Methods, devices, electronic equipment and storage media for judging abnormal data access

Abstract

This disclosure proposes a method, apparatus, electronic device, and storage medium for judging abnormal access data, including: acquiring access data, a data security access baseline model, and a behavior model, and acquiring the rate density distribution curve of the access data; generating first processed data based on the K-Means algorithm, generating second processed data based on the isolated forest 5-fold cross-validation method, and generating third processed data based on the residual algorithm; determining whether the access data is abnormal based on the first processed data, the second processed data, and the third processed data; and in response to determining that the access data is abnormal, processing the access data through the behavior model, and determining whether the access data is abnormal based on the processing result. Therefore, by processing user behavior data using the K-Means algorithm, the isolated forest 5-fold cross-validation method, and the residual algorithm, abnormal user behavior can be accurately detected, thereby improving network security from the user behavior level.

Description

Technical Field

[0001] This disclosure relates to the field of network security technology, and in particular to a method, apparatus, electronic device, and storage medium for judging abnormal access data. Background Technology

[0002] In current technologies, data flow has become more widespread and frequent, and various business systems provide convenient services to other business systems or external partners through open application programming interfaces (APIs). For example, when a user logs in to access company data, they must first send their unique identifier or key to verify their identity. Only after successful verification is data access allowed. However, in some situations, such as malicious behavior, system failure, misconfiguration, or operational errors, abnormal access may occur during data access.

[0003] For computers, people are also a kind of virus. Malicious access, high-frequency access, and access with abnormal permissions are all abnormal behaviors. Therefore, this application proposes to define the network operation behavior of internal users based on User and Entity Behavior Analysis (UEBA), and to build a behavior anomaly detection model through machine learning algorithms to determine which internal users' behavior is normal and which internal users' behavior is abnormal, thereby managing the security of internal networks and data from the user behavior level. Summary of the Invention

[0004] This disclosure aims to at least partially address one of the technical problems in the related art.

[0005] Therefore, one objective of this disclosure is to propose a method for judging abnormal access data.

[0006] The second objective of this disclosure is to provide an abnormal access data judgment device.

[0007] The third objective of this disclosure is to propose an electronic device.

[0008] The fourth objective of this disclosure is to provide a non-transitory computer-readable storage medium.

[0009] The fifth objective of this disclosure is to provide a computer program product.

[0010] To achieve the above objectives, a first aspect of this disclosure proposes a method for judging abnormal access data, comprising: acquiring access data, acquiring a data security access baseline model and a behavior model, and processing the access data based on the data security access baseline model to obtain a rate density distribution curve of the access data; processing the rate density distribution curve based on the K-Means algorithm to generate first processed data, and processing the rate density distribution curve based on the isolated forest 5-fold cross-validation method to generate second processed data, and processing the rate density distribution curve based on the residual algorithm to generate third processed data; determining whether the access data is abnormal based on the first processed data, the second processed data, and the third processed data; and in response to determining that the access data is abnormal, processing the access data through the behavior model, and determining whether the access data is abnormal access data based on the processing result.

[0011] According to one embodiment of this disclosure, determining whether the access data is abnormal based on the first processed data, the second processed data, and the third processed data includes: determining a first score based on the first processed data, determining a second score based on the second processed data, and determining a third score based on the third processed data; determining an abnormal score of the access data based on the first score, the second score, and the third score; and comparing the abnormal score with an abnormal score threshold to determine whether the access data is abnormal.

[0012] According to one embodiment of this disclosure, after acquiring the access data, the method further includes: preprocessing the access data; extracting features from the preprocessed access data to obtain multiple candidate features; filtering the multiple candidate features to determine a target feature; and filtering the access data based on the target feature.

[0013] According to one embodiment of this disclosure, processing the access data through the behavior model includes: inputting the access data into the behavior model to generate candidate processing results; processing the candidate processing results based on the K-Means algorithm to generate fourth processing data; processing the candidate processing results based on the isolated forest 5-fold cross-validation method to generate fifth processing data; and processing the candidate processing results based on the residual algorithm to generate sixth processing data; and determining whether the access data is abnormal based on the fourth processing data, the fifth processing data, and the sixth processing data.

[0014] According to one embodiment of this disclosure, determining whether the access data is abnormal access data based on the processing result includes: in response to the processing result being abnormal; determining that the access data is abnormal access data.

[0015] According to one embodiment of this disclosure, the method further includes: in response to the processing result being normal; retraining the data security access baseline model and the behavior model.

[0016] According to one embodiment of this disclosure, the method further includes: issuing an alarm in response to the access data being abnormal access data.

[0017] To achieve the above objectives, a second aspect of this disclosure provides an abnormal access data judgment device, comprising: an acquisition module, configured to acquire access data, acquire a data security access baseline model and a behavior model, and process the access data based on the data security access baseline model to obtain a rate density distribution curve of the access data; a generation module, configured to process the rate density distribution curve based on the K-Means algorithm to generate first processed data, process the rate density distribution curve based on the isolated forest 5-fold cross-validation method to generate second processed data, and process the rate density distribution curve based on the residual algorithm to generate third processed data; a determination module, configured to determine whether the access data is abnormal based on the first processed data, the second processed data, and the third processed data; and a judgment module, configured to, in response to determining that the access data is abnormal, process the access data through the behavior model, and determine whether the access data is abnormal access data based on the processing result.

[0018] To achieve the above objectives, a third aspect of this disclosure provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to implement the abnormal access data judgment method as described in the first aspect of this disclosure.

[0019] To achieve the above objectives, a fourth aspect of this disclosure provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to implement the abnormal access data judgment method as described in the first aspect of this disclosure.

[0020] To achieve the above objectives, a fifth aspect of this disclosure provides a computer program product, including a computer program that, when executed by a processor, implements the abnormal access data judgment method as described in the first aspect of this disclosure.

[0021] Therefore, by processing user behavior data using the K-Means algorithm, the Isolation Forest 5-fold cross-validation method, and the residual algorithm, it is possible to accurately detect whether a user's behavior is abnormal, thereby improving network security from the user behavior level. Attached Figure Description

[0022] Figure 1 This is a schematic diagram of an abnormal access data judgment method according to one embodiment of the present disclosure;

[0023] Figure 2 This is a schematic diagram of the probability density distribution curve of the probability of an event occurring within a day, according to one embodiment of this disclosure.

[0024] Figure 3 This is a schematic diagram of another abnormal access data judgment method according to one embodiment of this disclosure;

[0025] Figure 4 This is a schematic diagram of another abnormal access data judgment method according to one embodiment of this disclosure;

[0026] Figure 5 This is a schematic diagram of an abnormal access data determination device according to one embodiment of the present disclosure;

[0027] Figure 6 This is a schematic diagram of an electronic device according to one embodiment of the present disclosure. Detailed Implementation

[0028] Embodiments of this disclosure are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this disclosure, and should not be construed as limiting this disclosure.

[0029] The acquisition, storage, use, and processing of data in this disclosed technical solution all comply with the relevant provisions of relevant laws and regulations.

[0030] It should be noted that in the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, it does not mean that the applicant has used or necessarily used the solution.

[0031] Figure 1 This is a schematic diagram of an abnormal access data judgment method according to one embodiment of this disclosure, such as... Figure 1 As shown, the method for judging abnormal access data includes the following steps:

[0032] S101, acquire access data, acquire the data security access baseline model and behavior model, and process the access data based on the data security access baseline model to obtain the rate density distribution curve of the access data.

[0033] The abnormal access data judgment method of this application embodiment can be applied to network security protection scenarios. The execution subject of the abnormal access data judgment in this application embodiment can be the abnormal access data judgment device of this application embodiment, which can be installed on an electronic device.

[0034] In the embodiments of this disclosure, there are various methods for obtaining access data, and no limitation is made here.

[0035] In one possible implementation, the accessed data can be manually entered.

[0036] In another possible approach, accessed data can be obtained through analysis of log data. For example, log data collected from users during their time at the company can be acquired, processed, and then collected using Log4j to a local disk or remote server. The collected log information can then be stored in a database, analyzed using ELK tools, and the analysis results can be visualized using visualization tools.

[0037] In this embodiment of the disclosure, the data security access baseline model is a model constructed using time series processing. In this embodiment, the data security access baseline model for users and entities can be constructed by building behavioral models from the collected data and using machine learning and statistical methods, including using time series analysis for feature construction to identify normal behavioral patterns.

[0038] The behavioral model is generated by combining an autoregressive model (AR model) and a moving average model (MA model).

[0039] It's important to note that the probability density function (PDF) is a way to describe the probability distribution of a continuous random variable. The probability density function provides the probability density of the random variable's values ​​within a certain interval, rather than direct probability values. The graph of the probability density function is called the probability density distribution curve. For example, as... Figure 2 The probability density distribution curve shown is the probability density distribution curve of the probability of an event occurring at a given time within a day.

[0040] S102, the rate density distribution curve is processed based on the K-Means algorithm to generate the first processed data, the rate density distribution curve is processed based on the isolated forest 5-fold cross-validation method to generate the second processed data, and the rate density distribution curve is processed based on the residual algorithm to generate the third processed data.

[0041] It should be noted that the K-Means algorithm is a commonly used unsupervised learning method, primarily used for cluster analysis. Its goal is to divide a dataset into K clusters, such that data points within each cluster are as similar as possible, while data points between different clusters are as different as possible. Each cluster is represented by its centroid.

[0042] Isolation Forest (iForest) is an unsupervised learning algorithm for anomaly detection. It detects outliers in a dataset by building multiple trees (usually decision trees) to isolate them. The core idea of ​​Isolation Forest is that outliers are more easily isolated; therefore, during tree construction, outliers are typically separated at a shallower level.

[0043] The residual algorithm is a method used to evaluate the goodness of fit of data, especially in regression analysis. Residuals are the differences between actual observations and model predictions; calculating residuals helps us understand the model's performance and whether systematic biases exist.

[0044] S103, determine whether the accessed data is abnormal based on the first processed data, the second processed data and the third processed data.

[0045] In this embodiment of the disclosure, after obtaining the first processed data, the second processed data, and the third processed data, there are various methods to determine whether the accessed data is abnormal, and no limitation is made here.

[0046] In one possible implementation, the first, second, and third processed data can be processed by a judgment algorithm to obtain a judgment value, and the access data can be determined as abnormal based on the judgment value.

[0047] It should be noted that this judgment algorithm is pre-designed and can be modified according to actual design needs.

[0048] In another possible implementation, the first, second, and third processed data can be processed by a judgment model to determine whether the accessed data is abnormal.

[0049] It should be noted that the judgment model is pre-trained and stored in the storage space of the electronic device for easy retrieval and use when needed.

[0050] S104, in response to determining that the accessed data is abnormal, the accessed data is processed through a behavioral model, and the accessed data is determined as abnormal based on the processing result.

[0051] In this embodiment of the disclosure, since there may be problems such as the data security access baseline model training not achieving the expected results, data errors, and model output errors, after determining that the access data is abnormal, the access data can be processed again through the behavior model, thereby improving the accuracy of the final judgment.

[0052] In this embodiment, access data is first acquired, along with a data security access baseline model and a behavior model. The access data is then processed based on the data security access baseline model to obtain a rate density distribution curve. Next, the rate density distribution curve is processed using the K-Means algorithm to generate first processed data, then using the isolated forest 5-fold cross-validation method to generate second processed data, and finally using the residual algorithm to generate third processed data. Based on the first, second, and third processed data, it is then determined whether the access data is abnormal. Finally, in response to the determination that the access data is abnormal, the behavior model is used to process the access data, and the processing result is used to determine whether the access data is abnormal. Therefore, by processing user behavior data using the K-Means algorithm, the isolated forest 5-fold cross-validation method, and the residual algorithm, abnormal user behavior can be accurately detected, thereby improving network security from the user behavior perspective.

[0053] In the above embodiments, determining whether the accessed data is abnormal based on the first processed data, the second processed data, and the third processed data can also be achieved through... Figure 3 To further explain, the method includes:

[0054] S301, determine a first score based on the first processed data, determine a second score based on the second processed data, and determine a third score based on the third processed data.

[0055] In this embodiment of the disclosure, the first score may be the direct result of the first processed data, or it may be obtained after processing based on the first processed data, without any limitation.

[0056] In this embodiment of the disclosure, the second score may be a direct result of the second processed data, or it may be obtained after processing based on the second processed data; no limitation is made here.

[0057] In this embodiment of the disclosure, the third score may be the direct result of the third processed data, or it may be obtained after processing based on the third processed data, without any limitation.

[0058] S302, determine the abnormal score of the accessed data based on the first score, the second score and the third score.

[0059] In this embodiment of the disclosure, after obtaining the first score, the second score, and the third score, the first score, the second score, and the third score can be calculated using an abnormal score algorithm to obtain an abnormal score.

[0060] It should be noted that this anomaly scoring algorithm is pre-designed and can be modified according to actual design needs; no limitations are imposed here.

[0061] In one possible implementation, it can be represented by the following formula:

[0062] 1) If the first score obtained by the K-Means algorithm is 0, and the second score obtained by the 5-fold cross-validation method of the Isolation Forest is less than 0.5, then the anomaly score of the accessed data is 0.5 * the second score, as shown in the following formula:

[0063] if KOFi=0and IFSi<0.5, then OSi=IFSi*0.5

[0064] 2) If the first score obtained by the K-Means algorithm is 1, and the second score obtained by the Isolation Forest 5-fold cross-validation method is greater than 0.5, then the abnormal score for this behavior is the smaller of 1.5 * the second score and 1, as shown in the following formula:

[0065] if KOFi=1and IFSi>0.5, then OSi=min(IFSi*1.5, 1)

[0066] 3) If the third score obtained by the residual algorithm is 1, and the second score obtained by the 5-fold cross-validation method of the isolated forest is greater than 0.5, then the abnormal score for this behavior is the smaller of 1.5 * the second score and 1, as shown in the following formula:

[0067] if AK=1and IFSi>0.5, then OSi=min(IFSi*1.5,1)

[0068] 4) Other cases, including: if the first score obtained by the K-Means algorithm is 0, and the second score obtained by the 5-fold cross-validation method of the isolated forest is greater than 0.5; or if the first score obtained by the K-Means algorithm is 1, and the second score obtained by the 5-fold cross-validation method of the isolated forest is less than 0.5; or if the first score obtained by the K-Means algorithm is 0 or 1, and the second score obtained by the 5-fold cross-validation method of the isolated forest is equal to 0.5, then the abnormal behavior score of the user and entity is the third score, as shown in the following formula:

[0069] OSi = IFSi

[0070] Where KOFi (K-MeansOutlierFlag) represents the first score calculated by the K-Means algorithm for the i-th user and entity behavior log. IFSi (IsolationForestScore) represents the second score obtained by using the 5-fold cross-validation method of the Isolation Forest for the i-th user and entity behavior log; AK represents the third score; and OSi (OutlierScore) represents the final anomaly score for the i-th user and entity behavior log.

[0071] S303 compares the anomaly score with the anomaly score threshold to determine whether the accessed data is abnormal.

[0072] It should be noted that the abnormal score threshold is pre-designed and can be changed according to actual design needs; no restrictions are imposed here.

[0073] In this embodiment, a first score is first determined based on first processed data, a second score is determined based on second processed data, and a third score is determined based on third processed data. Then, an anomaly score for the accessed data is determined based on the first, second, and third scores. Finally, the anomaly score is compared with an anomaly score threshold to determine whether the accessed data is abnormal. Therefore, by calculating an anomaly score for the accessed data and determining whether user behavior is abnormal based on the anomaly score, the judgment can be data-driven, and the accuracy of the judgment can be controlled by adjusting the size of the anomaly score threshold according to the user's actual needs.

[0074] In the above embodiments, after obtaining the access data, the method further includes, for example, Figure 4 The steps shown are as follows:

[0075] S401, preprocesses the accessed data.

[0076] In the embodiments of this disclosure, there are various methods for preprocessing accessed data, and no limitation is made here.

[0077] For example, this could include deleting missing values:

[0078] The dropna() method can be used to delete rows or columns containing missing values. By default, this method deletes rows containing any missing values, or you can specify to delete columns containing missing values.

[0079] Filling missing values ​​using interpolation:

[0080] Use the interpolate() method to interpolate missing values;

[0081] It may also include removing duplicate values:

[0082] When there are identical records in a dataset, the drop_duplicates() function can be called to delete duplicate records in the dataset, thereby avoiding data redundancy and misleading information.

[0083] It may also include merging duplicate values:

[0084] When there are some identical records in a dataset, we can use the groupby() and sum() functions in the Pandas library to merge them into a single record, thus preserving all the information and reducing data redundancy.

[0085] It may also include deleting outliers:

[0086] Outliers can be handled by deleting them. The `read_csv` function in the pandas library was used to read the CSV file, and outliers with values ​​greater than 100 or less than 0 were deleted using Boolean indexing.

[0087] It may also include interpolation methods to handle outliers:

[0088] Interpolation is another method for handling outliers. It can estimate the true value of outliers based on other values ​​in the dataset. You can use the nan function in the numpy library to set outliers greater than 100 or less than 0 to NaN, and then use the interpolate function in the pandas library to fill in the missing values ​​using linear interpolation.

[0089] S402, feature extraction is performed on the preprocessed access data to obtain multiple candidate features.

[0090] It should be noted that there are various methods for feature extraction, and no limitations are made here.

[0091] In one possible implementation, the accessed data can be processed using a feature extraction model to obtain multiple candidate features. It should be noted that this feature extraction model is pre-trained and stored in the electronic device's storage space.

[0092] In this embodiment of the disclosure, candidate features may include a variety of features, which are not limited here. For example, candidate features may include one or more of the following: a single account access time baseline, a single account at terminal IP and access time baseline, a single account at terminal IP, application port and access time baseline, a single account at terminal connection switch IP and access time baseline, a single account accessing URL and access time baseline, and a single account at terminal IP, accessing URL and access time baseline.

[0093] S403, filter multiple candidate features to determine the target feature, and filter the accessed data based on the target feature.

[0094] It should be noted that due to potential errors in the data or in the data processing, the generated candidate features may be inaccurate.

[0095] In the embodiments of this disclosure, there are various methods for screening candidate features, and no limitation is made here.

[0096] In one possible implementation, filtering rules can be pre-defined, and target features can be selected from candidate features according to the filtering rules.

[0097] In another possible implementation, candidate features and accessed data can be processed by a screening model to output target features. This screening model is pre-trained and stored in the electronic device's storage space for easy retrieval when needed.

[0098] In this embodiment, the access data is first preprocessed, then features are extracted from the preprocessed access data to obtain multiple candidate features, and finally, the multiple candidate features are filtered to determine the target feature, and the access data is filtered based on the target feature. Therefore, by extracting target features from the data and further filtering the data using the target feature, the effectiveness of the access data can be improved, and the efficiency and accuracy of subsequent data processing and analysis can be enhanced.

[0099] In this embodiment of the disclosure, the access data is processed by a behavioral model. First, the access data is input into the behavioral model to generate candidate processing results. Then, the candidate processing results are processed based on the K-Means algorithm to generate fourth processing data. The candidate processing results are also processed based on the isolated forest 5-fold cross-validation method to generate fifth processing data. Finally, the candidate processing results are processed based on the residual algorithm to generate sixth processing data. Finally, the access data is determined to be abnormal based on the fourth, fifth, and sixth processing data.

[0100] It should be noted that the method for determining whether the accessed data is abnormal based on the fourth, fifth, and sixth processed data can refer to the content of determining whether the accessed data is abnormal based on the first, second, and third processed data in the above embodiment, and will not be repeated here.

[0101] In this embodiment of the disclosure, if the access data is determined to be abnormal based on the fourth processing data, the fifth processing data, and the sixth processing data, then the access data is determined to be abnormal access data.

[0102] If the accessed data is determined to be normal based on the fourth, fifth, and sixth processed data, the output results of the data security access baseline model and the behavior model are inconsistent, and it is impossible to determine whether the accessed data is abnormal.

[0103] At this point, the baseline model and behavioral model for secure data access need to be retrained. This ensures the accuracy of subsequent prediction processes and results.

[0104] In one possible implementation, after determining that the access data is abnormal, a user behavior alert can be issued. Abnormal behaviors are defined based on the current behavioral data, and normal behaviors are set using learned data as a basis. These abnormal behaviors could include setting maximum frequency limits for user visits to a website, the time of unusual logins, or other abnormal access behaviors. This allows other users to refer to these settings to determine whether their behavior is normal.

[0105] In another possible implementation, the normal baseline model library can be scanned periodically to detect any new abnormal information. If new vulnerability information is found, updated monitoring rules are generated and added to the security behavior baseline knowledge base. Then, it is checked whether the abnormal behavior information has been fixed. If so, the corresponding updated monitoring detection rules in the security baseline knowledge base are queried and deleted.

[0106] Corresponding to the abnormal access data judgment methods provided in the above embodiments, an embodiment of this disclosure also provides an abnormal access data judgment device. Since the abnormal access data judgment device provided in this disclosure corresponds to the abnormal access data judgment methods provided in the above embodiments, the implementation methods of the above abnormal access data judgment methods are also applicable to the abnormal access data judgment device provided in this disclosure, and will not be described in detail in the following embodiments.

[0107] Figure 5 This is a schematic diagram of an abnormal access data determination device according to one embodiment of the present disclosure, such as... Figure 5 As shown, the abnormal access data judgment device 500 includes: an acquisition module 510, a generation module 520, a determination module 530, and a judgment module 540.

[0108] The acquisition module 510 is used to acquire access data, acquire a data security access baseline model and a behavior model, and process the access data based on the data security access baseline model to obtain the rate density distribution curve of the access data.

[0109] The generation module 520 is used to process the rate density distribution curve based on the K-Means algorithm to generate first processed data, process the rate density distribution curve based on the isolated forest 5-fold cross-validation method to generate second processed data, and process the rate density distribution curve based on the residual algorithm to generate third processed data.

[0110] The determination module 530 is used to determine whether the accessed data is abnormal based on the first processed data, the second processed data, and the third processed data.

[0111] The judgment module 540 is used to process the access data through a behavior model in response to the determination that the access data is abnormal, and to determine whether the access data is abnormal access data based on the processing result.

[0112] In one possible implementation, the determining module 530 is further configured to: determine a first score based on first processed data, determine a second score based on second processed data, and determine a third score based on third processed data; determine an abnormal score of the accessed data based on the first score, the second score, and the third score; and compare the abnormal score with an abnormal score threshold to determine whether the accessed data is abnormal.

[0113] The acquisition module 510 is also used for: preprocessing the access data; extracting features from the preprocessed access data to obtain multiple candidate features; filtering the multiple candidate features to determine the target feature; and filtering the access data based on the target feature.

[0114] The judgment module 540 is also used to: input the access data into the behavior model to generate candidate processing results; process the candidate processing results based on the K-Means algorithm to generate fourth processing data, process the candidate processing results based on the isolated forest 5-fold cross-validation method to generate fifth processing data, and process the candidate processing results based on the residual algorithm to generate sixth processing data; and determine whether the access data is abnormal based on the fourth processing data, the fifth processing data, and the sixth processing data.

[0115] The judgment module 540 is also used to: respond to the processing result being abnormal; determine that the accessed data is abnormal access data.

[0116] The judgment module 540 is also used to: respond to a normal processing result; retrain the data security access baseline model and behavior model.

[0117] The judgment module 540 is also used to: issue an alarm in response to abnormal access data.

[0118] To implement the above embodiments, this disclosure also proposes an electronic device 600. Figure 6This is a schematic diagram of an electronic device according to one embodiment of the present disclosure, such as... Figure 6 As shown, the electronic device 600 includes: a processor 601 and a memory 602 communicatively connected to the processor. The memory 602 stores instructions executable by at least one processor. The instructions are executed by at least one processor 601 to implement the functions described in this disclosure. Figures 1-4 An example of a method for judging abnormal access data.

[0119] To implement the above embodiments, this disclosure also proposes a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause a computer to perform as disclosed herein. Figures 1-4 An example of a method for judging abnormal access data.

[0120] To implement the above embodiments, this disclosure also proposes a computer program product, including a computer program, which, when executed by a processor, implements the features of this disclosure. Figures 1-4 An example of a method for judging abnormal access data.

[0121] It should be noted that personal information collected from users should be used for legitimate and reasonable purposes and should not be shared or sold outside of these legitimate uses. Furthermore, such collection / sharing should only be conducted after receiving the user's informed consent, including but not limited to notifying the user to read the user agreement / user notice and sign an agreement / authorization that includes authorization of relevant user information before the user uses the function. In addition, any necessary steps must be taken to protect and safeguard access to such personal information data and ensure that others with access to personal information data comply with their privacy policies and procedures.

[0122] This application is intended to provide an implementation scheme for users to selectively prevent the use or access to their personal information data. Specifically, this disclosure is intended to provide hardware and / or software to prevent or block access to such personal information data. Once personal information data is no longer needed, risks can be minimized by restricting data collection and deleting data. Furthermore, where applicable, such personal information is de-identified to protect user privacy.

[0123] In the foregoing descriptions of the embodiments, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0124] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "multiple" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0125] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0126] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that contains, stores, communicates, propagates, or transmits programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0127] It should be understood that various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0128] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0129] Furthermore, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0130] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of this application.

Claims

1. A method for judging abnormal data access, characterized in that, include: Acquire access data, and obtain a data security access baseline model and a behavior model. Process the access data based on the data security access baseline model to obtain the probability density distribution curve of the access data. The probability density distribution curve is processed using the K-Means algorithm to generate the first processed data, and the probability density distribution curve is processed using the isolated forest 5-fold cross-validation method to generate the second processed data, and the probability density distribution curve is processed using the residual algorithm to generate the third processed data. Based on the first processed data, the second processed data, and the third processed data, determine whether the access data is abnormal; In response to determining that the access data is abnormal, the access data is processed through the behavior model, and the access data is determined as abnormal based on the processing result.

2. The method according to claim 1, characterized in that, The step of determining whether the access data is abnormal based on the first processed data, the second processed data, and the third processed data includes: A first score is determined based on the first processed data, a second score is determined based on the second processed data, and a third score is determined based on the third processed data; An anomaly score for the accessed data is determined based on the first score, the second score, and the third score. The anomaly score is compared with the anomaly score threshold to determine whether the accessed data is abnormal.

3. The method according to claim 1, characterized in that, After obtaining the access data, the process also includes: The accessed data is preprocessed; Feature extraction is performed on the preprocessed access data to obtain multiple candidate features; Multiple candidate features are filtered to determine the target feature, and the accessed data is then filtered based on the target feature.

4. The method according to claim 1, characterized in that, The process of processing the access data through the behavioral model includes: The access data is input into the behavior model to generate candidate processing results; The candidate processing results are processed using the K-Means algorithm to generate the fourth processing data, and the candidate processing results are processed using the isolated forest 5-fold cross-validation method to generate the fifth processing data, and the candidate processing results are processed using the residual algorithm to generate the sixth processing data. Based on the fourth processed data, the fifth processed data, and the sixth processed data, it is determined whether the access data is abnormal.

5. The method according to claim 4, characterized in that, Determining whether the accessed data is abnormal accessed based on the processing result includes: The processing result is abnormal; The access data was determined to be abnormal access data.

6. The method according to claim 5, characterized in that, The method further includes: The response is that the processing result is normal; The data security access baseline model and the behavior model are retrained.

7. The method according to any one of claims 1-6, characterized in that, The method further includes: An alarm is triggered if the accessed data is deemed abnormal.

8. An abnormal data access judgment device, characterized in that, include: The acquisition module is used to acquire access data, acquire a data security access baseline model and a behavior model, and process the access data based on the data security access baseline model to obtain the probability density distribution curve of the access data. The generation module is used to process the probability density distribution curve based on the K-Means algorithm to generate first processed data, process the probability density distribution curve based on the isolated forest 5-fold cross-validation method to generate second processed data, and process the probability density distribution curve based on the residual algorithm to generate third processed data. The determination module is used to determine whether the access data is abnormal based on the first processed data, the second processed data, and the third processed data; The judgment module is used to process the access data through the behavior model in response to determining that the access data is abnormal, and to determine whether the access data is abnormal access data based on the processing result.

9. An electronic device, characterized in that, Including memory and processor; The processor reads executable program code stored in the memory to run a program corresponding to the executable program code, so as to implement the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-7.

Images