Method and device for determining abnormal access behavior

Abstract

The embodiment of the present application discloses a method and device for determining abnormal access behavior, which relates to the field of computer technology and solves the problem of being unable to analyze whether some users have abnormal access behavior. The specific scheme is: based on the target user's access volume to the server within a preset time period and the periodic idle period, determine whether the target user has abnormal access behavior. That is, if the preset time period and the periodic idle period match, but the access volume is too high, then there is abnormal access behavior. The periodic idle period is a time period determined based on the user's historical access volume and meets the following conditions: in each preset cycle of multiple unit time periods, the historical access volume of the unit time period corresponding to the periodic idle period is less than the first threshold. The above method determines the user's periodic idle period based on the user's historical access volume, and analyzes abnormal access behavior based on the periodic idle period, thereby ensuring the security and reliability of the computer network.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, and in particular, to a method and device for determining abnormal access behavior. Background Art

[0002] With the development of data storage business, especially the development of cloud storage business, more and more applications build their basic data services on the "cloud", that is, application developers rent cloud storage service systems and store application data through cloud storage service systems. With the widespread use of computer networks, it is very important to ensure the security and reliability of computer networks. In addition, the method of discovering abnormal behavior based on the analysis of the research object's access behavior to the computer system is also one of the research hotspots in recent years. In addition, applications built on the "cloud" often have time-based busy and idle characteristics, and for more mature businesses, these busy and idle characteristics become more obvious. Therefore, from the perspective of computer network security protection, these busy and idle characteristics with time periodicity may be used for abnormal access behavior analysis. The basic idea is that when the access behavior marked by a certain user violates the behavioral characteristics of its regular access, there is reason to be skeptical of the access behavior marked by the user. This is mainly due to the fact that the account authentication information used on the Internet may be different from the actual account holder.

[0003] Based on the above, in the prior art, the method of analyzing abnormal access behavior using the "holiday" characteristics of users accessing computer systems is a relatively traditional method of discovering abnormal access behavior based on busy and idle characteristics in time. In other words, compared with national statutory holidays and weekends in the calendar, these users tend to have more access to the computer system on weekdays, and correspondingly, less access to the computer system on holidays. Therefore, it is possible to analyze whether the user's access to the computer system meets the "holiday" characteristics to determine whether there is abnormal access behavior. For example, if a user's access to the computer system increases during holidays, then it can be determined that there is abnormal access behavior.

[0004] However, in actual applications, the busy and idle characteristics of users' access to computer systems may not always correspond to traditional "holidays", which makes the analysis of abnormal access behavior using "holiday" characteristics invalid, and thus cannot guarantee the security and reliability of computer networks. Summary of the invention

[0005] The embodiments of the present application provide a method and device for determining abnormal access behavior, which solves the problem of being unable to analyze whether some users have abnormal access behavior.

[0006] In a first aspect of an embodiment of the present application, a method for determining abnormal access behavior is provided, wherein the target user's access volume to a server within a preset time period is obtained, and based on the access volume and the periodic idle period, it is determined whether the target user has abnormal access behavior. If the preset time period matches the periodic idle period, but the access volume within the preset time period does not match the access volume during the periodic idle period, then it can be determined that the user has abnormal access behavior. The periodic idle period is a unit time period determined based on the user's historical access volume and meets the following conditions: in multiple unit time periods, the historical access volume of the unit time period corresponding to the periodic idle period in each preset period is less than a first threshold.

[0007] In the above method, for each user, the exclusive periodic idle time period corresponding to the user is determined through the user's historical visit volume, and based on the periodic idle time period, it is analyzed whether the user's access within a certain period of time has abnormal access behavior. Since the periodic idle time period of each user is determined based on the user's historical visit volume, it is possible to judge the abnormal access behavior of each user with periodic busy-idle characteristics, thereby protecting the user's account security and ensuring the security and reliability of the computer network.

[0008] In an optional embodiment, the method further includes: obtaining the historical visits of the target user to the server in multiple unit time periods, the multiple unit time periods including the first unit time period; when the historical visits corresponding to the first unit time period are less than the first threshold, and the historical visits corresponding to the second unit time period separated from the first unit time period by one or more preset periods are all less than the first threshold, determining that the unit time period corresponding to the first unit time period within the preset period is a periodic idle period. The above steps can accurately determine the periodic idle period of the target user.

[0009] In an optional embodiment, the method further includes: determining a first threshold value based on the historical visits; wherein the first threshold value is determined according to the weighted sum of the maximum historical visits and the minimum historical visits among the historical visits corresponding to multiple unit times; or the first threshold value is determined according to the average value of the historical visits corresponding to multiple unit times. Through the above method, the first threshold value can be determined according to the service characteristics of the target user, so that the first threshold value is more accurate and more in line with the characteristics of the historical visits of the current user.

[0010] In an optional embodiment, before determining the periodic idle time period, the method further includes: determining the target user as a user with busy-idle characteristics according to the target user's historical access volume to the server in multiple unit time periods. That is, only the periodic idle time period analysis is performed on the user with the busy-idle characteristics, which can reduce the amount of calculation.

[0011] In an optional embodiment, the target user is determined to be a user with busy-idle characteristics based on the target user's historical visits to the server in multiple unit time periods, including: determining the flatness of the historical visits corresponding to the multiple unit time periods based on the target user's historical visits to the server in multiple unit time periods; the flatness is used to indicate the range of change in the historical visits corresponding to the multiple unit time periods, and the flatness is proportional to the range of change; when the flatness is greater than a second threshold, the target user is determined to be a user with busy-idle characteristics.

[0012] In an optional embodiment, determining the flatness of historical page views corresponding to multiple unit time periods includes: determining the difference between the maximum historical page views and the minimum historical page views in the multiple unit time periods, and taking the ratio of the difference to the first value as the flatness.

[0013] In an optional embodiment, the first value is: the minimum historical visits; or the maximum value of the minimum historical visits and the second value; the second value is the minimum visits within a unit time period determined based on the service characteristics of the target user. By this method, the flatness cannot be calculated.

[0014] In a second aspect of an embodiment of the present application, a device for determining abnormal access behavior is provided, including: an acquisition module for acquiring the number of visits to a server by a target user within a preset time period; a determination module for determining whether the target user has abnormal access behavior based on the number of visits and a periodic idle period corresponding to the target user; the periodic idle period is determined based on the historical number of visits to the server by the target user in multiple unit time periods, and the periodic idle period meets the following conditions: within each preset period included in the multiple unit time periods, the historical number of visits in the unit time period corresponding to the periodic idle period is less than a first threshold; wherein, when the preset time period matches the periodic idle period, and the number of visits does not match the number of visits corresponding to the periodic idle period, it is determined that the target user has abnormal access behavior.

[0015] In an optional embodiment, the acquisition module is also used to: obtain the historical visits of the target user to the server in multiple unit time periods, and the multiple unit time periods include a first unit time period; the determination module is also used to: when the historical visits corresponding to the first unit time period are less than a first threshold, and the historical visits corresponding to the second unit time period separated from the first unit time period by one or more preset periods are all less than the first threshold, determine that the unit time period corresponding to the first unit time period within the preset period is a periodic idle period.

[0016] In an optional embodiment, the determination module is also used to: determine a first threshold based on historical visits; wherein the first threshold is determined according to the weighted sum of the maximum historical visits and the minimum historical visits among the historical visits corresponding to multiple unit times; or, the first threshold is determined according to the average value of the historical visits corresponding to multiple unit times.

[0017] In an optional embodiment, before determining the periodic idle time period, the determination module is further configured to: determine that the target user is a user with busy-idle characteristics according to the target user's historical visits to the server in multiple unit time periods.

[0018] In an optional embodiment, the determination module is specifically used to: determine the flatness of the historical visits corresponding to the multiple unit time periods based on the historical visits of the target user to the server in multiple unit time periods; the flatness is used to indicate the change range of the historical visits corresponding to the multiple unit time periods, and the flatness is proportional to the change range; when the flatness is greater than the second threshold, determine that the target user is a user with busy-idle characteristics.

[0019] In an optional embodiment, the determination module is specifically used to: determine the difference between the maximum historical page views and the minimum historical page views in the historical page views corresponding to the multiple unit time periods, and use the ratio of the difference to the first value as the flatness.

[0020] In an optional embodiment, the first value is: the minimum historical visits; or the maximum value of the minimum historical visits and the second value; the second value is the minimum visits within a unit time period determined based on the business characteristics of the target user.

[0021] In a third aspect of an embodiment of the present application, an electronic device is provided, including a memory and a processor, the memory being used to store a computer program, and the processor being used to execute the computer program, to implement the method for determining abnormal access behavior described in the first aspect of an embodiment of the present application.

[0022] In a fourth aspect of the embodiments of the present application, a computer-readable storage medium is provided, on which a computer program is stored, and the computer program is used to implement the method for determining abnormal access behavior described in the first aspect of the embodiments of the present application.

[0023] In the fifth aspect of the embodiments of the present application, a computer program product is provided, including a computer-readable code, or a non-volatile computer-readable storage medium carrying the computer-readable code. When the computer-readable code is executed in an electronic device, the processor in the electronic device executes the method for determining abnormal access behavior described in the first aspect of the embodiments of the present application.

[0024] It should be understood that the technical solutions provided in the above-mentioned second aspect, third aspect, fourth aspect, and fifth aspect, and their technical features can all correspond to the methods provided in the first aspect and its optional embodiments, so the beneficial effects that can be achieved are similar and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1A A schematic diagram of the access volume of a user with periodic busy-idle characteristics shown in the prior art;

[0026] Figure 1B A schematic diagram of the access volume of a user without periodic busy-idle characteristics shown in the prior art;

[0027] Figure 2A A simplified schematic diagram of a system architecture provided in an embodiment of the present application;

[0028] Figure 2B A schematic diagram of the composition of a server provided in an embodiment of the present application;

[0029] Figure 3 A flowchart of a method for determining abnormal access behavior provided in an embodiment of the present application;

[0030] Figure 4 A flowchart of a method for determining a periodic idle period of a target user provided in an embodiment of the present application;

[0031] Figure 5 A schematic diagram of an HOV provided in an embodiment of the present application;

[0032] Fig. 6A A schematic diagram of a RoF corresponding to a HOV with busy / idle characteristics provided in an embodiment of the present application;

[0033] Figure 6B A schematic diagram of a RoF corresponding to a HOV without busy / idle characteristics provided in an embodiment of the present application;

[0034] Fig. 7A A schematic diagram of the historical visit volume within 15 days of a target user with periodic busy-idle characteristics provided in an embodiment of the present application;

[0035] Figure 7B A schematic diagram of the historical page views within 15 days of a target user without periodic busy / idle characteristics provided in an embodiment of the present application;

[0036] Figure 7C A schematic diagram of the historical page views within 15 days of another target user with periodic busy-idle characteristics provided in an embodiment of the present application;

[0037] Fig.7DA schematic diagram of the historical visit volume of a target user within 15 days is provided for an embodiment of the present application;

[0038] Fig. 7E Another schematic diagram of the historical visit volume of a target user within 15 days is provided for the embodiment of the present application;

[0039] Figure 8 A schematic diagram of the composition of a server provided in an embodiment of the present application;

[0040] Fig. 9 A schematic diagram of the composition of another server provided in an embodiment of the present application. DETAILED DESCRIPTION

[0041] With the development of cloud storage services, more and more applications store their data in the "cloud", that is, application builders rent cloud storage services and store the data in their applications through the cloud storage services.

[0042] For cloud storage service providers, it is necessary to ensure the account security of each user who rents the cloud storage service. In order to ensure the security of the user's account, it is necessary to determine whether there is any abnormal access to the user's account. In the prior art, some users' access behaviors (that is, operations on the account) have obvious periodic busy and idle characteristics, that is, within a preset period, some time periods have more access and some time periods have less access. For example, see Figure 1A and Figure 1B , Figure 1A is the number of visits by users with periodic busy and idle characteristics. Figure 1B It refers to the number of visits by users who do not have periodic busy and idle characteristics. Figure 1A and Figure 1B In the figure, the horizontal axis represents time and the vertical axis represents the number of visits.

[0043] For example, for a catering application, the application will have a large amount of data updates such as ordering during meal times every day. Then the users of the cloud storage service corresponding to the builder of the application will also make a large number of visits to the cloud storage service server during meal times to update their own data on the cloud storage service server. During non-meal times every day, the number of visits to the cloud storage server by the users corresponding to the builder of the catering application will decrease. The above-mentioned catering application has more visits during meal times and fewer visits during non-meal times. Such busy-idle characteristics of the number of visits with one day as a cycle are also the above-mentioned periodic busy-idle characteristics.

[0044] Through the above-mentioned periodic busy-idle characteristics, it can be determined that the user corresponding to the builder of the catering application (hereinafter referred to as the user) has fewer visits during non-meal times of the day. If the user has a large number of visits to the server of the cloud storage service during non-meal times of a certain day, it can be determined that the user has abnormal access behavior, that is, the user's account may be stolen.

[0045] In the related art, the periodic busy-idle characteristics of many users of cloud storage services are "holiday" busy-idle characteristics. For example, for internal communication applications in a company, the data of the application is updated more frequently on weekdays, and the data is updated less frequently on holidays. In other words, the users of the cloud storage service corresponding to the builders of this application have more visits to the servers of the cloud storage service on weekdays, and correspondingly, fewer visits to the servers of the cloud storage service on holidays. In the prior art, it is possible to determine whether there is abnormal access based on whether the user's access volume meets the "holiday" characteristics. For example, if the number of operations on holidays increases, it proves that the user has abnormal access behavior.

[0046] However, for some users, their access behaviors have periodic busy-idle characteristics, such as fewer operations at certain times in each cycle and more operations at other times, such as the catering application mentioned above. However, the periodic idle time periods of the above users do not correspond to "holidays", and the existing technology cannot accurately analyze whether these users have abnormal access behaviors. It should be noted that the periodic busy-idle characteristics are at least used to indicate the characteristics of the periodic idle period.

[0047] Based on this, in order to analyze the access behaviors of these users and protect the account security of users of the cloud storage service. In the present application, the target user's access volume to the server within a preset time period is obtained, and based on the access volume and the periodic idle period, it is determined whether the target user has abnormal access behavior. If the preset time period matches the periodic idle period, but the access volume within the preset time period does not match the access volume during the periodic idle period, then it can be determined that the user has abnormal access behavior. Among them, the periodic idle period is a unit time period in which the user's historical access volume meets the following conditions: the historical access volume within the unit time period is less than the first threshold, and the historical access volume within the unit time period separated from the unit time period by one or more preset periods is less than the first threshold.

[0048] In the above method, for each user, the exclusive periodic idle time period corresponding to the user is determined through the user's historical visit volume, and based on the periodic idle time period, it is analyzed whether the user's access within a certain period of time has abnormal access behavior. Since the periodic idle time period of each user is determined based on the user's historical visit volume, it is possible to judge the abnormal access behavior of each user with periodic busy-idle characteristics, thereby protecting the user's account security and ensuring the security and reliability of the computer network.

[0049] The implementation of the embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0050] Figure 2A What is shown is a simplified schematic diagram of a system architecture to which the embodiments of the present application can be applied. Figure 2A As shown, the system architecture may include: at least one server 21 and a user device 22 .

[0051] Server 21 is also the server of the cloud storage service, which is responsible for receiving the user's access request, processing the user's access request, and determining whether the user's access behavior is abnormal access behavior. That is, server 21 is the execution subject of the method for determining abnormal access behavior in the embodiment of the present application. It should be noted that the server 21 can also be a server cluster composed of multiple servers, and the present application does not limit the specific form of server 21.

[0052] The user device 22 is a device used by the user of the cloud storage service. The device is used to send an access request to the server 21 of the cloud storage service based on the user's operation to update the user data stored on the server of the cloud storage service. The user device 22 can be a terminal device such as a computer, a mobile phone, or a server. As long as it is a device that allows the user to access the server of the cloud storage service, it can be the user device 22 in this application. The specific form of the user device 22 is not limited in this application.

[0053] like Figure 2B As shown, Figure 2A The server 21 shown may include: a processor 201 and a memory 202, the memory 202 is used to store computer programs, and the processor 201 is used to execute computer programs to implement the following method for determining abnormal access behavior. The embodiment of the present application does not limit the number of these devices, for example, the server 21 may include one or more processors 201.

[0054] The processor 201 is the control center of the system. For example, the processor 201 can be any one or a combination of multiple CPUs, GPUs, field-programmable gate arrays (FPGAs) and application-specific integrated circuits (ASICs).

[0055] Processor 201 is used to execute the following Figure 3 and Figure 4 The method shown in .

[0056] The memory 202 may include a first storage medium, a second storage medium, and a third storage medium. The third storage medium is the main storage medium of the system architecture, such as a hard disk, etc. The first storage medium may be a memory or a video memory (also referred to as a graphics card memory), etc. For example, if the first storage medium is a memory, the processor 201 may be any one or a combination of multiple CPUs, FPGAs, and ASCIs; if the first storage medium is a video memory, the processor 201 may be a GPU. The second storage medium may be a cache, etc., which is mainly used to improve the read and write performance of the system. The above three storage media together provide cloud storage services for users.

[0057] In other words, the present application provides an electronic device, including a memory and a processor, wherein the memory is used to store a computer program, and the processor is used to execute the computer program to implement the following method for determining abnormal access behavior.

[0058] Next, we will combine Figure 3 , to illustrate an exemplary embodiment of a method for determining abnormal access behavior shown in the present application, such as Figure 3 As shown, the method includes:

[0059] Step 301: Obtain the number of visits to the server by the target user within a preset time period.

[0060] The preset time period is a period of time used for abnormal access behavior analysis. The preset time period may be a historical period of time when the server has generated a lot of visits, which may be a unit time period mentioned later. For example, if the unit time period in the following text is one day, the preset time period may also be one day. The preset time period may also include multiple unit time periods. For example, if the unit time period in the following text is one day, the preset time period may be 5 days. This application does not limit the specific length of the preset time period.

[0061] Wherein, in the case where the preset time period includes multiple unit time periods, in order to facilitate the subsequent determination of whether there is abnormal access behavior, the number of visits corresponding to each unit time period in the multiple unit time periods can be determined in step 301. For example, in the case where the unit time period is 1 day and the preset time period is 5 days, the number of visits per day in the 5 days of the preset time period can be determined in step 301, that is, 5 numbers of visits corresponding to the preset time period can be determined in step 301, and these 5 numbers of visits can be analyzed separately in the subsequent to determine whether there is abnormal access behavior.

[0062] The target user is the user who accesses the server in step 301. In one embodiment, the server is a server of a cloud storage service, and correspondingly, the target user is the user who rents the cloud storage service, such as a builder of an application, or an individual user who rents the cloud storage service, etc. The specific form of the target user is not limited in this application, and any user who can access the server mentioned in step 301 and whose historical access behavior has periodic busy and idle characteristics can be the target user of this application.

[0063] It should be noted that, although only the users corresponding to the builders of the application are mentioned in the above introduction to the prior art, it can be understood that other users whose access behaviors have periodic busy and idle characteristics can also be the target users in this application. As mentioned above, the server can be a server that provides cloud storage services. Of course, the method can also be applied to other fields. For example, the server can be a server that provides cloud computing services, and the corresponding target users are users who use cloud computing services. The server can be the server of a certain application, and the target users are users who use the application.

[0064] The number of visits is the number of operations performed by the target user on the server. For example, when the server is a cloud storage service server, the target user's logging into the cloud storage service, the target user writing new data in the cloud storage server, and the target user modifying the data already stored in the cloud storage server can all be regarded as a visit of the user to the server. The number of visits to the server by the target user within the preset time period is the sum of the number of operation behaviors of the target user on the server within the preset time period. Of course, as described above, when the preset time period includes multiple unit time periods, the unit time period can be used as the statistical unit to count the number of operation behaviors of the target user on the server within the preset time period, so as to obtain the sum of the data volume of the operation behaviors in each unit time period within the preset time period, that is, to obtain the number of visits for each unit time period within the preset time period.

[0065] The number of visits can be determined based on the target user's operation log. As known to those skilled in the art, the server generally has an operation log that records all past operations of the user, so the number of visits to the server within a preset time period can be determined based on the operation behaviors recorded in the operation log.

[0066] For example, the unit time period is 1 minute, the preset time period is also 1 minute, and the target user logs in to the cloud storage service once within 1 minute, writes data to the server of the cloud storage service twice, and modifies the data stored in the server of the cloud storage service three times. Then it can be determined that the target user's visits to the server within the preset time period are 6.

[0067] Step 302: Determine whether the target user has abnormal access behavior based on the access volume and the periodic idle time period corresponding to the target user.

[0068] When the preset time period matches the periodic idle time period and the access volume does not match the access volume corresponding to the periodic idle time period, it is determined that the target user has abnormal access behavior.

[0069] Abnormal access behavior, that is, access behavior that does not conform to the target user's access pattern. If the target user has abnormal access behavior, it can be determined that the target user's account has security risks, such as the possibility that the target user's account password is known by other people, allowing other users to steal the target user's account. In this application, for a target user with a periodic busy-idle feature, it is determined whether the user's access conforms to the periodic busy-idle feature to determine whether there is abnormal access behavior. The periodic busy-idle feature is a feature that indicates a periodic idle period, and the periodic idle period is a time period that indicates the number of visits should be less within each preset period.

[0070] Among them, the periodic idle period is determined based on the historical visits of the target user to the server in multiple unit time periods, and the periodic idle period meets the following conditions: in each preset period included in the multiple unit time periods, the historical visits in the unit time period corresponding to the periodic idle period are all less than the first threshold.

[0071] In other words, the periodic idle period is a unit time period determined according to the user's past access rules: a unit time period in a preset period when the user should have fewer visits. Specifically, if the number of visits in a certain unit time period in the historical number of visits is less than a first threshold, and the number of visits corresponding to all unit time periods separated from the unit time period by one or more preset periods is less than the first threshold, it can be determined that the time period corresponding to the unit time period in the preset period belongs to the periodic idle period.

[0072] For example, the preset period is one week, the unit time period is one day, and the multiple unit time periods include three weeks, that is, three preset periods. In the first week, the historical number of visits on Monday is less than the first threshold, in the second week, the historical number of visits on Monday is less than the first threshold, and in the third week, the historical number of visits on Monday is less than the first threshold. Then it can be determined that "Monday" is a periodic idle period.

[0073] The preset period is the period of the periodic busy-idle characteristics of the target user. The size of the preset period can be determined based on the behavioral characteristics of the target user. The behavioral characteristics of the target user, that is, the access patterns of the target user, can also be business category labels of different users. For example, different business category labels can be assigned to different users in advance. Business category labels can specifically include catering applications, communication applications, etc., and then the preset period of the target user is determined based on the general period corresponding to the business type label. The general period corresponding to the business type label can be determined based on historical experience. For example, the preset period corresponding to the catering application can be preset to one day. When it is determined that the business category label of the target user is a catering application, the preset period of the target user is determined to be one day.

[0074] In addition, in order to obtain a more accurate result, the multiple unit time periods used to determine the periodic idle period at least correspond to the time lengths of two preset cycles.

[0075] The historical visits to the server in multiple unit time periods, that is, for multiple historical unit time periods, the visits to the server by the target user in each unit time period are calculated respectively.

[0076] The unit time period, that is, the time period of the unit time length, can be, for example, one minute, one hour, two days, three months, etc. The length of the unit time period can be determined according to the preset period of the target user, and a suitable time length that can be used to determine the busy and idle characteristics is selected as the unit time period according to the size of the preset period. For example, for the target user with a preset period of one day, the length of the unit time period can be ten minutes, and for the target user with a preset period of one week, the length of the unit time period can be one day. The length of the unit time period can also be determined according to the computing power of the server. For example, if the computing power of the server is strong, then in order to obtain the most accurate result possible, the length of the unit time period can be shorter. The method of determining the historical visits to the server in the unit time period is similar to the process of obtaining the visits in step 301, and will not be repeated here.

[0077] The first threshold value may be a predetermined value. For example, the threshold value may be estimated based on the behavioral characteristics of the target user, or may be determined based on the historical visits. The meaning of the user behavioral characteristics is the same as above and will not be repeated here. For the former, for example, the possible visits during the user's general idle time period may be determined based on the behavioral characteristics of the target user, and the first threshold value may be determined based on the possible visits. For the latter, the specific determination method is described below and will not be described in detail here.

[0078] The preset time period matches the periodic idle period, that is, the preset time period includes the periodic idle period, for example, the preset period is one week, and the periodic idle period is Monday. If the preset time period also includes Monday, for example, the preset time period is Monday of a certain week, or the preset time period is Monday and Tuesday of a certain week, then the preset time period matches the periodic idle period.

[0079] It should be noted that if the preset time period includes multiple unit time periods, it can be determined for each unit time period whether the unit time period matches the periodic idle time period, and whether the access volume of the unit time period does not match the access volume corresponding to the periodic idle time period.

[0080] The access volume does not match the access volume corresponding to the periodic idle period, that is, the access volume in the preset time period is higher than the access volume corresponding to the periodic idle period. The specific method for determining whether the access volume matches the access volume corresponding to the periodic idle period can refer to the method in the prior art, or can be determined based on whether it is greater than the first threshold above. For example, when the access volume is greater than the first threshold, it can be determined that the access volume does not match the access volume corresponding to the periodic idle period.

[0081] Through the above method, for the target user, the periodic idle period used to determine whether he has abnormal access behavior is determined based on the user's historical access volume. In this way, the judgment result of whether the target user has abnormal access behavior is more accurate, thereby ensuring the security of the user's account.

[0082] The above embodiment describes how to determine whether the target user has abnormal access behavior. Next, a method for determining the periodic idle time period of the target user in the present application will be described in conjunction with an embodiment.

[0083] like Figure 4 As shown, the method comprises the following steps:

[0084] Step 401: Obtain the historical visits of the target user to the server in multiple unit time periods.

[0085] The multiple unit time periods include a first unit time period. The first unit time period may be any unit time of the multiple unit time periods, and the first unit time period may also be a unit time period for which a determination of whether it is a periodic idle period has not yet been made.

[0086] As for the specific implementation of step 401, the historical visits of the user to the server in multiple unit time periods can be determined based on the operation log (also called security log) of the server.

[0087] Among them, according to the content of the operation log, m operations of the target user are extracted from the operation log, and these m operations are called valid operations. Specifically, the operation log will not only record each operation of the target user, but also record some other contents, such as the login password, Internet Protocol Address (IP address) and other information of the target user when the target user logs in. Information such as login password and IP address are invalid information for analyzing the user's visits. Therefore, when determining the historical visits, it is necessary to extract valid operations from the operation log, that is, operations that are useful for analyzing the historical visits, and count the number of the above valid operations in each unit time period in multiple unit time periods as the historical visits.

[0088] It is easy to understand that the longer the total duration of multiple unit time periods is, the more analyzable it is. However, in some cases, if the total duration of multiple unit time periods selected from the operation log at one time is too long, when the computing power of the server is weak, it may cause the server to be unable to analyze the historical visits within multiple unit time periods. Therefore, a suitable time window can be determined, and the window length is T. Then the historical visits corresponding to the window length T are analyzed.

[0089] As described above, the upper limit of the window length depends on the size of the computing power of the server, and the lower limit of the window length depends on the size of the preset period. In some instances, in the subsequent steps, it is necessary to determine whether the idle period is a periodic idle period, so the window length can be greater than or equal to two preset periods to ensure the accuracy of the determined periodic idle period. In order to accurately determine the periodic idle period through the historical access volume in multiple unit time periods, the historical access volume in multiple unit time periods can verify whether the periodic idle period is accurate, and the window length (that is, the total length of multiple unit time periods) can be greater than two preset periods.

[0090] For example, m operations of the object under study can be extracted from the operation log within a period of time starting from t0 and ending at t0+T. The extracted m operations are then divided into multiple operation sets according to the unit time period, and the sum of the number of operations in each operation set is determined. The sum of the number of operations in an operation set can be used as the historical access volume corresponding to a unit time period. Here, taking a unit time period of one day as an example, the following can be formed based on the content in the operation log: Figure 5 The array shown is a summary of the historical visits corresponding to multiple unit time periods. Each value in the array represents the visits in one day. According to the array and the size of the window length T, multiple vectors of historical visits including multiple unit time periods can be determined. The vector is used to describe the visit behavior of the target user in the past period of time. Here, the vector is called the Historical Operation Vector (HOV).

[0091] like Figure 5 As shown, taking the preset period as 7 days and T as 15 days as an example, two HOVs can be determined from the operation log, namely HOV1 including the visit volume of days 1-15 and HOV2 including the visit volume of days 2-16. Figure 4 In the steps shown, the periodic idle time periods of HOV1 and HOV2 are analyzed respectively. Figure 4 The steps shown are executed periodically, once a day, so you can execute them on the first day. Figure 4 In the steps shown, the analysis of the periodic period is performed for HOV1, and the next day is executed Figure 4 During the steps shown, HOV2 is analyzed at periodic intervals.

[0092] Step 402: Determine that the target user is a user with busy / idle characteristics according to the historical visits of the target user to the server in multiple unit time periods.

[0093] Specifically, due to the different services of different users, the behavior of users accessing the cloud storage service does not always have periodic busy-idle characteristics. Therefore, after constructing the HOV in step 401, it is possible to further analyze whether the target user's access behavior has busy-idle characteristics. In other words, whether there are obvious periodic idle periods. In order to reduce the subsequent calculation amount, for target users without busy-idle characteristics, there is no need to use the periodic busy-idle characteristic method to further analyze them.

[0094] Here, it is determined whether the target user is a user with busy / idle characteristics, that is, for the HOVs corresponding to the multiple unit time periods, it is determined whether they have the busy / idle characteristics.

[0095] In addition, step 402 is an optional step. This step is to reduce the amount of subsequent calculations so that the target user without busy-idle characteristics is not analyzed for periodic idle periods during subsequent calculations. When the method of the present application is executed, step 402 may not be executed.

[0096] Next, the implementation method of step 402 will be described through the following specific examples. It should be noted that the following method does not limit the present application. For example, an artificial neural network can also be used to determine whether the target user has the busy and idle characteristics.

[0097] Step 402 specifically includes determining the flatness of the historical access volume corresponding to the multiple unit time periods according to the historical access volume of the target user to the server in the multiple unit time periods. When the flatness is greater than the second threshold, the target user is determined to be a user with busy-idle characteristics.

[0098] The flatness is used to indicate the variation range of the historical visit volume corresponding to multiple unit time periods, and the flatness is proportional to the variation range.

[0099] That is, when the flatness is less than the second threshold, it is determined that the multiple unit time periods corresponding to the target user do not have the busy-idle feature, that is, the target user currently does not have the busy-idle feature, and step 403 is not continued. When the flatness is greater than the second threshold, the following step 403 is continued to be executed to continue analyzing the periodic idle time period of the target user.

[0100] It should be noted that when the flatness is equal to the second threshold, it can be considered that the target user currently has the busy-idle feature and the following step 403 is continued to be executed, or it can be considered that the target user does not have the busy-idle feature and the following step 403 is not continued to be executed. Whether to execute the following step 403 when the flatness is equal to the second threshold can be set according to the needs of the actual application scenario, and the embodiment of the present application does not limit it here.

[0101] The flatness can be determined based on the difference between the maximum historical visit volume and the minimum historical visit volume in the HOV. For example, the difference between the maximum historical visit volume and the minimum historical visit volume can be used as the flatness. Different second thresholds can be determined for target users with different business characteristics. For example, for catering applications, the visit volume during busy and idle times is generally very different, so the second threshold can be determined based on the difference between the visit volume during busy and idle times. And when the flatness is greater than the second threshold, it can be determined that the user has busy and idle characteristics.

[0102] The flatness can also be determined based on the ratio of the difference between the maximum historical visits and the minimum historical visits in the HOV to the first value. As mentioned above, different target users have different business characteristics. If only the difference between the maximum historical visits and the minimum historical visits of different target users is considered, different second thresholds need to be set to analyze whether different target users have busy and idle characteristics. Therefore, in order to reduce manual participation, a second threshold can be used to uniformly measure whether different target users have busy and idle characteristics. In order to achieve the above purpose, the flatness can be determined based on the ratio of the maximum historical visits and the minimum historical visits to the first value. Among them, the first value can be a value related to the HOV, such as the maximum historical visits, the minimum historical visits, the median of the historical visits, and the like in the HOV.

[0103] In addition to the above values, the first value can also be the maximum value of the minimum historical visits and the second value; the second value is the minimum visit in a unit time period determined based on the business characteristics of the target user. For some target users, their minimum historical visits may be 0. If the minimum historical visits are 0, the flatness cannot be determined by the above method. Therefore, for the target user, based on the business characteristics of the target user, the lower limit of the user's visits in a unit time period (that is, the second value) can be determined, and the lower limit of the visits can be replaced by the minimum historical visits in the above denominator. The meaning of the business characteristics is detailed above and will not be repeated here. For example, for an email application, if the user corresponding to the application has busy and idle characteristics, the visits during its idle period will not be too low. Correspondingly, for a catering application, if the user corresponding to the application has busy and idle characteristics, there may be basically no one using the catering application during the idle period of the catering industry, and the visits during its idle period may be very low.

[0104] Specifically, the flatness used to measure whether the target user has the busy-idle feature can be calculated according to the following formula (1):

[0105]

[0106] Among them, RoF is the above flatness, and ε is a given positive constant, which is used to indicate the lower bound of the minimum number of operations of the target user in a unit time period, that is, the lower bound of the number of visits. i That is, the historical visit volume corresponding to each unit time in HOV, max{h i} is the maximum historical visit volume in HOV, min{h i} is the minimum historical visit volume in HOV. max{ε,min{h i}} is used to indicate that if the target user’s historical visits in a certain unit time period are less than ε, then the target user’s historical visits are considered to be ε; otherwise, the target user’s actual minimum historical visits are used as the data for comparative analysis in (1).

[0107] Next, we will combine Fig. 6A and Figure 6B The above formula (1) is explained below. Fig. 6A and Figure 6B This is a simple illustration of RoF. It is easy to see that the numerator of RoF in formula (1) corresponds to the distance between the two dashed lines in the figure, and the denominator of RoF in formula (1) corresponds to the distance between the dashed line closest to the horizontal axis and the horizontal axis. Fig. 6A If the RoF value is large, it means that there is a significant difference between the maximum historical visit volume and the minimum historical visit volume in the HOV, that is, the HOV corresponding to the target user has busy and idle characteristics. Figure 6B As shown in FIG. 1 , if the value of RoF is small, it indicates that there is no obvious difference between the maximum historical visit volume and the minimum historical visit volume in the HOV, that is, the HOV corresponding to the target user has no obvious busy-idle characteristics.

[0108] The second threshold is α, which is a positive constant and can be adjusted according to the actual application process. According to the RoF calculated above, there are the following two situations.

[0109] Case 1: When RoF≤α, the busy-idle characteristics of the target user's historical access behavior are not obvious, and there is no need to analyze the periodic idle period of his historical access behavior;

[0110] Case 2: When RoF>α, the historical access behavior of the target user has obvious busy-idle characteristics, and the method given in this application can be used to further analyze the periodic idle time period corresponding to the target user.

[0111] By selecting the second threshold α, the target user's historical access behavior can be preliminarily classified first, and target users with periodic busy-idle characteristics can be screened out. In this way, only the target users with busy-idle characteristics are subsequently analyzed for periodic idle periods, which reduces the amount of calculation and the processing pressure on the server.

[0112] It should be noted that the above is described by taking the ratio of the difference between the maximum historical visit volume and the minimum historical visit volume in the HOV to the first value or the difference between the maximum historical visit volume and the minimum historical visit volume in the HOV as an example to determine the flatness. It is understandable that in step 402, the variance and standard deviation of the historical visit volume corresponding to multiple unit time periods can also be used as the flatness. The embodiment of the present application does not specifically limit the method for determining the HOV flatness, and it is only necessary to determine whether there is a significant difference between the maximum historical visit volume and the minimum historical visit volume in the HOV.

[0113] Step 403: Determine a first threshold based on the historical page views.

[0114] For different target users, their periodic busy and idle characteristics may be different. This difference is mainly reflected in two aspects: first, the time of the periodic idle period may be different, and second, the number of visits of different target users in the idle period varies greatly. In order to effectively distinguish whether each unit time period of the target user is a periodic idle period, it is necessary to determine a threshold for distinguishing the idle period and busy period of the target user based on the service characteristics of the target user, such as the first threshold in this application, so as to ensure that the determined periodic idle period is more accurate.

[0115] In some embodiments, the first threshold value can be determined based on the weighted sum of the maximum historical visits and the minimum historical visits among the historical visits corresponding to multiple unit times. In other embodiments, the first threshold value can be determined based on the average value of the historical visits corresponding to multiple unit times. In addition, the first threshold value can be determined based on the product of the maximum historical visits and a preset ratio. For example, if the preset ratio is 0.3, the first threshold value can be 0.3 times the maximum historical visits. In the case where it is determined through step 402 that the HOV has busy and idle characteristics, a more accurate first threshold value can be determined by using the weighted sum of the maximum historical visits and the minimum historical visits or the average value of the historical visits. In the case where step 402 is not performed, a more accurate result can be obtained by using the product of the maximum historical visits and the preset ratio to determine the above-mentioned first threshold value. Of course, the three methods for determining the first threshold value shown above do not represent limitations on the present application.

[0116] Here, step 403 will be described through a specific example.

[0117] In this application, the first threshold G can be calculated by the following formula (2):

[0118]

[0119] The meaning of each symbol in formula (2) can be found in the explanation of formula (1), and will not be repeated here. The weight of the weighted sum here can be a value preset based on experience.

[0120] Step 404, when the historical visit volume corresponding to the first unit time period is less than the first threshold, and the historical visit volume corresponding to the second unit time period separated from the first unit time period by one or more preset periods is less than the first threshold, it is determined that the unit time period corresponding to the first unit time period within the preset period is a periodic idle period.

[0121] As described above, the first unit time period may be a unit time period for which whether it is a periodic idle time period has not yet been determined. In step 404, the above operation may be performed for each first unit time period to determine whether each first unit time period is a periodic idle time period.

[0122] Exemplarily, for each first unit time period, whether it is a periodic idle period can be determined by the following formula (3):

[0123]

[0124] Among them, h i is the historical visits of the target object in the first unit time period, h i-7 is the historical access volume of the same unit time period in the previous preset cycle, and G is the first threshold calculated by formula (2). Formula (3) shows that if the number of valid operations of the target user in the first time period is less than the first threshold, and at the same time, the number of valid operations in the second unit time period separated by a preset cycle is also small, then it can be determined that the first unit time period and the second unit time period are both periodic idle periods.

[0125] It should also be noted that although formula (3) only determines h i and h i-7 Whether it is less than G. However, when HOV includes historical visit volume data within multiple preset periods, it can also be determined whether each second unit time period separated from the first unit time period by one or more preset periods is less than G. Only when the above-mentioned first unit time period and each second unit time period are less than G, can it be determined that the first unit time period and the second unit time period are periodic idle periods.

[0126] In other words, according to the above formula (3), we can get the following conclusion:

[0127] Case 1: When the historical visit volume of the target user in the first unit time period and the historical visit volume in the second unit time period are both lower than the G value, the first unit time period and the second unit time period are periodic idle periods.

[0128] Case 2: When case 1 is not satisfied, the first unit time period and the second unit time period are time periods without idle characteristics.

[0129] like Fig. 7A As shown, Fig. 7A The figure shows the historical visits within 15 days for a target user with periodic busy-idle characteristics. The historical visits of the target user on Day 15 and Day 8, Day 14 and Day 7 are all lower than the first threshold corresponding to this target object, satisfying Case 1. Then Day 15 and Day 8, Day 14 and Day 7 are all periodic idle periods. The historical visits of other unit time periods do not satisfy Case 1 and are time periods without idle characteristics. The horizontal line in the figure is the G value of the research object.

[0130] Correspondingly, such as Figure 7B As shown, Figure 7B 15 days of historical visits of a target user without periodic busy-idle characteristics are shown in FIG. When step 402 is executed, it can be determined that the user does not have the busy-idle characteristics according to the flatness of the HOV of the target user. When step 402 is not executed, it can be directly determined that the HOV does not have a periodic idle period according to step 404.

[0131] In addition, the above embodiment shows that only when each second unit time period is less than the first threshold value can the second unit time period be determined as a periodic idle period. However, for some target users, their periodic idle periods may change frequently, so it is possible to determine whether there is a periodic idle period based on the data in the two preset periods closest to the current moment. That is, when the historical access volume in the first unit time period is less than the first threshold value, and the second unit time period separated from the first unit time period by a preset period is also less than the threshold value, it can be determined that the first unit time period and the second unit time period are periodic idle periods.

[0132] for Figure 4 As for the execution timing of the method shown in the above, the above method can be executed at regular intervals, or it can be executed when abnormal access behavior analysis is required. Figure 4 There is no limitation on the execution timing of the method shown.

[0133] In addition, since the analysis of abnormal access behavior focuses on the originally idle time period, the originally busy time period cannot be determined as abnormal access behavior by the above method, so only the periodic idle time period is determined in the above process. Of course, the periodic busy time period can also be determined by a method similar to step 404.

[0134] For example, the first threshold value may be determined through the above steps 401 and 403, and the time period in which the historical visit volume per unit time period corresponding to each preset period in the HOV is greater than the first threshold value may be screened out through the first threshold value as the periodic busy period. Alternatively, it may be determined whether the target user has the busy-idle feature through the above steps 401, 402, and 403, and if the target user has the busy-idle feature, step 403 may be executed to determine the first threshold value, and then the time period in which the historical visit volume per unit time period corresponding to each preset period in the HOV is greater than the first threshold value may be screened out as the periodic busy period.

[0135] In addition, for Figure 7C In the example, Figure 7C The figure shows the historical visits of the target user within 15 days. The horizontal axis in the figure is time, the unit time length is one hour, and the vertical axis is the size of the visits, where D01 represents Monday, D02 represents Tuesday, and so on. Using formula (1), it can be determined that the flatness corresponding to the HOV of the target user is greater than the second threshold and has busy and idle characteristics. According to formula (2), the first threshold of the target user can be determined, which is the horizontal line in the figure. Then, based on formula (3), the periodic idle period is determined. Through the method of the present application, it can be determined that Saturday is not a periodic idle period. If based on the method in the prior art, judging whether there is abnormal access based on holidays will obtain inaccurate results, and using the method of the present application to determine whether there is abnormal access will obtain more accurate results.

[0136] In addition, in the present application, when determining whether the target user has the busy-idle feature, the RoF is calculated and compared with the second threshold. If the RoF is greater than the second threshold, it means that the target user has the periodic busy-idle feature; if the RoF is less than or equal to the second threshold, it means that the target user does not have the busy-idle feature. Selecting different second thresholds will result in different results for determining whether the target user has a periodic idle period.

[0137] For example, for the same target user, see Fig.7D , when the second threshold is α1, formula (1) can be used to determine that the target user does not have the busy-idle feature. When the second threshold is α2, Fig. 7E As shown, by using (1), it can be determined that the target user does not have the busy-idle feature, and the target user is in a time period with the idle feature at D13. Under different second thresholds, the judgment results for D13 are different.

[0138] Therefore, it can be Figure 4 After the steps are executed, it is manually determined whether the result of the judgment of the periodic idle period is accurate.

[0139] The above mainly describes the embodiments of the present application from the perspective of the steps executed by the server. It is understandable that, in order to implement the above functions, the server includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present application.

[0140] The embodiment of the present application can divide the functional modules of the server according to the above method example. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0141] In the case of dividing each functional module into corresponding functional modules, Figure 8 A possible composition diagram of the server involved in the above-mentioned embodiments is shown as follows: Figure 8 As shown, the server may include:

[0142] Acquisition module 801 is used to obtain the target user's access to the server within a preset time period.

[0143] Determination module 802 is used to determine whether the target user has abnormal access behavior based on the access volume and the periodic idle period corresponding to the target user; the periodic idle period is determined based on the historical access volume of the target user to the server in multiple unit time periods, and the periodic idle period includes unit time periods that meet the following conditions: the corresponding historical access volume is less than the first threshold, and there are one or more preset periods between each other.

[0144] When the preset time period matches the periodic idle time period and the access volume does not match the access volume corresponding to the periodic idle time period, it is determined that the target user has abnormal access behavior.

[0145] In an optional embodiment, the acquisition module 801 is also used to: obtain the historical visits of the target user to the server in multiple unit time periods, and the multiple unit time periods include a first unit time period; the determination module 802 is also used to: determine that the first unit time period and the second unit time period belong to a periodic idle period when the historical visits corresponding to the first unit time period are less than a first threshold, and the historical visits corresponding to the second unit time period separated from the first unit time period by one or more preset periods are both less than the first threshold.

[0146] In an optional embodiment, the determination module 802 is also used to: determine a first threshold based on the historical visits; wherein the first threshold is determined according to the weighted sum of the maximum historical visits and the minimum historical visits among the historical visits corresponding to multiple unit times; or, the first threshold is determined according to the average value of the historical visits corresponding to multiple unit times.

[0147] In an optional embodiment, the plurality of unit time periods are unit time periods having busy and idle characteristics.

[0148] In an optional embodiment, the determination module 802 is also used to: determine the flatness of the historical visit volumes corresponding to the multiple unit time periods; the flatness is used to indicate the variation range of the historical visit volumes corresponding to the multiple unit time periods, and the flatness is proportional to the variation range; when the flatness is greater than the second threshold, determine that the multiple unit time periods are unit time periods with busy and idle characteristics.

[0149] In an optional embodiment, the determination module 802 is specifically used to: determine the difference between the maximum historical page views and the minimum historical page views in the historical page views corresponding to the multiple unit time periods, and use the ratio of the difference to the minimum historical page views as the flatness.

[0150] In an optional embodiment, when the minimum historical visits are 0, the determination module 802 is specifically used to: use the ratio of the difference to a preset value as the flatness; wherein the preset value is the minimum visits within a unit time period determined based on the user's business characteristics.

[0151] It should be noted that all relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module and will not be repeated here.

[0152] The server provided in the embodiment of the present application is used to execute the above-mentioned method for determining abnormal access behavior, and thus can achieve the same effect as the above-mentioned method for determining abnormal access behavior.

[0153] In the case of an integrated unit, Fig. 9 FIG. 2 shows another possible composition diagram of the server involved in the above embodiment. Fig. 9 As shown, the server includes: a processing module 91 and a communication module 92.

[0154] The processing module 91 is used to control and manage the actions of the server. For example, the processing module 91 is used to support the server to execute Figure 3 Step 301 and step 302 in Figure 4 Step 401, step 402, step 403, step 404, and / or other processes for the technology described herein. The communication module 92 is used to support the communication between the server and other network entities, such as Figure 2A The server may further include a storage module 93 for storing program codes and data of the server.

[0155] The processing module 91 may be a processor or a controller. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. The processor may also be a combination that implements a computing function, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc. The communication module 92 may be a transceiver, a transceiver circuit or a communication interface, etc. The storage module 93 may be a memory.

[0156] Among them, the processing module 91 may correspond to Figure 2B The processor 201 in the storage module 93 may correspond to Figure 2B Memory 202 in.

[0157] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0158] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0159] The units described as separate components may or may not be physically separated, and the components shown as units may be one physical unit or multiple physical units, that is, they may be located in one place or distributed in multiple different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0160] The present application provides a computer-readable storage medium, on which a computer program is stored, and the computer program is used to implement the above-mentioned method for determining abnormal access behavior.

[0161] The present application provides a computer program product, including a computer-readable code, or a non-volatile computer-readable storage medium carrying the computer-readable code. When the computer-readable code runs in an electronic device, a processor in the electronic device executes the above-mentioned method for determining abnormal access behavior.

[0162] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0163] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium, including several instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), disk or optical disk and other media that can store program code.

[0164] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for determining abnormal access behavior, characterized in that: The method comprises: Obtain the target user's access volume to the server within a preset time period; Based on the access volume and the periodic idle period corresponding to the target user, determining whether the target user has abnormal access behavior; the periodic idle period is determined based on the historical access volume of the target user to the server in multiple unit time periods, and the periodic idle period meets the following conditions: in each preset period included in the multiple unit time periods, the historical access volume in the unit time period corresponding to the periodic idle period is less than a first threshold; Among them, when the preset time period matches the periodic idle period, and the access volume does not match the access volume corresponding to the periodic idle period, it is determined that the target user has abnormal access behavior; the preset time period matches the periodic idle period means that the preset time period includes the periodic idle period.

2. The method according to claim 1, characterized in that The method further comprises: Acquire the historical visits of the target user to the server in the multiple unit time periods, where the multiple unit time periods include a first unit time period; When the historical visit volume corresponding to the first unit time period is less than the first threshold, and the historical visit volume corresponding to the second unit time period separated from the first unit time period by one or more preset cycles is less than the first threshold, the unit time period corresponding to the first unit time period within the preset cycle is determined to be the periodic idle period.

3. The method according to claim 2, characterized in that The method further comprises: Determining the first threshold based on the historical page views; The first threshold is determined according to the weighted sum of the maximum and minimum historical visits among the historical visits corresponding to the multiple unit times; or the first threshold is determined according to the average value of the historical visits corresponding to the multiple unit times.

4. The method according to claim 2 or 3, characterized in that: Before determining the periodic idle period, the method further includes: According to the historical visits of the target user to the server in multiple unit time periods, it is determined that the target user is a user with busy-idle characteristics.

5. The method according to claim 4, characterized in that The determining, based on the historical visits of the target user to the server in multiple unit time periods, that the target user is a user with busy-idle characteristics includes: According to the historical visits of the target user to the server in multiple unit time periods, determine the flatness of the historical visits corresponding to the multiple unit time periods; the flatness is used to indicate the change range of the historical visits corresponding to the multiple unit time periods, and the flatness is proportional to the change range; When the flatness is greater than a second threshold, it is determined that the target user is a user with a busy / idle feature.

6. The method according to claim 5, characterized in that The determining the flatness of the historical visit volumes corresponding to the multiple unit time periods includes: Determine a difference between a maximum historical pageview amount and a minimum historical pageview amount among the historical pageview amounts corresponding to the multiple unit time periods, and use a ratio of the difference to the first value as the flatness; Wherein, the first value is: The minimum historical visits; Or, the maximum value of the minimum historical page views and a second value; the second value is the minimum page views within a unit time period determined based on the service characteristics of the target user.

7. A device for determining abnormal access behavior, characterized in that: The device comprises: The acquisition module is used to obtain the number of visits to the server by the target user within a preset time period; A determination module, configured to determine whether the target user has abnormal access behavior based on the access volume and the periodic idle period corresponding to the target user; the periodic idle period is determined based on the historical access volume of the target user to the server in multiple unit time periods, and the periodic idle period meets the following conditions: within each preset period included in the multiple unit time periods, the historical access volume in the unit time period corresponding to the periodic idle period is less than a first threshold; Among them, when the preset time period matches the periodic idle period, and the access volume does not match the access volume corresponding to the periodic idle period, it is determined that the target user has abnormal access behavior; the preset time period matches the periodic idle period means that the preset time period includes the periodic idle period.

8. The device according to claim 7, characterized in that The acquisition module is further used to: acquire the historical visits of the target user to the server in the multiple unit time periods, the multiple unit time periods including the first unit time period; The determination module is also used to: when the historical visit volume corresponding to the first unit time period is less than the first threshold, and the historical visit volume corresponding to the second unit time period separated from the first unit time period by one or more preset cycles is less than the first threshold, determine that the unit time period corresponding to the first unit time period within the preset cycle is the periodic idle period.

9. The device according to claim 8, characterized in that The determining module is also used for: Determining the first threshold based on the historical page views; The first threshold is determined according to the weighted sum of the maximum and minimum historical visits among the historical visits corresponding to the multiple unit times; or the first threshold is determined according to the average value of the historical visits corresponding to the multiple unit times.

10. The device according to claim 8 or 9, characterized in that Before determining the periodic idle period, the determining module is further configured to: According to the historical visits of the target user to the server in multiple unit time periods, it is determined that the target user is a user with busy-idle characteristics.

11. The device according to claim 10, characterized in that The determination module is specifically used for: According to the historical visits of the target user to the server in multiple unit time periods, determine the flatness of the historical visits corresponding to the multiple unit time periods; the flatness is used to indicate the change range of the historical visits corresponding to the multiple unit time periods, and the flatness is proportional to the change range; When the flatness is greater than a second threshold, it is determined that the target user is a user with a busy / idle feature.

12. The device according to claim 11, characterized in that The determination module is specifically used for: Determine a difference between a maximum historical pageview amount and a minimum historical pageview amount among the historical pageview amounts corresponding to the multiple unit time periods, and use a ratio of the difference to the first value as the flatness; Wherein, the first value is: The minimum historical visits; Or, the maximum value of the minimum historical page views and a second value; the second value is the minimum page views within a unit time period determined based on the service characteristics of the target user.

13. An electronic device, characterized in that: It comprises a memory and a processor, wherein the memory is used to store a computer program, and the processor is used to execute the computer program to implement the method for determining abnormal access behavior as described in any one of claims 1 to 6.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is used to implement the method for determining abnormal access behavior according to any one of claims 1 to 6.

15. A computer program product, characterized in that The method comprises a computer-readable code. When the computer-readable code is executed in an electronic device, a processor in the electronic device executes the method for determining abnormal access behavior according to any one of claims 1 to 6.

Images