Behavioral statistics and intelligent security response method and device applicable to e-commerce threats
By building a threat behavior identification and response model in the background of the e-commerce platform, the high cost of third-party detection services and insufficient information are solved, the rapid identification and detailed statistics of threat behaviors within the e-commerce platform are achieved, and the e-commerce platform is improved Security and operational efficiency.
Patent Information
- Application Number
- CN202410246507.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-03-05
- Publication Date
- 2024-12-27
- Estimated Expiration
- 2044-03-05
AI Technical Summary
When preventing threat behavior, existing e-commerce platforms rely on third-party detection services, resulting in high costs and lack of detailed content for threat behaviors, and are unable to effectively count and respond to threat behaviors within e-commerce platforms.
Build a threat behavior recognition model, threat response mechanism model, threat behavior statistical model and adaptive learning model, deploy it in the backend server of the e-commerce platform, and use e-commerce big data to identify and respond to threat behaviors, and use adaptive learning optimization model to identify and response mechanism.
It realizes rapid identification and detailed statistics of threat behaviors within e-commerce platforms, saves high third-party detection costs, and provides detailed behavioral statistics reports to help e-commerce platforms identify network security vulnerabilities and improve operational efficiency.
Smart Images
Figure CN117978529B_ABST
Abstract
Description
Technical Field
[0001] The present disclosure relates to the technical field of e-commerce data identification and processing, and in particular to a behavior statistics and intelligent security response method, device and electronic device applicable to e-commerce threats. Background Art
[0002] E-commerce threats and their hazards are diverse. E-commerce platforms and consumers need to strengthen their security awareness and take effective measures to prevent these threats.
[0003] The following measures are usually taken to deal with e-commerce threats:
[0004] 1. Establish a strict merchant review mechanism: E-commerce platforms should establish a complete merchant review mechanism to ensure that the goods sold on the platform are of qualified quality and reliable source. For counterfeit and shoddy goods, the platform should promptly remove them from the shelves and punish the relevant merchants.
[0005] 2. Strengthen user privacy protection: E-commerce platforms should adopt effective encryption technology and security measures to protect user personal information from being leaked. At the same time, the platform should formulate a strict privacy policy, clearly inform users of the way to collect, use and protect personal information, and respect users' privacy rights.
[0006] 3. Fight against fraud: E-commerce platforms should strengthen cooperation with relevant departments to jointly fight against e-commerce fraud. For merchants and behaviors suspected of fraud, the platform should take timely measures to investigate and deal with them.
[0007] 4. Improve logistics safety: E-commerce platforms should establish cooperative relationships with logistics companies to ensure the safe transportation of goods. Logistics companies should take effective packaging and transportation measures to ensure that goods are not damaged or stolen during transportation.
[0008] 5. Establish a sound after-sales service system: E-commerce platforms should establish a sound after-sales service system to provide users with timely and effective after-sales support and services. For product quality issues, logistics issues, etc., the platform should actively assist users in solving them and protect their legitimate rights and interests.
[0009] However, among the anti-threat measures taken above, the main method is to perform attack detection of behavioral data through firewalls or third parties outsourced by e-commerce platforms (such as 360) to provide anti-threat protection. Among them, the anti-threat detection method through a third party requires the e-commerce platform to access the service port of the third party, and the third party will retrieve the corresponding user behavior or platform log from the e-commerce platform to perform anti-threat detection and identification, and detect whether there is potential threatening behavior data from user behavior data and log information, and then provide anti-threat measures. This method requires the deployment of additional data ports on the e-commerce platform, as well as the provision of some threads and memory to cooperate with the third party for detection, which will occupy the operation of the background server where the e-commerce platform is located.
[0010] In addition, entrusting a third party to conduct testing requires high fees, and only the processing results can be obtained from the third party. The e-commerce platform cannot obtain effective statistics on the details of the threat behavior, such as the threat source, threat type, and data type that is vulnerable to attack by the threat source, etc. Summary of the invention
[0011] In order to solve the above problems, the present application proposes a behavior statistics and intelligent security response method, device and electronic device suitable for e-commerce threats.
[0012] On the one hand, this application proposes a behavior statistics and intelligent security response method applicable to e-commerce threats, including the following steps:
[0013] S1. Construct threat behavior identification model, threat response mechanism model, threat behavior statistical model and adaptive learning model, among which:
[0014] The threat behavior identification model is used to identify threats based on e-commerce big data and output corresponding threat behaviors s;
[0015] The threat response mechanism model is used to respond to and process the threat behavior s, and mark the threat response measure k that effectively processes the threat behavior s this time;
[0016] The threat behavior statistical model is used to count the threat behavior s and the corresponding threat response measure k, and form a data set: (s, k);
[0017] The adaptive learning model is used to optimize and train the threat behavior identification model and the threat response mechanism model according to the data set: (s, k);
[0018] S2. Deploy the threat behavior identification model, the threat response mechanism model, the threat behavior statistical model and the adaptive learning model in the background server of the e-commerce platform to perform threat identification on the e-commerce data.
[0019] As an optional implementation scheme of the present application, optionally, after step S2, the method further includes:
[0020] Deploy a background model monitoring center on the background server;
[0021] The background model monitoring center is used to:
[0022] Monitor the data set counted by the threat behavior statistical model: data volume information p of (s, k): when the background model monitoring center finds that p reaches a preset data volume threshold, it issues an activation instruction to activate the adaptive learning model and reports to the administrator at the same time;
[0023] Monitor the state of the adaptive learning model optimizing the training of the threat behavior identification model and the threat response mechanism model: when the optimization training is completed, delete the data set used for the optimization training: (s, k).
[0024] As an optional implementation scheme of the present application, optionally, in step S1, the method for constructing the threat behavior identification model includes:
[0025] Retrieving the stored e-commerce big data from the backend database;
[0026] Cleaning and screening the e-commerce big data to obtain training data for training the model;
[0027] Extracting threat behavior features related to threat behaviors from the e-commerce data, and using a preset machine learning algorithm to learn the features and perform model training, so that the model learns the ability to identify features related to threat behaviors;
[0028] After the training is completed, the initial threat behavior recognition model is obtained;
[0029] Importing an optimized data set with labeled threat behavior features to optimize and train the initial threat behavior identification model;
[0030] After the optimization training is completed, the threat behavior recognition model is obtained.
[0031] As an optional implementation scheme of the present application, optionally, in step S1, the method for constructing the threat response mechanism model includes:
[0032] Configuring the threat response measures k to handle different types of threat behaviors s;
[0033] Configuring threat behavior characteristics of the threat behavior s;
[0034] Establishing a mapping relationship between the threat response measure k and the threat behavior characteristics of the corresponding threat behavior s;
[0035] The mapping relationship is saved in a background database to obtain the threat response mechanism model.
[0036] As an optional implementation scheme of the present application, optionally, in step S1, the method for constructing the threat behavior statistical model includes:
[0037] Build a blank model;
[0038] Generate various statistical items in the blank model, the statistical items including the source, target, time, frequency, mode, whether e-commerce payment is involved in the threatening behavior, and the threat response measure k for effectively handling the threatening behavior;
[0039] After the generation is completed, the threat behavior statistical model is obtained.
[0040] As an optional implementation scheme of the present application, optionally, in step S1, the method for constructing the adaptive learning model includes:
[0041] Establishing a stress monitoring program for monitoring whether the background model monitoring center issues an activation instruction;
[0042] Establishing a USB data port for importing the data set generated by the threat behavior statistical model: (s, k);
[0043] Establishing an API interface for sending the data set: (s, k) to the threat behavior identification model and the threat response mechanism model respectively;
[0044] Establishing an adaptive learning rule for regulating and learning the threat behavior identification model and the threat response mechanism model;
[0045] After the construction is completed, the adaptive learning model is obtained.
[0046] As an optional implementation scheme of the present application, optionally, in step S2, threat identification is performed on the e-commerce data, including:
[0047] Collect and save e-commerce behavior data generated on e-commerce platforms;
[0048] Importing the e-commerce behavior data into the threat behavior identification model, extracting threat behavior features of the e-commerce behavior data using the threat behavior identification model, and identifying and outputting the corresponding threat behavior s;
[0049] Importing the threat behavior s into the threat response mechanism model, using the threat response mechanism model to respond to and process the threat behavior s, and marking the threat response measure k that effectively processes the threat behavior s this time;
[0050] The threat behavior statistical model is used to count the threat behavior s and the corresponding threat response measure k, and form a data set: (s, k);
[0051] When the background model monitoring center finds that the data volume information p of the data set (s, k) counted by the threat behavior statistical model reaches a preset data volume threshold, an activation instruction is issued to activate the adaptive learning model and report to the administrator at the same time;
[0052] The adaptive learning model is used to optimize and train the threat behavior identification model and the threat response mechanism model using the data set: (s, k).
[0053] On the other hand, the present application proposes a device for implementing a behavior statistics and intelligent security response method applicable to e-commerce threats, including:
[0054] Model building module, used to build threat behavior identification model, threat response mechanism model, threat behavior statistical model and adaptive learning model;
[0055] A deployment module is used to deploy the threat behavior identification model, the threat response mechanism model, the threat behavior statistical model and the adaptive learning model on the background server;
[0056] Backend database, used to store data;
[0057] A background model monitoring center is used to monitor the data set counted by the threat behavior statistical model: the data volume information p of (s, k): when the background model monitoring center finds that p reaches a preset data volume threshold, it issues an activation instruction to activate the adaptive learning model and reports to the administrator at the same time; and
[0058] Monitor the state of the adaptive learning model optimizing the training of the threat behavior identification model and the threat response mechanism model: when the optimization training is completed, delete the data set used for the optimization training this time: (s, k);
[0059] The backend server is used to schedule each model and the backend model monitoring center to identify and warn of threatening behaviors on the e-commerce platform.
[0060] In another aspect, the present application further provides an electronic device, comprising:
[0061] processor;
[0062] a memory for storing processor-executable instructions;
[0063] Among them, the processor is configured to implement the behavioral statistics and intelligent security response method applicable to e-commerce threats when executing the executable instructions.
[0064] Technical effects of the present invention:
[0065] This solution can identify the behavior of user big data on the e-commerce platform by constructing a threat behavior identification model, a threat response mechanism model, a threat behavior statistical model and an adaptive learning model, identify threatening behaviors and respond to corresponding threat response measures. It can quickly respond to threats after using the model to identify threat behaviors, and can also use the threat behavior statistical model to make detailed statistics of corresponding threat behaviors and corresponding measures. The corresponding statistical results can be generated through model statistics, allowing administrators to identify threat objects that are vulnerable to attacks, frequency, time, mode and other details from the statistical results. Therefore, the e-commerce platform operator can quickly understand the operating vulnerabilities of its own platform and perform intelligent threat behavior detection based on its own platform data. This solution can save the high cost of entrusting third-party detection by the e-commerce platform operator, saving high expenses for the e-commerce platform operator. At the same time, this solution can provide detailed behavior statistical reports for operators through intelligent models for threat behavior identification, response mechanism and statistics, effectively count the network security vulnerabilities of its own platform, and detect and respond quickly.
[0066] Further features and aspects of the present disclosure will become apparent from the following detailed description of exemplary embodiments with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS
[0067] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate exemplary embodiments, features, and aspects of the disclosure and, together with the description, serve to explain the principles of the disclosure.
[0068] Figure 1 A schematic diagram showing the architecture of the e-commerce backend management system used in the present invention is shown;
[0069] Figure 2 It is shown as a schematic diagram of the implementation process of the present invention;
[0070] Figure 3 Shown is a schematic diagram of the background application system of the present invention;
[0071] Figure 4 It is a schematic diagram showing the interaction relationship between various models of the present invention;
[0072] Figure 5 Shown is a schematic diagram of the application of the background model monitoring center of the present invention;
[0073] Figure 6 It is a schematic diagram showing the application of the electronic device of the present invention. DETAILED DESCRIPTION
[0074] Various exemplary embodiments, features and aspects of the present disclosure will be described in detail below with reference to the accompanying drawings. The same reference numerals in the accompanying drawings represent elements with the same or similar functions. Although various aspects of the embodiments are shown in the accompanying drawings, the drawings are not necessarily drawn to scale unless otherwise specified.
[0075] The word “exemplary” is used exclusively herein to mean “serving as an example, example, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.
[0076] In addition, in order to better illustrate the present disclosure, numerous specific details are given in the following specific embodiments. It should be understood by those skilled in the art that the present disclosure can also be implemented without certain specific details. In some examples, means, components and circuits well known to those skilled in the art are not described in detail in order to highlight the main purpose of the present disclosure.
[0077] Example 1
[0078] This solution can deploy the various models built and generated by this solution on the backend server where the e-commerce backend management system is located, as well as the backend model monitoring center. For the deployed e-commerce backend management system, it can be deployed in combination with the user's own backend management system, such as Figure 1 An e-commerce backend management system is shown.
[0079] This solution does not limit the deployment method and operating system. For the application of building corresponding models in the background, etc., the model can be built in conjunction with a third-party development platform.
[0080] The backend database can use the database of the existing e-commerce backend management system.
[0081] like Figure 2 As shown, on the one hand, the present application proposes a behavior statistics and intelligent security response method applicable to e-commerce threats, including the following steps:
[0082] S1. Construct threat behavior identification model, threat response mechanism model, threat behavior statistical model and adaptive learning model, among which:
[0083] The threat behavior identification model is used to identify threats based on e-commerce big data and output corresponding threat behaviors s;
[0084] The threat response mechanism model is used to respond to and process the threat behavior s, and mark the threat response measure k that effectively processes the threat behavior s this time;
[0085] The threat behavior statistical model is used to count the threat behavior s and the corresponding threat response measure k, and form a data set: (s, k);
[0086] The adaptive learning model is used to optimize and train the threat behavior identification model and the threat response mechanism model according to the data set: (s, k);
[0087] S2. Deploy the threat behavior identification model, the threat response mechanism model, the threat behavior statistical model and the adaptive learning model in the background server of the e-commerce platform to perform threat identification on the e-commerce data.
[0088] The following will describe the construction, deployment and application of each of the above models with reference to the accompanying drawings and detailed steps.
[0089] like Figure 3 The background application system of this solution is shown in FIG.
[0090] Administrators can select, install, and call corresponding applications such as machine learning models according to the construction steps of each model in this solution to complete the corresponding model construction. After the administrator optimizes the parameters of each model and configures the model interface, they can deploy it on the background server.
[0091] like Figure 4 As shown in the figure, it is the interactive relationship between the various models of this scheme.
[0092] like Figure 5 As shown, as an optional implementation scheme of the present application, optionally, after step S2, it also includes:
[0093] Deploy a background model monitoring center on the background server;
[0094] The background model monitoring center is used to:
[0095] Monitor the data set counted by the threat behavior statistical model: data volume information p of (s, k): when the background model monitoring center finds that p reaches a preset data volume threshold, it issues an activation instruction to activate the adaptive learning model and reports to the administrator at the same time;
[0096] Monitor the state of the adaptive learning model optimizing the training of the threat behavior identification model and the threat response mechanism model: when the optimization training is completed, delete the data set used for the optimization training: (s, k).
[0097] The threat behavior statistical model needs to collect statistics on the results of identifying each piece of e-commerce behavior data. Therefore, in the statistical process of the threat behavior statistical model, the total amount of data counted in the current stage can be calculated and counted, that is, the capacity of the current statistical data set has reached. If the statistics find that the number of data sets currently counted on the e-commerce platform has reached the threshold, the adaptive learning model can be activated, and the self-learning model uses the statistical data set to regulate and optimize the training of the threat behavior identification model and the threat response mechanism model.
[0098] The backend model monitoring center is mainly used to monitor the capacity of the identified and statistical data sets. When the statistical data capacity reaches a certain value, if it is too large, it will take a long time to update and optimize the training of threat behavior identification models and threat response mechanism models. Through capacity monitoring, model updates and optimization training can be performed within a controllable time to improve the model's recognition ability.
[0099] The specific data volume threshold is set by the administrator. For example, when the capacity P of the statistical data set reaches 50 megabytes, an activation command is issued to allow the adaptive learning model to begin regulating and optimizing the training of threat behavior identification models and threat response mechanism models to avoid large-capacity training data from occupying the application time of the model.
[0100] As an optional implementation scheme of the present application, optionally, in step S1, the method for constructing the threat behavior identification model includes:
[0101] Retrieving the stored e-commerce big data from the backend database;
[0102] Cleaning and screening the e-commerce big data to obtain training data for training the model;
[0103] Extracting threat behavior features related to threat behaviors from the e-commerce data, and using a preset machine learning algorithm to learn the features and perform model training, so that the model learns the ability to identify features related to threat behaviors;
[0104] After the training is completed, the initial threat behavior recognition model is obtained;
[0105] Importing an optimized data set with labeled threat behavior features to optimize and train the initial threat behavior identification model;
[0106] After the optimization training is completed, the threat behavior recognition model is obtained.
[0107] The e-commerce big data in the backend database can be all the data generated by users in e-commerce shopping, including characteristic behavior data such as abnormal purchases, abnormal evaluation content, abnormal user behavior, errors in system logs, etc. Data with threatening behavior characteristics needs to be intelligently identified and distinguished by machine learning algorithms.
[0108] The specific steps can be:
[0109] 1. Data collection: Collect user behavior data on the e-commerce platform, including but not limited to browsing history, purchase history, user reviews, etc. This data can be obtained through the platform's API or log files.
[0110] 2. Feature extraction: Extract features related to threatening behaviors from the collected data. For example, features such as abnormal purchase frequency, abnormal purchase of goods, abnormal evaluation content, abnormal user behavior, and errors in system logs can be extracted. In addition, users' social network information can also be extracted, such as purchase partnerships, evaluation interaction relationships, etc.
[0111] 3. Model training: Use machine learning algorithms (such as support vector machines, naive Bayes, neural networks, etc.) to train the model so that the model can identify threat behaviors. Select or develop a suitable machine learning algorithm to identify threat behaviors. During the training process, you can use existing annotated data sets to train and optimize the model.
[0112] 4. Threat behavior identification: By real-time monitoring of user behavior data on e-commerce platforms, trained models are used to identify potential threat behaviors. Once threatening behaviors are discovered, corresponding measures can be taken, such as sending warning messages, restricting account permissions, etc.
[0113] When conducting threat behavior statistics later, you can analyze the threat behaviors identified by the model: perform statistical analysis on the identified threat behaviors. This includes analyzing the source, target, time, frequency and pattern of the threat, and determining whether the target involves e-commerce payment: if so, mark it, and how they change over time. Through these analyses, you can better understand the nature of the threat and develop more effective response strategies.
[0114] As an optional implementation scheme of the present application, optionally, in step S1, the method for constructing the threat response mechanism model includes:
[0115] Configuring the threat response measures k to handle different types of threat behaviors s;
[0116] Configuring threat behavior characteristics of the threat behavior s;
[0117] Establishing a mapping relationship between the threat response measure k and the threat behavior characteristics of the corresponding threat behavior s;
[0118] The mapping relationship is saved in a background database to obtain the threat response mechanism model.
[0119] The administrator can configure a number of corresponding threat response measures k for handling different threat behaviors s.
[0120] Specific threat response measures are configured for different types of threat behaviors. For example, for threat behaviors of payment link attacks against e-commerce user payment behaviors, the administrator can configure corresponding threat response measures for such payment behaviors.
[0121] For a certain type of threat behavior, the administrator can configure several threat response measures, so that when the threat behavior is identified, the corresponding model can quickly activate and schedule the corresponding threat response measures according to the identified behavior type, and effectively combat and handle the behavior, such as denying access, etc. The specific configuration can be made by the administrator.
[0122] For the configured threat response measures and the corresponding types of threat behaviors, the corresponding mapping relationship can be established in advance during the configuration. Subsequently, the threat response mechanism model can quickly index and call the corresponding threat response measures for countermeasures based on the type of threat behavior identified and output by the threat behavior identification model.
[0123] As an optional implementation scheme of the present application, optionally, in step S1, the method for constructing the threat behavior statistical model includes:
[0124] Build a blank model;
[0125] Generate various statistical items in the blank model, the statistical items including the source, target, time, frequency, mode, whether e-commerce payment is involved in the threatening behavior, and the threat response measure k for effectively handling the threatening behavior;
[0126] After the generation is completed, the threat behavior statistical model is obtained.
[0127] The blank model is a blank form, which contains various statistical items, including the source, target, time, frequency, mode, whether e-commerce payment is involved in the threatening behavior, and the threat response measure k for effectively handling the threatening behavior.
[0128] After the model identifies the corresponding threat behavior and the effective threat response measures adopted for countermeasures, the threat behavior statistical model can write the source, target, time, mode of the identified threat behavior, whether it involves e-commerce payment, and the threat response measures called by the threat response mechanism model to effectively handle the threat behavior into the blank form according to the corresponding statistical items.
[0129] For each type of dangerous behavior, you can fill in the statistical items of the blank form in a unified manner, and generate the threat behavior identification results counted by the model in turn. The administrator can then use the various statistical items recorded in the form to identify and judge the details of various threat behaviors and effective response measures to effectively deal with various dangerous behaviors. This is convenient for collecting effective countermeasures to deal with various threat behaviors.
[0130] There is no limitation on the format of a blank form, such as an Excel table.
[0131] As an optional implementation scheme of the present application, optionally, in step S1, the method for constructing the adaptive learning model includes:
[0132] Establishing a stress monitoring program for monitoring whether the background model monitoring center issues an activation instruction;
[0133] Establishing a USB data port for importing the data set generated by the threat behavior statistical model: (s, k);
[0134] Establishing an API interface for sending the data set: (s, k) to the threat behavior identification model and the threat response mechanism model respectively;
[0135] Establishing an adaptive learning rule for regulating and learning the threat behavior identification model and the threat response mechanism model;
[0136] After the construction is completed, the adaptive learning model is obtained.
[0137] The adaptive learning model mainly responds after receiving the activation command issued by the background, and uses the data set (s, k) generated by the statistical model to regulate and optimize the training of threat behavior recognition model and threat response mechanism model.
[0138] This is because the identification results collected by the statistical model include various threat response measures that can effectively counter various threat behaviors.
[0139] Therefore, in the statistical table, for each threat behavior, threat response measures that are effective in countering the threat behavior have been collected. Therefore, these statistical data can be used to provide feedback to optimize the threat behavior identification model and threat response mechanism model that have been constructed in the early stage of training.
[0140] The adaptive learning model is an adaptive learning control module deployed on the background. This module can optimize and adjust the training data set in the threat behavior recognition model according to the statistically generated data set: (s, k), thereby optimizing the recognition capability of the threat behavior recognition model.
[0141] For the mapping relationship between various threat behaviors and their corresponding threat response measures in the threat response mechanism model, the mapping relationship between various threat behaviors and their corresponding threat response measures in the threat response mechanism model can also be adjusted by using the various threat response measures that are effective for the threat behaviors counted in the data set: (s, k).
[0142] Therefore, the statistical results can be used to feedback and adjust the model recognition capabilities of the threat behavior identification model and the threat response mechanism model, thereby improving the model's counter-effect on threat behavior.
[0143] The adaptive learning rules deployed on the model are used to regulate the training and learning procedures of the two models respectively. For the adaptive learning rules, the administrator can write corresponding adaptive learning rules according to the construction steps of the threat behavior identification model and the threat response mechanism model respectively, and configure them in the adaptive learning model.
[0144] As an optional implementation scheme of the present application, optionally, in step S2, threat identification is performed on the e-commerce data, including:
[0145] Collect and save e-commerce behavior data generated on e-commerce platforms;
[0146] Importing the e-commerce behavior data into the threat behavior identification model, extracting threat behavior features of the e-commerce behavior data using the threat behavior identification model, and identifying and outputting the corresponding threat behavior s;
[0147] Importing the threat behavior s into the threat response mechanism model, using the threat response mechanism model to respond to and process the threat behavior s, and marking the threat response measure k that effectively processes the threat behavior s this time;
[0148] The threat behavior statistical model is used to count the threat behavior s and the corresponding threat response measure k, and form a data set: (s, k);
[0149] When the background model monitoring center finds that the data volume information p of the data set (s, k) counted by the threat behavior statistical model reaches a preset data volume threshold, an activation instruction is issued to activate the adaptive learning model and report to the administrator at the same time;
[0150] The adaptive learning model is used to optimize and train the threat behavior identification model and the threat response mechanism model using the data set: (s, k).
[0151] Regarding the steps of using various models in the background to identify threats to the e-commerce data, please understand them in conjunction with the functions and interactions of the above models, which will not be repeated here.
[0152] This method can effectively improve the security of e-commerce platforms and protect the interests of users. The algorithms for feature extraction and model training can be further optimized to improve the accuracy of identifying threatening behaviors. At the same time, this method can be considered for application to other types of online platforms to enhance the security of the entire network. Intelligent identification involves real-time or near-real-time analysis and identification of potential threatening behaviors, while statistics involves data collection and statistical analysis of these threatening behaviors to better understand the nature and source of threats.
[0153] Intelligent identification can be achieved in many ways, such as using machine learning algorithms to analyze network traffic and user behavior to identify abnormal or potentially malicious behavior. In addition, threat intelligence can be used, which is a big data-based security analysis technology designed to analyze information about network threats. By analyzing tactical information such as threat vectors, tools, infrastructure used by attackers, targeted business or technology types, and evasion strategies, threat behaviors can be identified more accurately.
[0154] In terms of statistics, it is necessary to collect and organize data on the identified threat behaviors. This includes recording information such as the types of threats, frequency of occurrence, target systems, etc. Through statistical analysis, various conclusions about threat behaviors can be drawn, such as the attacker's motivations, goals, methods, etc.
[0155] It is critical for enterprises to understand the likelihood of becoming a target of different types of attacks, as well as the severity and potential impact of these attacks. Through intelligent identification and statistics, enterprises can better understand the nature and source of threats and take appropriate measures to respond to and defend against them.
[0156] Please note that the specific implementation methods and technologies may vary depending on different application scenarios and requirements. Therefore, in actual applications, selection and adjustment are required according to specific circumstances. When implementing intelligent identification and statistics of threat behaviors, enterprises can establish an effective intelligent identification and statistics system for threat behaviors, thereby better protecting their network and information security.
[0157] Obviously, those skilled in the art should understand that the implementation of all or part of the processes in the above-mentioned embodiments can be completed by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the above-mentioned embodiments. Those skilled in the art can understand that the implementation of all or part of the processes in the above-mentioned embodiments can be completed by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the above-mentioned embodiments. Among them, the storage medium can be a disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory (Flash Memory), a hard disk (Hard Disk Drive, abbreviated as: HDD) or a solid-state drive (SSD), etc.; the storage medium can also include a combination of the above-mentioned types of memory.
[0158] Example 2
[0159] Based on the implementation principle of Example 1, on the other hand, the present application proposes a device for implementing a behavior statistics and intelligent security response method applicable to e-commerce threats, including:
[0160] Model building module, used to build threat behavior identification model, threat response mechanism model, threat behavior statistical model and adaptive learning model;
[0161] A deployment module is used to deploy the threat behavior identification model, the threat response mechanism model, the threat behavior statistical model and the adaptive learning model on the background server;
[0162] Backend database, used to store data;
[0163] A background model monitoring center is used to monitor the data set counted by the threat behavior statistical model: the data volume information p of (s, k): when the background model monitoring center finds that p reaches a preset data volume threshold, it issues an activation instruction to activate the adaptive learning model and reports to the administrator at the same time; and
[0164] Monitor the state of the adaptive learning model optimizing the training of the threat behavior identification model and the threat response mechanism model: when the optimization training is completed, delete the data set used for the optimization training this time: (s, k);
[0165] The backend server is used to schedule each model and the backend model monitoring center to identify and warn of threatening behaviors on the e-commerce platform.
[0166] The functions and interactions of the various entities of the above-mentioned device can be understood in conjunction with Example 1, and will not be described in detail in this embodiment.
[0167] The modules or steps of the present invention described above can be implemented by a general-purpose computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, and optionally, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.
[0168] Example 3
[0169] like Figure 6 As shown, further, in another aspect, the present application also proposes an electronic device, including:
[0170] processor;
[0171] a memory for storing processor-executable instructions;
[0172] Among them, the processor is configured to implement the behavioral statistics and intelligent security response method applicable to e-commerce threats when executing the executable instructions.
[0173] The electronic device according to the embodiment of the present disclosure includes a processor and a memory for storing instructions executable by the processor, wherein the processor is configured to implement any of the above-mentioned behavior statistics and intelligent security response methods applicable to e-commerce threats when executing the executable instructions.
[0174] Here, it should be noted that the number of processors can be one or more. At the same time, the electronic device in the embodiment of the present disclosure may also include an input device and an output device. Among them, the processor, memory, input device and output device may be connected through a bus or in other ways, which are not specifically limited here.
[0175] As a computer-readable storage medium, the memory can be used to store software programs, computer executable programs and various modules, such as: a program or module corresponding to a behavior statistics and intelligent security response method for e-commerce threats in an embodiment of the present disclosure. The processor executes various functional applications and data processing of the electronic device by running the software programs or modules stored in the memory.
[0176] The input device can be used to receive input numbers or signals. The signal can be a key signal related to user settings and function control of the device / terminal / server. The output device can include a display device such as a display screen.
[0177] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or technical improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.
Claims
1. A behavior statistics and intelligent security response method applicable to e-commerce threats, characterized in that: The steps include: S1. Construct threat behavior identification model, threat response mechanism model, threat behavior statistical model and adaptive learning model, among which: The threat behavior identification model is used to identify threats based on e-commerce big data and output corresponding threat behaviors s; The threat response mechanism model is used to respond to and process the threat behavior s, and mark the threat response measure k that effectively processes the threat behavior s this time; The threat behavior statistical model is used to count the threat behavior s and the corresponding threat response measure k, and form a data set: (s, k), including analyzing the source, target, time, frequency and pattern of the threat, and determining whether the target involves e-commerce payment: if so, it is marked, and how they change over time; The adaptive learning model is used to optimize and train the threat behavior identification model and the threat response mechanism model according to the data set: (s, k); S2, deploying the threat behavior identification model, the threat response mechanism model, the threat behavior statistical model and the adaptive learning model in the backend server of the e-commerce platform to perform threat identification on the e-commerce big data; Deploy a background model monitoring center on the background server; The background model monitoring center is used to: Monitor the data set counted by the threat behavior statistical model: data volume information p of (s, k): when the background model monitoring center finds that p reaches a preset data volume threshold, an activation instruction is issued to activate the adaptive learning model and report to the administrator at the same time; when the capacity P of the statistical data set reaches 50 megabytes, an activation instruction is issued to allow the adaptive learning model to start regulating and optimizing the training of the threat behavior identification model and the threat response mechanism model; Monitor the state of the adaptive learning model optimizing the training of the threat behavior identification model and the threat response mechanism model: when the optimization training is completed, delete the data set used for the optimization training: (s, k).
2. According to claim 1, a behavior statistics and intelligent security response method applicable to e-commerce threats is characterized in that: In step S1, the method for constructing the threat behavior identification model includes: Retrieve the stored e-commerce big data from the backend database; Cleaning and screening the e-commerce big data to obtain training data for training the model; Extracting threat behavior features related to threat behaviors from the e-commerce big data, and using a preset machine learning algorithm to learn the features and perform model training, so that the model learns the ability to identify features related to threat behaviors; After the training is completed, the initial threat behavior recognition model is obtained; Importing an optimized data set with labeled threat behavior features to optimize and train the initial threat behavior identification model; After the optimization training is completed, the threat behavior recognition model is obtained.
3. The behavior statistics and intelligent security response method applicable to e-commerce threats according to claim 1 is characterized in that: In step S1, the method for constructing the threat response mechanism model includes: Configuring the threat response measures k to handle different types of threat behaviors s; Configuring threat behavior characteristics of the threat behavior s; Establishing a mapping relationship between the threat response measure k and the threat behavior characteristics of the corresponding threat behavior s; The mapping relationship is saved in a background database to obtain the threat response mechanism model.
4. According to claim 1, a behavior statistics and intelligent security response method applicable to e-commerce threats is characterized in that: In step S1, the method for constructing the threat behavior statistical model includes: Build a blank model; Generate various statistical items in the blank model, the statistical items including the source, target, time, frequency, mode, whether e-commerce payment is involved in the threatening behavior, and the threat response measure k for effectively handling the threatening behavior; After the generation is completed, the threat behavior statistical model is obtained.
5. The behavior statistics and intelligent security response method applicable to e-commerce threats according to claim 1 is characterized in that: In step S1, the method for constructing the adaptive learning model includes: Establishing a stress monitoring program for monitoring whether the background model monitoring center issues an activation instruction; Establishing a USB data port for importing the data set generated by the threat behavior statistical model: (s, k); Establishing an API interface for sending the data set: (s, k) to the threat behavior identification model and the threat response mechanism model respectively; Establishing an adaptive learning rule for regulating and learning the threat behavior identification model and the threat response mechanism model; After the construction is completed, the adaptive learning model is obtained.
6. The behavior statistics and intelligent security response method applicable to e-commerce threats according to claim 1 is characterized in that: In step S2, threat identification is performed on the e-commerce big data, including: Collect and save e-commerce behavior data generated on e-commerce platforms; Importing the e-commerce behavior data into the threat behavior identification model, extracting threat behavior features of the e-commerce behavior data using the threat behavior identification model, and identifying and outputting the corresponding threat behavior s; Importing the threat behavior s into the threat response mechanism model, using the threat response mechanism model to respond to and process the threat behavior s, and marking the threat response measure k that effectively processes the threat behavior s this time; The threat behavior statistical model is used to count the threat behavior s and the corresponding threat response measure k, and form a data set: (s, k); When the background model monitoring center finds that the data volume information p of the data set (s, k) counted by the threat behavior statistical model reaches a preset data volume threshold, an activation instruction is issued to activate the adaptive learning model and report to the administrator at the same time; The adaptive learning model is used to optimize and train the threat behavior identification model and the threat response mechanism model using the data set: (s, k).
7. A device for implementing the behavior statistics and intelligent security response method applicable to e-commerce threats as described in any one of claims 1 to 6, characterized in that: include: Model building module, used to build threat behavior identification model, threat response mechanism model, threat behavior statistical model and adaptive learning model; A deployment module is used to deploy the threat behavior identification model, the threat response mechanism model, the threat behavior statistical model and the adaptive learning model on the background server; Backend database, used to store data; The background model monitoring center is used to monitor the data set counted by the threat behavior statistical model: the data volume information p of (s, k): when the background model monitoring center finds that p reaches a preset data volume threshold, it issues an activation instruction to activate the adaptive learning model and reports to the administrator at the same time; as well as Monitor the state of the adaptive learning model optimizing the training of the threat behavior identification model and the threat response mechanism model: when the optimization training is completed, delete the data set used for the optimization training this time: (s, k); The backend server is used to schedule each model and the backend model monitoring center to identify and warn of threatening behaviors on the e-commerce platform.
8. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to implement a behavior statistics and intelligent security response method applicable to e-commerce threats as described in any one of claims 1 to 6 when executing the executable instructions.