A security early warning method and system based on network user behavior

Abstract

The present invention relates to the technical field of network data analysis, and in particular to a security warning method and system based on network user behavior. When a security alarm periodic update request is obtained, the warning user and warning rule corresponding to the security alarm periodic update request are collected; the warning conditions in the warning rule are collected, the warning condition outputs the warning behavior path and the path node warning rule corresponding to the warning behavior path, and the safety identification result of the behavior path node of the warning user is constructed based on the path node warning rule; the safety identification result of the behavior path node is updated to the warning rule, the user safety alarm corresponding to the warning user is output, and the reporting request of the user safety alarm is transmitted to the server, so that the server reports the user safety alarm. The present invention can effectively capture various behaviors of network users at regular intervals, give safety warning results of various behavior users, and guide users to operate safely in the network.

Description

Technical Field

[0001] The present invention relates to the technical field of network data analysis, and in particular to a security early warning method and system based on network user behavior. Background Art

[0002] Nowadays, the Internet is everywhere. People can connect to wireless hotspots or use other networks to connect to the Internet in a large number of places. By using big data and machine learning technology to analyze the extracted application layer data packets, big data analysis and judgment are conducted on behaviors including APP downloads, Internet access, call behavior, and transfer and payment behavior.

[0003] In the existing technology, abnormal behavior monitoring is generally based solely on investigation and positioning of big data network behavior. By collecting historical data, a large amount of call record data and device behavior data is formed, and a machine recognition model is built. The model is trained using historical data to identify abnormal numbers, devices and behaviors. The means of tracing abnormal devices are single and lack flexibility. Summary of the invention

[0004] To achieve the above objectives, this application provides the following technical solutions:

[0005] According to a first aspect of the present invention, the present invention claims protection for a security early warning method based on network user behavior, characterized in that it comprises the following steps:

[0006] When a security alarm periodic update request is obtained, collecting the warning users and warning rules corresponding to the security alarm periodic update request;

[0007] Collect the warning conditions in the warning rules, identify the warning conditions to output the warning behavior path and the path node warning rules corresponding to the warning behavior path, and construct the safety identification results of the behavior path nodes of the warning user based on the path node warning rules;

[0008] The security identification result of the behavior path node is updated into the warning rule, a user security alert corresponding to the warning user is output, and a reporting request of the user security alert is transmitted to a server so that the server reports the user security alert.

[0009] Furthermore, the step of constructing the safety identification result of the behavior path node of the warning user based on the path node warning rule includes:

[0010] When the warning behavior path is a multi-dimensional warning behavior, collecting adjacent behavior path nodes corresponding to the multi-dimensional warning behavior, and detecting whether the adjacent behavior path nodes are the same behavior path node;

[0011] When it is determined that the adjacent behavior path nodes are the same behavior path node, the adjacent behavior path nodes are deduplicated according to the multi-dimensional warning behavior, and a safety identification result of the behavior path node is output;

[0012] When the adjacent behavior path nodes are not the same behavior path nodes, the behavior path leaf nodes in the adjacent behavior path nodes are determined, non-behavior path leaf nodes in the adjacent behavior path nodes other than the behavior path leaf nodes are deduplicated, and a security identification result of the behavior path node is output.

[0013] Furthermore, the step of constructing the safety identification result of the behavior path node of the warning user based on the path node warning rule also includes:

[0014] When the warning condition is a one-dimensional warning behavior, a sub-warning behavior type of the one-dimensional warning behavior is obtained, wherein the sub-warning behavior type includes a buried point warning behavior and a visit warning behavior;

[0015] When the sub-warning behavior type is the burying point warning behavior, the first behavior path node deployed as the burying point warning behavior in the warning user is processed according to the burying point attribute identified by the burying point warning behavior, and a safety identification result of the behavior path node is output;

[0016] When the sub-warning behavior type is the access warning behavior, the second behavior path node deployed as the access warning behavior in the warning user is processed according to the access identified by the access warning behavior, and the security identification result of the behavior path node is output.

[0017] Furthermore, before the step of collecting the warning conditions in the warning rules, it also includes:

[0018] Collecting the metadata path of the warning user, acquiring the stored warning behavior history record according to the metadata path, and judging whether all the warning behavior types corresponding to the behavior path nodes of the warning user exist in the warning behavior history record;

[0019] When all the warning behavior types exist in the warning behavior history record, the warning conditions of the warning user are updated based on the warning behavior types, and the warning conditions are stored in the warning rules by column.

[0020] Furthermore, after the step of determining whether all warning behavior types corresponding to the behavior path nodes of the warning user exist in the warning behavior history records, the method further includes:

[0021] When the warning behavior type corresponding to the behavior path node does not exist in the warning behavior historical record, a preset warning behavior is newly created in the warning behavior historical record based on the behavior path node path of the behavior path node;

[0022] The user warning behavior of the warning user is updated based on the preset warning behavior, and the user warning behavior is stored in the warning rule by column.

[0023] Further, after the step of updating the security identification result of the behavior path node into the warning rule, outputting the user security alert corresponding to the warning user, and transmitting the reporting request of the user security alert to the server so that the server reports the user security alert, it also includes:

[0024] When a correction request for the user security alert is obtained, searching for a user correction attribute and an invalid behavior path node corresponding to the correction request;

[0025] Correct the abnormal warning behavior corresponding to the invalid behavior path node according to the user correction attribute, and output a normal warning behavior;

[0026] The normal warning behavior output correction template is re-imported into the warning rule, and the correction safety alarm corresponding to the correction request is updated based on the correction template.

[0027] Further, the step of transmitting the reporting request of the user safety alarm to the server so that the server reports the user safety alarm includes:

[0028] The user security alarm is associated with a corresponding preset reporting control, and when the association between the user security alarm and the preset reporting control is completed, a reporting request of the user security alarm is transmitted to the server, so that the server reports the user security alarm.

[0029] According to a second aspect of the present invention, the present invention claims protection for a security early warning system based on network user behavior, characterized in that it includes:

[0030] An acquisition unit, configured to, when acquiring a security alarm periodic update request, collect an early warning user and an early warning rule corresponding to the security alarm periodic update request;

[0031] An identification unit, used for collecting the warning conditions in the warning rules, identifying the warning conditions to output the warning behavior path and the path node warning rules corresponding to the warning behavior path, and constructing the safety identification results of the behavior path nodes of the warning user based on the path node warning rules;

[0032] An updating unit, configured to update the security identification result of the behavior path node into the warning rule, output a user security alert corresponding to the warning user, and transmit a reporting request of the user security alert to a server so that the server reports the user security alert;

[0033] The security early warning system based on network user behavior is used to implement the security early warning method based on network user behavior.

[0034] The present invention relates to the technical field of network data analysis, and in particular to a security warning method and system based on network user behavior. When a security alarm periodic update request is obtained, the warning user and warning rule corresponding to the security alarm periodic update request are collected; the warning conditions in the warning rule are collected, the warning condition outputs the warning behavior path and the path node warning rule corresponding to the warning behavior path, and the safety identification result of the behavior path node of the warning user is constructed based on the path node warning rule; the safety identification result of the behavior path node is updated to the warning rule, the user safety alarm corresponding to the warning user is output, and the reporting request of the user safety alarm is transmitted to the server, so that the server reports the user safety alarm. The present invention can effectively capture various behaviors of network users at regular intervals, give safety warning results of various behavior users, and guide users to operate safely in the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 A workflow diagram of a security early warning method based on network user behavior as claimed in an embodiment of the present invention;

[0036] Figure 2 A structural module diagram of a security early warning system based on network user behavior for which protection is requested in an embodiment of the present invention. DETAILED DESCRIPTION

[0037] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0038] The terms "first", "second" and "third" in this application are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features. Thus, the features defined as "first", "second" and "third" can explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "multiple" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined. All directional indications in the embodiments of the present application (such as up, down, left, right, front, back...) are only used to explain the relative position relationship, movement, etc. between the components under a certain specific posture (as shown in the accompanying drawings). If the specific posture changes, the directional indication also changes accordingly. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices.

[0039] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0040] In order to enable people in the technical field to better understand the present application, the technical solution in the embodiment of the present application will be clearly and completely described below in conjunction with the accompanying drawings. It should be noted that the security warning method based on network user behavior provided in the embodiment of the present application is generally executed by a server, and accordingly, the security warning system based on network user behavior is generally set in the server.

[0041] refer to Figure 1 , shows a flow chart of an embodiment of a security early warning method based on network user behavior according to the present application. The security early warning method based on network user behavior comprises the following steps:

[0042] Step S201: when a security alarm periodic update request is obtained, the warning user and warning rule corresponding to the security alarm periodic update request are collected.

[0043] In this embodiment, when a security alarm periodic update request is obtained, the warning user and warning rule corresponding to the security alarm periodic update request are obtained, wherein the warning user is metadata that needs to be updated for the security alarm, and the warning rule is a preset security alarm template. The obtained security alarm update request is identified, the security alarm identifier corresponding to the security alarm update request is output, and the corresponding warning user and warning rule are determined according to the security alarm identifier.

[0044] Step S202, collect the warning conditions in the warning rules, identify the warning conditions to output the warning behavior path and the path node warning rules corresponding to the warning behavior path, and construct the security identification results of the behavior path nodes of the warning user based on the path node warning rules.

[0045] In this embodiment, the warning rule includes a table header, a warning behavior column, and all behavior path nodes in the warning user, and each warning behavior column corresponds to a warning condition. The warning condition is a warning behavior pre-deployed according to the user behavior path node in the warning user. When the warning behavior deployment of all user behavior path nodes in the warning user is completed, the warning condition is stored in the user template by column. Among them, the warning behavior deployment of the user behavior path node can be deployed through the behavior path node attribute of the user behavior path node, such as the user behavior path node with the buried point attribute, and the user behavior path node is deployed with the buried point warning behavior. The warning condition may specifically include one-dimensional warning behavior and multi-dimensional warning behavior, wherein the one-dimensional warning behavior is the warning behavior information corresponding to the behavior path node of a single behavior path node path and does not need to be deduplicated into adjacent behavior path nodes, and the multi-dimensional warning behavior is the warning behavior corresponding to the behavior path node that needs to be deduplicated into adjacent behavior path nodes. According to the warning behavior path, the execution action of the behavior path node in the warning user is judged, that is, the path node warning rule. An early warning rule may include multiple early warning conditions, and an early warning rule corresponds to a user security alarm. Specifically, when outputting the warning rule, the warning condition deployed in the warning rule is obtained, the warning condition is identified, and the warning behavior path of the warning condition and the path node warning rule corresponding to the warning behavior path are output. Among them, the warning condition can be identified by obtaining a preset regular expression, matching the regular expression with the warning condition, and outputting the warning behavior path and the path node warning rule. Afterwards, the behavior path node of the warning user is constructed based on the path node warning rule to obtain a safety identification result of the behavior path node, that is, the behavior path node of the warning user is constructed into a safety identification result of the behavior path node that meets the warning rule through the path node warning rule.

[0046] Step S203, updating the security identification result of the behavior path node into the warning rule, outputting the user security alert corresponding to the warning user, and transmitting the reporting request of the user security alert to the server, so that the server reports the user security alert.

[0047] In this embodiment, since the security identification result of the behavior path node is the information output by processing the behavior path node in the warning user according to the path node warning rule of the warning condition, when the security identification result of the behavior path node is output, the security identification result of the behavior path node is updated in the warning rule in a column according to the corresponding warning condition. Among them, the user column of the security identification result of the behavior path node is also deployed in the warning condition, and the user column is the column to which the user warning behavior belongs in the warning rule (security alarm). When the update of the warning rule is completed, the user security alarm is output; the reporting request of the user security alarm is transmitted to the server so that the server reports the user security alarm. When the user security alarm is reported successfully, the user security alarm is fed back to the user display control of the server; when the user security alarm fails to be reported, the reason for the failure to report is obtained, and the reason for the failure is fed back to the user display control of the server.

[0048] It should be emphasized that in order to further ensure the privacy and security of the above-mentioned user security alerts, the above-mentioned user security alerts can also be stored in a node of a blockchain.

[0049] The blockchain referred to in this application is a new application model of computer technologies such as distributed behavior path node storage, point-to-point transmission, consensus mechanism, encryption algorithm, etc.

[0050] This application realizes the unified management and regular updating of security alarms according to early warning behaviors, saves the time of security alarm updating, improves the efficiency of security alarm updating, and further reduces the maintenance cost of security alarms.

[0051] In some optional implementations of this embodiment, the step of constructing the security identification result of the behavior path node of the warning user based on the path node warning rule includes:

[0052] When the warning behavior path is a multi-dimensional warning behavior, collecting adjacent behavior path nodes corresponding to the multi-dimensional warning behavior, and detecting whether the adjacent behavior path nodes are the same behavior path node;

[0053] When it is determined that the adjacent behavior path nodes are the same behavior path node, the adjacent behavior path nodes are deduplicated according to the multi-dimensional warning behavior, and a safety identification result of the behavior path node is output;

[0054] When the adjacent behavior path nodes are not the same behavior path nodes, the behavior path leaf nodes in the adjacent behavior path nodes are determined, non-behavior path leaf nodes in the adjacent behavior path nodes other than the behavior path leaf nodes are deduplicated, and a security identification result of the behavior path node is output.

[0055] In this embodiment, different warning behavior paths correspond to different path node warning rules. When the warning behavior path is a multi-dimensional warning behavior, the adjacent behavior path node corresponding to the multi-dimensional warning behavior is obtained, wherein the adjacent behavior path node is a behavior path node randomly placed in rows in the warning rule in the warning user, and it is determined whether all the behavior path nodes in the adjacent behavior path node are the same behavior path node. If the adjacent behavior path nodes are all the same behavior path node, the adjacent behavior path nodes corresponding to the multi-dimensional warning behavior are deduplicated, and the safety identification result of the behavior path node corresponding to the warning user is output. If the adjacent behavior path node is not the same behavior path node, the behavior path leaf node in the adjacent behavior path node is determined, and the behavior path leaf node is a behavior path node that is inconsistent with other behavior path nodes in the adjacent behavior path node; the behavior path leaf node is screened out, and the remaining non-behavior path leaf nodes in the adjacent behavior path node are deduplicated, and the safety identification result of the behavior path node corresponding to the warning user is output.

[0056] This application deduplicates adjacent behavior path nodes through multi-dimensional warning behaviors, thereby achieving unified management of behavior path nodes with the same content and improving the efficiency of deduplication of behavior path nodes.

[0057] In some optional implementations of this embodiment, the step of constructing the security identification result of the behavior path node of the warning user based on the path node warning rule further includes:

[0058] When the warning condition is a one-dimensional warning behavior, a sub-warning behavior type of the one-dimensional warning behavior is obtained, wherein the sub-warning behavior type includes a buried point warning behavior and a visit warning behavior;

[0059] When the sub-warning behavior type is the burying point warning behavior, the first behavior path node deployed as the burying point warning behavior in the warning user is processed according to the burying point attribute identified by the burying point warning behavior, and a safety identification result of the behavior path node is output;

[0060] When the sub-warning behavior type is the access warning behavior, the second behavior path node deployed as the access warning behavior in the warning user is processed according to the access identified by the access warning behavior, and the security identification result of the behavior path node is output.

[0061] In this embodiment, when the warning condition is a one-dimensional warning behavior, the sub-warning behavior type of the one-dimensional warning behavior is obtained, wherein the sub-warning behavior type includes a buried warning behavior, an access warning behavior, and a designated warning behavior. The buried warning behavior specifies the output attributes of the buried behavior path node in the warning user, and the access warning behavior is the access ID of the ratio or ratio in the warning user; the designated warning behavior is the processing warning behavior of the designated behavior path node in the warning user, and according to the designated warning behavior, the designated behavior path node can be logically processed only for the warning user. The sub-warning behavior type of the one-dimensional warning behavior is obtained, and different logical processing is performed on the behavior path node of the warning user according to the sub-warning behavior type, that is, the security identification result of the behavior path node of the warning user is output. When the sub-warning behavior type is a buried warning behavior, the first behavior path node deployed as a buried warning behavior in the warning user is processed according to the buried attribute of the buried warning behavior identification, and the security identification result of the behavior path node is output. Specifically, when the sub-warning behavior type is a buried point warning behavior, the first behavior path node deployed as a buried point warning behavior in the warning user and the buried point attribute identified by the buried point warning behavior are obtained; the first behavior path node is corrected to a behavior path node that conforms to the buried point attribute, that is, the security identification result of the behavior path node is output. When the sub-warning behavior type is an access warning behavior, the second behavior path node deployed as an access warning behavior in the warning user is processed according to the access identified by the access warning behavior, and the security identification result of the behavior path node is output; wherein, for the behavior path nodes belonging to the same access, the same access warning behavior is corresponding. Taking the absence rate as an access as an example, the absence rate is calculated and output by the ratio of the number of absentees to the total number of people, and the number of absentees and the total number of people correspond to the same access warning behavior. When the sub-warning behavior type is an access warning behavior, the second behavior path node deployed as an access warning behavior in the warning user is obtained, and the calculation formula associated with the access is obtained according to the access identified by the access warning behavior. The second behavior path node is access calculated according to the calculation formula, and the final access result is output, which is the security identification result of the behavior path node of the output warning user.

[0062] This embodiment constructs the security identification result of the behavior path node of the warning user through the one-dimensional warning behavior, realizes different logical processing of the behavior path nodes according to the one-dimensional warning behavior, and further realizes the regular update of the security alarm.

[0063] In some optional implementations of this embodiment, before the step of collecting the warning conditions in the warning rule, the method further includes:

[0064] Collecting the metadata path of the warning user, acquiring the stored warning behavior history record according to the metadata path, and judging whether all the warning behavior types corresponding to the behavior path nodes of the warning user exist in the warning behavior history record;

[0065] When all the warning behavior types exist in the warning behavior history record, the warning conditions of the warning user are updated based on the warning behavior types, and the warning conditions are stored in the warning rules by column.

[0066] In this embodiment, the metadata path is the path to which the warning user belongs. The metadata path of the warning user can be determined based on the suffix name or metadata name of the warning user. The stored warning behavior history record is obtained based on the metadata path, and different metadata paths correspond to different warning behavior history records. It is determined whether all warning behavior types corresponding to the behavior path nodes of the warning user exist in the warning behavior history record, where different behavior path node paths or behavior path node contents may correspond to different warning behavior types. When the warning behavior types corresponding to all behavior path nodes of the warning user exist in the warning behavior history record, the warning condition of the warning user is updated based on the warning behavior type, and the warning condition is stored in the warning rule by column.

[0067] This embodiment manages the warning conditions in a unified manner through the warning behavior history record, so that when it is necessary to add or correct the security alarm content, the regular correction of the security alarm can be completed by correcting the warning behavior, thereby improving the efficiency of the regular update of the security alarm.

[0068] In some optional implementations of this embodiment, after the step of determining whether all warning behavior types corresponding to the behavior path nodes of the warning user exist in the warning behavior history records, the method further includes:

[0069] When the warning behavior type corresponding to the behavior path node does not exist in the warning behavior historical record, a preset warning behavior is newly created in the warning behavior historical record based on the behavior path node path of the behavior path node;

[0070] The user warning behavior of the warning user is updated based on the preset warning behavior, and the user warning behavior is stored in the warning rule by column.

[0071] In this embodiment, the warning behavior types corresponding to all the behavior path nodes of the warning user may not exist in the warning behavior history record. When the warning behavior types corresponding to the behavior path nodes of the warning user do not exist in the warning behavior history record, the behavior path node path of the behavior path node is obtained, and a corresponding preset warning behavior is newly created in the warning behavior history record according to the behavior path node path. Among them, the behavior path node path and the preset warning behavior are in an associated relationship, and the preset warning behavior corresponding to the behavior path node path can be obtained through the preset associated mapping warning behavior. When outputting the preset warning behavior, the user warning behavior of the warning user is updated according to the preset warning behavior, and the user warning behavior is stored in the warning rule corresponding to the warning user by column.

[0072] This embodiment adds a new user warning behavior to the warning behavior history record, so that the content of the security alarm behavior path node can be processed differently through the newly added warning behavior, further improving the processing efficiency of the security alarm behavior path node.

[0073] In some optional implementations of this embodiment, after the steps of updating the security identification result of the behavior path node into the warning rule, outputting the user security alert corresponding to the warning user, and transmitting the reporting request of the user security alert to the server so that the server reports the user security alert, the method further includes:

[0074] When a correction request for the user security alert is obtained, searching for a user correction attribute and an invalid behavior path node corresponding to the correction request;

[0075] Correct the abnormal warning behavior corresponding to the invalid behavior path node according to the user correction attribute, and output a normal warning behavior;

[0076] The normal warning behavior output correction template is re-imported into the warning rule, and the correction safety alarm corresponding to the correction request is updated based on the correction template.

[0077] In this embodiment, when a correction request for a user security alarm is obtained, the user correction attribute and the invalid behavior path node corresponding to the correction request are searched, and the abnormal warning behavior corresponding to the invalid behavior path node is corrected according to the user correction attribute. The corrected abnormal warning behavior is the normal warning behavior, which is re-imported into the warning rule and saved, and a correction template is output. Reporting the correction template is to output the correction security alarm corresponding to the current correction request.

[0078] This embodiment corrects the abnormal warning behavior, outputs the normal warning behavior, and then updates the correction template according to the normal warning behavior, thereby achieving regular correction of security alarms through warning behaviors and improving the efficiency of security alarm correction.

[0079] In some optional implementations of this embodiment, the step of transmitting the reporting request of the user safety alarm to the server so that the server reports the user safety alarm includes:

[0080] The user security alarm is associated with a corresponding preset reporting control, and when the association between the user security alarm and the preset reporting control is completed, a reporting request of the user security alarm is transmitted to the server, so that the server reports the user security alarm.

[0081] In this embodiment, when the security identification result of the behavior path node is updated to the user template and the user security alarm is output, the user security alarm is associated with the corresponding preset reporting control. When the association between the user security alarm and the preset reporting control is completed, the reporting request of the user security alarm is transmitted to the server; when the server receives the reporting request of the user security alarm, the server reports the user security alarm based on the reporting request. In addition, when the user template corresponding to the security alarm periodic update request is obtained, the user template can also be associated with the preset reporting control of the corresponding server in advance; when the security identification result of the behavior path node is updated to the early warning rule and the user security alarm is output, there is no need to associate the user security alarm with the preset reporting control, and the reporting request of the user security alarm is directly transmitted to the server, and the server reports the user security alarm based on the reporting request.

[0082] This embodiment achieves regular reporting of user security alarms by associating user security alarms with corresponding preset reporting controls, thereby further improving the updating efficiency of user security alarms.

[0083] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be realized by requesting related hardware to complete through a computer-readable request, and the computer-readable request can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the aforementioned storage medium can be a non-volatile storage medium such as a disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0084] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0085] Further references Figure 2 , as a response to the above Figure 1 The present application provides an embodiment of a security early warning system based on network user behavior. Figure 1 Corresponding to the method embodiment shown, the system can be specifically applied to various electronic devices.

[0086] like Figure 2 As shown, the security warning system based on network user behavior described in this embodiment includes: an acquisition unit 301, an identification unit 302 and an update unit 303. Among them:

[0087] The acquisition unit 301 is used to collect the warning user and warning rule corresponding to the security alarm periodic update request when the security alarm periodic update request is obtained;

[0088] In this embodiment, when a security alarm periodic update request is obtained, the warning user and warning rule corresponding to the security alarm periodic update request are obtained, wherein the warning user is metadata that needs to be updated for the security alarm, and the warning rule is a preset security alarm template. The obtained security alarm update request is identified, the security alarm identifier corresponding to the security alarm update request is output, and the corresponding warning user and warning rule are determined according to the security alarm identifier.

[0089] An identification unit 302 is used to collect the warning conditions in the warning rules, identify the warning conditions, output the warning behavior path and the path node warning rules corresponding to the warning behavior path, and construct the safety identification results of the behavior path nodes of the warning user based on the path node warning rules;

[0090] In some optional implementations of this embodiment, the identification unit 302 includes:

[0091] A first acquisition unit is used to collect adjacent behavior path nodes corresponding to the multi-dimensional warning behavior when the warning behavior path is a multi-dimensional warning behavior, and detect whether the adjacent behavior path nodes are the same behavior path node;

[0092] A deduplication unit, configured to, when determining that the adjacent behavior path nodes are the same behavior path node, deduplicate the adjacent behavior path nodes according to the multi-dimensional warning behavior, and output a safety identification result of the behavior path node;

[0093] A confirmation unit is used to determine the behavior path leaf nodes in the adjacent behavior path nodes when the adjacent behavior path nodes are not the same behavior path nodes, deduplicate the non-behavior path leaf nodes in the adjacent behavior path nodes except the behavior path leaf nodes, and output the security identification result of the behavior path node.

[0094] In some optional implementations of this embodiment, the identification unit 302 further includes:

[0095] A second acquisition unit is used to acquire a sub-warning behavior type of the one-dimensional warning behavior when the warning condition is a one-dimensional warning behavior, wherein the sub-warning behavior type includes a buried point warning behavior and a visit warning behavior;

[0096] A first construction unit is used for processing, when the sub-warning behavior type is the burying point warning behavior, a first behavior path node deployed as the burying point warning behavior in the warning user according to the burying point attribute identified by the burying point warning behavior, and outputting a safety identification result of the behavior path node;

[0097] The second construction unit is used to process the second behavior path node deployed as the access warning behavior in the warning user according to the access identified by the access warning behavior when the sub-warning behavior type is the access warning behavior, and output the security identification result of the behavior path node.

[0098] In this embodiment, the warning rule includes a table header, a warning behavior column, and all behavior path nodes in the warning user, and each warning behavior column corresponds to a warning condition. The warning condition is a warning behavior pre-deployed according to the user behavior path node in the warning user. When the warning behavior deployment of all user behavior path nodes in the warning user is completed, the warning condition is stored in the user template by column. Among them, the warning behavior deployment of the user behavior path node can be deployed through the behavior path node attribute of the user behavior path node, such as the user behavior path node with the buried point attribute, and the user behavior path node is deployed with the buried point warning behavior. The warning condition may specifically include one-dimensional warning behavior and multi-dimensional warning behavior, wherein the one-dimensional warning behavior is the warning behavior information corresponding to the behavior path node of a single behavior path node path and does not need to be deduplicated into adjacent behavior path nodes, and the multi-dimensional warning behavior is the warning behavior corresponding to the behavior path node that needs to be deduplicated into adjacent behavior path nodes. According to the warning behavior path, the execution action of the behavior path node in the warning user is judged, that is, the path node warning rule. An early warning rule may include multiple early warning conditions, and an early warning rule corresponds to a user security alarm. Specifically, when outputting the warning rule, the warning condition deployed in the warning rule is obtained, the warning condition is identified, and the warning behavior path of the warning condition and the path node warning rule corresponding to the warning behavior path are output. Among them, the warning condition can be identified by obtaining a preset regular expression, matching the regular expression with the warning condition, and outputting the warning behavior path and the path node warning rule. Afterwards, the behavior path node of the warning user is constructed based on the path node warning rule to obtain a safety identification result of the behavior path node, that is, the behavior path node of the warning user is constructed into a safety identification result of the behavior path node that meets the warning rule through the path node warning rule.

[0099] The updating unit 303 is used to update the security identification result of the behavior path node into the warning rule, output the user security alert corresponding to the warning user, and transmit the reporting request of the user security alert to the server so that the server reports the user security alert.

[0100] In some optional implementations of this embodiment, the updating unit 303 includes:

[0101] The association unit is used to associate the user security alarm with the corresponding preset reporting control, and when the association between the user security alarm and the preset reporting control is completed, transmit the reporting request of the user security alarm to the server so that the server reports the user security alarm.

[0102] In this embodiment, since the security identification result of the behavior path node is the information output by processing the behavior path node in the warning user according to the path node warning rule of the warning condition, when the security identification result of the behavior path node is output, the security identification result of the behavior path node is updated in the warning rule in a column according to the corresponding warning condition. Among them, the user column of the security identification result of the behavior path node is also deployed in the warning condition, and the user column is the column to which the user warning behavior belongs in the warning rule (security alarm). When the update of the warning rule is completed, the user security alarm is output; the reporting request of the user security alarm is transmitted to the server so that the server reports the user security alarm. When the user security alarm is reported successfully, the user security alarm is fed back to the user display control of the server; when the user security alarm fails to be reported, the reason for the failure to report is obtained, and the reason for the failure is fed back to the user display control of the server.

[0103] It should be emphasized that in order to further ensure the privacy and security of the above-mentioned user security alerts, the above-mentioned user security alerts can also be stored in a node of a blockchain.

[0104] The blockchain referred to in this application is a new application model of computer technologies such as distributed behavior path node storage, peer-to-peer transmission, consensus mechanism, and encryption algorithm.

[0105] In some optional implementations of this embodiment, the above-mentioned security early warning system based on network user behavior 300 further includes:

[0106] A confirmation unit, used to collect the metadata path of the warning user, obtain the stored warning behavior history record according to the metadata path, and determine whether all warning behavior types corresponding to the behavior path nodes of the warning user exist in the warning behavior history record;

[0107] An updating unit is used to update the warning condition of the warning user based on the warning behavior type when all the warning behavior types exist in the warning behavior history record, and store the warning condition in the warning rule by column.

[0108] In some optional implementations of this embodiment, the confirming unit further includes:

[0109] A new creation unit, configured to create a preset warning behavior in the warning behavior historical record based on the behavior path node path of the behavior path node when the warning behavior type corresponding to the behavior path node does not exist in the warning behavior historical record;

[0110] The storage unit is used to update the user warning behavior of the warning user based on the preset warning behavior, and store the user warning behavior in the warning rule by column.

[0111] In this embodiment, the metadata path is the path to which the warning user belongs. The metadata path of the warning user can be determined based on the suffix name or metadata name of the warning user. The stored warning behavior history record is obtained based on the metadata path, and different metadata paths correspond to different warning behavior history records. It is determined whether all warning behavior types corresponding to the behavior path nodes of the warning user exist in the warning behavior history record, where different behavior path node paths or behavior path node contents may correspond to different warning behavior types. When the warning behavior types corresponding to all behavior path nodes of the warning user exist in the warning behavior history record, the warning condition of the warning user is updated based on the warning behavior type, and the warning condition is stored in the warning rule by column.

[0112] In some optional implementations of this embodiment, the above-mentioned security early warning system 300 based on network user behavior further includes:

[0113] A search unit, configured to search for a user correction attribute and an invalid behavior path node corresponding to the correction request when a correction request for the user security alert is obtained;

[0114] A correction unit, configured to correct the abnormal warning behavior corresponding to the invalid behavior path node according to the user correction attribute, and output a normal warning behavior;

[0115] The importing unit is used to re-import the normal warning behavior output correction template in the warning rule, and update the correction safety alarm corresponding to the correction request based on the correction template.

[0116] In this embodiment, when a correction request for a user security alarm is obtained, the user correction attribute and the invalid behavior path node corresponding to the correction request are searched, and the abnormal warning behavior corresponding to the invalid behavior path node is corrected according to the user correction attribute. The abnormal warning behavior after correction is the normal warning behavior, and the normal warning behavior is re-imported into the warning rule and saved, and a correction template is output. Reporting the correction template is to output the correction security alarm corresponding to the current correction request.

[0117] The security warning system based on network user behavior proposed in this embodiment realizes unified management and regular updating of security alarms according to warning behaviors, saves the time for security alarm updates, improves the efficiency of security alarm updates, and further reduces the maintenance cost of security alarms.

[0118] The present application also provides another implementation, namely, providing a computer-readable storage medium, which stores a computer-readable request, and the computer-readable request can be executed by at least one processor so that the at least one processor executes the steps of the security warning method based on network user behavior as described above.

[0119] The computer-readable storage medium proposed in this embodiment realizes the unified management and regular updating of security alarms according to early warning behaviors, saves the time for updating security alarms, improves the efficiency of updating security alarms, and further reduces the maintenance cost of security alarms.

[0120] In the several embodiments provided in the present application, it should be understood that the disclosed systems, systems and methods can be implemented in other ways. For example, the system embodiments described above are only schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of systems or units, which can be electrical, mechanical or other forms.

[0121] In addition, each functional unit in each embodiment of the present application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of software functional units. The above is only an implementation method of the present application, and does not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the specification and drawings of this application, or directly or indirectly used in other related technical fields, is also included in the patent protection scope of the present application.

[0122] The specific implementation methods of the invention are described in detail above, but they are only examples, and the present application is not limited to the specific implementation methods described above. For those skilled in the art, any equivalent correction or substitution of the invention is also within the scope of the present application, and therefore, the equalization, correction, and improvement made without departing from the spirit and principle of the present application should be included in the scope of the present application.

Claims

1. A security early warning method based on network user behavior, characterized in that: The steps include: When a security alarm periodic update request is obtained, collecting the warning users and warning rules corresponding to the security alarm periodic update request; Collect the warning conditions in the warning rules, identify the warning conditions to output the warning behavior path and the path node warning rules corresponding to the warning behavior path, and construct the safety identification results of the behavior path nodes of the warning user based on the path node warning rules; Updating the security identification result of the behavior path node into the warning rule, outputting the user security alert corresponding to the warning user, and transmitting the reporting request of the user security alert to the server, so that the server reports the user security alert; The step of constructing the safety identification result of the behavior path node of the warning user based on the path node warning rule comprises: When the warning behavior path is a multi-dimensional warning behavior, collecting adjacent behavior path nodes corresponding to the multi-dimensional warning behavior, and detecting whether the adjacent behavior path nodes are the same behavior path node; When it is determined that the adjacent behavior path nodes are the same behavior path node, the adjacent behavior path nodes are deduplicated according to the multi-dimensional warning behavior, and a security identification result of the behavior path node is output; when the adjacent behavior path nodes are not the same behavior path node, the behavior path leaf nodes in the adjacent behavior path nodes are determined, non-behavior path leaf nodes in the adjacent behavior path nodes other than the behavior path leaf nodes are deduplicated, and a security identification result of the behavior path node is output; the step of constructing the security identification result of the behavior path node of the warning user based on the path node warning rule also includes: When the warning condition is a one-dimensional warning behavior, a sub-warning behavior type of the one-dimensional warning behavior is obtained, wherein the sub-warning behavior type includes a buried point warning behavior and a visit warning behavior; When the sub-warning behavior type is the burying point warning behavior, the first behavior path node deployed as the burying point warning behavior in the warning user is processed according to the burying point attribute identified by the burying point warning behavior, and a safety identification result of the behavior path node is output; When the sub-warning behavior type is the access warning behavior, a second behavior path node deployed as the access warning behavior in the warning user is processed according to the access identified by the access warning behavior, and a security identification result of the behavior path node is output; Before the step of collecting the warning conditions in the warning rule, the method further includes: collecting the metadata path of the warning user, acquiring the stored warning behavior history records according to the metadata path, and judging whether all the warning behavior types corresponding to the behavior path nodes in the warning user exist in the warning behavior history records; When all the warning behavior types exist in the warning behavior history records, the warning conditions of the warning user are updated based on the warning behavior types, and the warning conditions are stored in the warning rules by column; after the step of judging whether all the warning behavior types corresponding to the behavior path nodes in the warning user exist in the warning behavior history records, it also includes: When the warning behavior type corresponding to the behavior path node does not exist in the warning behavior historical record, a preset warning behavior is newly created in the warning behavior historical record based on the behavior path node path of the behavior path node; Based on the preset warning behavior, the user warning behavior of the warning user is updated, and the user warning behavior is stored in the warning rule by column; After the step of updating the security identification result of the behavior path node into the warning rule, outputting the user security alert corresponding to the warning user, and transmitting the reporting request of the user security alert to the server so that the server reports the user security alert, the method further includes: When a correction request for the user security alert is obtained, searching for a user correction attribute and an invalid behavior path node corresponding to the correction request; Correct the abnormal warning behavior corresponding to the invalid behavior path node according to the user correction attribute, and output a normal warning behavior; Re-importing the normal warning behavior output correction template into the warning rule, and updating the correction safety alarm corresponding to the correction request based on the correction template; The step of transmitting the reporting request of the user safety alarm to the server so that the server reports the user safety alarm comprises: The user security alarm is associated with a corresponding preset reporting control, and when the association between the user security alarm and the preset reporting control is completed, a reporting request of the user security alarm is transmitted to the server, so that the server reports the user security alarm.

2. A security early warning system based on network user behavior, characterized in that: include: An acquisition unit, configured to, when acquiring a security alarm periodic update request, collect an early warning user and an early warning rule corresponding to the security alarm periodic update request; An identification unit, used for collecting the warning conditions in the warning rules, identifying the warning conditions to output the warning behavior path and the path node warning rules corresponding to the warning behavior path, and constructing the safety identification results of the behavior path nodes of the warning user based on the path node warning rules; An updating unit, configured to update the security identification result of the behavior path node into the warning rule, output a user security alert corresponding to the warning user, and transmit a reporting request of the user security alert to a server so that the server reports the user security alert; The security early warning system based on network user behavior is used to implement the security early warning method based on network user behavior as described in claim 1.

Images