Network abnormal access identification method and device, electronic equipment and storage medium

Abstract

The application provides a network abnormal access identification method and device, an electronic device and a storage medium. By determining a target address and a corresponding address type, determining different analysis manners according to the address attribute of the target address being an isolated target address or address segment, analyzing the access behavior of each target address, further determining an abnormal address through the characteristics of the access behavior and shielding the abnormal address. Therefore, the method reduces the complexity of the processing flow, can be deployed on a system with low hardware resource demand, simplifies the network abnormal access identification flow, and improves the network abnormal access identification efficiency.

Description

Technical Field

[0001] This application relates to information security technology, and in particular to a method, apparatus, electronic device and storage medium for identifying abnormal network access. Background Technology

[0002] With the increasing number of network access devices, identifying abnormal IPs accessing network device resources through network anomaly detection methods has become a core aspect of preventing network attacks. Existing network anomaly detection methods mainly rely on highly complex algorithms, resulting in high learning costs for identifying abnormal IPs and requiring significant hardware resources for deployment.

[0003] Therefore, a method for identifying abnormal network access is needed to reduce the hardware resources required for deployment and improve the efficiency of identifying abnormal network access. Summary of the Invention

[0004] This application provides a method, apparatus, electronic device, and storage medium for identifying abnormal network access, in order to solve the problems of complex models, high learning costs, and large hardware resources required for deployment in the current process of identifying abnormal network access.

[0005] Firstly, this application provides a method for identifying abnormal network access, including:

[0006] Determine the target addresses and the address type of each target address;

[0007] Address types include isolated target addresses or target address ranges;

[0008] Based on the address type of each target address, analyze the access behavior of each target address, and identify abnormal addresses based on the access behavior;

[0009] The identified abnormal addresses will be masked.

[0010] As an optional implementation, the access behavior of each target address is analyzed based on its address type, and abnormal addresses are identified based on the access behavior, including:

[0011] Based on the address type of each target address, analyze the access behavior of each target address and determine whether each target address meets the abnormal conditions in the address blacklist;

[0012] The address blacklist is used to indicate the address characteristics of abnormal addresses;

[0013] If the target address is determined to meet the abnormal conditions in the address blacklist, or the access behavior of the target address meets the preset judgment conditions, then the corresponding target address will be determined as an abnormal address.

[0014] As an optional implementation, based on the address type of each target address, the access behavior of each target address is analyzed, and it is determined whether each target address meets the abnormal conditions in the address blacklist, including:

[0015] Based on the address type of each target address, analyze the access behavior of each target address, and determine the behavior type and corresponding behavior parameters of the access behavior;

[0016] Based on the address type of each target address, a preset model is used to determine whether each target address meets the abnormal conditions in the address blacklist.

[0017] Furthermore, if a target address is determined to meet the abnormal conditions in the address blacklist, or if the access behavior of the target address meets the preset judgment conditions, then the corresponding target address will be identified as an abnormal address, including:

[0018] If the behavior type of the target address access behavior is determined to be consistent with the preset type and the behavior parameters exceed the preset threshold, or if the target address is determined to meet the abnormal conditions in the address blacklist, then the corresponding target address will be determined as an abnormal address.

[0019] Furthermore, after performing masking operations on the identified abnormal addresses, the method also includes:

[0020] The identified abnormal addresses will be added to the address blacklist.

[0021] As an optional implementation, the target address is an isolated target address. Based on the address type of each target address, the access behavior of each target address is analyzed, and the behavior type and corresponding behavior parameters of the access behavior are determined, including:

[0022] Determine the access records for the target address;

[0023] The access records are used to indicate the accessed address, access time, and access frequency corresponding to each target address;

[0024] Based on the access records, determine the access behavior of each target address, and determine the behavior type and corresponding behavior parameters of the access behavior;

[0025] Furthermore, if the behavior type of the target address access behavior is determined to be consistent with a preset type and the behavior parameters exceed a preset threshold, or if the target address is determined to meet the abnormal conditions in the address blacklist, then the corresponding target address will be identified as an abnormal address, including:

[0026] If the target address contains access records exceeding the first threshold within the first preset time period, and the corresponding access time is an abnormal time;

[0027] Alternatively, if the target address has more than two access records to the same accessed address within the second preset time period, and the corresponding access time is an abnormal time;

[0028] Alternatively, if the target address is determined to meet the abnormal conditions in the address blacklist, then the corresponding target address is identified as an abnormal address.

[0029] As an optional implementation, the address type of the target address is a target address range. Based on the address type of each target address, the access behavior of each target address is analyzed, and the behavior type and corresponding behavior parameters of the access behavior are determined, including:

[0030] Determine the access records for the target address;

[0031] The access records are used to indicate the visited address, access time, and access frequency corresponding to the target address range;

[0032] Based on the access records, determine the access behavior of the target address range, and determine the behavior type and corresponding behavior parameters of the access behavior;

[0033] Furthermore, if the behavior type of the target address access behavior is determined to be consistent with a preset type and the behavior parameters exceed a preset threshold, or if the target address is determined to meet the abnormal conditions in the address blacklist, then the corresponding target address will be identified as an abnormal address, including:

[0034] Determine if there are address conditions indicating a target address range in the address blacklist. If it is determined that there are address conditions indicating a target address range in the address blacklist, then each target address belonging to the target address range is identified as an abnormal address.

[0035] If it is determined that there is no address condition indicating the target address range in the address blacklist, then based on the behavior type and behavior parameters of the target address range, it is determined whether the target address range meets the preset behavior conditions. If it is determined that the target address range meets the preset behavior conditions, then each target address belonging to the target address range is identified as an abnormal address.

[0036] Among them, the behavioral conditions include:

[0037] If the target address range has more than the third access threshold within the third preset time period, and the corresponding access time is an abnormal time, or if the target address range has more than the fourth access threshold for the same accessed address within the fourth preset time period, and the corresponding access time is an abnormal time.

[0038] Secondly, this application provides a network abnormal access identification device, the device comprising:

[0039] The acquisition module is used to determine the target address and the address type of each target address;

[0040] Address types include isolated target addresses or target address ranges;

[0041] The processing module is used to analyze the access behavior of each target address based on its address type, and to identify abnormal addresses based on the access behavior.

[0042] The processing module is also used to perform masking operations on the identified abnormal addresses.

[0043] As an optional implementation, the processing module analyzes the access behavior of each target address based on its address type, and determines the specific method of identifying abnormal addresses based on the access behavior, including:

[0044] Based on the address type of each target address, analyze the access behavior of each target address and determine whether each target address meets the abnormal conditions in the address blacklist;

[0045] The address blacklist is used to indicate the address characteristics of abnormal addresses;

[0046] If the target address is determined to meet the abnormal conditions in the address blacklist, or the access behavior of the target address meets the preset judgment conditions, then the corresponding target address will be determined as an abnormal address.

[0047] As an optional implementation, the processing module analyzes the access behavior of each target address based on its address type and determines whether each target address meets the abnormal conditions in the address blacklist in the following specific ways:

[0048] Based on the address type of each target address, analyze the access behavior of each target address, and determine the behavior type and corresponding behavior parameters of the access behavior;

[0049] Based on the address type of each target address, a preset model is used to determine whether each target address meets the abnormal conditions in the address blacklist.

[0050] Furthermore, if the processing module determines that the target address meets the abnormal conditions in the address blacklist, or that the access behavior of the target address meets the preset judgment conditions, the specific methods for determining the corresponding target address as an abnormal address include:

[0051] If the behavior type of the target address access behavior is determined to be consistent with the preset type and the behavior parameters exceed the preset threshold, or if the target address is determined to meet the abnormal conditions in the address blacklist, then the corresponding target address will be determined as an abnormal address.

[0052] In addition, the processing module is also used to add the identified abnormal addresses to the address blacklist after performing the blocking operation on each identified abnormal address.

[0053] As an optional implementation, the target address is an isolated target address. The processing module analyzes the access behavior of each target address based on its address type, and determines the behavior type and corresponding behavior parameters, including:

[0054] Determine the access records for the target address;

[0055] The access records are used to indicate the accessed address, access time, and access frequency corresponding to each target address;

[0056] Based on the access records, determine the access behavior of each target address, and determine the behavior type and corresponding behavior parameters of the access behavior;

[0057] Furthermore, if the processing module determines that the behavior type of the target address access behavior matches a preset type and the behavior parameters exceed a preset threshold, or if it determines that the target address meets the abnormal conditions in the address blacklist, the specific methods for identifying the corresponding target address as an abnormal address include:

[0058] If the target address contains access records exceeding the first threshold within the first preset time period, and the corresponding access time is an abnormal time;

[0059] Alternatively, if the target address has more than two access records to the same accessed address within the second preset time period, and the corresponding access time is an abnormal time;

[0060] Alternatively, if the target address is determined to meet the abnormal conditions in the address blacklist, then the corresponding target address is identified as an abnormal address.

[0061] As an optional implementation, the target address's address type is a target address range. The processing module analyzes the access behavior of each target address based on its address type, and determines the behavior type and corresponding behavior parameters, including:

[0062] Determine the access records for the target address;

[0063] The access records are used to indicate the visited address, access time, and access frequency corresponding to the target address range;

[0064] Based on the access records, determine the access behavior of the target address range, and determine the behavior type and corresponding behavior parameters of the access behavior;

[0065] Furthermore, if the processing module determines that the behavior type of the target address access behavior matches a preset type and the behavior parameters exceed a preset threshold, or if it determines that the target address meets the abnormal conditions in the address blacklist, the specific methods for identifying the corresponding target address as an abnormal address include:

[0066] Determine if there are address conditions indicating a target address range in the address blacklist. If it is determined that there are address conditions indicating a target address range in the address blacklist, then each target address belonging to the target address range is identified as an abnormal address.

[0067] If it is determined that there is no address condition indicating the target address range in the address blacklist, then based on the behavior type and behavior parameters of the target address range, it is determined whether the target address range meets the preset behavior conditions. If it is determined that the target address range meets the preset behavior conditions, then each target address belonging to the target address range is identified as an abnormal address.

[0068] Among them, the behavioral conditions include:

[0069] If the target address range has more than the third access threshold within the third preset time period, and the corresponding access time is an abnormal time, or if the target address range has more than the fourth access threshold for the same accessed address within the fourth preset time period, and the corresponding access time is an abnormal time.

[0070] Thirdly, this application also provides an electronic device, comprising:

[0071] At least one processor; and

[0072] A memory that is communicatively connected to at least one processor; wherein,

[0073] The memory stores instructions that can be executed by at least one processor, such that the instructions are executed by at least one processor to enable the at least one processor to perform the method as described in the first aspect.

[0074] Fourthly, this application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the method as described in the first aspect.

[0075] The network abnormal access identification method, apparatus, electronic device, and storage medium provided in this application determine the target address and its corresponding address type, and determine different analysis methods based on the address attributes of the target address, such as whether it is an isolated target address or an address range. They then analyze the access behavior of each target address and further identify and block abnormal addresses based on the characteristics of the access behavior. As a result, this method reduces the complexity of the processing flow, can be deployed on systems with low hardware resource requirements, simplifies the network abnormal access identification process, and improves the efficiency of network abnormal access identification. Attached Figure Description

[0076] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0077] Figure 1 This is a flowchart illustrating a method for identifying abnormal network access disclosed in an embodiment of the present invention;

[0078] Figure 2 This is a flowchart illustrating another method for identifying abnormal network access disclosed in an embodiment of the present invention;

[0079] Figure 3 This is a schematic diagram of the structure of a network abnormal access identification device disclosed in an embodiment of the present invention;

[0080] Figure 4 This is a schematic diagram of the structure of an electronic device for identifying abnormal network access disclosed in an embodiment of the present invention;

[0081] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0082] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0083] With the increasing number of network access devices, identifying abnormal IPs accessing network device resources through network anomaly detection methods has become a core aspect of preventing network attacks. Existing network anomaly detection methods mainly rely on highly complex algorithms, such as large-scale machine learning or neural network algorithms. Such methods have high learning costs for identifying abnormal IPs and require large hardware resources for deployment.

[0084] Therefore, a method for identifying abnormal network access is needed to reduce the hardware resources required for deployment and improve the efficiency of identifying abnormal network access. The technical concept of this application lies in determining the target address and its corresponding address type, and based on the address attribute of the target address (whether it is an isolated target address or an address range), determining different analysis methods, and analyzing the access behavior of each target address accordingly. Abnormal addresses are further identified and blocked based on the characteristics of the access behavior. Address characteristics can be compared using methods such as blacklists, and access behavior characteristics can be compared using preset behavioral conditions. These two aspects of information can be used to determine whether a target address is an abnormal address. This reduces the complexity of the processing flow, allows it to be deployed on systems with low hardware resource requirements, simplifies the network abnormal access identification process, and improves the efficiency of network abnormal access identification.

[0085] Example 1

[0086] Please see Figure 1 , Figure 1 This is a flowchart illustrating a method for identifying abnormal network access disclosed in an embodiment of the present invention. Figure 1 As shown, the method includes:

[0087] S101. Determine the target address and the address type of each target address;

[0088] Address types include isolated target addresses or target address ranges;

[0089] The access behavior characteristics of isolated target addresses and target address ranges may differ, and different analysis methods can be used when analyzing their access behavior. For details, please refer to the relevant content in Embodiment 2. Furthermore, this application also relates to methods for determining abnormal addresses based on address characteristics in an address blacklist. The address characteristics of a target address may also differ depending on its address type; therefore, it is necessary to classify it by address type. The methods for classifying address types can be based on the address data itself, or on the attributes indicated by the address data. For example, multiple isolated target addresses belonging to the same area or the same business function can be classified into a single target address range, and are not limited to the address data itself.

[0090] S102. Analyze the access behavior of each target address based on its address type, and identify the abnormal addresses based on the access behavior.

[0091] As mentioned earlier, the methods for analyzing access behavior differ depending on the address type, as detailed in Example 2. Since the behavior of isolated target addresses in abnormal access differs from that of addresses within a target address range, and since the abnormal access behaviors of addresses within a target address range share commonalities, dividing addresses in this way can further improve the efficiency of abnormal access identification.

[0092] S103. Perform a masking operation on each identified abnormal address.

[0093] Based on the corresponding device node, the corresponding blocking operation can be performed. In addition, after the address is blocked, the abnormal address can be updated to the blacklist in real time, and this can be used as a new database to perform network abnormal access identification operation.

[0094] This embodiment determines the target address and its corresponding address type, and determines different analysis methods based on whether the target address is an isolated target address or an address range. It then analyzes the access behavior of each target address and further identifies and blocks abnormal addresses based on the characteristics of the access behavior. As a result, this method reduces the complexity of the processing flow, can be deployed on systems with low hardware resource requirements, simplifies the network abnormal access identification process, and improves the efficiency of network abnormal access identification.

[0095] Example 2

[0096] Please see Figure 2 , Figure 2 This is a flowchart illustrating another method for identifying abnormal network access disclosed in an embodiment of the present invention. Figure 2 As shown, the method includes:

[0097] S201. Determine the target address and the address type of each target address;

[0098] Address types include isolated target addresses or target address ranges;

[0099] S202. Based on the address type of each target address, analyze the access behavior of each target address and determine whether each target address meets the abnormal conditions in the address blacklist.

[0100] The address blacklist is used to indicate the address characteristics of abnormal addresses;

[0101] S203. If the target address is determined to meet the abnormal conditions in the address blacklist, or the access behavior of the target address meets the preset judgment conditions, then the corresponding target address is determined to be an abnormal address.

[0102] Access behavior and address characteristics can be used together as criteria for judging abnormal addresses. In practical application scenarios, the priority order of these two conditions can also be determined according to specific needs. One feasible implementation method is to first determine whether the address characteristics of each target address meet the abnormal address characteristics indicated by the address blacklist, or directly determine whether the target address is in the address blacklist. If it does not meet the corresponding address conditions, then its access behavior is judged. Based on the behavioral characteristics and related parameters of the access behavior, it is determined whether it is an abnormal address.

[0103] S204. Perform a masking operation on each identified abnormal address.

[0104] As an optional implementation, based on the address type of each target address, the access behavior of each target address is analyzed, and it is determined whether each target address meets the abnormal conditions in the address blacklist, including:

[0105] Based on the address type of each target address, analyze the access behavior of each target address, and determine the behavior type and corresponding behavior parameters of the access behavior;

[0106] Based on the address type of each target address, a preset model is used to determine whether each target address meets the abnormal conditions in the address blacklist.

[0107] The preset model here refers to a lightweight artificial intelligence model or mathematical computation model. The definition of "lightweight" can be set according to the definition in this field or specific needs. Alternatively, no corresponding model can be set, and the determination of whether each target address is in the blacklist can be made directly by comparison or traversal search, or by judging whether the corresponding address characteristics meet the conditions indicated by the abnormal address.

[0108] Furthermore, if a target address is determined to meet the abnormal conditions in the address blacklist, or if the access behavior of the target address meets the preset judgment conditions, then the corresponding target address will be identified as an abnormal address, including:

[0109] If the behavior type of the target address access behavior is determined to be consistent with the preset type and the behavior parameters exceed the preset threshold, or if the target address is determined to meet the abnormal conditions in the address blacklist, then the corresponding target address will be determined as an abnormal address.

[0110] Furthermore, after performing masking operations on the identified abnormal addresses, the method also includes:

[0111] The identified abnormal addresses will be added to the address blacklist.

[0112] As mentioned before, the address blacklist can serve as a database of address characteristics, allowing corresponding hardware to perform comparison or matching functions for each target address.

[0113] By further identifying the access behavior, the behavior type and behavior parameters corresponding to each target address are determined. Based on the preset calculation model or judgment method, it is determined whether the target address meets the address characteristics indicated in the blacklist. When the target address's behavior type and behavior parameters meet the preset conditions, or when the target address is determined to meet the abnormal conditions in the address blacklist, it can be identified as an abnormal address and then added to the address blacklist. This reduces the complexity of the processing flow and can be deployed on systems with low hardware resource requirements, simplifying the network abnormal access identification process. The design of the address blacklist also helps to further improve the efficiency of network abnormal access identification.

[0114] As an optional implementation, the target address is an isolated target address. Based on the address type of each target address, the access behavior of each target address is analyzed, and the behavior type and corresponding behavior parameters of the access behavior are determined, including:

[0115] Determine the access records for the target address;

[0116] The access records are used to indicate the accessed address, access time, and access frequency corresponding to each target address;

[0117] Based on the access records, determine the access behavior of each target address, and determine the behavior type and corresponding behavior parameters of the access behavior;

[0118] Furthermore, if the behavior type of the target address access behavior is determined to be consistent with a preset type and the behavior parameters exceed a preset threshold, or if the target address is determined to meet the abnormal conditions in the address blacklist, then the corresponding target address will be identified as an abnormal address, including:

[0119] If the target address contains access records exceeding the first threshold within the first preset time period, and the corresponding access time is an abnormal time;

[0120] The aforementioned target address has access records exceeding the first threshold within a first preset time period, meaning the access frequency of the target address exceeds the corresponding threshold within the first preset time period. Subsequent conditions have similar equivalent expressions. For example, in an application scenario, if the same target address has access records with abnormal times within four consecutive weeks, it can be considered an abnormal address, blocked, and blacklisted. The abnormal time here can also be determined according to actual needs. For example, times outside of regular working hours, such as 10 PM to 6 AM the next day, can be considered abnormal times. In this application, the network abnormal access identification work is performed on preset target nodes. Therefore, the aforementioned access time, access records, etc., all refer to relevant information about the target address accessing the preset target node. The visited address mentioned in this embodiment is the address information corresponding to the preset target node in the network.

[0121] Alternatively, if the target address has more than two access records to the same accessed address within the second preset time period, and the corresponding access time is an abnormal time;

[0122] In a specific application scenario, this condition can be applied as follows: if the same target address is accessed by the same accessed address at abnormal times for two consecutive weeks, then the target address is considered an abnormal address.

[0123] Alternatively, if the target address is determined to meet the abnormal conditions in the address blacklist, then the corresponding target address is identified as an abnormal address.

[0124] Address characteristics in the address blacklist can be directly used to determine abnormal addresses. In practical applications, this condition can take precedence over other conditions. If the target address is in the address blacklist, or its address characteristics match the address conditions described in the address blacklist, it is directly identified as the target address. If the condition is not met, then its access behavior is judged.

[0125] Access records can be used to identify access behavior characteristics such as access behavior and behavior parameters of each isolated target address. Then, based on preset judgment conditions, it can be determined whether the corresponding target address is an abnormal address, which reduces the complexity of the processing flow. It can be deployed on systems with low hardware resource requirements, simplifying the network abnormal access identification process and improving the efficiency of network abnormal access identification.

[0126] As an optional implementation, the address type of the target address is a target address range. Based on the address type of each target address, the access behavior of each target address is analyzed, and the behavior type and corresponding behavior parameters of the access behavior are determined, including:

[0127] Determine the access records for the target address;

[0128] The access records are used to indicate the visited address, access time, and access frequency corresponding to the target address range;

[0129] Based on the access records, determine the access behavior of the target address range, and determine the behavior type and corresponding behavior parameters of the access behavior;

[0130] Furthermore, if the behavior type of the target address access behavior is determined to be consistent with a preset type and the behavior parameters exceed a preset threshold, or if the target address is determined to meet the abnormal conditions in the address blacklist, then the corresponding target address will be identified as an abnormal address, including:

[0131] Determine if there are address conditions indicating a target address range in the address blacklist. If it is determined that there are address conditions indicating a target address range in the address blacklist, then each target address belonging to the target address range is identified as an abnormal address.

[0132] As mentioned before, address criteria in the address blacklist can be used as a basis for determining higher priority.

[0133] If it is determined that there is no address condition indicating the target address range in the address blacklist, then based on the behavior type and behavior parameters of the target address range, it is determined whether the target address range meets the preset behavior conditions. If it is determined that the target address range meets the preset behavior conditions, then each target address belonging to the target address range is identified as an abnormal address.

[0134] Among them, the behavioral conditions include:

[0135] If the target address range has more than the third access threshold within the third preset time period, and the corresponding access time is an abnormal time, or if the target address range has more than the fourth access threshold for the same accessed address within the fourth preset time period, and the corresponding access time is an abnormal time.

[0136] The specific implementation method of the behavioral conditions can be found in the corresponding description in the next implementation method.

[0137] Access records can identify access behavior characteristics such as access behavior and behavior parameters for each target address range. Then, based on preset judgment conditions, it can determine whether the corresponding target address is an abnormal address by access behavior characteristics or address blacklists. This reduces the complexity of the processing flow and can be deployed on systems with low hardware resource requirements, simplifying the network abnormal access identification process and improving the efficiency of network abnormal access identification.

[0138] In one application scenario, the specific implementation of the method provided in this application may be as follows:

[0139] Step 1: Summarize the IPs that appear within a certain time period and divide them into multiple IPs that can be divided into IP segments and a single independent IP, namely the isolated target address or target address segment mentioned above in this application. In this embodiment, a single independent IP refers to the aforementioned isolated target address, and multiple IPs that can be divided into IP segments refer to the aforementioned target address segment.

[0140] Step 2: Judge individual IPs. Due to the covert and intermittent nature of attacks, abnormal behavior usually does not involve continuous access, but rather intermittent and irregular periodic access. Therefore, access behavior can be judged for individual IPs.

[0141] Step 3: Determine if the access behavior meets the following conditions. If it does, it is considered abnormal access: Based on the existing address blacklist, the addresses in the blacklist will be directly identified as abnormal IPs. If they are not in the blacklist, proceed to Step 4 for further determination.

[0142] Step 4: If either of the following two conditions is met, the access is considered abnormal, the IP is identified as an abnormal IP, and the blacklist is updated: 1. The same IP has access records for 4 consecutive weeks, and the access time is outside of normal working hours; 2. The same accessed IP is accessed by the same IP for 2 consecutive weeks, and the access time is outside of normal working hours.

[0143] Step 5: When multiple IPs are divided into one IP segment, check if there are any IPs belonging to this IP segment in the blacklist. If there are, proceed to step 6; otherwise, proceed to step 7.

[0144] Step 6: If the IPs in this network segment have access records every day for 7 consecutive days, and the access time is outside of normal working hours, then the IPs in this network segment in this batch are determined to be abnormal IPs, and the blacklist is updated.

[0145] Step 7: If an IP address in this network segment has a record of accessing the same IP address every day for 30 consecutive days, then the IP addresses in this batch in this network segment are determined to be abnormal IP addresses, and the blacklist is updated.

[0146] Step 8: Once an IP is identified as an abnormal IP, block the IP on the managed device node to prevent access.

[0147] This embodiment can determine whether a target address meets preset judgment conditions by analyzing the access behavior of the target address and the abnormal address characteristics indicated by the blacklist. If the address characteristics or access behavior meet the corresponding conditions, it can be identified as an abnormal address, which reduces the complexity of the processing flow and can be deployed on systems with low hardware resource requirements. This simplifies the network abnormal access identification process and improves the efficiency of network abnormal access identification.

[0148] Example 3

[0149] This invention also provides a network abnormal access identification device to implement the aforementioned method. Please refer to [link to relevant documentation]. Figure 3 , Figure 3 This is a schematic diagram of the structure of a network abnormal access identification device disclosed in an embodiment of the present invention. Figure 3 As shown, based on any other embodiment, the apparatus includes:

[0150] The acquisition module 31 is used to determine the target address and the address type of each target address;

[0151] Address types include isolated target addresses or target address ranges;

[0152] The processing module 32 is used to analyze the access behavior of each target address according to the address type of each target address, and determine the abnormal address based on the access behavior.

[0153] The processing module 32 is also used to perform a masking operation on each of the identified abnormal addresses.

[0154] By determining the target address and its corresponding address type, and based on whether the target address is an isolated target address or an address range, different analysis methods are determined, and the access behavior of each target address is analyzed accordingly. By further identifying the abnormal addresses based on the characteristics of the access behavior, the abnormal addresses are identified and blocked. Thus, this method reduces the complexity of the processing flow, can be deployed on systems with low hardware resource requirements, simplifies the network abnormal access identification process, and improves the efficiency of network abnormal access identification.

[0155] As an optional implementation, the processing module 32 analyzes the access behavior of each target address based on its address type, and determines the specific method of identifying abnormal addresses based on the access behavior, including:

[0156] Based on the address type of each target address, analyze the access behavior of each target address and determine whether each target address meets the abnormal conditions in the address blacklist;

[0157] The address blacklist is used to indicate the address characteristics of abnormal addresses;

[0158] If the target address is determined to meet the abnormal conditions in the address blacklist, or the access behavior of the target address meets the preset judgment conditions, then the corresponding target address will be determined as an abnormal address.

[0159] By analyzing the access behavior of the target address and the abnormal address characteristics indicated by the blacklist, it can be determined whether the target address meets the preset judgment conditions. If the address characteristics or access behavior meet the corresponding conditions, it can be identified as an abnormal address, which reduces the complexity of the processing flow and can be deployed on systems with low hardware resource requirements. This simplifies the network abnormal access identification process and improves the efficiency of network abnormal access identification.

[0160] As an optional implementation, the processing module 32 analyzes the access behavior of each target address based on its address type and determines the specific method by which it determines whether each target address meets the abnormal conditions in the address blacklist, including:

[0161] Based on the address type of each target address, analyze the access behavior of each target address, and determine the behavior type and corresponding behavior parameters of the access behavior;

[0162] Based on the address type of each target address, a preset model is used to determine whether each target address meets the abnormal conditions in the address blacklist.

[0163] Furthermore, if the processing module 32 determines that the target address meets the abnormal conditions in the address blacklist, or that the access behavior of the target address meets the preset judgment conditions, the specific methods for determining the corresponding target address as an abnormal address include:

[0164] If the behavior type of the target address access behavior is determined to be consistent with the preset type and the behavior parameters exceed the preset threshold, or if the target address is determined to meet the abnormal conditions in the address blacklist, then the corresponding target address will be determined as an abnormal address.

[0165] In addition, the processing module 32 is also used to add the identified abnormal addresses to the address blacklist after performing the masking operation on each identified abnormal address.

[0166] By further identifying the access behavior, the behavior type and behavior parameters corresponding to each target address are determined. Based on the preset calculation model or judgment method, it is determined whether the target address meets the address characteristics indicated in the blacklist. When the target address's behavior type and behavior parameters meet the preset conditions, or when the target address is determined to meet the abnormal conditions in the address blacklist, it can be identified as an abnormal address and then added to the address blacklist. This reduces the complexity of the processing flow and can be deployed on systems with low hardware resource requirements, simplifying the network abnormal access identification process. The design of the address blacklist also helps to further improve the efficiency of network abnormal access identification.

[0167] As an optional implementation, the target address is an isolated target address. The processing module 32 analyzes the access behavior of each target address based on its address type, and determines the behavior type and corresponding behavior parameters, including:

[0168] Determine the access records for the target address;

[0169] The access records are used to indicate the accessed address, access time, and access frequency corresponding to each target address;

[0170] Based on the access records, determine the access behavior of each target address, and determine the behavior type and corresponding behavior parameters of the access behavior;

[0171] Furthermore, if the processing module 32 determines that the behavior type of the target address access behavior matches a preset type and the behavior parameters exceed a preset threshold, or determines that the target address meets the abnormal conditions in the address blacklist, the specific methods for determining the corresponding target address as an abnormal address include:

[0172] If the target address contains access records exceeding the first threshold within the first preset time period, and the corresponding access time is an abnormal time;

[0173] Alternatively, if the target address has more than two access records to the same accessed address within the second preset time period, and the corresponding access time is an abnormal time;

[0174] Alternatively, if the target address is determined to meet the abnormal conditions in the address blacklist, then the corresponding target address is identified as an abnormal address.

[0175] Access records can be used to identify access behavior characteristics such as access behavior and behavior parameters of each isolated target address. Then, based on preset judgment conditions, it can be determined whether the corresponding target address is an abnormal address, which reduces the complexity of the processing flow. It can be deployed on systems with low hardware resource requirements, simplifying the network abnormal access identification process and improving the efficiency of network abnormal access identification.

[0176] As an optional implementation, the address type of the target address is a target address range. The processing module 32 analyzes the access behavior of each target address based on its address type, and determines the behavior type and corresponding behavior parameters, including:

[0177] Determine the access records for the target address;

[0178] The access records are used to indicate the visited address, access time, and access frequency corresponding to the target address range;

[0179] Based on the access records, determine the access behavior of the target address range, and determine the behavior type and corresponding behavior parameters of the access behavior;

[0180] Furthermore, if the processing module 32 determines that the behavior type of the target address access behavior matches a preset type and the behavior parameters exceed a preset threshold, or determines that the target address meets the abnormal conditions in the address blacklist, the specific methods for determining the corresponding target address as an abnormal address include:

[0181] Determine if there are address conditions indicating a target address range in the address blacklist. If it is determined that there are address conditions indicating a target address range in the address blacklist, then each target address belonging to the target address range is identified as an abnormal address.

[0182] If it is determined that there is no address condition indicating the target address range in the address blacklist, then based on the behavior type and behavior parameters of the target address range, it is determined whether the target address range meets the preset behavior conditions. If it is determined that the target address range meets the preset behavior conditions, then each target address belonging to the target address range is identified as an abnormal address.

[0183] Among them, the behavioral conditions include:

[0184] If the target address range has more than the third access threshold within the third preset time period, and the corresponding access time is an abnormal time, or if the target address range has more than the fourth access threshold for the same accessed address within the fourth preset time period, and the corresponding access time is an abnormal time.

[0185] Access records can identify access behavior characteristics such as access behavior and behavior parameters for each target address range. Then, based on preset judgment conditions, it can determine whether the corresponding target address is an abnormal address by access behavior characteristics or address blacklists. This reduces the complexity of the processing flow and can be deployed on systems with low hardware resource requirements, simplifying the network abnormal access identification process and improving the efficiency of network abnormal access identification.

[0186] Example 4

[0187] This application provides an electronic device, including:

[0188] At least one processor; and

[0189] A memory that is communicatively connected to at least one processor; wherein,

[0190] The memory stores instructions that can be executed by at least one processor to enable the at least one processor to perform the method as described in any of the embodiments.

[0191] This application provides a computer-readable storage medium storing computer-executable instructions that, when executed by a processor, are used to implement the method as described in any of the embodiments.

[0192] For details, please refer to Figure 4 , Figure 4 This is a schematic diagram of the structure of an electronic device disclosed in an embodiment of the present invention. For example... Figure 4 As shown, the electronic device may include:

[0193] The device includes a processor 291 and a memory 292 storing executable program code; it may also include a communication interface 293 and a bus 294. The processor 291, memory 292, and communication interface 293 can communicate with each other via the bus 294. The communication interface 293 can be used for information transmission. The processor 291 is coupled to the memory 292, and the processor 291 can call logical instructions (executable program code) in the memory 292 to execute the text processing model training method of any of the above embodiments.

[0194] Furthermore, the logic instructions in the aforementioned memory 292 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium.

[0195] The memory 292, as a computer-readable storage medium, can be used to store software programs and computer-executable programs, such as program instructions / modules corresponding to the methods in the embodiments of this application. The processor 291 executes functional applications and data processing by running the software programs, instructions, and modules stored in the memory 292, thereby implementing the methods in the above-described method embodiments.

[0196] The memory 292 may include a program storage area and a data storage area. The program storage area may store the operating system and application programs required for at least one function; the data storage area may store data created based on the use of the terminal device. Furthermore, the memory 292 may include high-speed random access memory and may also include non-volatile memory.

[0197] This invention also provides a computer-readable storage medium storing computer-executable instructions, which, when invoked, are used to implement the method in any of the embodiments.

[0198] This invention also discloses a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to cause a computer to perform the steps in the text processing model training method described in any embodiment.

[0199] The device embodiments described above are merely illustrative. The modules described as separate components may or may not be physically separate, and the components shown as modules may or may not be physical modules; that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0200] Through the detailed description of the above embodiments, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, including read-only memory (ROM), random access memory (RAM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), one-time programmable read-only memory (OTPROM), electrically-Erasable Programmable Read-Only Memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, disk storage, magnetic tape storage, or any other computer-readable medium that can be used to carry or store data.

[0201] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0202] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A method for identifying abnormal network access, characterized in that, The method includes: Determine the target address and determine the address type of each target address; wherein the address type includes an isolated target address or a target address range; Based on the address type of each target address, analyze the access behavior of each target address, and determine the behavior type and corresponding behavior parameters of the access behavior; Based on the address type of each target address, a preset model is used to determine whether each target address meets the abnormal conditions in the address blacklist; wherein, the address blacklist is used to indicate the address characteristics of abnormal addresses; If it is determined that the behavior type of the target address access behavior conforms to a preset type and the behavior parameter exceeds a preset threshold, or if it is determined that the target address conforms to the abnormal conditions in the address blacklist, then the corresponding target address is determined as an abnormal address. Perform a masking operation on each of the identified abnormal addresses; The identified abnormal addresses are added to the address blacklist; When the target address is an isolated target address, if it is determined that the behavior type of the target address access behavior conforms to a preset type and the behavior parameter exceeds a preset threshold, or if it is determined that the target address meets the abnormal conditions in the address blacklist, then the corresponding target address is determined as an abnormal address, including: If the target address contains access records exceeding the first threshold within a first preset time period, and the corresponding access time is an abnormal time; Alternatively, the target address has access records to the same visited address exceeding the second threshold within a second preset time period, and the corresponding access time is an abnormal time. Alternatively, if the target address is determined to meet the abnormal conditions in the address blacklist, then the corresponding target address is determined to be an abnormal address; When the address type of the target address is a target address range, if it is determined that the behavior type of the target address access behavior conforms to a preset type and the behavior parameter exceeds a preset threshold, or if it is determined that the target address meets the abnormal conditions in the address blacklist, then the corresponding target address is determined as an abnormal address, including: Determine whether there is an address condition indicating the target address range in the address blacklist. If it is determined that there is an address condition indicating the target address range in the address blacklist, then each target address belonging to the target address range is determined as an abnormal address. If it is determined that there is no address condition indicating the target address segment in the address blacklist, then based on the behavior type and behavior parameters of the target address segment, it is determined whether the target address segment meets the preset behavior conditions. If it is determined that the target address segment meets the preset behavior conditions, then each target address belonging to the target address segment is determined as an abnormal address. The behavioral conditions include: The target address range has access records exceeding the third threshold within a third preset time period, and the corresponding access time is an abnormal time; or the target address range has access records exceeding the fourth threshold for the same accessed address within a fourth preset time period, and the corresponding access time is an abnormal time.

2. The method according to claim 1, characterized in that, The target address is an isolated target address. The step of analyzing the access behavior of each target address based on its address type and determining the behavior type and corresponding behavior parameters includes: Determine the access records for the target address; The access records are used to indicate the visited address, access time, and access frequency corresponding to each of the target addresses; Based on the access records, the access behavior of each target address is determined, and the behavior type and corresponding behavior parameters of the access behavior are determined.

3. The method according to claim 1, characterized in that, The address type of the target address is a target address range. The step of analyzing the access behavior of each target address based on its address type, and determining the behavior type and corresponding behavior parameters of the access behavior, includes: Determine the access records for the target address; The access records are used to indicate the visited address, access time, and access frequency corresponding to the target address range; Based on the access records, the access behavior of the target address range is determined, and the behavior type and corresponding behavior parameters of the access behavior are determined.

4. A network abnormal access identification device, characterized in that, The device includes: The acquisition module is used to determine the target address and the address type of each target address; The address type includes an isolated target address or a target address range; The processing module is used to analyze the access behavior of each target address according to its address type, and determine the behavior type and corresponding behavior parameters of the access behavior; based on the address type of each target address, and through a preset model, determine whether each target address meets the abnormal conditions in the address blacklist; wherein, the address blacklist is used to indicate the address characteristics of abnormal addresses; if it is determined that the behavior type of the target address access behavior meets the preset type and the behavior parameters exceed the preset threshold, or if it is determined that the target address meets the abnormal conditions in the address blacklist, then the corresponding target address is determined as an abnormal address; The processing module is also used to perform a blocking operation on each of the determined abnormal addresses; and to add the determined abnormal addresses to the address blacklist. When the target address is an isolated target address, the processing module is specifically used to determine the target address as an abnormal address if the target address has access records exceeding the first threshold within a first preset time period, and the corresponding access time is an abnormal time; or, the target address has access records to the same visited address exceeding the second threshold within a second preset time period, and the corresponding access time is an abnormal time; or, if the target address is determined to meet the abnormal conditions in the address blacklist, then the corresponding target address is determined as an abnormal address. When the address type of the target address is a target address range, the processing module is specifically used to determine whether there is an address condition indicating the target address range in the address blacklist. If it is determined that there is an address condition indicating the target address range in the address blacklist, then each target address belonging to the target address range is determined as an abnormal address. If it is determined that the address blacklist does not contain an address condition indicating the target address segment, then based on the behavior type and behavior parameters of the target address segment, it is determined whether the target address segment meets preset behavior conditions. If it is determined that the target address segment meets the preset behavior conditions, then each target address belonging to the target address segment is identified as an abnormal address. The behavior conditions include: the target address segment has access records exceeding the third threshold within a third preset time period, and the corresponding access time is an abnormal time; or the target address segment has access records exceeding the fourth threshold for the same visited address within a fourth preset time period, and the corresponding access time is an abnormal time.

5. An electronic device, comprising: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method as described in any one of claims 1-3.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-3.

Images