A scene-based self-learning malicious request detection method and system

Abstract

The present application belongs to the field of network technology and security, and particularly relates to a scene-based self-learning malicious request detection method and system. The method mainly includes scene-based one-key configuration, detection granularity and self-defined configuration of strategy, and an integrated scoring engine combining abnormal score obtained from different detection strategies. In addition, the method also generates configuration feedback suggestions based on traffic self-learning, and presents them to customers in a clear and operable manner. Customers can adjust the configuration according to the feedback suggestions, generate personalized scene solutions for easy transposition, and perform gray test before delivery to ensure the availability of the current scene configuration. The present application realizes flexible and adaptive configuration of business scene capability by detailed division of different scene requests, and combination of different traffic restrictions and different detection functions for different scenes, thereby improving the scene security detection capability and reducing the false negatives and false positives caused by general configuration.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of network technology and security, and particularly relates to a scene-based self-learning malicious request detection method and system. BACKGROUND

[0002] With the exponential growth of global computer networks and network applications and the advancement of intelligence, intelligent and automated network attacks have surged. Network attacks have found a new transformation mode under the application of AI-based adversarial learning and automated tools, and rely on automation to form more humanized and sophisticated network attacks. Such robots simulate human behavior and will be smarter, bolder, more difficult to track, and more difficult to distinguish from human behavior. Most automated attack protection methods are easily penetrated. At the same time, it has also given birth to new automated attacks with more human characteristics. These malicious automated attacks will pose a great threat to system security by using simulators, fake browser environments, UAs, and distributed IPs. The three characteristics of free, simple, and efficient of automated attacks make automated attacks more and more intense, and constantly make the traditional network security line of enterprises frequently breached. Forrester reports show that because the current WAF solution cannot handle more extensive application attacks, especially automated attacks driven by robots, enterprise users have been suffering.

[0003] For example, the invention with the publication number CN115525813A discloses a network crawler detection system based on application scenarios, which includes a crawler detection platform. The crawler detection platform includes a user analysis unit, a man-machine recognition unit, a secondary verification unit, a space development unit, and a reality combination unit. The detection system divides enterprise networks into different application scenarios according to their purposes, performs three malicious crawler identifications based on application scenarios, realizes the screening of malicious crawlers, opens personal spaces for registered users, and controls personal spaces in combination with network information related to application scenarios.

[0004] As the existing patent application No. CN106027564A discloses a kind of detection anti-crawler strategy security method and device, the method is by embedding in the first front-end page of website for realizing anti-crawler strategy anti-crawler code;Anti-crawler code is used to detect whether the user accessing the first front-end page is crawler, and the user detected as crawler is recorded as target object;Verify whether target object is crawler, and count the number of times that target object is not crawler;According to the number of times, the injury rate of the anti-crawler strategy is calculated, and the injury rate is used to measure the security of anti-crawler strategy.Through the analysis of the above prior art, it is found that most of the existing defense means are to limit the request by a general configuration and the stacking of multiple defense technologies, which does not have the ability to quickly detect the anthropomorphized and precise bot requests, and the use of general configuration for bot request detection in different scenarios leads to high false positives and false negatives;In order to solve these problems, the present application provides a scene-based self-learning malicious request detection method and system. SUMMARY

[0005] The technical problem to be solved by the present application is to provide a scene-based self-learning malicious request detection method and system, which reduces the false positive and false negative rates of detecting anomalies by using a layered detection strategy and an integrated scoring engine.

[0006] To achieve the above purpose, the present application provides the following technical scheme:

[0007] A scene-based self-learning malicious request detection method, comprising the following steps:

[0008] S1: configure a basic scene, and configure user statistical granularity and detection strategy for the basic scene;

[0009] S2: use user statistical granularity and detection strategy to obtain scores of different anomalies in the configured scene;

[0010] S3: configure an integrated scoring engine, use the integrated scoring engine to synthesize the obtained different anomaly scores, obtain a comprehensive anomaly score, and determine the severity of the anomaly;

[0011] S4: visually display the obtained anomaly severity;

[0012] S5: analyze the traffic data of potential threats, and configure enhanced suggestion feedback for the detection strategy;

[0013] S6: set up a gray test, verify the above scene configuration through the gray test, obtain and repair scene compatibility or error configuration problems, and then deploy the scene.

[0014] Specifically, the configuration process of the user statistical granularity in S1 includes:

[0015] S2.1: The client configures the user statistical granularity by selecting four aspects of IP, IP+UA, custom token and gateway-specific cookie;

[0016] S2.2: The following priorities are set from high to low for the user statistical granularity: custom token, gateway-specific cookie, IP+UA and IP;

[0017] S2.3: When the user statistical granularity is missing at a higher priority level, the lower-level user statistical granularity is used as the positioning identifier of the user unique identity.

[0018] Specifically, the detection strategies include front-end confrontation, access speed limit, intelligence analysis and intelligent analysis, and preset detection thresholds are included in the front-end confrontation, access speed limit, intelligence analysis and intelligent analysis.

[0019] Specifically, the specific process of obtaining different abnormal scores in S2 includes:

[0020] S4.1: According to the user statistical granularity configured by the client, the system where the scene is located automatically counts the user statistical granularity data of all access requests of different scenes;

[0021] S4.2: The user statistical granularity data of the scene with high priority collected is first input into the parallel detection strategy layer configured by the scene for analysis and calculation, and the abnormal score is independently set according to the weight of the detection strategy; then the second-level scene is detected, and the abnormal scores of different scenes are obtained in this way.

[0022] Specifically, the comprehensive score in S3 includes single abnormal comprehensive score and multiple abnormal comprehensive score, and the specific calculation process includes:

[0023] S5.1 When the comprehensive score is a single abnormal comprehensive score, the abnormal score obtained from a single detection strategy is directly used as the comprehensive score;

[0024] S5.2: When the comprehensive score is a multiple abnormal comprehensive score, the highest score of the single abnormal score in the detection strategy is used as the highest score of the single abnormal score, and the scores of the remaining detection strategies are multiplied by the weight corresponding to the detection strategy and added to the highest score of the single abnormal score to obtain the comprehensive score, and the formula is as follows:

[0025]

[0026] wherein, M is the comprehensive multiple abnormal score, M1 is the highest score of the single abnormal score, M2, M3 and M4 are the second, third and fourth abnormal scores, respectively, M2, M3, M4 correspond to the weights of the detection strategies.

[0027] Specifically, the configuration enhancement suggestion feedback adopts a traffic self-learning strategy, and the specific process includes:

[0028] S6.1: According to the acquired potential threat, collect the traffic data of the threat using the statistical granularity configured by the scene, and pre-process;

[0029] S6.2: Extract specific traffic patterns, abnormal access behaviors or other suspicious activities related to attacks from the pre-processed traffic data as attack samples, and use the detection threshold of the detection strategy corresponding to the acquired potential threat as the initial threshold;

[0030] S6.3: Input the above attack samples and the initial threshold into a pre-trained support vector machine to obtain the attack pattern and trend of the threat, and output the optimal threshold corresponding to the threat;

[0031] S6.4: Adjust the configuration and weight of the front-end confrontation, access rate limiting, intelligence analysis and intelligent analysis using the acquired attack pattern and trend, and update the preset detection threshold in the front-end confrontation, access rate limiting, intelligence analysis and intelligent analysis using the acquired optimal threshold.

[0032] A scene-based self-learning malicious request detection system includes a scene-based basic configuration module, an integrated scoring engine module, a configuration suggestion feedback module, and a gray test module.

[0033] The scene-based basic configuration module is used to provide customers with selectable scene configurations or customized scene configurations, and detect the scene configuration granularity and detection strategy;

[0034] The integrated scoring engine module is used to synthesize the abnormal scores obtained in different detection strategies to determine the severity of the detected anomaly, and provide appropriate measures;

[0035] The configuration suggestion feedback module is used to provide accurate and effective configuration suggestions for each measure;

[0036] The gray test module is used to verify the final configuration and ensure that normal users can smoothly pass the verification process.

[0037] Specifically, the scene-based basic configuration module includes a scene-based basic setting unit, a user statistical granularity unit and a detection strategy unit.

[0038] The scene-based basic setting unit is used to provide customers with scenes with different configurations, and provide one-key configuration function for different scenes;

[0039] A user statistical granularity unit is configured to provide different levels of user identification granularity for a customer-configured scenario;

[0040] A detection strategy unit is configured to provide different types of detection strategies for a customer-configured scenario, and to independently set an abnormal score according to the weight of the detection strategy.

[0041] Specifically, the detection strategy unit includes a front-end confrontation subunit, an access speed-limiting subunit, an intelligence analysis subunit, and an intelligent analysis subunit.

[0042] The front-end confrontation subunit is configured to detect abnormal behaviors such as crawler behavior, automated attacks, and page debugging, and to obtain an abnormal score.

[0043] The access speed-limiting subunit is configured to control the access frequency of user granularity (such as IP address), and to detect abnormalities through access frequency and obtain an abnormal score.

[0044] The intelligence analysis subunit is configured to manage threat intelligence database blacklists and whitelists, and to detect abnormalities through the managed blacklists and whitelists and obtain an abnormal score.

[0045] The intelligent analysis subunit is configured to analyze access behavior and human-computer behavior, and to detect abnormalities through the behavior analysis and obtain an abnormal score.

[0046] Specifically, the configuration suggestion feedback module includes a result display subunit and a traffic self-learning subunit.

[0047] The result display subunit is configured to visually display results with an abnormal score higher than a threshold value, to assist customers in quickly identifying potential threats, and to take appropriate measures to mitigate these threats.

[0048] The traffic self-learning subunit is configured to determine the patterns and trends of threat attacks, and to provide threshold value enhancement configuration suggestions for the detection strategy.

[0049] Compared with the prior art, the present application has the following advantages:

[0050] 1. The present application combines traditional defense methods to address the problem of easy missed reports and false reports of malicious requests, and uses a combination of multiple granularity configurations and detection strategies to more flexibly adapt to business scenarios, improve security detection capabilities, and reduce missed reports and false reports caused by general configurations.

[0051] 2. The present application combines the problems existing in traditional personal configuration mode, uses a combination of traffic self-learning, scoring engine, and configuration feedback strategies to improve the comprehensiveness of risk assessment, and enhances the performance of configuration scenario detection of malicious attacks, and more fully reflects the capabilities of the product.

[0052] 3. The present application adopts a gray scale test to verify the final configuration of a scene, further ensuring the availability of assets. BRIEF DESCRIPTION OF DRAWINGS

[0053] Other features, objects, and advantages of the present application will become more apparent from the following detailed description of non-limiting embodiments thereof as read with reference to the accompanying drawings:

[0054] Figure 1 A scene-based self-learning malicious request detection method flowchart for embodiment 1 of the present application.

[0055] Figure 2 A scene-based self-learning malicious request detection system module diagram for embodiment 1 of the present application. DETAILED DESCRIPTION

[0056] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, not all the embodiments.

[0057] Embodiment 1:

[0058] The defense means of many manufacturers at present are all to limit requests through a general configuration and the stacking of multiple defense technologies, and do not have a fast detection capability for personification and precision bot requests. Using a general configuration for bot request detection in different scenes leads to a high false alarm and missed alarm.

[0059] To solve the above problems, please refer to Figure 1 The present application provides an embodiment: a scene-based self-learning malicious request detection method, and the specific steps include:

[0060] S1: configuring a basic scene, and configuring a user statistical granularity and a detection strategy for the basic scene;

[0061] S2: using the user statistical granularity and the detection strategy to obtain scores of different abnormalities in the configured scene;

[0062] S3: configuring an integrated scoring engine, using the integrated scoring engine to comprehensively obtain the scores of different abnormalities, obtaining a comprehensive abnormality score, and determining the severity of the abnormality;

[0063] S4: visualizing the obtained abnormality severity;

[0064] S5: analyzing the flow data of potential threats, and configuring an enhanced suggestion feedback for the detection strategy;

[0065] S6: Set up a grayscale test, and verify the above scene configuration through the grayscale test, obtain and repair scene compatibility or error configuration problems, and then deploy the scene.

[0066] In the above description, the basic scene includes recommended scenes such as login, registration, purchase, etc. and custom scenes. Among them, the recommended scene is adjusted by using a general model, and the general model usually includes but is not limited to a user identity verification model, a purchase behavior model and a recommendation model. These scenes can be configured by one key. The customer can configure custom protection parameters according to the required protection scene request characteristics of the custom scene; and the priority of each custom scene is determined based on the configured priority value.

[0067] In this embodiment, the one-key configuration function is realized by creating a configuration template containing the above configuration information and a button connected to the configuration template.

[0068] The above scenes can be configured by one key to reduce the error rate of configuration and simplify maintenance; in addition, the same configuration template can ensure that different scenes have consistent configuration, thereby ensuring the stability and consistency of the system.

[0069] The configuration process of the user statistical granularity in S1 includes:

[0070] S2.1: The customer configures the user statistical granularity by selecting IP, IP+UA, custom token and gateway-specific cookie from four angles;

[0071] S2.2: The user statistical granularity is set from high to low in the following priority: custom token, gateway-specific cookie, ip+ua, ip; wherein Cookie is a small piece of data stored on the user's computer.

[0072] S2.3: When the user statistical granularity is missing at a higher priority level, the lower level user statistical granularity is used as the positioning identifier of the user's unique identity. For example, when the custom token is invalid, the gateway-specific cookie is used as the positioning identifier of the user's unique identity.

[0073] The detection strategy includes front-end confrontation, access speed limit, intelligence analysis and intelligent analysis, and the front-end confrontation, access speed limit, intelligence analysis and intelligent analysis all include preset detection methods and detection thresholds. Among them, in the front-end confrontation, specific detection methods such as crawler trap, automated attack identification, page debugging prevention, etc. are used for anomaly detection to obtain the corresponding anomaly score;

[0074] In the access speed limit, the user granularity is monitored and analyzed to detect abnormalities. For example, if the access frequency of a user exceeds the preset detection threshold, the system will determine that it is abnormal behavior and obtain the corresponding abnormal score.

[0075] Intelligence analysis detects abnormalities by matching requests with blacklists and whitelists in the managed threat intelligence database. For example, if an IP address or user is in the blacklist, its behavior will be determined as abnormal and will obtain the corresponding abnormal score. Conversely, if it is in the whitelist, its behavior will not be determined as abnormal.

[0076] Intelligent analysis detects abnormal behavior by analyzing the click behavior of users through behavior analysis and offline engines. For example, if a user performs a large number of meaningless clicks in a short period of time, or the click behavior pattern is significantly different from the normal user behavior pattern, it will be determined as abnormal and will obtain the corresponding abnormal score.

[0077] The specific process of obtaining different abnormal scores in S2 includes:

[0078] S4.1: According to the user statistical granularity configured by the customer, the system where the scene is located automatically counts the user statistical granularity data of all access requests of different scenes;

[0079] S4.2: The user statistical granularity data of the high-priority scenes collected is first input into the parallel detection strategy layer configured by the scene for analysis and calculation, and the abnormal score is independently set according to the weight of the detection strategy; Then detect the next level scene, and so on to obtain the abnormal score of different scenes.

[0080] Assume that in a period of time, the scene corresponding to the custom token received 1000 access requests, and the weight of the front-end confrontation is 0.6, and the detection threshold is 500. According to this weight, the abnormal score of the custom token corresponding to the scene under the front-end confrontation detection strategy is 600 points, and according to the detection threshold, it can be determined as abnormal.

[0081] In the same period of time, the scene corresponding to the gateway-specific cookie received 500 access requests, and the weight of the access speed limit is 0.4, and the detection threshold is 400. According to this weight, the abnormal score of the scene corresponding to the gateway-specific cookie is 200 points, and it will not be determined as abnormal.

[0082] The comprehensive score in S3 includes single abnormal comprehensive score and multiple abnormal comprehensive score, and the specific calculation process includes:

[0083] S5.1 When the comprehensive score is a single abnormal comprehensive score, the abnormal score obtained from a single detection strategy is directly used as the comprehensive score.

[0084] S5.2: When the comprehensive score is a multi-abnormality comprehensive score, the highest score of the abnormality score in the detection strategy is taken as the highest score of single abnormality, and the scores of the remaining detection strategies are multiplied by the weight corresponding to the detection strategy and added to the highest score of single abnormality to obtain a comprehensive score, and the formula is as follows:

[0085]

[0086] wherein, M is a comprehensive multi-abnormality score, M1 is the highest score of single abnormality, M2, M3, and M4 are the second, third, and fourth abnormality scores, respectively, M2, M3, and M4 are the weights of the corresponding detection strategies, respectively.

[0087] S4 can be specifically visualized as follows:

[0088] The abnormality scores and comprehensive scores corresponding to front-end confrontation, access speed limit, intelligence analysis, and intelligent analysis are displayed in the form of a bar chart, and the detection thresholds corresponding to front-end confrontation, access speed limit, intelligence analysis, and intelligent analysis are taken as standard lines, so as to obtain specific potential threats and the severity of potential threats, and take corresponding measures.

[0089] The following measures can be taken for the abnormalities obtained by the above different detection strategies:

[0090] For the abnormal behavior obtained by front-end confrontation, it can be checked whether there are vulnerabilities or malicious attacks in the front-end code, and measures such as adding a verification code, limiting access frequency, and preventing malicious crawlers can be taken to enhance the defense capability of the scene.

[0091] For the abnormal behavior obtained by intelligence analysis, measures such as increasing identity verification and enabling IP blocking function can be taken to enhance the defense capability of the scene.

[0092] For the abnormal behavior obtained by access speed limit, measures such as establishing a more comprehensive log recording system and strengthening data encryption and protection can be taken to enhance the defense capability of the scene.

[0093] For the abnormal behavior obtained by intelligent analysis, measures such as enhancing the detection capability of the intelligent analysis model and limiting the number of clicks can be taken to enhance the defense capability of the scene.

[0094] A traffic self-learning strategy is adopted for configuration enhancement suggestion feedback, and the specific process includes:

[0095] S6.1: According to the obtained potential threats, collect the traffic data of the threats by using the statistical granularity configured by the scene, and perform preprocessing;

[0096] S6.2: Extract specific traffic patterns, abnormal access behaviors or other suspicious activities related to attacks from the preprocessed traffic data as attack samples, and use the detection threshold corresponding to the detection strategy of the acquired potential threat as the initial threshold;

[0097] S6.3: Input the above attack samples and the initial threshold into a pre-trained support vector machine to obtain the attack patterns and trends of the threat, and output the optimal threshold corresponding to the threat;

[0098] S6.4: Adjust the configurations and weights of the front-end confrontation, access rate limiting, intelligence analysis and intelligent analysis using the obtained attack patterns and trends, and update the preset detection thresholds in the front-end confrontation, access rate limiting, intelligence analysis and intelligent analysis using the obtained optimal threshold.

[0099] The specific process of the gray test for verifying the above scene configuration is as follows:

[0100] A test IP is configured for a subset of users, and the user performs functional testing according to the configured scene-based basic configuration, statistical granularity configuration, detection strategy configuration and traffic self-learning function items, and collects user feedback and system logs and other information. Analyze the collected feedback information to check if there are any problems or misconfigurations. If any problems are found, they are fed back to the development team for repair, and then the test is performed again until there are no problem feedbacks for all subset users; then the verified scene is deployed online.

[0101] Embodiment 2:

[0102] To further illustrate the scene-based self-learning malicious request detection method in embodiment 1, this embodiment is set in the scene of crawler management project, WAF protection project and other scenes with automatic crawler attack protection, and the specific process is as follows:

[0103] S1: Configure the scene including crawler management project and WAF protection project and other scenes with automatic crawler attack protection through a one-key configuration switch, and assume that the configured statistical granularity is ip.

[0104] S2: The system where the scene is configured automatically counts the number of request ips through the configured user statistical granularity, assuming 1000; and detects the collected ips through the configured front-end confrontation, access rate limiting, intelligence analysis and intelligent analysis; The number of detection strategies can be selected by the customer through combination in actual application, and four kinds are selected in this embodiment, and the weights and preset detection thresholds corresponding to the above detection strategies are assumed to be 0.4, 300; 0.2, 200; 0.3, 200, 0.1, 300.

[0105] S3: Through calculation, the abnormal scores obtained by the four detection strategies are 400, 200, 300 and 100 in turn; according to the detection threshold, the front-end confrontation and intelligence analysis detect the abnormality, and the comprehensive score obtained according to the configured integrated scoring engine is 700;

[0106] S4: Through the bar chart display, it can be obtained that the comprehensive score is much larger than all the detection thresholds, and the threat degree is more serious; and the front-end confrontation and intelligence analysis detect the abnormality, and the traffic data of the front-end confrontation and intelligence analysis is input into the traffic self-learning model, and it is obtained that the mode of the abnormal attack is mainly crawler, and the risk of being crawled is increasing, therefore, the weights of the front-end confrontation and intelligence analysis are increased to 0.6 and 0.4 respectively, the detection threshold is reduced, the defense range of the crawler trap and the black and white list management range are enhanced, and the defense ability of the whole scene is improved.

[0107] Embodiment 3

[0108] Please refer to Figure 2 The present application provides an embodiment: a scene-based self-learning malicious request detection system, comprising a scene-based basic configuration module, an integrated scoring engine module, a configuration suggestion feedback module and a gray test module.

[0109] The scene-based basic configuration module is used to provide customers with selectable scene configurations or customized scene configurations, and detect the granularity and detection strategy of the selected scene configuration.

[0110] The integrated scoring engine module is used to integrate the abnormal scores obtained in different detection strategies to determine the severity of the detected abnormality, and provide appropriate measures.

[0111] The configuration suggestion feedback module is used to provide accurate and effective configuration suggestions for each measure.

[0112] The gray test module is used to verify the final configuration and ensure that normal users can smoothly pass the verification process.

[0113] Specifically, the scene-based basic configuration module comprises a scene-based basic setting unit, a user statistical granularity unit and a detection strategy unit.

[0114] The scene-based basic setting unit is used to provide customers with scenes with different configurations, and provide a one-key configuration function for different scenes.

[0115] The user statistical granularity unit is used to provide different levels of user identification granularity for the scene configured by the customer.

[0116] The detection strategy unit is used to provide different types of detection strategies for the scene configured by the customer, and independently set the abnormal score according to the weight of the detection strategy.

[0117] Specifically, the detection strategy unit comprises a front-end confrontation subunit, an access speed-limiting subunit, an intelligence analysis subunit, and an intelligent analysis subunit;

[0118] The front-end confrontation subunit is configured to detect abnormal behaviors such as crawler behaviors, automated attacks, and page debugging, and obtain an abnormal score;

[0119] The access speed-limiting subunit is configured to control the access frequency of users in a granularity such as an IP address, and detect abnormalities through the access frequency and obtain an abnormal score;

[0120] The intelligence analysis subunit is configured to manage a threat intelligence database blacklist and a whitelist, and detect abnormalities through the managed blacklist and whitelist and obtain an abnormal score;

[0121] The intelligent analysis subunit is configured to analyze access behaviors and human-computer behaviors, and detect abnormalities through the behavior analysis and obtain an abnormal score.

[0122] Specifically, the configuration suggestion feedback module comprises a result display subunit and a traffic self-learning subunit;

[0123] The result display subunit is configured to visually display results with an abnormal score higher than a threshold value, to assist customers in quickly identifying potential threats, and to take appropriate measures to mitigate the threats;

[0124] The traffic self-learning subunit is configured to determine the mode and trend of threat attacks, and to provide threshold value enhancement configuration suggestions for the detection strategy.

[0125] Although the embodiments of the present application have been shown and described above, it should be understood that the above-described embodiments are exemplary and should not be construed as limiting the present application, and those of ordinary skill in the art can make changes, modifications, replacements, and variations to the above-described embodiments within the scope of the present application.

Claims

1. A scenario-based self-learning method for detecting malicious requests, characterized in that, The method comprises the following steps: S1: configuring a basic scene, and configuring user statistical granularity and a detection strategy for the basic scene; S2: obtaining scores of different anomalies in the configured scene by using the user statistical granularity and the detection strategy; S3: configuring an integrated scoring engine, and comprehensively obtaining an integrated anomaly score by using the integrated scoring engine, to determine the severity of the anomaly; S4: visualizing the obtained anomaly severity; S5: analyzing traffic data for potential threats, and configuring enhanced feedback for the detection strategy; S6: setting up a gray test, verifying the above scene configuration through the gray test, obtaining and repairing scene compatibility or error configuration problems, and then deploying the scene.

2. The method of claim 1, wherein the method further comprises: The configuration process of the user statistical granularity in S1 comprises: S2.1: the user statistical granularity is configured by the customer through selection of IP, IP+UA, custom token, and gateway-specific cookie; S2.2: the user statistical granularity is set from high to low in the following priority: custom token, gateway-specific cookie, IP+UA, and IP; S2.3: when the user statistical granularity is missing in the high priority level, the lower level user statistical granularity is used as the positioning identifier of the user unique identity.

3. The method of claim 2, wherein the method further comprises: The detection strategy comprises front-end confrontation, access speed limit, intelligence analysis, and intelligent analysis, and each of the front-end confrontation, access speed limit, intelligence analysis, and intelligent analysis comprises a preset detection threshold.

4. The method of claim 3, wherein the method further comprises: The specific process of obtaining different anomaly scores in S2 comprises: S4.1: according to the user statistical granularity configured by the customer, the system where the scene is located automatically counts the user statistical granularity data of all access requests of different scenes; S4.2: the user statistical granularity data of the scene with high priority is first input into the parallel detection strategy layer configured by the scene for analysis and calculation, and the anomaly score is independently set according to the weight of the detection strategy; then the second-level scene is detected, and the anomaly scores of different scenes are obtained in this way.

5. The method of claim 4, wherein the method further comprises: The integrated score in S3 comprises single anomaly integrated score and multiple anomaly integrated score, and the specific calculation process comprises: S5.1: when the integrated score is a single anomaly integrated score, the anomaly score obtained from a single detection strategy is directly used as the integrated score; S5.2: when the integrated score is a multiple anomaly integrated score, the highest score of the anomaly in the detection strategy is taken as the highest score of a single anomaly, and the scores of the remaining detection strategies are multiplied by the weights of the corresponding detection strategies and added to the highest score of the single anomaly to obtain the integrated score, which is as follows: M=M1+w2M2+w3M3+w4M4, wherein M is the integrated multiple anomaly score, M1 is the highest score of a single anomaly, M2, M3, and M4 are the scores of the second, third, and fourth anomalies, respectively, and w2, w3, and w4 are the weights of the corresponding detection strategies of M2, M3, and M4.

6. The method of claim 5, wherein the method further comprises: The configuration of the enhanced feedback adopts a traffic self-learning strategy, and the specific process comprises: S6.1: Collecting traffic data of the threat with statistical granularity of the scenario configuration and preprocessing according to the acquired potential threat; S6.2: Extracting specific traffic patterns, abnormal access behaviors or other suspicious activities related to the attack from the preprocessed traffic data as attack samples, and using the detection threshold of the detection strategy corresponding to the acquired potential threat as the initial threshold; S6.3: Inputting the attack samples and the initial threshold into a pre-trained support vector machine to acquire the attack pattern and trend of the threat, and outputting the optimal threshold corresponding to the threat; S6.4: Adjusting the configuration and weight of the front-end confrontation, access rate limiting, intelligence analysis and intelligent analysis using the acquired attack pattern and trend, and updating the preset detection threshold in the front-end confrontation, access rate limiting, intelligence analysis and intelligent analysis using the acquired optimal threshold.

7. A scene-based self-learning malicious request detection system based on the scene-based self-learning malicious request detection method according to any one of claims 1-6, characterized in that, The system comprises a scenario-based basic configuration module, an integrated scoring engine module, a configuration suggestion feedback module and a gray test module; The scenario-based basic configuration module is configured to provide customers with selectable scenario configurations or customized scenario configurations, and detect the granularity and detection strategy of the selected scenario configurations; The integrated scoring engine module is configured to comprehensively score the abnormal scores obtained in different detection strategies to determine the severity of the detected anomaly, and provide appropriate measures; The configuration suggestion feedback module is configured to provide accurate and effective configuration suggestions for each measure; The gray test module is configured to verify the final configuration and ensure that normal users can smoothly pass the verification process.

8. The contextual self-learning malicious request detection system of claim 7, wherein, The scenario-based basic configuration module comprises a scenario-based basic setting unit, a user statistical granularity unit and a detection strategy unit; The scenario-based basic setting unit is configured to provide customers with scenarios with different configurations, and provide one-key configuration function for different scenarios; The user statistical granularity unit is configured to provide different levels of user identification granularity for the scenario configured by the customer; The detection strategy unit is configured to provide different types of detection strategies for the scenario configured by the customer, and independently set the abnormal score according to the weight of the detection strategy.

9. The contextual self-learning malicious request detection system of claim 8, wherein, The detection strategy unit comprises a front-end confrontation subunit, an access rate limiting subunit, an intelligence analysis subunit and an intelligent analysis subunit; The front-end confrontation subunit is configured to detect abnormal behaviors such as crawler behavior, automated attack and page debugging, and acquire an abnormal score; The access rate limiting subunit is configured to control the access frequency of user granularity (such as IP address), and detect abnormalities through access frequency to acquire an abnormal score; The intelligence analysis subunit is configured to manage the blacklist and whitelist of the threat intelligence database, and detect abnormalities through the managed blacklist and whitelist to acquire an abnormal score; The intelligent analysis subunit is configured to analyze access behaviors and human-computer behaviors, and detect abnormalities through the behavior analysis to acquire an abnormal score.

10. The contextual self-learning malicious request detection system of claim 9, wherein, The configuration suggestion feedback module comprises a result display subunit and a traffic self-learning subunit; The result display subunit is used for visualizing the results with abnormal scores higher than a threshold value, assisting customers in quickly identifying potential threats, and taking appropriate measures to mitigate the threats. The traffic self-learning subunit is used for determining the mode and trend of threat attacks, and providing a threshold value enhancement configuration suggestion for a detection strategy.

Images