devices) to exchange data. Although Figure 4 Electronic devices with various devices are shown, but it should be understood that it is not required to implement or have all of the devices shown. More or fewer devices may be implemented or have alternatively.

[0119] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device, or installed from a ROM. When the computer program is executed by a processing device, all or part of the steps of the method for analyzing page traversal behavior based on dynamic data sources according to embodiments of this disclosure are performed.

[0120] For a detailed description of this embodiment, please refer to the corresponding descriptions in the foregoing embodiments, which will not be repeated here.

[0121] A computer-readable storage medium according to embodiments of the present disclosure stores non-transitory computer-readable instructions. When these non-transitory computer-readable instructions are executed by a processor, all or part of the steps of the methods for analyzing page traversal behavior based on dynamic data sources according to the foregoing embodiments of the present disclosure are performed.

[0122] The aforementioned computer-readable storage media include, but are not limited to: optical storage media (e.g., CD-ROM and DVD), magneto-optical storage media (e.g., MO), magnetic storage media (e.g., magnetic tape or portable hard drive), media with built-in rewritable non-volatile memory (e.g., memory card), and media with built-in ROM (e.g., ROM cartridge).

[0123] For a detailed description of this embodiment, please refer to the corresponding descriptions in the foregoing embodiments, which will not be repeated here.

[0124] The basic principles of this disclosure have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in this disclosure are merely examples and not limitations, and should not be considered as essential features of each embodiment of this disclosure. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the scope of this disclosure to the necessity of employing the aforementioned specific details for implementation.

[0125] In this disclosure, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. The block diagrams of devices, apparatuses, devices, and systems involved in this disclosure are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, devices, and systems can be connected, arranged, and configured in any manner. Words such as "comprising," "including," "having," etc., are open-ended terms meaning "including but not limited to," and are used interchangeably with them. The terms "or" and "and" as used herein refer to the terms "and / or," and are used interchangeably with them unless the context clearly indicates otherwise. The term "such as" as used herein refers to the phrase "such as but not limited to," and is used interchangeably with it.

[0126] Additionally, as used herein, the “or” used in a list of items beginning with “at least one” indicates a separate list, such that a list of, for example, “at least one of A, B, or C” means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word “exemplary” does not imply that the described example is preferred or better than other examples.

[0127] It should also be noted that in the systems and methods of this disclosure, the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered as equivalent solutions to this disclosure.

[0128] Various changes, substitutions, and modifications can be made to the technology described herein without departing from the teachings defined by the appended claims. Furthermore, the scope of the claims of this disclosure is not limited to the specific aspects of the processes, machines, manufactures, events, means, methods, and actions described above. Currently existing or later-developed processes, machines, manufactures, events, means, methods, or actions that perform substantially the same function or achieve substantially the same result as the corresponding aspects described herein can be utilized. Therefore, the appended claims include such processes, machines, manufactures, events, means, methods, or actions within their scope.

[0129] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use this disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of this disclosure. Therefore, this disclosure is not intended to be limited to the aspects shown herein, but rather to be carried out within the widest scope consistent with the principles and novel features disclosed herein.

[0130] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this disclosure to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations therein.

Claims

1. A method for analyzing page traversal behavior based on dynamic data sources, characterized in that, include: Obtain user traffic log data within the target time period; Offline analysis is performed on the traffic log data to obtain target data; wherein, the target data includes several types of feature data used to indicate user page traversal behavior; The feature data includes access frequency; The access frequency is obtained by calculating the ratio of the total number of access requests to the effective access duration in the traffic log data. Among them, the access sequence consisting of continuous HTTP requests generated when a user operates a business function in the information system or calls a service interface is divided into different conceptual abstraction levels; Extract the functional sequence from the conceptual abstraction level; Calculate the duration of the functional sequence; Calculate the total duration of all the functional sequences within the target time period to obtain the effective access duration; The conceptual abstraction hierarchy includes: a business concept-level sequence at the upper level, a system module-level sequence at the middle level, and a communication technology-level sequence at the lower level; the functional sequence represents the business concept-level sequence. Extracting the functional sequence from the conceptual abstraction level includes: Obtain several request URLs and access times; Sort the obtained request URLs and access times; Based on the preset session duration, the total duration of several access times is divided starting from the first access request to obtain several sets of function sequences; The data of each group of functional sequences is divided into several groups of operation sequences according to a preset operation time; Calculating the duration of the functional sequence includes: Calculate the time difference between the first and last access requests of each group of operation sequences to obtain the operation sequence duration of each group of operation sequences; Calculate the sum of the operation sequence durations of all operation sequences in each group of the function sequences to obtain the duration of the function sequence; Calculate the latest feature value of the user's page traversal behavior corresponding to each type of feature data; Establish a feature baseline based on the historical feature values ​​of each type of feature data obtained; Based on the comparison results between the latest feature value and the feature baseline, the analysis results of user page traversal behavior are obtained.

2. The method for analyzing page traversal behavior based on dynamic data sources according to claim 1, characterized in that, Based on the historical feature values ​​of each type of feature data obtained, a feature baseline is established, including: The mean and standard deviation of each historical feature value are calculated using the following formula to obtain the feature baseline: In the formula, M represents the average value; n represents the number of historical feature values; and x1, x2, x3...xn represent the historical feature values. σ=sqrt(((x1-M)^2+(x2-M)^2+...(xn-M)^2) / n); In the formula, σ represents the standard deviation; sqrt represents the square root calculation function.

3. The method for analyzing page traversal behavior based on dynamic data sources according to claim 1, characterized in that, Offline analysis of the traffic log data is performed to obtain target data, including at least: The invalid access frequency is obtained by calculating the ratio of the number of invalid requests in the traffic log data to the total number of access requests. The resource purity is obtained by calculating the ratio of the number of accesses to non-static resources in the traffic log data to the total number of access requests.

4. The method for analyzing page traversal behavior based on dynamic data sources according to claim 1, characterized in that, Based on the comparison results between the latest feature values ​​and the feature baseline, the analysis results of user page traversal behavior are obtained, including: If the difference between the latest feature value and the feature baseline is less than a preset threshold, the feature value is determined to be normal, and an analysis result showing that the user's page traversal behavior is normal is output. If the difference between the latest feature value and the feature baseline is greater than or equal to a preset threshold, the feature value is determined to be abnormal, the analysis result of abnormal user page traversal behavior is output, and an alarm message is issued.

5. A device for analyzing page traversal behavior based on dynamic data sources, characterized in that, include: The acquisition unit is configured to acquire user traffic log data within a target time period; The analysis unit is configured to perform offline analysis on the traffic log data to obtain target data; wherein the target data includes several types of feature data used to indicate user page traversal behavior; The feature data includes access frequency; The access frequency is obtained by calculating the ratio of the total number of access requests to the effective access duration in the traffic log data. Among them, the access sequence consisting of continuous HTTP requests generated when a user operates a business function in the information system or calls a service interface is divided into different conceptual abstraction levels; Extract the functional sequence from the conceptual abstraction level; Calculate the duration of the functional sequence; Calculate the total duration of all the functional sequences within the target time period to obtain the effective access duration; The conceptual abstraction hierarchy includes: a business concept-level sequence at the upper level, a system module-level sequence at the middle level, and a communication technology-level sequence at the lower level; the functional sequence represents the business concept-level sequence. Extracting the functional sequence from the conceptual abstraction level includes: Obtain several request URLs and access times; Sort the obtained request URLs and access times; Based on the preset session duration, the total duration of several access times is divided starting from the first access request to obtain several sets of function sequences; The data of each group of functional sequences is divided into several groups of operation sequences according to a preset operation time; Calculating the duration of the functional sequence includes: Calculate the time difference between the first and last access requests of each group of operation sequences to obtain the operation sequence duration of each group of operation sequences; Calculate the sum of the operation sequence durations of all operation sequences in each group of the function sequences to obtain the duration of the function sequence; The calculation unit is configured to calculate the latest feature value of the user's page traversal behavior corresponding to each type of feature data; The establishment unit is configured to establish a feature baseline based on the historical feature values ​​of each type of feature data acquired; The comparison unit is configured to obtain the analysis results of the user's page traversal behavior based on the comparison results between the latest feature value and the feature baseline.

6. An electronic device, characterized in that, The electronic device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method for analyzing page traversal behavior based on dynamic data sources as described in any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing a computer to perform the method of analyzing page traversal behavior based on dynamic data sources as described in any one of claims 1 to 4.

Images