Method and device for determining time baseline, electronic equipment and readable storage medium

Abstract

The application discloses a time baseline determination method and device, electronic equipment and a readable storage medium, and belongs to the computer field. The method comprises the following steps: obtaining login information of a target user in a target time period, wherein the target time period comprises M unit time granularities, and the login information comprises a login frequency; obtaining a target sequence of the target user based on the login information, wherein the target sequence comprises M target values, the M target values correspond to the M unit time granularities in a one-to-one manner, and the target value represents the login frequency of the target user in one unit time granularity; if M is greater than a first threshold value, determining a target time baseline by using a target machine learning model for anomaly detection, wherein the target time baseline comprises a specified unit time granularity in which the target user is allowed to access a target resource, and the specified unit time granularity is at least one unit time granularity in the M unit time granularities; and if M is not greater than the first threshold value, determining the target time baseline based on a sequence fluctuation judgment model.

Description

Technical Field

[0001] This application belongs to the field of computer science, and specifically relates to a method, apparatus, electronic device, and readable storage medium for determining a time baseline. Background Technology

[0002] With technological advancements, the concept of "zero trust" for servers has emerged to better protect network resource security. In a zero-trust system, each terminal must be authenticated before connecting to the server, ensuring that each device is authorized to access. For example, the Software-Defined Perimeter (SDP) proposed by the Cloud Security Alliance (CSA) aims to hide core network assets and facilities from direct exposure to the internet, thus protecting them from external security threats. In a zero-trust architecture, terminals need to establish a certain level of trust before logging into the corresponding website or asset. This trust-building process involves dozens of rule configurations, such as checks on login time, login address (IP), and login frequency. If the login time or address (IP) is inconsistent with commonly used login times (i.e., time baselines) and addresses (IP), the login is considered untrusted and access to the corresponding asset is denied.

[0003] In related technologies, methods for obtaining time baselines primarily rely on working hours, meaning that the time baseline is indirectly generated based on working hours. For example, if a user's working hours are 8:00-18:00, the time baseline usually aligns with this time period. However, some users' typical working hours may not cover the entire working time period, or the working time period may not cover the user's typical working hours. Therefore, the accuracy of time baselines determined in this way is relatively low. Summary of the Invention

[0004] This application provides a method, apparatus, electronic device, and readable storage medium for determining a time baseline, which can, to some extent, solve the problem of low accuracy of time baselines caused by generating time baselines through working time in related technologies.

[0005] In a first aspect, embodiments of this application provide a method for determining a time baseline, characterized in that it includes:

[0006] Obtain login information of a target user within a target time period, wherein the target time period includes M unit time granularities, and the login information includes the number of logins;

[0007] Based on the login information, a target sequence of the target user is obtained. The target sequence includes M target values, and each of the M target values ​​corresponds to one of the M unit time granularities. The target value represents the number of times the target user logs in within a unit time granularity, and M is a positive integer.

[0008] If M is greater than the first threshold, a target time baseline is determined by the target machine learning model used for anomaly detection. The target time baseline includes a specified unit time granularity that allows the target user to access the target resource. The specified unit time granularity is at least one of the M unit time granularities.

[0009] If M is not greater than the first threshold, the target time baseline is determined based on the sequence fluctuation judgment model.

[0010] Secondly, embodiments of this application provide a time baseline determination apparatus, characterized in that it includes:

[0011] The acquisition module is used to acquire the login information of the target user within a target time period, wherein the target time period includes M unit time granularities, and the login information includes the number of logins;

[0012] The processing module is used to obtain the target sequence of the target user based on the login information. The target sequence includes M target values, which correspond one-to-one with M unit time granularities. The target value represents the number of times the target user logs in within a unit time granularity, and M is a positive integer.

[0013] The determination module is used to determine a target time baseline by using a target machine learning model for anomaly detection if M is greater than a first threshold. The target time baseline includes a specified unit time granularity that allows the target user to access the target resource. The specified unit time granularity is at least one of the M unit time granularities.

[0014] The determination module is also used to determine the target time baseline based on the sequence fluctuation judgment model if M is not greater than the first threshold.

[0015] Thirdly, embodiments of this application provide an electronic device, including a processor and a memory, wherein the memory stores a program or instructions, and when the program or instructions are executed by the processor, they implement the steps of the method described in the first aspect.

[0016] Fourthly, embodiments of this application provide a computer-readable storage medium storing a program or instructions that, when executed, implement the steps of the method described in the first aspect.

[0017] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the steps of the method described in the first aspect.

[0018] In this embodiment, login information of a target user within a target time period is obtained, wherein the target time period includes M unit time granularities, and the login information includes the number of logins; based on the login information, a target sequence of the target user is obtained, the target sequence including M target values, each of which corresponds one-to-one with one of the M unit time granularities, the target value representing the number of logins of the target user within one unit time granularity, and M being a positive integer; if M is greater than a first threshold, a target time baseline is determined using a target machine learning model for anomaly detection, the target time baseline including a specified unit time granularity allowing the target user to access target resources, the specified unit time granularity being at least one of the M unit time granularities; if M is not greater than the first threshold, the target time baseline is determined based on a sequence fluctuation judgment model. Thus, to address the diversity of target values, different models are used to generate target time baselines that include specified unit time granularity. Compared to related technologies that use a whole working time segment as the target time baseline, the target time baseline provided in this application embodiment can be more flexible and distributed, improving the accuracy of the target time baseline. This can, to some extent, solve the problem of low accuracy in time baselines generated by working time in related technologies. Furthermore, since the target value can represent the number of times a target user logs in within a target time period, the target sequence can correspondingly represent the number of times a target user logs in at different unit time granularities. Obtaining the target time baseline based on the target sequence makes the target time baseline more correlated with the target user, further improving the accuracy of the target time baseline. Attached Figure Description

[0019] Figure 1 A flowchart illustrating a method for determining a time baseline as provided in an embodiment of this application;

[0020] Figure 2 A flowchart illustrating a method for determining a time baseline as provided in an embodiment of this application;

[0021] Figure 3 A flowchart illustrating a method for determining a time baseline as provided in an embodiment of this application;

[0022] Figure 4 A flowchart illustrating a method for determining a time baseline as provided in an embodiment of this application;

[0023] Figure 5 An architecture diagram of a method for determining a time baseline provided in an embodiment of this application;

[0024] Figure 6 A structural block diagram of a time baseline determination device provided in an embodiment of this application;

[0025] Figure 7 This is a schematic diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0026] The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application are within the scope of protection of this application.

[0027] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0028] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0029] As described in the background section, with the development of technology, the concept of "zero trust" for servers has emerged to better protect network resource security. The zero trust model means that each terminal must be authenticated before connecting to the server, ensuring that each device is allowed to access. For example, the Software-Defined Perimeter (SDP) proposed by the Cloud Security Alliance (CSA) aims to hide core network assets and facilities through the SDP architecture, preventing them from being directly exposed to the internet and protecting them from external security threats. In a zero trust architecture, terminals need to establish a certain level of trust before logging into the corresponding website or asset. This trust-building process involves dozens of rule configurations, such as checks on login time, login address (IP), and login frequency. If the login time or address (IP) is inconsistent with commonly used login times (i.e., time baselines) and addresses (IP), then the login is considered untrusted and the user cannot log into the corresponding asset.

[0030] In related technologies, methods for obtaining time baselines primarily rely on working hours, meaning that the time baseline is indirectly generated based on working hours. For example, if a user's working hours are 8:00-18:00, the time baseline usually aligns with this time period. However, some users' typical working hours may not cover the entire working time period, or the working time period may not cover the user's typical working hours. Therefore, the accuracy of time baselines determined in this way is relatively low.

[0031] This application provides a method for determining a time baseline, which can, to some extent, solve the problem of low accuracy of time baselines caused by generating time baselines based on working hours in related technologies. Specifically, the method involves obtaining login information of a target user within a target time period, wherein the target time period includes M unit time granularities, and the login information includes the number of logins; based on the login information, obtaining a target sequence of the target user, wherein the target sequence includes M target values, each of which corresponds one-to-one with one of the M unit time granularities, and the target value represents the number of logins of the target user within a unit time granularity, where M is a positive integer; if M is greater than a first threshold, a target time baseline is determined using a target machine learning model for anomaly detection, wherein the target time baseline includes a specified unit time granularity that allows the target user to access target resources, and the specified unit time granularity is at least one of the M unit time granularities; if M is not greater than the first threshold, the target time baseline is determined based on a sequence fluctuation judgment model. Thus, to address the diversity of target values, different models are used to generate target time baselines that include specified unit time granularity. Compared to related technologies that use a whole working time segment as the target time baseline, the target time baseline provided in this application embodiment can be more flexible and distributed, improving the accuracy of the target time baseline. This can, to some extent, solve the problem of low accuracy in time baselines generated by working time in related technologies. Furthermore, since the target value can represent the number of times a target user logs in within a target time period, the target sequence can correspondingly represent the number of times a target user logs in at different unit time granularities. Obtaining the target time baseline based on the target sequence makes the target time baseline more correlated with the target user, further improving the accuracy of the target time baseline.

[0032] In related technologies, generating a time baseline indirectly based on working time can easily result in excessively large time granularity, leading to a time baseline spanning a large time interval. However, in this embodiment, the target sequence includes M target values ​​corresponding one-to-one with a unit time granularity. Furthermore, based on different unit time granularities, target sequences comprising different numbers of target values ​​are obtained, making the process of obtaining the target time baseline based on the target sequence more flexible and meeting more needs. Compared to related technologies where excessively large time granularity results in a time baseline spanning a large time interval, the time baseline determination method provided in this embodiment offers selectivity and diversity in the selection of unit time granularity, allowing for the setting of an appropriate unit time granularity based on the smallest time window required by the actual situation.

[0033] In this embodiment, the target machine learning model includes N anomaly detection modules. These N modules determine the target time baseline, thereby improving the adaptability and generalization ability of the target machine learning model. This allows the model to handle more complex target sequences, further enhancing the accuracy of the generated target time series. Simultaneously, the target machine learning model, through deep learning, has advantages in handling large-scale data and emerging threats, meeting the ever-changing needs of enterprises and accommodating the increasing scale and complexity of their data. It possesses scalability and adaptability.

[0034] It should be understood that the method for determining a time baseline provided in this application embodiment can be executed by a target device. The target device can be a single electronic device or multiple electronic devices working together. The electronic device can be, for example, a server, such as a standalone physical server, a server cluster consisting of multiple servers, or a cloud server capable of cloud computing.

[0035] The methods provided in this application will be described in detail below with reference to the accompanying drawings, through specific embodiments and application scenarios.

[0036] Figure 1 A flowchart illustrating a method for determining a time baseline as provided in an embodiment of this application. Figure 1 As shown, the method for determining the time baseline provided in this application includes the following steps:

[0037] Step 110: Obtain the login information of the target user within a target time period, wherein the target time period includes M unit time granularities, and the login information includes the number of logins.

[0038] In this embodiment, the target user can be any user, and can be one or multiple users. This embodiment does not impose specific restrictions on the number and / or identity of the target users. The target time period can be any defined time period, such as one hour, one day, or one week. The unit time granularity can also be any specified unit time, such as one second or one minute. The target time period including M unit time granularities can be understood as including M unit time granularities within the target time period. For example, when the target time period is one day and the unit time granularity is one hour, the target time period includes 24 unit time granularities.

[0039] The login information can be any information generated when the target user performs a login operation, such as the target user's login time or the duration the target user stays on the page. The login information may include the number of login attempts, and more specifically, it may be the number of login attempts made by the target user within a target time period, for example, the target user logged in 124 times within the target time period. The format of the login information can be a data exchange format (e.g., JSON), or a standard time format, such as YYYY-MM-DD HH:MM:SS, or a table format; this application embodiment does not impose specific limitations on these.

[0040] In this embodiment, the target device can obtain the login information of the target user within a target time period from its internal storage. For example, the target device can obtain the login information of the target user through internal system operation logs, network device logs, application logs, and other logs. The target device can also obtain the login information of the target user through its internal database (such as ES, Oracle, Gbase, etc.), but this embodiment does not impose specific limitations on this.

[0041] In this embodiment of the application, the target device can also obtain the login information of the target user within a target time period from outside the device via communication technology. For example, the target device can obtain the login information of the target user within a target time period through a data acquisition device (e.g., a distributed system). The target device and the data acquisition device can be connected via wired technology, such as optical fiber, or via wireless technology, such as Bluetooth.

[0042] The target device can standardize the login information after acquiring it from the target user within a target time period, unifying the acquired login information into a standard format, such as YYYY-MM-DDHH:MM:SS. The target device can also perform data cleaning on the acquired login information, including format cleaning, logical error cleaning, and missing value cleaning. Format cleaning can include converting data with inconsistent display formats (such as date and time values), data containing characters that should not exist, and data whose content does not match the expected content of fields. Logical error cleaning can include removing / replacing unreasonable data. Missing value cleaning can include replacing / deleting data with missing values ​​or NULL values ​​in required fields.

[0043] After obtaining the login information of the target user within the target time period, the target device can not only perform the above-mentioned format standardization processing, but also perform step 120 to further process the login information of the target user within the target time period.

[0044] Step 120: Based on the login information, obtain the target sequence of the target user. The target sequence includes M target values, which correspond one-to-one with M unit time granularities. The target value represents the number of times the target user logs in within a unit time granularity, and M is a positive integer.

[0045] In this embodiment of the application, the target value represents the number of times the target user logs in within a unit time granularity. For example, when the unit time granularity is one hour, the target value can represent the number of times the target user logs in within one hour, such as 5 times.

[0046] The target sequence can represent the number of logins of a target user within M unit time granularities, using M target values ​​that correspond one-to-one with each unit time granularity. Furthermore, the target sequence can represent the data distribution of the target user's login count within a target time period. For example, if the target time period is one day and the unit time granularity is eight hours, the target sequence could be 2 5 6, representing that the target user logged in 2 times in the first eight hours of the day, 5 times in the second eight hours, and 6 times in the third eight hours, respectively. In this embodiment, the unit time granularity can also be a finer-grained time interval, such as one hour. When the target time period is still one day, the target sequence includes 24 target values, each representing the number of logins of the target user within each hour.

[0047] In the process of obtaining the target sequence provided in the embodiments of this application, a target sequence can correspond to an account, or a target sequence can correspond to an account and an address (IP address). The embodiments of this application do not impose specific limitations on this. If a target sequence corresponds to a user account and an address (IP address), the login information of the same user account and the same address (IP address) within the target time period can be used as a target sequence.

[0048] The target sequence represents the login information of the target user within the target time period, making the login information more intuitive, so that the following steps can be performed to obtain the target time baseline. In this embodiment, the target time baseline can be determined by different methods based on the number of target values ​​in the target sequence, i.e., the size of M. If M is greater than a first threshold, step 130 can be executed; if M is not greater than the first threshold, step 140 can be executed.

[0049] Step 130: If M is greater than the first threshold, a target time baseline is determined by the target machine learning model used for anomaly detection. The target time baseline includes a specified unit time granularity that allows the target user to access the target resource. The specified unit time granularity is at least one of the M unit time granularities.

[0050] In this embodiment, the target time baseline can be a time standard baseline for determining whether a target user has passed authentication. The target time baseline can be used in a zero-trust system to determine whether a target user can access a target resource. If the target user's access time falls within the time period allowed by the target time baseline, the target user can be considered to have passed authentication. The specified unit time granularity can be any one of the M unit time granularities. For example, in step 120, if the second eight-hour period of a day is specified as the specified unit time granularity, then the target time baseline can be the second eight-hour period of a day.

[0051] In this embodiment, the first threshold represents the number threshold of target values ​​in the target sequence. The first threshold can be any integer, such as 30, 50, etc. If M is greater than the first threshold, it means that the number of target values ​​in the target sequence can reach the number of target machine learning models input for anomaly detection. The target machine learning model for anomaly detection can be any machine learning model capable of detecting anomalies in data, such as the Local Outlier Factor (LOF), K-Nearest Neighbor (KNN), and Isolation Forest models. The target machine learning model for anomaly detection may include one target machine learning model or multiple target machine learning models; this embodiment does not impose specific limitations on this. If the target machine learning model for anomaly detection includes one target machine learning model, the target time baseline can be determined based on the output of the target machine learning model. If the target machine learning model for anomaly detection includes multiple target machine learning models, one of the target machine learning models can be selected through evaluation criteria to determine the target time baseline, or the target time baseline can be jointly determined by the outputs of multiple target machine learning models.

[0052] In the process of determining the target time baseline using a target machine learning model for anomaly detection provided in this application embodiment, the abnormal target values ​​in the target sequence can be determined by the target machine learning model for anomaly detection, and the unit time granularity corresponding to the normal target values ​​other than the abnormal target values ​​is used as the specified unit time granularity. For example, in the example in step 120, if the target machine learning model for anomaly detection determines that 2 and 6 in the target sequence are abnormal target values, then the unit time granularity corresponding to the target value 5 (i.e., the second eight hours of the day) is the specified unit time granularity, and the target time baseline can be the second eight hours of the day.

[0053] In this embodiment, if M is greater than a first threshold, a target time baseline is determined using a target machine learning model for anomaly detection. To enable the target machine learning model for anomaly detection to determine the target time baseline more accurately, the number of target values ​​input to the target machine learning model for anomaly detection can be increased. If M is not greater than the first threshold, the target sequence can be processed through step 140.

[0054] Step 140: If M is not greater than the first threshold, determine the target time baseline based on the sequence fluctuation judgment model.

[0055] In this embodiment, the sequence fluctuation judgment model can be used to judge the data situation of target values ​​in the target sequence, such as the difference or average value of target values. The sequence fluctuation judgment model may include a machine learning model with learning capabilities, or it may include statistical methods. If M is not greater than a first threshold, it is considered that the number of target values ​​in the target sequence is less than the first threshold, and the method provided in step 140 can be used more specifically.

[0056] In this embodiment, a specified unit time granularity can be obtained through a sequence fluctuation judgment model, and the target time baseline includes the specified unit time granularity. For example, the average value of the target values ​​included in the target sequence can be obtained through the sequence fluctuation judgment model, and the unit time granularity corresponding to the target values ​​in the target sequence that are greater than the average value can be used as the specified unit time granularity.

[0057] In this embodiment, login information of a target user within a target time period is obtained, wherein the target time period includes M unit time granularities, and the login information includes the number of logins; based on the login information, a target sequence of the target user is obtained, the target sequence including M target values, each of which corresponds one-to-one with one of the M unit time granularities, the target value representing the number of logins of the target user within one unit time granularity, and M being a positive integer; if M is greater than a first threshold, a target time baseline is determined using a target machine learning model for anomaly detection, the target time baseline including a specified unit time granularity allowing the target user to access target resources, the specified unit time granularity being at least one of the M unit time granularities; if M is not greater than the first threshold, the target time baseline is determined based on a sequence fluctuation judgment model. Thus, to address the diversity of target values, different models are used to generate target time baselines that include specified unit time granularity. Compared to related technologies that use a whole working time segment as the target time baseline, the target time baseline provided in this application embodiment can be more flexible and distributed, improving the accuracy of the target time baseline. This can, to some extent, solve the problem of low accuracy in time baselines generated by working time in related technologies. Furthermore, since the target value can represent the number of times a target user logs in within a target time period, the target sequence can correspondingly represent the number of times a target user logs in at different unit time granularities. Obtaining the target time baseline based on the target sequence makes the target time baseline more correlated with the target user, further improving the accuracy of the target time baseline.

[0058] In this embodiment, the target sequence includes M target values ​​corresponding one-to-one with a unit time granularity. Furthermore, based on different unit time granularities, target sequences including different numbers of target values ​​are obtained, making the process of obtaining the target time baseline based on the target sequence more flexible and meeting more needs. Compared to related technologies where the time granularity is too large, resulting in a large, continuous time span for the time baseline, the time baseline determination method provided in this embodiment offers selectivity and diversity in the selection of unit time granularity, allowing for the setting of an appropriate unit time granularity based on the smallest time window required by the actual situation.

[0059] Figure 2 A flowchart illustrating a method for determining a time baseline as provided in an embodiment of this application. Figure 2 As shown, the method for determining the time baseline provided in this application includes the following steps:

[0060] Step 210: Obtain the login information of the target user within a target time period, wherein the target time period includes M unit time granularities, and the login information includes the number of logins.

[0061] Step 220: Based on the login information, obtain the target sequence of the target user. The target sequence includes M target values, which correspond one-to-one with M unit time granularities. The target value represents the number of times the target user logs in within a unit time granularity, and M is a positive integer.

[0062] In this embodiment, the target time baseline can be determined using different methods based on the number of target values ​​in the target sequence, i.e., the size of M. If M is greater than a first threshold, steps 230-250 can be executed; if M is not greater than the first threshold, step 260 can be executed.

[0063] In this embodiment, if M is greater than a first threshold, a target time baseline can be determined using a target machine learning model for anomaly detection. This target machine learning model includes N anomaly detection modules, where N is a natural number. In this embodiment, the anomaly detection module may include a machine learning model for detecting whether there is abnormal data in the target value. For example, the anomaly detection module may include the target machine learning model for anomaly detection exemplified in step 130.

[0064] For the k-th anomaly detection module among the N anomaly detection modules, where k is an integer less than N, perform the following operations:

[0065] Step 230: If M is greater than the first threshold, input the target sequence into the anomaly detection module. The target machine learning model includes N anomaly detection modules, where N is a natural number.

[0066] In this embodiment, the target device containing the target sequence can be the same as the target device containing the anomaly detection module. In this case, the target sequence can be processed internally by the target device and then input into the anomaly detection module. Alternatively, the target device containing the target sequence can be a different target device from the target device containing the anomaly detection module, allowing the anomaly detection module to acquire the target sequence via communication technology.

[0067] In this embodiment, if N is 1, the target machine learning model includes one anomaly detection module. After inputting the target sequence into the anomaly detection module, the target time baseline can be determined by processing the results of the anomaly detection module through the target machine learning model. If the target machine learning model includes at least one anomaly detection module, the target time baseline can be determined jointly by the processing results of multiple anomaly detection modules. Alternatively, the processing result of one anomaly detection module can be selected based on the processing results of multiple anomaly detection modules to determine the target time baseline.

[0068] In the process of determining the target time baseline based on the output of the anomaly detection module, steps 240 to 250 can be performed.

[0069] Step 240: The anomaly detection module outputs M data tags for the M target values. The M data tags correspond one-to-one with the M target values, and the data tags are used to indicate whether the target value is an anomaly.

[0070] In this embodiment, the anomaly detection module can output M data tags that correspond one-to-one with M target values. The content of the data tags can be normal or abnormal, and the data tags can be pseudo-tags. For example, when the target sequence is 2, 5, 6, the output result of the anomaly detection module can be abnormal, normal, normal.

[0071] In this embodiment, the target machine learning model includes N anomaly detection modules, and correspondingly, each target value in the target sequence corresponds to N data labels. The target time baseline can be determined based on the output results of the N anomaly detection modules.

[0072] Step 250: Generate the target time baseline based on the output results of N anomaly detection modules.

[0073] In this embodiment, the outputs of the N anomaly detection modules include N data labels corresponding to each target value in the target sequence. Based on the outputs of the N anomaly detection modules, the output of one of the anomaly detection modules can be selected to generate a target time baseline. For example, if the output of one anomaly detection module is selected as "abnormal," "normal," or "abnormal," then the unit time granularity corresponding to the target value with the data label "normal" can be used as the specified unit time granularity, and further, the specified unit time granularity can be used as the target time baseline.

[0074] Step 260: If M is not greater than the first threshold, determine the target time baseline based on the sequence fluctuation judgment model.

[0075] In this embodiment, the target machine learning model includes N anomaly detection modules. These N modules determine the target time baseline, thereby improving the adaptability and generalization ability of the target machine learning model. This allows the model to handle more complex target sequences, further enhancing the accuracy of the generated target time series. Simultaneously, the target machine learning model, through deep learning, has advantages in handling large-scale data and emerging threats, meeting the ever-changing needs of enterprises and accommodating the increasing scale and complexity of their data. It possesses scalability and adaptability.

[0076] In this embodiment of the application, during the process of generating the target time baseline based on the output results of N anomaly detection modules, the target time baseline can also be jointly determined based on N data tags. For example, for the i-th target value among the M target values, the following operations are performed: obtain N data tags corresponding to the i-th target value, wherein the N data tags are output by N anomaly detection modules, and one anomaly detection module outputs one data tag for the i-th target value; based on the N data tags corresponding to the i-th target value, jointly determine whether the i-th target value is an anomaly; if the i-th target value is a normal value, then obtain the unit time granularity corresponding to the i-th target value; based on the unit time granularity corresponding to the i-th target value, generate the target time baseline.

[0077] In this embodiment of the application, in the process of jointly determining whether the i-th target value is an outlier based on the N data tags corresponding to the i-th target value, one outlier detection module can be selected from the N data tags output by the N outlier detection modules through certain evaluation criteria, and the target value is determined as an outlier based on the output result of that outlier detection module.

[0078] In this embodiment, during the process of jointly determining whether the i-th target value is an outlier based on the N data labels corresponding to the i-th target value, the number of labels with normal values ​​can be compared with the number of labels with outliers. If the number of labels with normal values ​​is greater than the number of labels with outliers, the target value can be considered normal; if the number of labels with normal values ​​is less than the number of labels with outliers, the target value can be considered outlier. In this embodiment, if N is even, the target machine learning model includes an even number of anomaly detection modules. An odd number of anomaly detection modules can be selected through the evaluation criteria and, through the aforementioned comparison process, jointly determine whether the i-th target value is an outlier.

[0079] In this embodiment, after obtaining the N data labels corresponding to the i-th target value, to improve the accuracy of the data labels for the target value, manual secondary modification can be selected based on the magnitude of the i-th target value. For example, if a target value in the target sequence is greater than the third-quarter digit and the corresponding data label is represented as an outlier, the label for this target value can be modified to normal. This is because the target value in the target sequence corresponds to the number of operations within different unit time granularities within the target time period. A larger number of operations indicates that the target user operates more frequently within this unit time granularity, which should be the user's frequently used time interval and therefore should be retained.

[0080] In this embodiment of the application, after determining that the target value is a normal value, if the i-th target value is a normal value, the unit time granularity corresponding to the i-th target value can be obtained, and the unit time granularity corresponding to the i-th target value can be used as the specified unit time granularity. Based on the unit time granularity corresponding to the i-th target value (i.e., the specified unit time granularity), the target time baseline is generated.

[0081] In this embodiment, the data tags output by N anomaly detection modules jointly determine whether the i-th target value is an anomaly, making the process of confirming whether the target value is a normal value more accurate and further improving the accuracy of the target time baseline.

[0082] Figure 3 A flowchart illustrating a method for determining a time baseline as provided in an embodiment of this application. Figure 3 As shown, the method for determining the time baseline provided in this application includes the following steps:

[0083] Step 310: Obtain the login information of the target user within a target time period, wherein the target time period includes M unit time granularities, and the login information includes the number of logins.

[0084] Step 320: Based on the login information, obtain the target sequence of the target user. The target sequence includes M target values, which correspond one-to-one with M unit time granularities. The target value represents the number of times the target user logs in within a unit time granularity, and M is a positive integer.

[0085] If M is greater than the first threshold, step 330 can be executed; if M is not greater than the first threshold, steps 340 to 360 can be executed.

[0086] Step 330: If M is greater than the first threshold, determine the target time baseline using the target machine learning model for anomaly detection.

[0087] Step 340: If M is not greater than the first threshold, determine whether the target sequence is a fluctuating sequence, where the fluctuating sequence represents a sequence with a discrete distribution of target values.

[0088] In this embodiment, if M is not greater than a first threshold, the sequence fluctuation judgment model can be used to determine whether the target sequence is a fluctuating sequence. The fluctuating sequence represents a discrete distribution of target values ​​within the target sequence, with the target values ​​exhibiting a certain range of variation. In this embodiment, the sequence fluctuation judgment model can be a machine learning model with learning capabilities, or it can be a statistical calculation method; this embodiment does not impose specific limitations on this.

[0089] In the process of determining whether the target sequence is a fluctuating sequence provided in the embodiments of this application, a specific implementation method can be: statistically counting the target sequence, calculating the number of times different values ​​appear, and if the number of times the mode appears accounts for 80% or more of the total number of target values, then the data sequence is considered to be a stationary sequence (i.e., not a fluctuating sequence), otherwise it is a fluctuating sequence.

[0090] In the process of determining whether the target sequence is a fluctuating sequence provided in the embodiments of this application, a specific implementation method can also be: calculate the variance and / or mean of the target sequence, calculate the coefficient of variation of the target sequence based on the variance and / or mean of the target sequence, and if the coefficient of variation is less than a preset threshold, the data sequence is considered to be a stationary sequence, otherwise it is a fluctuating sequence. The coefficient of variation, also known as the "coefficient of variation", is a normalized measure of the degree of dispersion of the probability distribution.

[0091] If the target sequence is determined to be a fluctuating sequence by the sequence fluctuation judgment model, step 350 can be executed; if the target sequence is determined to be a non-fluctuating sequence (i.e., a stationary sequence) by the sequence fluctuation judgment model, step 360 can be executed.

[0092] Step 350: If the target sequence is a fluctuating sequence, the target sequence is processed using a fluctuating sequence processing model to obtain a target time baseline. The sequence fluctuation judgment model includes a fluctuating sequence processing model and / or a stationary sequence processing model.

[0093] In this embodiment, if the target sequence is a fluctuation sequence, it means that the target value distribution of the target sequence is relatively discrete. Considering the relatively discrete distribution of target values, in the process of processing the target sequence using a fluctuation sequence processing model, the fluctuation sequence processing model can be a machine learning model for processing discrete data, or it can be a statistical method for processing discrete data. For example, the fluctuation sequence model can be a clustering algorithm, which divides the target sequence into multiple classes, selects one class as the target class, and uses the unit time granularity corresponding to the target class as the specified unit time granularity to further determine the target time baseline.

[0094] Step 360: If the target sequence is not a fluctuating sequence, process the target sequence using a stationary sequence processing model to obtain the target time baseline.

[0095] In this embodiment, if the target sequence is not a fluctuating sequence, it can be considered a stationary sequence, indicating that the target value distribution of the target sequence is relatively continuous. Considering the relatively continuous distribution of target values, in the process of processing the target sequence using a stationary sequence processing model, the stationary sequence processing model can be a machine learning model for processing continuous data, or it can be a statistical method for processing continuous data. For example, the stationary sequence model can be a box plot processing method, which obtains a confidence interval by setting a pre-set confidence level, and further determines the target time baseline based on the confidence interval.

[0096] In this embodiment, if M is not greater than a first threshold, it is determined whether the target sequence is a fluctuating sequence, where the fluctuating sequence represents a sequence with a discrete distribution of target values. Further, based on the distribution characteristics of the target values ​​(stationary sequences can be considered as having a relatively continuous target value distribution, while fluctuating sequences can be considered as having a relatively discrete target value distribution), a more targeted processing model is selected to make the generated target time baseline more accurate.

[0097] In step 350 of this application embodiment, the target sequence is processed using a fluctuation sequence processing model to obtain a target time baseline, including: obtaining X center points, wherein the center points are derived from M target values ​​in the target sequence, and X is an integer not less than 2; based on the X center points, the M target values ​​are clustered using the fluctuation sequence processing model to obtain X classes of target values; obtaining the average value of each class of target values ​​in the X classes of target values; obtaining X average values ​​from the X classes of target values; selecting the maximum average value from the X average values; and using the unit time granularity corresponding to the maximum average value as the target time baseline.

[0098] In this embodiment, the fluctuation sequence processing model can be a clustering model, such as the kmean clustering algorithm or other clustering algorithms. During the processing of the target sequence using the fluctuation sequence model, X target values ​​can be randomly selected from M target values ​​in the target sequence as center points. The target values ​​in the target sequence represent the number of logins of the target user within a unit time granularity. Therefore, the largest average value is selected from the X average values, and the unit time granularity corresponding to the largest average value is used as the specified unit time granularity to further confirm the target time baseline. For example, by manually specifying two clusters, two center points are randomly selected, the distance between the center point and adjacent points is calculated, and the target value closest to the center point is selected as one cluster of target values. The unit time granularity corresponding to the target value with the larger mean is selected as the final target time baseline.

[0099] In this embodiment, when M is not greater than the first threshold and the target sequence is a fluctuating sequence, it indicates that the number of target values ​​in the target sequence is small and the distribution of target values ​​is relatively discrete. Based on the characteristics of the target values ​​in the target sequence and the meaning represented by the target values, a fluctuating sequence processing model is specifically selected to process the target sequence, so that the obtained target time baseline has higher accuracy.

[0100] In step 360 of the embodiments of this application, the target sequence is processed using a stationary sequence processing model to obtain a target time baseline, including: obtaining a preset confidence level, wherein the preset confidence level represents the probability that any target value in the target sequence falls within a confidence interval; generating a confidence interval based on the preset confidence level using a stationary sequence processing model; obtaining P target values ​​that fall within the confidence interval from the M target values; and determining the unit time granularity corresponding to the P target values ​​as the target time baseline.

[0101] In this embodiment, the stationary sequence can be a box plot or a KSI curve for processing continuous data. The confidence level can be preset manually, and its value range can be [0,1]. During the process of generating confidence intervals using a stationary sequence processing model based on the preset confidence level, the mean and / or standard deviation of the target sequence can be obtained. Based on the mean and / or standard deviation of the target sequence and the preset confidence level, a confidence interval is determined. The unit time granularity corresponding to the target point within the confidence interval is then used as the specified unit time granularity to further confirm the target time baseline.

[0102] In the process of obtaining the target time baseline through the stationary sequence processing model, the quantiles or one-sided confidence lower bounds of the target sequence can be obtained according to the preset confidence level. The unit time granularity corresponding to the target value in the sequence that is greater than the quantile / confidence lower bound is used as the specified unit time granularity to further confirm the target time baseline.

[0103] In the embodiments of this application, based on various situations of the target sequence, different processing methods can be selected according to the data distribution of the target sequence to obtain a suitable target time baseline, so as to adapt to complex and variable situations and generate an accurate target time baseline.

[0104] Figure 4 A flowchart illustrating a method for determining a time baseline as provided in an embodiment of this application. Figure 4 As shown, the method for determining the time baseline provided in this application includes the following steps:

[0105] Step 410: Obtain the login information of the target user within a target time period, wherein the target time period includes M unit time granularities, and the login information includes the number of logins.

[0106] Step 415: Based on the login information, obtain the target sequence of the target user. The target sequence includes M target values, which correspond one-to-one with M unit time granularities. The target value represents the number of times the target user logs in within a unit time granularity, and M is a positive integer.

[0107] Step 420: If M is greater than the first threshold, input the target sequence into the anomaly detection module. The target machine learning model includes N anomaly detection modules.

[0108] Step 425: Output M data tags for the M target values ​​through the anomaly detection module.

[0109] Step 430: For the i-th target value among the M target values, perform the following operation: obtain the N data labels corresponding to the i-th target value.

[0110] Step 435: If the i-th target value is normal, then obtain the unit time granularity corresponding to the i-th target value.

[0111] Step 440: Generate the target time baseline based on the unit time granularity corresponding to the i-th target value.

[0112] Step 445: If M is not greater than the first threshold, determine whether the target sequence is a fluctuating sequence.

[0113] Step 450: If the target sequence is a fluctuation sequence, obtain X center points, where the center points are derived from M target values ​​in the target sequence, and X is an integer not less than 2.

[0114] Step 455: Based on X center points, cluster the M target values ​​using the fluctuation sequence processing model to obtain X types of target values.

[0115] Step 460: Obtain the average value of each target value in the X target value.

[0116] Step 465: Obtain X average values ​​from the X target values.

[0117] Step 470: Select the maximum average value from the X average values; use the unit time granularity corresponding to the maximum average value as the target time baseline.

[0118] Step 475: If the target sequence is not a fluctuating sequence, obtain a preset confidence level, whereby the preset confidence level represents the probability that any target value in the target sequence falls within a confidence interval.

[0119] Step 480: Based on the preset confidence level, generate confidence intervals using a stationary sequence processing model.

[0120] Step 485: Obtain P target values ​​that fall within the confidence interval from the M target values.

[0121] Step 490: Determine the unit time granularity corresponding to the P target values ​​as the target time baseline.

[0122] In this embodiment, login information of a target user within a target time period is obtained. The target time period includes M unit time granularities, and the login information includes the number of logins. Based on the login information, a target sequence of the target user is obtained. The target sequence includes M target values, each corresponding one-to-one with one of the M unit time granularities. Each target value represents the number of logins by the target user within a unit time granularity, and M is a positive integer. If M is greater than a first threshold, a target time baseline is determined using a target machine learning model for anomaly detection. The target time baseline includes a specified unit time granularity that allows the target user to access target resources, and the specified unit time granularity is at least one of the M unit time granularities. If M is not greater than the first threshold, the target time baseline is determined based on a sequence fluctuation judgment model. Thus, the target value can represent the number of logins by the target user within the target time period, and correspondingly, the target sequence can represent the number of logins by the target user at different unit time granularities. To address the diversity of target values, different models are used to generate target time baselines that include specified unit time granularity. Compared to related technologies that use a whole work period as the target time baseline, the target time baseline provided in this application can be more flexible and distributed, improving the accuracy of the target time baseline. This can, to some extent, solve the problem of low accuracy in time baselines generated by working time in related technologies. Furthermore, since the target sequence can represent the number of logins of a target user at different unit time granularities, obtaining the target time baseline based on the target sequence makes the target time baseline more correlated with the target user, further improving the accuracy of the target time baseline.

[0123] To better understand the method for determining the time baseline provided in the embodiments of this application, examples are given below. It should be understood that these examples are not intended to be limiting. Figure 5 An architecture diagram of the time baseline determination method provided in the embodiments of this application is shown below. Figure 5 As shown, the method for determining the time baseline provided in this application embodiment can be divided into four steps: data collection, data preprocessing, data sequence fluctuation discrimination / anomaly detection module, and time baseline generation.

[0124] Step S1: Data Collection

[0125] 1. Data source: The required data can be collected from different data sources, such as Elasticsearch, Oracle, Gbase and other databases.

[0126] 2. Log Types: Determine the log sources to be collected. This may include operating system logs, network device logs, application logs, etc. Selecting different log types can help ensure the accuracy of the results.

[0127] Step S2: Data Preprocessing

[0128] 1. Time format conversion: Due to the different data acquisition methods and rules of different data acquisition devices, the format of the time field may vary greatly. Before performing subsequent operations, it is necessary to standardize the time field format of the training data, such as converting them all to YYYY-MM-DD HH:MM:SS format.

[0129] 2. Data Cleaning: The collected data needs to be cleaned, including formatting, logical error removal, and missing value removal. Formatting involves converting data with inconsistent display formats (such as dates and times), data containing unwanted characters, and data whose content does not match the expected content of fields. Logical error removal involves removing / replacing unreasonable data. Missing value removal involves replacing / deleting data that is missing values ​​or is NULL in required fields.

[0130] 3. Data Grouping: Group the data according to the grouping field. The grouping field is the smallest distinguishing granularity of the generated time baseline, indicating that subsequent calculations are based on data of this category. For example, grouping the data according to the account field means that the final generated time baseline is based on the account dimension, with one account corresponding to one time baseline.

[0131] 4. Generate the data sequence (i.e., the target sequence): Recombine the data according to the required baseline period to generate the data sequence needed for calculation. For example, to generate a one-day time baseline, divide the original data according to the 24 hours of a day. You can also choose finer-grained time intervals, such as ten minutes / half an hour, as needed. Take the frequency of occurrence in each cell as the value in the sequence to prepare for subsequent calculations.

[0132] After data preprocessing is completed, the data sequence is entered into different modules according to the amount of data. When the amount of data in the data sequence is less than the preset threshold (i.e., the first threshold, for example, 30), it enters step S31 - data sequence fluctuation judgment. If the amount of data in the data sequence is greater than the preset threshold, it enters step S32 - data sequence anomaly detection module.

[0133] Step S31: Data Sequence Fluctuation Determination

[0134] This section uses a sequence fluctuation judgment model to determine the fluctuation of data sequences, and then uses different methods to obtain time baselines for different types of sequences, making the final results more accurate. The specific judgment process is as follows:

[0135] 1. Perform statistical counting on the data sequence, calculate the frequency of different values. If the frequency of the mode accounts for 80% or more of the total, the data sequence is considered to be a stationary sequence; otherwise, it is a fluctuating sequence.

[0136] 2. Calculate the variance and mean of the data sequence, and then calculate the coefficient of variation of the sequence. If the coefficient of variation is less than a preset threshold, the data sequence is considered to be a stationary sequence; otherwise, it is considered a fluctuating sequence.

[0137] In actual solution, you can choose one of the options based on the data conditions, as long as one condition is met.

[0138] Step S41: Generate time baseline module

[0139] 1. Depending on whether the data sequence obtained in step S31 is stationary or fluctuating, different algorithm flows are entered;

[0140] 2. If the sequence is a fluctuating sequence, it needs to be placed into a fluctuating sequence processing model (e.g., a clustering model), and the cluster with the larger mean is selected as the frequently used time cluster. The clustering model here can be k-means or other clustering algorithms, specifying two clusters. The clustering model clusters the target values ​​into two clusters, and the unit time granularity corresponding to the target value of the cluster with the larger mean is selected as the final target time baseline. Since the data sequence value represents the number of logins within a certain time window, selecting the cluster with the larger mean means selecting the cluster with the most frequent average logins. Since the target time baseline represents the time period during which the target user frequently operates, using the unit time granularity corresponding to the cluster with the larger mean as the final target time baseline conforms to the definition of a target time baseline.

[0141] 3. If the sequence is stationary, it needs to be placed into a stationary sequence processing model (e.g., box plot or ksigma). The quantiles or lower confidence limits of the data sequence can be obtained based on a preset confidence level. The unit time granularity corresponding to the target value in the data sequence that is greater than the quantile / lower confidence limit is the time baseline.

[0142] Step S32: Data Sequence Anomaly Detection Module

[0143] If the data volume exceeds the threshold, a time baseline is obtained using a target machine learning model for anomaly detection, which includes N anomaly detection modules. The specific steps are as follows:

[0144] 1. Calculate the third-quarter or median of a data sequence;

[0145] 2. Train multiple basic anomaly detectors (i.e., anomaly detection modules) and feed the data sequence into the anomaly detection modules. The anomaly detection algorithms that can be selected in this application embodiment are: LOF, KNN, and Isolation Forest.

[0146] 3. Generate pseudo-labels (i.e., data labels) to indicate whether the target value is an outlier for evaluation. After this process, anomaly labels obtained from various anomaly detectors can be filtered. This filtering process can modify the labels of outlier data in the data sequence whose values ​​are greater than the third-quarters to be normal. The reason is that the target value in the data sequence corresponds to the number of operations performed by the target user within different unit time granularities. The larger this number of operations value, the more frequently the user operates within this time period. This should be the user's frequently used time interval, so it should be retained.

[0147] 4. Obtain a set of pseudo-labels for each time point;

[0148] 5. Label merging to obtain the final result. For each target value, the label with the most occurrences is selected as the final label for that target value. The time period corresponding to the target value with the final label being normal is the desired time baseline.

[0149] Step S42: Generate time baseline module

[0150] The unit time granularity corresponding to the normal label data output from the S32 model is the desired time baseline.

[0151] In the time baseline determination method provided in this application embodiment, the method first selects whether to perform data sequence stationarity determination or direct anomaly detection based on the length of the data sequence. If data stationarity determination is performed first, a clustering algorithm is used for fluctuating sequences, and a box plot / KSigma is used for stationary sequences to obtain the final time baseline. If anomaly detection is used directly to obtain a comprehensive model, the final time baseline is obtained based on the output of the target machine learning model. This can improve the adaptability and generalization ability of the target machine learning model. Simultaneously, through several stages including data collection, data preprocessing, data sequence fluctuation determination / anomaly detection modules, and time baseline generation, the log data is given sufficient and effective feature representation. By improving the accuracy of the data sequence input to the anomaly module and through the joint processing by multiple anomaly detection modules, the accuracy and reliability of the anomaly detection module are improved.

[0152] In addition, the method for determining the time baseline provided in this application embodiment has the following advantages:

[0153] 1. Select different machine learning algorithms based on the amount of data in the data sequence to obtain a suitable time baseline, in order to adapt to complex and variable situations and generate an accurate time baseline.

[0154] 2. It offers selectivity and diversity in the selection of time interval granularity (i.e., unit time granularity), allowing for the setting of an appropriate granularity based on the minimum time window required in the actual situation.

[0155] 3. Enhanced Security: With the increasing number of cyber threats, enterprises face growing security risks. Machine learning-based methods for generating time baselines can effectively detect anomalous behavior and security threats in zero-trust architectures, helping enterprises to promptly identify and respond to potential attacks and improve overall security.

[0156] 4. Automation and Efficiency Improvement: Current methods for generating time baselines require manual rule writing and log data analysis, which is time-consuming, labor-intensive, and prone to errors. Machine learning-based time baseline generation methods significantly reduce the need for manual intervention, improving audit efficiency and accuracy.

[0157] 5. Real-time Monitoring and Response: Machine learning-based methods for generating time baselines can process large amounts of log data in real time and quickly detect abnormal behavior, enabling timely monitoring and response to network security situations. This helps reduce the impact and losses of potential attacks and improves the ability to respond quickly to security incidents.

[0158] 6. High Scalability and Adaptability: As enterprises' data scale and complexity continue to grow, they require log auditing systems that are scalable and adaptable. Deep learning-based approaches have advantages in handling large-scale data and emerging threats, and can meet the ever-changing needs of enterprises.

[0159] In terms of compliance and risk management, this application implements a time-baseline approach that can provide a reliable security audit record and help companies meet compliance requirements and reduce legal and compliance risks.

[0160] Figure 6 This is a structural block diagram of a time baseline determination device provided in an embodiment of this application. Figure 6 As shown, the time baseline determination device 600 provided in this application embodiment includes: an acquisition module 610, a processing module 620, and a determination module 630.

[0161] The acquisition module 610 is used to acquire the login information of the target user within a target time period, wherein the target time period includes M unit time granularities, and the login information includes the number of logins;

[0162] Processing module 620 is used to obtain the target sequence of the target user based on the login information. The target sequence includes M target values, which correspond one-to-one with M unit time granularities. The target value represents the number of times the target user logs in within a unit time granularity, and M is a positive integer.

[0163] The determination module 630 is used to determine a target time baseline by using a target machine learning model for anomaly detection if M is greater than a first threshold. The target time baseline includes a specified unit time granularity that allows the target user to access the target resource. The specified unit time granularity is at least one of the M unit time granularities.

[0164] The determination module is also used to determine the target time baseline based on the sequence fluctuation judgment model if M is not greater than the first threshold.

[0165] It should be noted that the embodiments of the time baseline determination device in this specification and the embodiments of the time baseline determination method in this specification are based on the same inventive concept. Therefore, the specific implementation of this embodiment can be referred to the implementation of the corresponding time baseline determination method above, and the repeated parts will not be described again.

[0166] Figure 7 This is a schematic diagram of an electronic device provided in an embodiment of this application. (As shown...) Figure 7 As shown, the electronic device 700 provided in this application embodiment may include a processor 710 and a memory 720. The memory stores a computer program, which, when executed, implements any of the time baseline determination methods provided in this application embodiment (e.g., ...). Figures 1-4 The steps in the method for determining the time baseline shown in any of the figures)

[0167] Memory is used to store programs or data. Memory may be, but is not limited to, Random Access Memory (RAM), Read Only Memory (ROM), Programmable Read-Only Memory (PROM), Erasable Programmable Read-Only Memory (EPROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), etc.

[0168] This application also provides a computer-readable storage medium storing a program or instructions that, when executed by a processor, implement the various processes of the above-described caching method embodiments based on a content delivery network and achieve the same technical effect. To avoid repetition, these will not be described again here.

[0169] This application also provides a computer program product, which is stored in a storage medium and executed by at least one processor to implement the various processes of the above method embodiments and achieve the same technical effect. To avoid repetition, it will not be described again here.

[0170] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0171] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0172] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a computer software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0173] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A method for determining a time baseline, characterized in that, include: Obtain login information of a target user within a target time period, wherein the target time period includes M unit time granularities, and the login information includes the number of logins; Based on the login information, a target sequence of the target user is obtained. The target sequence includes M target values, and each of the M target values ​​corresponds to one of the M unit time granularities. The target value represents the number of times the target user logs in within a unit time granularity, and M is a positive integer. If M is greater than the first threshold, a target time baseline is determined by the target machine learning model used for anomaly detection. The target time baseline includes a specified unit time granularity that allows the target user to access the target resource. The specified unit time granularity is at least one of the M unit time granularities. If M is not greater than the first threshold, the target time baseline is determined based on the sequence fluctuation judgment model; the sequence fluctuation judgment model includes a fluctuation sequence processing model and / or a stationary sequence processing model. The step of determining the target time baseline based on the sequence fluctuation judgment model includes: determining whether the target sequence is a fluctuating sequence, wherein the fluctuating sequence represents a sequence with a discrete distribution of target values; if the target sequence is a fluctuating sequence, processing the target sequence using a fluctuating sequence processing model to obtain the target time baseline; if the target sequence is not a fluctuating sequence, processing the target sequence using a stationary sequence processing model to obtain the target time baseline.

2. The method according to claim 1, characterized in that, The target machine learning model includes N anomaly detection modules, where N is a natural number; The determination of the target time baseline through a target machine learning model for anomaly detection includes: For the kth anomaly detection module among the N anomaly detection modules, the following operations are performed: input the target sequence into the anomaly detection module; output M data labels for the M target values ​​through the anomaly detection module, wherein the M data labels correspond one-to-one with the M target values, and the data labels are used to indicate whether the target value is an anomaly value; Based on the output results of N anomaly detection modules, a target time baseline is generated.

3. The method according to claim 2, characterized in that, The generation of the target time baseline based on the output results of N anomaly detection modules includes: For the i-th target value among the M target values, perform the following operations: obtain N data tags corresponding to the i-th target value, wherein the N data tags are output by N anomaly detection modules, and one anomaly detection module outputs one data tag for the i-th target value; based on the N data tags corresponding to the i-th target value, jointly determine whether the i-th target value is an anomaly value; If the i-th target value is normal, then obtain the unit time granularity corresponding to the i-th target value; A target time baseline is generated based on the unit time granularity corresponding to the i-th target value.

4. The method according to claim 1, characterized in that, The target sequence is processed using a stationary sequence processing model to obtain a target time baseline, including: Obtain a preset confidence level, which represents the probability that any target value in the target sequence falls within a confidence interval; Confidence intervals are generated based on a pre-set confidence level using a stationary sequence processing model. From the M target values, obtain P target values ​​that fall within the confidence interval; The unit time granularity corresponding to the P target values ​​is determined as the target time baseline.

5. The method according to claim 1, characterized in that, The target sequence is processed using a fluctuation sequence processing model to obtain a target time baseline, including: Obtain X center points, where each center point comes from M target values ​​in the target sequence, and X is an integer not less than 2; Based on X centroids, the M target values ​​are clustered using a fluctuation sequence processing model to obtain X classes of target values. Obtain the average value of each target value in the X target value category; X average values ​​are obtained from the X target values. Select the largest average from the X averages; The unit time granularity corresponding to the maximum average value is used as the target time baseline.

6. A device for determining a time baseline, characterized in that, include: The acquisition module is used to acquire the login information of the target user within a target time period, wherein the target time period includes M unit time granularities, and the login information includes the number of logins; The processing module is used to obtain the target sequence of the target user based on the login information. The target sequence includes M target values, which correspond one-to-one with M unit time granularities. The target value represents the number of times the target user logs in within a unit time granularity, and M is a positive integer. The determination module is used to determine a target time baseline by using a target machine learning model for anomaly detection if M is greater than a first threshold. The target time baseline includes a specified unit time granularity that allows the target user to access the target resource. The specified unit time granularity is at least one of the M unit time granularities. The determination module is also used to determine the target time baseline based on the sequence fluctuation judgment model if M is not greater than the first threshold; the sequence fluctuation judgment model includes a fluctuation sequence processing model and / or a stationary sequence processing model. Specifically, in the process of determining the target time baseline based on the sequence fluctuation judgment model, the determining module is used to: determine whether the target sequence is a fluctuating sequence, wherein the fluctuating sequence represents a sequence with a discrete distribution of target values; if the target sequence is a fluctuating sequence, process the target sequence using a fluctuating sequence processing model to obtain the target time baseline; if the target sequence is not a fluctuating sequence, process the target sequence using a stationary sequence processing model to obtain the target time baseline.

7. An electronic device, characterized in that, It includes a processor and a memory, the memory storing a program or instructions that run on the processor, the program or instructions which, when executed by the processor, implement the steps of the method as described in any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The medium stores a program or instructions that, when executed, implement the steps of the method as described in any one of claims 1-5.

9. A computer program product, characterized in that, Includes a computer program, which, when executed by a processor, implements the steps of the method according to any one of claims 1-5.

Images