Abnormality detection method and device, electronic equipment and storage medium

Abstract

The present disclosure relates to an anomaly detection method and device, electronic equipment and storage medium. The method comprises: in the case where a running detection heartbeat corresponding to a target to-be-detected object is abnormal, obtaining current running feature information of the target to-be-detected object and a current anomaly detection condition of a target application corresponding to the target to-be-detected object, the current anomaly detection condition being obtained by updating a preset anomaly detection condition based on historical running feature information, historical anomaly detection results and historical anomaly reference information; obtaining target feature information of a target detection dimension corresponding to the current anomaly detection condition from the current running feature information; and performing anomaly detection on the target to-be-detected object based on the target feature information and the current anomaly detection condition to obtain an anomaly detection result of the target to-be-detected object. The embodiments of the present disclosure can enhance the robustness of anomaly detection and improve the accuracy and coverage of anomaly detection.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to an anomaly detection method, apparatus, electronic device, and storage medium. Background Technology

[0002] Many game cheat developers often attempt to bypass security detection schemes by killing client-side security processes, disabling security components, or tampering with or forging security data packets. To protect the game's runtime environment, existing heartbeat keep-alive mechanisms typically integrate a heartbeat module into the security client. Through a certain obfuscation mechanism, heartbeat data is combined with other security data and reported to the backend. The backend distribution service extracts the heartbeat-related data and sends it to the heartbeat detection service for heartbeat detection. When the client's heartbeat module is activated, it sends a login message to the backend heartbeat detection service; the backend heartbeat detection service then begins detecting this client (usually identified by a unique account). Next, the client's heartbeat module sends heartbeat packets to the backend heartbeat detection service periodically (e.g., every 10 seconds). Upon receiving this heartbeat packet, the backend considers the client to be working normally until the client sends a logout packet to the heartbeat detection service, at which point the detection stops. If the backend heartbeat detection service does not receive a heartbeat packet for a certain period (e.g., 30 seconds), it considers the client to have engaged in abnormal activity and can kick the client out of the game.

[0003] However, the detection time is generally determined based on experience, the current game mechanics, and historical network conditions. If it's too long, cheating by players during this period may go undetected; if it's too short, the detection will be overly sensitive, leading to numerous false positives during network fluctuations. Therefore, the existing heartbeat-based survival mechanism is easily affected by various factors such as client environment, user network environment, game data reporting mechanisms, and traffic limitations, resulting in low detection coverage, low accuracy, and a high likelihood of false positives. Summary of the Invention

[0004] In view of the above-mentioned technical problems, this disclosure proposes an anomaly detection method, apparatus, electronic device and storage medium.

[0005] According to one aspect of the embodiments of this disclosure, an anomaly detection method is provided, comprising:

[0006] When an abnormality occurs in the running detection heartbeat corresponding to the target object to be detected, the current running feature information of the target object to be detected and the current abnormality detection conditions of the target application corresponding to the target object to be detected are obtained. The current abnormality detection conditions are obtained by updating the preset abnormality detection conditions based on historical running feature information, historical abnormality detection results and historical abnormality reference information. The historical abnormality reference information is used to characterize the accuracy of the historical abnormality detection results. The preset abnormality detection conditions are the abnormality detection conditions of the target detection dimension determined based on the application feature information of the target application.

[0007] Obtain the target feature information corresponding to the target detection dimension from the current running feature information;

[0008] Based on the target feature information and the current anomaly detection conditions, anomaly detection is performed on the target object to be detected, and the anomaly detection result of the target object to be detected is obtained.

[0009] According to another aspect of the embodiments of this disclosure, an anomaly detection device is provided, comprising:

[0010] The first information acquisition module is used to acquire the current running feature information of the target object to be detected and the current anomaly detection conditions of the target application corresponding to the target object to be detected when the running detection heartbeat of the target object to be detected is abnormal. The current anomaly detection conditions are obtained by updating the preset anomaly detection conditions based on historical running feature information, historical anomaly detection results and historical anomaly reference information. The historical anomaly reference information is used to characterize the accuracy of the historical anomaly detection results. The preset anomaly detection conditions are anomaly detection conditions of the target detection dimension determined based on the application feature information of the target application.

[0011] The target feature information acquisition module is used to acquire the target feature information corresponding to the target detection dimension from the currently running feature information;

[0012] An anomaly detection module is used to perform anomaly detection on the target object based on the target feature information and the current anomaly detection conditions, and obtain the anomaly detection result of the target object.

[0013] According to another aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing processor-executable instructions; wherein the processor is configured to execute the instructions to implement the above-described anomaly detection method.

[0014] According to another aspect of the present disclosure, a computer-readable storage medium is provided, which, when the instructions in the storage medium are executed by a processor of an electronic device, enables the electronic device to perform the above-described anomaly detection method.

[0015] The technical solutions provided by the embodiments of this disclosure bring at least the following beneficial effects:

[0016] When an anomaly occurs in the heartbeat of the target object being detected, the current operational feature information of the target object and the current anomaly detection conditions of the target application corresponding to the target object are obtained. The current anomaly detection conditions are obtained by updating the preset anomaly detection conditions based on historical operational feature information, historical anomaly detection results, and historical anomaly reference information, which can realize the dynamic adjustment of the current anomaly detection conditions. The preset anomaly detection conditions are the anomaly detection conditions of the target detection dimension determined based on the application feature information of the target application. Different preset anomaly detection conditions can be generated independently for different applications, which can improve the adaptability of anomaly detection to different applications. Then, the target feature information corresponding to the target detection dimension is obtained from the current operational feature information. Based on the target feature information and the current anomaly detection conditions, anomaly detection is performed on the target object to obtain the anomaly detection result of the target object. This can enhance the robustness of anomaly detection, significantly reduce the number of false positives caused by network jitter and changes in the client environment during the anomaly detection process, and thus greatly improve the accuracy and coverage of anomaly detection.

[0017] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0018] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure, and are not intended to unduly limit this disclosure.

[0019] Figure 1 This is a schematic diagram illustrating an application system according to an exemplary embodiment;

[0020] Figure 2 This is a flowchart illustrating an anomaly detection method according to an exemplary embodiment;

[0021] Figure 3 This is a system framework diagram of an anomaly detection device according to an exemplary embodiment;

[0022] Figure 4 This is a block diagram illustrating an anomaly detection device according to an exemplary embodiment;

[0023] Figure 5 This is a block diagram illustrating an electronic device for anomaly detection of a target object according to an exemplary embodiment;

[0024] Figure 6 This is a block diagram illustrating another electronic device for anomaly detection of a target object according to an exemplary embodiment. Detailed Implementation

[0025] Various exemplary embodiments, features, and aspects of this application will now be described in detail with reference to the accompanying drawings. The same reference numerals in the drawings denote elements that have the same or similar functions. Although various aspects of the embodiments are shown in the drawings, they are not necessarily drawn to scale unless specifically indicated otherwise.

[0026] The term “exemplary” as used herein means “serving as an example, embodiment, or illustration.” Any embodiment illustrated herein as “exemplary” is not necessarily to be construed as superior to or better than other embodiments.

[0027] Furthermore, to better illustrate this application, numerous specific details are provided in the following detailed embodiments. Those skilled in the art should understand that this application can be implemented without certain specific details. In some instances, methods, means, components, and circuits well-known to those skilled in the art have not been described in detail in order to highlight the main points of this application.

[0028] Please see Figure 1 , Figure 1 This is a schematic diagram illustrating an application system according to an exemplary embodiment. The application system can be used in the anomaly detection method of this application. Figure 1 As shown, the application system may include at least server 01 and terminal 02.

[0029] In this embodiment, server 01 can be used to perform anomaly detection on the target object. Specifically, the server can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms.

[0030] In this embodiment, the first terminal 02 can be a user terminal running the target application. The second terminal 03 can be a user terminal of the anomaly detection and maintenance party. The aforementioned user terminal may include physical devices such as smartphones, desktop computers, tablets, laptops, smart speakers, in-vehicle terminals, digital assistants, augmented reality (AR) / virtual reality (VR) devices, and smart wearable devices, and may also include software running on the physical device, such as applications. The operating system running on the aforementioned user terminal in this embodiment may include, but is not limited to, Android, iOS, Linux, and Windows.

[0031] In the embodiments described in this specification, the server 01, the first terminal 02, and the second terminal 03 can be directly or indirectly connected via wired or wireless communication, and this application does not limit this connection.

[0032] It should be noted that the following diagram shows one possible sequence of steps, and it is not strictly necessary to follow this order. Some steps can be executed in parallel without interdependence.

[0033] Specifically, Figure 2 This is a flowchart illustrating an anomaly detection method according to an exemplary embodiment. For example... Figure 2 As shown, this anomaly detection method can be used in electronic devices such as terminals or servers, and specifically includes the following steps:

[0034] In step S201, if the running detection heartbeat corresponding to the target object to be detected is abnormal, the current running characteristic information of the target object to be detected and the current abnormal detection conditions of the target application corresponding to the target object to be detected are obtained.

[0035] In one specific embodiment, the target object to be detected can refer to an object whose cheating operations need to be detected during current operation. The target object to be detected can be a user terminal with the target application installed. The cheating operations mentioned above can include using cheats or similar methods. The target application can refer to the application currently running on the target object to be detected. Optionally, the target application can include a game application or a live streaming application, etc.

[0036] In a specific embodiment, the current running feature information can characterize the running characteristics of the target object at the current moment. The current running feature information can include feature information corresponding to multiple detection dimensions. For example, taking a game application as the target application, the current running feature information can include timeout information, object channel information, and game running information. Specifically, timeout information can characterize the timeout status of the target object, including the current game timeout duration, historical game timeout counts, and the current server-wide timeout ratio. Object channel information can refer to the association information of the security channel corresponding to the target object, including security channel status information, channel anomaly duration, and the current server-wide anomaly status of the game channel. The security channel corresponding to the target object can refer to the logical path between the security client and the corresponding security backend. Game running information can characterize the game state of the target object at the current moment, including login time, login frequency, game anomaly duration, and operation status information; where operation status information can characterize whether the target object is in a normal operation state. It is understood that any feature information in the current running feature information can correspond to a detection dimension.

[0037] In a specific embodiment, the current anomaly detection conditions can be used to detect whether a target object running in the current detection period is engaging in cheating. The current anomaly detection conditions can be obtained by updating preset anomaly detection conditions based on historical running feature information, historical anomaly detection results, and historical anomaly reference information. The current anomaly detection conditions can include conditions corresponding to each detection dimension in the target detection dimension. The target detection dimension can include at least one detection dimension. For example, taking a game application as an example, the target detection dimension can include the game timeout duration and the game anomaly duration. The current anomaly detection conditions can include a first condition corresponding to the game timeout duration and a second condition corresponding to the game anomaly duration; wherein, the first condition can be that the game timeout duration is greater than 5 minutes, and the second condition can be that the game anomaly duration is greater than 10 seconds. The current detection period can refer to the detection period in which the current moment occurs. The detection period can refer to the time between two adjacent update moments. The update moment can refer to the moment when the anomaly detection conditions are updated. It can be understood that the first detection period can be the time between the start of anomaly detection and the first update moment.

[0038] In a specific embodiment, the preset anomaly detection condition can refer to the initial anomaly detection condition. The preset anomaly detection condition can be anomaly detection condition for the target detection dimension determined based on the application feature information of the target application. It is understood that before the first update of the detection conditions, the preset anomaly detection condition can be used to detect whether the object to be detected in the first detection cycle exhibits any cheating operations.

[0039] In one specific embodiment, historical runtime feature information can characterize the runtime features of multiple objects to be detected during detection. The historical runtime feature information may include runtime feature information corresponding to each of the multiple objects to be detected; wherein, the runtime feature information corresponding to each object to be detected includes feature information corresponding to multiple detection dimensions. Multiple objects to be detected may refer to objects that were running the target application and being detected in the previous detection cycle. The previous detection cycle may refer to the detection cycle preceding the current detection cycle.

[0040] In a specific embodiment, historical anomaly detection results can refer to the anomaly detection results obtained from performing anomaly detection on the aforementioned multiple objects to be detected in the previous detection cycle. Historical anomaly detection results can include the anomaly detection results corresponding to each of the aforementioned multiple objects to be detected. The anomaly detection result can include a first detection result or a second detection result; the first detection result can be used to indicate that the object to be detected is a normal object; the second detection result can be used to indicate that the object to be detected is an anomaly object. In practical applications, if an object to be detected is found to be an anomaly object, services to that anomaly object can be immediately suspended.

[0041] In one specific embodiment, historical anomaly reference information can be used to characterize the accuracy of historical anomaly detection results. Historical anomaly reference information may include object types corresponding to multiple objects to be detected. The object type of each object to be detected can characterize whether the object actually engaged in cheating during the current execution of the target application. Object types may include normal object types and abnormal object types; a normal object type object to be detected refers to an object that did not engage in cheating during the current execution of the target application; an abnormal object type object to be detected refers to an object that actually engaged in cheating during the current execution of the target application.

[0042] In a specific embodiment, the running detection heartbeat of the target object can be used to detect whether the current process of the target application is alive during its operation. The first terminal corresponding to the target object can periodically send heartbeat information to the server while running the target application. When the heartbeat detection service on the server receives the heartbeat information, it can determine that the target object is running normally. If the heartbeat detection service does not receive the heartbeat information within a timeout period, it can determine that the running detection heartbeat of the target object is abnormal and can send timeout information of the target object to the policy service. This allows the policy service to obtain the current running characteristic information of the target object and the current abnormality detection conditions of the target application corresponding to the target object from a preset memory on the server. The policy service can then combine the current abnormality detection conditions with the target characteristic information corresponding to the target detection dimension to perform abnormality detection on the target object.

[0043] In a specific embodiment, the above-mentioned preset anomaly detection conditions may be obtained in the following ways:

[0044] Obtain application feature information of the target application;

[0045] Based on the application feature information of the target application, feature analysis is performed on the target application to obtain the preset anomaly detection conditions corresponding to the target application.

[0046] In a specific embodiment, application feature information can characterize the associated features of the target application during its operation. For example, taking a game application as the target application, the application feature information of the target application may include average game duration and average interaction duration. Specifically, the average interaction duration may refer to the interval between the first terminal sending interaction signals to the server; wherein, interaction signals may include mouse click operation signals or keyboard input operation signals, etc.

[0047] In one specific embodiment, application feature information of the target application can be obtained by acquiring the application operation information of the target application and performing feature extraction analysis on the application operation information. For example, taking a game application as an example, the application operation information may include the game duration of multiple game matches or operation information during the game.

[0048] In a specific embodiment, based on the application feature information of the target application, the target detection dimension corresponding to the target application can be determined. Combining the target detection dimension, the preset anomaly detection conditions corresponding to the target application can be determined. For example, taking a game application as the target application, the application feature information of the target application includes the average game duration and the average interaction duration. The average game duration is 30 minutes, and the average interaction duration is 1 second. The target detection dimensions can be determined to include the game timeout duration and the duration of game anomalies. Combining the target detection dimension and the application feature information, any value less than the average game duration is used as a threshold for judging timeout, resulting in the first condition that the game timeout duration is greater than 5 minutes. Similarly, any value less than the average interaction duration is used as a threshold for judging game anomalies, resulting in the second condition that the duration of game anomalies is greater than 10 seconds. Accordingly, the preset anomaly detection conditions can be obtained.

[0049] In the above embodiments, preset anomaly detection conditions for the target detection dimension are determined by using the application feature information of the target application. Different preset anomaly detection conditions can be generated independently for different applications, which can improve the adaptability of anomaly detection to different applications. In addition, anomaly detection through multi-dimensional anomaly detection conditions can improve the accuracy of anomaly detection.

[0050] In one specific embodiment, the above method may further include:

[0051] Under the condition that the detection conditions are updated, the preset anomaly detection conditions, historical operation characteristic information, historical anomaly detection results and historical anomaly reference information are obtained.

[0052] Based on historical operational characteristics, historical anomaly detection results, and historical anomaly reference information, the preset anomaly detection conditions are updated to obtain the current anomaly detection conditions.

[0053] In one specific embodiment, the detection condition update condition can be a condition used to determine that a preset anomaly detection condition needs to be updated. The detection condition update condition can include detecting that the current time is a preset update time or receiving an update request. The preset update time can be set according to actual needs; optionally, the preset update time can be a specific time, such as 8:00 AM on a certain day, or it can be determined according to a preset interval, such as 8:00 AM every day. The update request can be used to request an update to the preset anomaly detection condition; the update request can be triggered and generated by the anomaly detection maintenance party through a second terminal.

[0054] In one specific embodiment, when the detection condition update condition is met, preset anomaly detection conditions, historical operation feature information, historical anomaly detection results, and historical anomaly reference information can be obtained from the server's preset memory.

[0055] In a specific embodiment, the target detection dimension may include multiple detection dimensions, and the preset anomaly detection conditions may include the anomaly detection conditions corresponding to any detection dimension.

[0056] Accordingly, the above-mentioned updating of the preset anomaly detection conditions based on historical operational characteristic information, historical anomaly detection results, and historical anomaly reference information to obtain the current anomaly detection conditions may include:

[0057] Based on historical anomaly detection results and historical anomaly reference information, anomaly detection analysis is performed on multiple objects to be detected to obtain the first detection index.

[0058] From multiple anomaly detection conditions, determine the first anomaly detection condition and the second anomaly detection condition;

[0059] Based on the first anomaly detection condition and the preset step size, multiple candidate anomaly detection conditions for the detection dimension corresponding to the first anomaly detection condition are generated.

[0060] Obtain historical feature information corresponding to the target detection dimension from historical operational feature information;

[0061] Based on each candidate anomaly detection condition, the second anomaly detection condition, and historical feature information, anomaly detection is performed on multiple objects to be detected, and the candidate condition detection result corresponding to each candidate anomaly detection condition is obtained.

[0062] Based on the detection results of the candidate conditions and historical anomaly reference information, anomaly detection analysis is performed on each object to be detected to obtain the second detection index corresponding to each candidate anomaly detection condition.

[0063] Based on the first and second detection indicators, the target detection condition is determined from multiple candidate anomaly detection conditions.

[0064] Based on the target detection condition, update the first anomaly detection condition. Based on the updated first anomaly detection condition, repeat the steps of determining the first anomaly detection condition and the second anomaly detection condition from multiple anomaly detection conditions until the first anomaly detection condition is updated based on the target detection condition, until all multiple anomaly detection conditions have been updated.

[0065] In a specific embodiment, the first detection index can characterize the accuracy and coverage of historical anomaly detection results obtained based on preset anomaly detection conditions (i.e., using the aforementioned preset anomaly detection conditions as detection conditions). The first detection index may include a first accuracy rate and a first coverage rate. The first accuracy rate may refer to the ratio of the number of first abnormal object types detected based on preset anomaly detection conditions (i.e., using the aforementioned preset anomaly detection conditions as detection conditions) to the number of abnormal objects in the previous detection period. The first coverage rate may refer to the ratio of the number of abnormal objects detected in the previous detection period based on preset anomaly detection conditions (i.e., using the aforementioned preset anomaly detection conditions as detection conditions) to the number of second abnormal object types. The number of first abnormal object types may refer to the number of objects of the abnormal object type among multiple abnormal objects corresponding to the previous detection period. The number of abnormal objects may refer to the number of objects detected as abnormal objects.

[0066] In one specific embodiment, based on historical anomaly detection results, the number of abnormal objects in the previous detection period can be determined. Based on historical anomaly detection results and historical anomaly reference information, objects whose anomaly detection result is a second detection result and whose object type is an abnormal object type are found, and correspondingly, the number of first abnormal object types can be obtained. Dividing the number of first abnormal object types by the number of abnormal objects in the previous detection period yields a first accuracy rate. Then, based on historical anomaly reference information, the number of second abnormal object types can be determined. Based on this, dividing the number of abnormal objects in the previous detection period by the number of second abnormal object types yields a first coverage rate.

[0067] In one specific embodiment, the first anomaly detection condition can be any one of the multiple anomaly detection conditions that has not been updated. The second anomaly detection condition can be any other condition among the multiple anomaly detection conditions besides the first anomaly detection condition.

[0068] In one specific embodiment, from multiple anomaly detection conditions, at least one currently unupdated condition can be determined. Then, from the at least one currently unupdated condition, any one anomaly detection condition can be selected as the first anomaly detection condition. Correspondingly, the conditions other than the first anomaly detection condition from the multiple anomaly detection conditions can be selected as the second anomaly detection conditions. Here, the currently unupdated condition can refer to the anomaly detection condition that has not yet been updated among the multiple anomaly detection conditions. Specifically, an anomaly detection condition can be selected as the first anomaly detection condition according to the order of conditions among the at least one currently unupdated condition, or it can be randomly selected as the first anomaly detection condition. In the above embodiment, by randomly selecting any anomaly detection condition as the first anomaly detection condition, errors that may exist due to a fixed update order can be eliminated.

[0069] In a specific embodiment, the preset step size can characterize the interval between condition parameters corresponding to multiple candidate anomaly detection conditions. The preset step size can be set according to actual needs. The preset step size can include the step size corresponding to multiple detection dimensions. Here, the condition parameter can refer to the critical value used to determine whether the condition is met in the anomaly detection condition. For example, for a condition where the match timeout duration is greater than 5 minutes, the condition parameter corresponding to this condition is 5 minutes. The aforementioned step size can refer to the parameter difference between two adjacent condition parameters among multiple candidate anomaly detection conditions corresponding to any detection dimension. For example, taking a game application as the target application, when the detection dimension is match timeout duration, the step size corresponding to the match timeout duration can be 1 minute.

[0070] In a specific embodiment, multiplying the step size corresponding to the detection dimension of the first anomaly detection condition by different factors yields multiple parameter differences. These multiple parameter differences are then sequentially superimposed with the condition parameters in the first anomaly detection condition to obtain multiple target condition parameters. Correspondingly, multiple candidate anomaly detection conditions can be generated based on these target condition parameters. For example, taking a game application as the target application, assuming the first anomaly detection condition is a match timeout duration greater than 5 minutes, the condition parameters for the generated multiple candidate anomaly detection conditions can be 1 minute, 2 minutes, 3 minutes, 4 minutes, 5 minutes, 6 minutes, 7 minutes, ..., 29 minutes and 30 minutes, respectively. Specifically, for different detection dimensions, the threshold range of the condition parameters for the candidate anomaly detection conditions can be preset. Alternatively, the maximum or minimum value of the condition parameters for the multiple candidate anomaly detection conditions can be determined based on historical running characteristic information. For example, the match duration of a draw (i.e., 30 minutes) can be used as the maximum value of the condition parameter, which can reduce the computational load while ensuring analysis accuracy.

[0071] In one specific embodiment, historical feature information can refer to the individual feature information of multiple objects to be detected in the object detection dimension. Historical feature information can include the feature information of each object to be detected in the object detection dimension.

[0072] In a specific embodiment, feature information corresponding to the target detection dimension can be found from historical operational feature information, and the found feature information corresponding to the target detection dimension can be used as historical feature information.

[0073] In one specific embodiment, the detection result corresponding to each candidate anomaly detection condition may include anomaly detection results corresponding to multiple objects to be detected. It is understood that under different candidate anomaly detection conditions, the same object to be detected may correspond to different anomaly detection results.

[0074] In a specific embodiment, historical feature information is matched with each candidate anomaly detection condition to obtain multiple first matching results corresponding to each candidate anomaly detection condition. Each first matching result corresponding to any candidate anomaly detection condition can be a matching result for any object to be detected that matches any candidate anomaly detection condition. Historical feature information is matched with a second anomaly detection condition to obtain multiple second matching results. Each second matching result can be a matching result for any object to be detected that matches a second anomaly detection condition. If both the first matching result and the corresponding second matching result for any candidate anomaly detection condition for any object to be detected indicate that the detection condition is met, the anomaly detection result for the object to be detected corresponding to that candidate anomaly detection condition can be determined as the second detection result. If the first matching result for any candidate anomaly detection condition for any object to be detected indicates that the detection condition is not met, or the corresponding second matching result indicates that the detection condition is not met, the anomaly detection result for the object to be detected corresponding to that candidate anomaly detection condition can be determined as the first detection result.

[0075] In a specific embodiment, the second detection metric can characterize the accuracy and anomaly coverage of the detection results obtained based on each candidate anomaly detection condition and the second anomaly detection condition (i.e., using each candidate anomaly detection condition and the second anomaly detection condition as detection conditions). The second detection metric may include a second accuracy rate and a second coverage rate corresponding to each candidate anomaly detection condition. The second accuracy rate corresponding to each candidate anomaly detection condition can refer to the percentage of the number of first anomaly object types detected relative to the number of anomaly objects in the previous detection period, based on each candidate anomaly detection condition and the second anomaly detection condition (i.e., using each candidate anomaly detection condition and the second anomaly detection condition as detection conditions). The second coverage rate corresponding to each candidate anomaly detection condition can refer to the percentage of the number of anomaly objects detected in the previous detection period relative to the number of second anomaly object types, based on each candidate anomaly detection condition and the second anomaly detection condition (i.e., using each candidate anomaly detection condition and the second anomaly detection condition as detection conditions).

[0076] In a specific embodiment, based on the detection results of each candidate anomaly detection condition, the number of abnormal objects in the previous detection period corresponding to each candidate anomaly detection condition can be determined. Based on the above candidate condition detection results and historical anomaly reference information, objects whose anomaly detection result is the second detection result and whose object type is an abnormal object type are found. Accordingly, the number of first abnormal object types corresponding to each candidate anomaly detection condition can be obtained. Dividing the above number of abnormal objects by the above number of first abnormal object types yields the second accuracy corresponding to each candidate anomaly detection condition. Then, based on the historical anomaly reference information, the number of second abnormal object types can be determined. On this basis, dividing the above number of abnormal objects by the above number of second abnormal object types yields the second coverage corresponding to each candidate anomaly detection condition.

[0077] In one specific embodiment, the target detection condition can be the condition among multiple candidate anomaly detection conditions where the corresponding second detection index is higher than the first detection index, and the difference between the corresponding second detection index and the first detection index is the largest. It can be understood that the target detection condition can be the condition among multiple candidate anomaly detection conditions that can maximize the comprehensive index of anomaly detection; wherein, the aforementioned comprehensive index can characterize the accuracy and coverage of anomaly detection.

[0078] In a specific embodiment, determining the target detection condition from multiple candidate anomaly detection conditions based on the first detection index and the second detection index may include:

[0079] Based on the first detection index, a difference analysis of the second detection index is performed to obtain the difference information of the index corresponding to each candidate anomaly detection condition.

[0080] Based on the information on differences in indicators, the target detection condition is selected from multiple candidate anomaly detection conditions.

[0081] In a specific embodiment, the indicator difference information can characterize the difference between the second detection indicator and the first detection indicator corresponding to each candidate anomaly detection condition.

[0082] In a specific embodiment, the index difference information m corresponding to each candidate anomaly detection condition can be obtained by the following formula:

[0083] m = (a2 - a1) + (b2 - b1)

[0084] Where m represents the difference in indicators corresponding to each candidate anomaly detection condition; a1 represents the first accuracy; a2 represents the second accuracy corresponding to each candidate anomaly detection condition; b1 represents the first coverage; and b2 represents the second coverage corresponding to each candidate anomaly detection condition.

[0085] In a specific embodiment, the index difference information m corresponding to each candidate anomaly detection condition can also be obtained by the following formula:

[0086] m = k1*(a2-a1) + k2*(b2-b1)

[0087] Where m represents the difference in indicators corresponding to each candidate anomaly detection condition; a1 represents the first accuracy; a2 represents the second accuracy corresponding to each candidate anomaly detection condition; b1 represents the first coverage; b2 represents the second coverage corresponding to each candidate anomaly detection condition; and k1 and k2 are weighting coefficients. Specifically, k1 and k2 can be determined based on the importance of accuracy and coverage, and k1 and k2 satisfy k1 + k2 = 1.

[0088] In a specific embodiment, from the indicator difference information corresponding to each candidate anomaly detection condition, indicator difference information with positive direction information can be filtered out. Then, from the positive indicator difference information, the largest indicator difference information is determined. Finally, the candidate anomaly detection condition corresponding to the largest indicator difference information is used as the target detection condition. Here, positive indicator difference information refers to difference information with a positive value; negative indicator difference information refers to difference information with a negative value. It is understood that when the first anomaly detection condition before the update is the optimal detection condition, the detection condition before the update is the same as the detection condition after the update.

[0089] In one specific embodiment, the first anomaly detection condition can be updated by using the target detection condition as the updated first anomaly detection condition. Furthermore, by repeatedly determining the first and second anomaly detection conditions from multiple anomaly detection conditions, and then updating the first anomaly detection condition based on the target detection condition, the anomaly monitoring conditions for multiple detection dimensions in the preset anomaly detection conditions can be updated.

[0090] In the above embodiments, by combining the first detection index and the second detection index, the unupdated anomaly detection conditions are updated sequentially, which can realize the updating of anomaly monitoring conditions in multiple detection dimensions in the preset anomaly detection conditions, thereby improving the accuracy and coverage of anomaly detection.

[0091] In one specific embodiment, the above method may further include:

[0092] If the conditions for updating the detection conditions are met, the current anomaly detection conditions are updated based on the operational characteristic information corresponding to the current detection cycle, the anomaly detection results corresponding to the current detection cycle, and the current anomaly reference information.

[0093] In a specific embodiment, the operational feature information corresponding to the current detection period can refer to the operational feature information of multiple detection objects detected within the current detection period. The abnormal detection result corresponding to the current detection period can refer to the abnormal detection result of multiple detection objects detected within the current detection period. The current abnormal reference information can refer to the abnormal reference information of multiple objects detected within the current detection period.

[0094] In one specific embodiment, when the detection condition update condition is met, the current anomaly detection condition can be updated based on the operational characteristic information of multiple objects detected in the current detection period, the anomaly detection results of multiple objects detected in the current detection period, and the current anomaly reference information. It is understood that after updating the current anomaly detection condition, anomaly detection in the next detection period can be performed using the updated current anomaly detection condition.

[0095] In the above embodiments, the preset anomaly detection conditions of the target application are updated based on historical operation feature information, historical anomaly detection results, and historical anomaly reference information to obtain the current anomaly detection conditions of the target application corresponding to the target object to be detected. Based on the operation feature information corresponding to the current detection period, the anomaly detection results corresponding to the current detection period, and the current anomaly reference information, the current anomaly detection conditions are updated, which can realize the dynamic adjustment of the current anomaly detection conditions, thereby improving the accuracy and coverage of anomaly detection.

[0096] In one specific embodiment, the aforementioned historical anomaly reference information may include the object types corresponding to multiple objects to be detected.

[0097] Accordingly, the aforementioned historical anomaly reference information may be obtained using the following methods:

[0098] If no heartbeat information is received from the historical object to be detected within a preset time, obtain the security channel information and operation status information corresponding to the historical object to be detected.

[0099] Based on the security channel information, the security channel status of historical objects to be detected is analyzed to obtain the security channel status information corresponding to the historical objects to be detected.

[0100] When the security channel status information indicates an abnormal channel status, the object type of the historical objects to be detected is analyzed based on the operation status information to obtain the object type of the historical objects to be detected.

[0101] In one specific embodiment, the historical object to be detected can be any one of a plurality of objects to be detected.

[0102] In one specific embodiment, the heartbeat information of a historical object to be detected can characterize the current state of that object. The heartbeat information of a historical object to be detected may include its heartbeat packets.

[0103] In one specific embodiment, the secure channel information corresponding to the historical object to be detected may include secure channel status change information and channel flow information. The secure channel status change information may include secure channel establishment information, secure channel destruction information, or secure channel reconnection information. The channel flow information can indicate whether the secure channel is congested. The operation status information corresponding to the historical object to be detected can indicate the operation status of the historical object to be detected. The operation status information corresponding to the historical object to be detected may include the interaction operation information of the historical object to be detected.

[0104] In one specific embodiment, when the target application of a historical target is detected to be running, heartbeat detection of the historical target can be initiated. During the heartbeat detection process, if no heartbeat information is received from the historical target within a preset time, the security channel information corresponding to the historical target can be obtained from the security channel of the historical target, and the operation status information corresponding to the historical target can be obtained from the server.

[0105] In one specific embodiment, the security channel status information corresponding to a historical object to be detected can characterize the current status of the security channel of that historical object. The security channel status information can include normal channel status information and abnormal channel status information. Normal channel status information can be used to indicate that the security channel of the historical object to be detected is currently in a normal state. Abnormal channel status information can be used to indicate that the security channel of the historical object to be detected is currently in an abnormal state.

[0106] In one specific embodiment, when the security channel status information indicates normal channel status information, the object type of the historical object to be detected can be determined to be an abnormal object type.

[0107] In one specific embodiment, when the secure channel status information indicates an abnormal channel status, the object type of the historical object to be detected can be determined based on the historical operation status information of the object to be detected. Specifically, if the operation status information indicates that the historical object to be detected is in a normal operation state, the object type of the historical object to be detected can be determined to be an abnormal object type; if the operation status information indicates that the historical object to be detected is in an abnormal operation state, the historical object to be detected can be determined to be in a network abnormal state, and the object type of the historical object to be detected can be determined to be a normal object type.

[0108] In the above embodiments, by combining the security channel information and operation status information of historical objects to be detected, the object type of historical objects to be detected can be determined, which can improve the accuracy of the determination of the object type of historical objects to be detected, and thus improve the accuracy of anomaly detection.

[0109] In one specific embodiment, the method described above for determining the object type of a historical object to be detected by combining its security channel information and operation status information can also be used as an anomaly detection method for the object to be detected. Specifically, when the security channel status information indicates a normal channel status, the anomaly detection result of the object to be detected can be determined as the second detection result; when the security channel status information indicates an abnormal channel status and the operation status information indicates that the historical object to be detected was in a normal operation state, the anomaly detection result of the object to be detected can be determined as the second detection result; and when the security channel status information indicates an abnormal channel status and the operation status information indicates that the historical object to be detected was in an abnormal operation state, the anomaly detection result of the object to be detected can be determined as the first detection result.

[0110] In the above embodiments, by using the security channel information and operation status information of the object to be detected, the current abnormal detection result of the object to be detected can be determined, and rapid detection of the object to be detected can be achieved.

[0111] In step S203, target feature information corresponding to the target detection dimension is obtained from the currently running feature information.

[0112] In a specific embodiment, target feature information may refer to the feature information corresponding to the target detection dimension in the currently running feature information.

[0113] In a specific embodiment, the feature information corresponding to the target detection dimension can be found in the currently running feature information, and the feature information corresponding to the target feature dimension can be used as the target feature information.

[0114] In step S205, based on the target feature information and the current anomaly detection conditions, anomaly detection is performed on the target object to be detected, and the anomaly detection result of the target object to be detected is obtained.

[0115] In one specific embodiment, the anomaly detection result of the target object to be detected can be used to indicate whether the target object to be detected is an abnormal object. The anomaly detection result of the target object to be detected may include a first detection result and a second detection result; the first detection result can be used to indicate that the target object to be detected is a normal object; the second detection result can be used to indicate that the target object to be detected is an abnormal object. If the anomaly detection result of the target object to be detected is the first detection result, services can continue to be provided to the target object to be detected; if the anomaly detection result of the target object to be detected is the second detection result, services can be immediately suspended to the target object to be detected.

[0116] In one specific embodiment, matching the target feature information with the current anomaly detection conditions yields a third matching result. This third matching result can include the matching results corresponding to at least one of the target detection dimensions. If the third matching result indicates that the target feature information meets the current anomaly detection conditions, the anomaly detection result of the target object can be determined as the first detection result. If the third matching result indicates that the target feature information does not meet any of the current anomaly detection conditions, the anomaly detection result of the target object can be determined as the second detection result.

[0117] In one specific embodiment, step S205 above may include:

[0118] Based on the target feature information and the current anomaly detection conditions, the running status of the target object to be detected is analyzed to obtain the running status of the object corresponding to the target object to be detected;

[0119] When the object is in an abnormal running state, obtain the object tag information corresponding to the target object to be detected;

[0120] When the object label information indicates that the target object to be detected belongs to the whitelist, determine the whitelist ratio information corresponding to the target object to be detected;

[0121] If the proportion of whitelist information is greater than or equal to the preset proportion threshold, the abnormal detection result is determined as the first detection result.

[0122] In a specific embodiment, the object running state corresponding to the target object to be detected can characterize the current running state of the target object to be detected. The object running state corresponding to the target object to be detected can include a normal running state and an abnormal running state. It can be understood that, when the analysis of the object running state of the target object to be detected is accurate through the current anomaly detection conditions, when the object type of the target object to be detected is a normal object type, the object running state of the target object to be detected is a normal running state; correspondingly, when the object type of the target object to be detected is an abnormal object type, the object running state of the target object to be detected is an abnormal running state. In the case of an anomaly detection misjudgment, when the object type of the target object to be detected is a normal object type, the object running state of the target object to be detected is an abnormal running state; correspondingly, when the object type of the target object to be detected is an abnormal object type, the object running state of the target object to be detected is a normal running state.

[0123] In one specific embodiment, matching the target feature information with the current anomaly detection conditions yields a third matching result. This third matching result can include the matching results corresponding to at least one of the target detection dimensions. If the third matching result indicates that the target feature information meets the current anomaly detection conditions, the object's running state can be determined to be in a normal running state. If the third matching result indicates that the target feature information does not meet any of the current anomaly detection conditions, the object's running state can be determined to be in an abnormal running state.

[0124] In one specific embodiment, the object tag information corresponding to the target object to be detected can characterize the object tag of the target object to be detected. The object tag of the target object to be detected can be used to characterize the quality of the target object to be detected. The object tag information corresponding to the target object to be detected may include first tag information and second tag information; the first tag information can be used to indicate that the target object to be detected belongs to a whitelist of objects; the second tag information can be used to indicate that the target object to be detected does not belong to a whitelist of objects. Here, a whitelisted object can refer to an object whose quality is considered high.

[0125] In one specific embodiment, the object tag information corresponding to the target object to be detected can be obtained in advance by performing quality analysis on the historical running data of the target application of the target object. Correspondingly, this object tag information can be stored in a preset memory of the server. When the object's running state is abnormal, the object tag information corresponding to the target object to be detected can be retrieved from the aforementioned preset memory.

[0126] In one specific embodiment, the whitelist ratio information can characterize the ratio of the current number of whitelist anomalies to the current cumulative number of anomalies in the current detection period.

[0127] In a specific embodiment, when the object tag information indicates that the target object to be detected belongs to the whitelist, the current number of whitelist anomalies and the current cumulative number of anomalies are determined. Dividing the current number of whitelist anomalies by the current cumulative number of anomalies yields the whitelist ratio information. The current number of whitelist anomalies can refer to the number of whitelist objects identified as anomalies within the current detection period and prior to the current moment. The current cumulative number of anomalies can refer to the cumulative number of objects with abnormal operating states within the current detection period and prior to the current moment.

[0128] In a specific embodiment, if the object tag information indicates that the target object to be detected does not belong to the whitelist, the abnormal detection result of the target object to be detected can be determined as the second detection result.

[0129] In one specific embodiment, if the proportion of the whitelist information corresponding to the target object to be detected is greater than or equal to a preset proportion threshold, the abnormal detection result of the target object to be detected can be determined as the first detection result; if the proportion of the whitelist information corresponding to the target object to be detected is less than the preset proportion threshold, the abnormal detection result of the target object to be detected can be determined as the second detection result. Specifically, the preset proportion threshold can be set according to actual needs.

[0130] In the above embodiments, when the object's running state is abnormal, the abnormal detection result of the target object to be detected can be determined by combining the object tag information corresponding to the target object to be detected. This can achieve the filtering of the second detection result, avoid the situation where some data has too much influence on the abnormal detection during the dynamic adjustment of the current abnormal detection conditions, resulting in a large number of false judgments, ensure the user experience of whitelisted objects, ensure the accuracy of abnormal detection, and improve the fault tolerance of abnormal detection.

[0131] In one specific embodiment, step S205 may further include:

[0132] If the proportion of whitelisted objects is less than a preset threshold, update the cumulative number of abnormal objects.

[0133] If the cumulative number of abnormal objects is greater than or equal to the first preset threshold, the abnormal detection result is determined as the first detection result.

[0134] In one specific embodiment, the cumulative number of abnormal objects may refer to the number of objects whose services have been suspended during the current detection period and before the current moment.

[0135] In one specific embodiment, if the whitelist ratio information is less than a preset ratio threshold, the cumulative number of abnormal objects before the update can be increased by 1 to obtain the updated cumulative number of abnormal objects.

[0136] In one specific embodiment, if the updated cumulative number of abnormal objects is greater than or equal to a first preset threshold, the abnormal detection result of the target object to be detected can be determined as the first detection result; if the updated cumulative number of abnormal objects is less than the first preset threshold, the abnormal detection result of the target object to be detected can be determined as the second detection result. Specifically, the first preset threshold can be set according to actual needs. It is understood that if the cumulative number of abnormal objects is greater than or equal to the first preset threshold, services to the target object to be detected may not be suspended.

[0137] In the above embodiments, when the whitelist ratio information is less than a preset ratio threshold, the updated cumulative number of abnormal objects is compared with the first preset number threshold. Based on the comparison result, the abnormal detection result of the target object to be detected is determined. This can further filter the second detection result, avoid the situation where some data has too much influence on abnormal detection during the dynamic adjustment of the current abnormal detection conditions, resulting in a large number of misjudgments, thus ensuring the accuracy of abnormal detection and improving the fault tolerance of abnormal detection.

[0138] In a specific embodiment, after determining the anomaly detection result as the first detection result when the cumulative number of abnormal objects is greater than or equal to a first preset number threshold, the above method may further include:

[0139] Restore the current anomaly detection conditions to the preset anomaly detection conditions.

[0140] In a specific embodiment, if the whitelist ratio information is less than a preset ratio threshold, the cumulative number of abnormal objects is updated. If the updated cumulative number of abnormal objects is greater than or equal to a first preset number threshold, the abnormal detection result can be determined as the first detection result. At the same time, it can be determined that the current abnormal detection conditions may be abnormal, and the current abnormal detection conditions can be restored to the preset abnormal detection conditions.

[0141] In one specific embodiment, after restoring the current anomaly detection conditions to the preset anomaly detection conditions, anomaly detection can be performed in the next detection cycle based on the restored preset anomaly detection conditions, and the preset anomaly detection conditions can be updated if the detection condition update conditions are met.

[0142] In one specific embodiment, if the whitelist ratio is less than a preset ratio threshold, the cumulative number of abnormal objects is updated. If the updated cumulative number of abnormal objects is greater than or equal to a first preset threshold, the abnormal detection result can be determined as the first detection result. Furthermore, if the updated cumulative number of abnormal objects is greater than or equal to a second preset threshold, all abnormal detection results within a preset detection period after the current time can be filtered, meaning that services are not suspended for abnormal objects detected within the preset detection period. The first preset threshold is less than the second preset threshold. Specifically, the preset detection period can be set according to actual needs.

[0143] In the above embodiments, when the updated cumulative number of abnormal objects is greater than or equal to the first preset number threshold, the abnormal detection result can be determined as the first detection result, and the current abnormal detection conditions can be restored to the preset abnormal detection conditions. This can avoid the situation where some data has too much influence on abnormal detection during the dynamic adjustment of the current abnormal detection conditions, resulting in a large number of misjudgments, thus ensuring the accuracy of abnormal detection and improving the fault tolerance of abnormal detection.

[0144] In the above embodiments, when an abnormality occurs in the running detection heartbeat corresponding to the target object to be detected, the current running feature information of the target object to be detected and the current anomaly detection conditions of the target application corresponding to the target object to be detected are obtained. The current anomaly detection conditions are obtained by updating the preset anomaly detection conditions based on historical running feature information, historical anomaly detection results and historical anomaly reference information, which can realize the dynamic adjustment of the current anomaly detection conditions. The preset anomaly detection conditions are the anomaly detection conditions of the target detection dimension determined based on the application feature information of the target application. Different preset anomaly detection conditions can be generated independently for different applications, which can improve the adaptability of anomaly detection to different applications. Then, the target feature information corresponding to the target detection dimension is obtained from the current running feature information. Based on the target feature information and the current anomaly detection conditions, anomaly detection is performed on the target object to be detected to obtain the anomaly detection result of the target object to be detected. This can enhance the robustness of anomaly detection, significantly reduce the number of false positives caused by network status jitter and changes in the client environment during the anomaly detection process, and thus greatly improve the accuracy and coverage of anomaly detection.

[0145] Figure 3 This is a system framework diagram illustrating an anomaly detection device according to an exemplary embodiment. Taking a game application as an example, as... Figure 3As shown, the heartbeat detection service can detect the running status of the first terminal corresponding to the game player (i.e., the target object to be detected) in real time. If no heartbeat information is received from the first terminal corresponding to the game player within a timeout period, the service can send timeout information of the first terminal corresponding to the game player to the policy service. Upon receiving the timeout information, the policy service obtains the current running feature information of the first terminal corresponding to the game player and the current anomaly detection conditions of the target application corresponding to the target object to be detected. From the current running feature information, the policy service obtains the target feature information of the target detection dimension corresponding to the current anomaly detection conditions. Based on the target feature information and the current anomaly detection conditions, the policy service analyzes the running status of the first terminal corresponding to the game player to obtain the object running status of the first terminal corresponding to the game player, and sends the object running status to the filtering service. The filtering service can obtain the object running status of the game player if the object running status is an abnormal running status. If the tag information indicates that the player belongs to the whitelist, the system determines the whitelist ratio for that player. If the whitelist ratio is greater than or equal to a preset threshold, the anomaly detection result is determined as the first detection result. If the whitelist ratio is less than the preset threshold, the system updates the cumulative number of anomaly objects. If the updated cumulative number of anomaly objects is greater than or equal to a first preset threshold, the system determines the anomaly detection result as the first detection result (i.e., the player did not cheat during the game). Conversely, if the updated cumulative number of anomaly objects is less than the first preset threshold, the system determines the anomaly detection result as the second detection result (i.e., the player cheated during the game), and sends the anomaly detection result to the suspension service. If the anomaly detection result for the target player is the second detection result, the system suspends service to the target player.

[0146] Figure 4 This is a block diagram illustrating an anomaly detection device according to an exemplary embodiment. Figure 4 As shown, the device may include:

[0147] The first information acquisition module 410 can be used to acquire the current running feature information of the target object to be detected and the current abnormal detection conditions of the target application corresponding to the target object to be detected when the running detection heartbeat of the target object to be detected is abnormal. The current abnormal detection conditions are obtained by updating the preset abnormal detection conditions based on historical running feature information, historical abnormal detection results and historical abnormal reference information. The historical abnormal reference information is used to characterize the accuracy of historical abnormal detection results. The preset abnormal detection conditions are the abnormal detection conditions of the target detection dimension determined based on the application feature information of the target application.

[0148] The target feature information acquisition module 420 can be used to acquire target feature information corresponding to the target detection dimension from the currently running feature information;

[0149] The anomaly detection module 430 can be used to perform anomaly detection on the target object based on the target feature information and the current anomaly detection conditions, and obtain the anomaly detection result of the target object.

[0150] In one specific embodiment, the above-described apparatus may further include:

[0151] The second information acquisition module can be used to acquire preset abnormal detection conditions, historical operation feature information, historical abnormal detection results and historical abnormal reference information when the detection condition update conditions are met. The historical abnormal detection results are the abnormal detection results of multiple objects to be detected corresponding to the previous detection cycle. The previous detection cycle is the detection cycle before the current detection cycle in which the current moment is located.

[0152] The first detection condition update module can be used to update the preset anomaly detection conditions based on historical operation feature information, historical anomaly detection results and historical anomaly reference information, so as to obtain the current anomaly detection conditions.

[0153] In one specific embodiment, the first detection condition update module described above may include:

[0154] The first anomaly detection and analysis module can be used to perform anomaly detection analysis on multiple objects to be detected based on historical anomaly detection results and historical anomaly reference information, and obtain a first detection index. The first detection index characterizes the accuracy and anomaly coverage of the historical anomaly detection results obtained on the basis of preset anomaly detection conditions.

[0155] The module for determining the conditions to be updated can be used to determine a first abnormal detection condition and a second abnormal detection condition from multiple abnormal detection conditions. The first abnormal detection condition is any one of the multiple abnormal detection conditions that has not been updated, and the second abnormal detection condition is any other condition among the multiple abnormal detection conditions other than the first abnormal detection condition.

[0156] The candidate anomaly detection condition generation module can be used to generate multiple candidate anomaly detection conditions for the detection dimension corresponding to the first anomaly detection condition based on the first anomaly detection condition and the preset step size.

[0157] The historical feature information acquisition module can be used to obtain historical feature information corresponding to the target detection dimension from historical operation feature information;

[0158] The candidate condition detection result determination module can be used to perform anomaly detection on multiple objects to be detected based on each candidate anomaly detection condition, the second anomaly detection condition and historical feature information, and obtain the candidate condition detection result corresponding to each candidate anomaly detection condition.

[0159] The second anomaly detection and analysis module can be used to perform anomaly detection analysis on each object to be detected based on the detection results of the candidate conditions and historical anomaly reference information, and obtain the second detection index corresponding to each candidate anomaly detection condition. The second detection index represents the accuracy and anomaly coverage of the candidate condition detection results obtained based on each candidate anomaly detection condition and the second anomaly detection condition.

[0160] The target detection condition determination module can be used to determine the target detection condition from multiple candidate anomaly detection conditions based on the first detection index and the second detection index; the target detection condition is the condition in which the corresponding second detection index is higher than the first detection index and the corresponding second detection index has the greatest difference from the first detection index among the multiple candidate anomaly detection conditions.

[0161] The first anomaly detection condition update module can be used to update the first anomaly detection condition based on the target detection condition, and repeat the steps of determining the first anomaly detection condition and the second anomaly detection condition from multiple anomaly detection conditions to update the first anomaly detection condition based on the target detection condition, based on the updated first anomaly detection condition, until all multiple anomaly detection conditions have been updated.

[0162] In one specific embodiment, the target detection condition determination module described above may include:

[0163] The indicator difference analysis module can be used to perform indicator difference analysis on the second detection indicator based on the first detection indicator, and obtain the indicator difference information corresponding to each candidate anomaly detection condition. The indicator difference information represents the difference between the second detection indicator and the first detection indicator corresponding to each candidate anomaly detection condition.

[0164] The filtering module can be used to select target detection conditions from multiple candidate anomaly detection conditions based on indicator difference information.

[0165] In one specific embodiment, the above-described apparatus may further include:

[0166] The application feature information acquisition module can be used to acquire application feature information of the target application;

[0167] The feature analysis module can be used to perform feature analysis on the target application based on the application feature information of the target application, and obtain the preset anomaly detection conditions corresponding to the target application.

[0168] In one specific embodiment, the above-described apparatus may further include:

[0169] The third information acquisition module can be used to acquire the security channel information and operation status information of the historical target object if no heartbeat information is received from the historical target object within a preset time. The historical target object can be any one of multiple target objects.

[0170] The security channel status analysis module can be used to perform security channel status analysis on historical objects to be detected based on security channel information, and obtain the security channel status information corresponding to the historical objects to be detected.

[0171] The object type analysis module can be used to perform object type analysis on historical objects to be detected based on operation status information when the security channel status information indicates abnormal channel status information, so as to obtain the object type of the historical objects to be detected.

[0172] In one specific embodiment, the anomaly detection module 430 described above may include:

[0173] The runtime status analysis module can be used to analyze the runtime status of the target object to be detected based on the target feature information and the current anomaly detection conditions, and obtain the object runtime status corresponding to the target object to be detected.

[0174] The fourth information acquisition module can be used to acquire the object tag information corresponding to the target object to be detected when the object's running state is in an abnormal running state;

[0175] The whitelist ratio information determination module can be used to determine the whitelist ratio information corresponding to the target object when the object label information indicates that the target object to be detected belongs to the whitelist object; the whitelist ratio information represents the ratio of the current number of whitelist anomalies to the current cumulative number of anomalies in the current detection period;

[0176] The first detection result determination module can be used to determine the abnormal detection result as the first detection result when the whitelist ratio information is greater than or equal to a preset ratio threshold. The first detection result is used to indicate that the target object to be detected is a normal object.

[0177] In one specific embodiment, the anomaly detection module 430 may further include:

[0178] The cumulative abnormal object count update module can be used to update the cumulative abnormal object count when the whitelist ratio information is less than a preset ratio threshold.

[0179] The second detection result determination module can be used to determine the abnormal detection result as the first detection result when the cumulative number of abnormal objects is greater than or equal to the first preset number threshold.

[0180] In one specific embodiment, the anomaly detection module 430 may further include:

[0181] The condition restoration module can be used to restore the current anomaly detection conditions to preset anomaly detection conditions.

[0182] In one specific embodiment, the above-described apparatus may further include:

[0183] The current anomaly detection condition update module can be used to update the current anomaly detection conditions based on the running feature information corresponding to the current detection period, the anomaly detection results corresponding to the current detection period, and the current anomaly reference information, provided that the detection condition update conditions are met.

[0184] Regarding the apparatus in the above embodiments, the specific manner in which each module and unit performs its operations has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0185] Figure 5 This is a block diagram illustrating an electronic device for anomaly detection of a target object according to an exemplary embodiment. The electronic device may be a server, and its internal structure diagram may be as follows: Figure 5 As shown, this electronic device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The network interface is used to communicate with external terminals via a network connection. When the computer program is executed by the processor, it implements an anomaly detection method.

[0186] Figure 6 This is a block diagram illustrating another electronic device for anomaly detection of a target object according to an exemplary embodiment. The electronic device may be a terminal, and its internal structure diagram may be as follows: Figure 6As shown, the electronic device includes a processor, memory, network interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The network interface is used to communicate with external terminals via a network connection. When the computer program is executed by the processor, it implements an anomaly detection method. The display screen can be a liquid crystal display (LCD) or an e-ink display. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the device's casing, or an external keyboard, touchpad, or mouse.

[0187] Those skilled in the art will understand that Figure 5 or Figure 6 The structure shown is merely a block diagram of a portion of the structure related to the present disclosure and does not constitute a limitation on the electronic device to which the present disclosure is applied. A specific electronic device may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0188] In an exemplary embodiment, an electronic device is also provided, including: a processor; and a memory for storing processor-executable instructions; wherein the processor is configured to execute the instructions to implement the anomaly detection method as described in the embodiments of this disclosure.

[0189] In an exemplary embodiment, a computer-readable storage medium is also provided, wherein when the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to perform the anomaly detection method in the embodiments of this disclosure.

[0190] In an exemplary embodiment, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to perform the anomaly detection method in the embodiments of this disclosure.

[0191] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and RAMbus dynamic RAM (RDRAM), etc.

[0192] It is understood that in the specific embodiments of this application, data such as user information are involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0193] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the following claims.

[0194] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this disclosure is limited only by the appended claims.

Claims

1. An anomaly detection method, characterized in that, The method includes: When an abnormality occurs in the running detection heartbeat corresponding to the target object to be detected, the current running feature information of the target object to be detected and the current abnormality detection conditions of the target application corresponding to the target object to be detected are obtained. The current abnormality detection conditions are obtained by updating the preset abnormality detection conditions based on historical running feature information, historical abnormality detection results and historical abnormality reference information. The historical abnormality reference information is used to characterize the accuracy of the historical abnormality detection results. The preset abnormality detection conditions are the abnormality detection conditions of the target detection dimension determined based on the application feature information of the target application. Obtain the target feature information corresponding to the target detection dimension from the current running feature information; Based on the target feature information and the current anomaly detection conditions, anomaly detection is performed on the target object to be detected, and the anomaly detection result of the target object to be detected is obtained; The historical anomaly reference information includes the object types corresponding to multiple objects to be detected. The object type of each object to be detected indicates whether the object to be detected actually engaged in cheating operations during the current operation of the target application being detected. The historical anomaly reference information is obtained using the following methods: If no heartbeat information is received from a historical target object within a preset time, the security channel information and operation status information corresponding to the historical target object are obtained, wherein the historical target object is any one of the plurality of target objects. Based on the security channel information, the security channel status of the historical objects to be detected is analyzed to obtain the security channel status information corresponding to the historical objects to be detected. When the security channel status information indicates an abnormal channel status information, the object type analysis is performed on the historical objects to be detected based on the operation status information to obtain the object type of the historical objects to be detected.

2. The method according to claim 1, characterized in that, The method further includes: When the detection condition update condition is met, the preset anomaly detection condition, the historical operation feature information, the historical anomaly detection result and the historical anomaly reference information are obtained. The historical anomaly detection result is the anomaly detection result of multiple objects to be detected corresponding to the previous detection period. The previous detection period is the detection period before the current detection period in which the current moment is located. Based on the historical operational feature information, the historical anomaly detection results, and the historical anomaly reference information, the preset anomaly detection conditions are updated to obtain the current anomaly detection conditions.

3. The method according to claim 2, characterized in that, The target detection dimension includes multiple detection dimensions, and the preset anomaly detection conditions include anomaly detection conditions corresponding to any of the detection dimensions; updating the preset anomaly detection conditions based on the historical operational feature information, the historical anomaly detection results, and the historical anomaly reference information to obtain the current anomaly detection conditions includes: Based on the historical anomaly detection results and the historical anomaly reference information, anomaly detection analysis is performed on the multiple objects to be detected to obtain a first detection index. The first detection index characterizes the accuracy and anomaly coverage of the historical anomaly detection results obtained based on the preset anomaly detection conditions. From multiple anomaly detection conditions, a first anomaly detection condition and a second anomaly detection condition are determined. The first anomaly detection condition is any one of the multiple anomaly detection conditions that has not been updated, and the second anomaly detection condition is any other condition among the multiple anomaly detection conditions other than the first anomaly detection condition. Based on the first anomaly detection condition and the preset step size, multiple candidate anomaly detection conditions for the detection dimension corresponding to the first anomaly detection condition are generated. From the historical operational feature information, obtain the historical feature information corresponding to the target detection dimension; Based on each candidate anomaly detection condition, the second anomaly detection condition, and the historical feature information, anomaly detection is performed on the plurality of objects to be detected to obtain the candidate condition detection result corresponding to each candidate anomaly detection condition. Based on the detection results of the candidate conditions and the historical anomaly reference information, anomaly detection analysis is performed on each candidate object to obtain a second detection index corresponding to each candidate anomaly detection condition. The second detection index characterizes the accuracy and anomaly coverage of the candidate condition detection results obtained based on each candidate anomaly detection condition and the second anomaly detection condition. Based on the first detection index and the second detection index, a target detection condition is determined from the plurality of candidate anomaly detection conditions; the target detection condition is the condition in the plurality of candidate anomaly detection conditions where the corresponding second detection index is higher than the first detection index and the corresponding second detection index has the greatest difference from the first detection index. Based on the target detection condition, the first anomaly detection condition is updated. Based on the updated first anomaly detection condition, the steps of determining the first anomaly detection condition and the second anomaly detection condition from the plurality of anomaly detection conditions to updating the first anomaly detection condition based on the target detection condition are repeated until all the plurality of anomaly detection conditions have been updated.

4. The method according to claim 3, characterized in that, The step of determining the target detection condition from the plurality of candidate anomaly detection conditions based on the first detection index and the second detection index includes: Based on the first detection index, the second detection index is analyzed for index difference to obtain index difference information corresponding to each candidate anomaly detection condition. The index difference information represents the difference between the second detection index and the first detection index corresponding to each candidate anomaly detection condition. Based on the aforementioned indicator difference information, the target detection condition is selected from the plurality of candidate anomaly detection conditions.

5. The method according to claim 2, characterized in that, The preset anomaly detection conditions are obtained using the following methods: Obtain the application feature information of the target application; Based on the application feature information of the target application, feature analysis is performed on the target application to obtain the preset anomaly detection conditions corresponding to the target application.

6. The method according to any one of claims 1-5, characterized in that, The step of performing anomaly detection on the target object based on the target feature information and the current anomaly detection conditions to obtain the anomaly detection result of the target object includes: Based on the target feature information and the current anomaly detection conditions, the running status of the target object to be detected is analyzed to obtain the object running status corresponding to the target object to be detected; When the object's running state is in an abnormal running state, obtain the object tag information corresponding to the target object to be detected; When the object tag information indicates that the target object to be detected belongs to the whitelist, the whitelist ratio information corresponding to the target object to be detected is determined; the whitelist ratio information represents the ratio of the current number of whitelist anomalies to the current cumulative number of anomalies in the current detection period. If the proportion of the whitelist information is greater than or equal to a preset proportion threshold, the abnormal detection result is determined as the first detection result, which is used to indicate that the target object to be detected is a normal object.

7. The method according to claim 6, characterized in that, The step of performing anomaly detection on the target object based on the target feature information and the current anomaly detection conditions to obtain the anomaly detection result of the target object includes: If the whitelist ratio is less than a preset ratio threshold, update the cumulative number of abnormal objects. If the cumulative number of abnormal objects is greater than or equal to a first preset threshold, the abnormal detection result is determined to be the first detection result.

8. The method according to claim 7, characterized in that, After determining the anomaly detection result as the first detection result when the cumulative number of abnormal objects is greater than or equal to a first preset threshold, the method further includes: Restore the current anomaly detection conditions to the preset anomaly detection conditions.

9. The method according to claim 1, characterized in that, The method further includes: If the detection condition update conditions are met, the current anomaly detection conditions are updated based on the operational feature information corresponding to the current detection cycle, the anomaly detection results corresponding to the current detection cycle, and the current anomaly reference information.

10. An anomaly detection device, characterized in that, The device includes: The first information acquisition module is used to acquire the current running feature information of the target object to be detected and the current abnormal detection conditions of the target application corresponding to the target object to be detected when the running detection heartbeat of the target object to be detected is abnormal. The current abnormal detection conditions are obtained by updating the preset abnormal detection conditions based on historical running feature information, historical abnormal detection results and historical abnormal reference information. The historical abnormal reference information is used to characterize the accuracy of the historical abnormal detection results. The preset abnormal detection conditions are the abnormal detection conditions of the target detection dimension determined based on the application feature information of the target application. The target feature information acquisition module is used to acquire the target feature information corresponding to the target detection dimension from the currently running feature information; An anomaly detection module is used to perform anomaly detection on the target object based on the target feature information and the current anomaly detection conditions, and obtain the anomaly detection result of the target object. The historical anomaly reference information includes object types corresponding to multiple objects to be detected, and the object type of each object to be detected indicates whether each object to be detected actually engaged in cheating operations during the current target application's operation; the device also includes: The third information acquisition module is used to acquire the security channel information and operation status information corresponding to the historical target object when no heartbeat information is received from the historical target object within a preset time. The historical target object is any one of the plurality of target objects. The security channel status analysis module is used to perform security channel status analysis on the historical objects to be detected based on the security channel information, and obtain the security channel status information corresponding to the historical objects to be detected. The object type analysis module is used to perform object type analysis on the historical objects to be detected based on the operation status information when the security channel status information indicates abnormal channel status information, so as to obtain the object type of the historical objects to be detected.

11. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to execute the executable instructions to implement the anomaly detection method according to any one of claims 1 to 9.

12. A non-volatile computer-readable storage medium storing computer program instructions thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the anomaly detection method according to any one of claims 1 to 9.

13. A computer program product comprising computer instructions, characterized in that, When the computer instructions are executed by the processor, they implement the anomaly detection method according to any one of claims 1 to 9.

Images