Information processing method and device

Abstract

The present application provides an information processing method and device, wherein the method includes: obtaining at least one request information received from a terminal device within a preset time period, wherein the request information includes a user account corresponding to the terminal device and user operation data corresponding to the terminal device; analyzing the at least one request information to generate a user score corresponding to the user account; determining whether the user score exceeds a preset score threshold; when it is determined that the user score exceeds the preset score threshold, issuing an alarm message for the user account, wherein the alarm message is used to indicate abnormal access to the user account. The embodiments provided by this scheme can improve the security of data resources.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to an information processing method and device. Background Art

[0002] With the rapid development of the Internet, the problem of malicious API swiping has become increasingly serious. Malicious API swiping refers to frequent, abnormal, and non-normal access to APIs in network applications or services, usually initiated by malicious users or automated scripts (such as crawlers, robots, etc.). This behavior may cause a waste of system resources and may also lead to data leakage and service interruption.

[0003] In the related technologies, traditional interface anti-brushing mechanisms, such as verification codes and Internet Protocol (IP) restrictions, also have some obvious defects (such as verification codes are easily bypassed). Therefore, traditional interface anti-brushing mechanisms are insufficient in the face of increasingly complex attack methods and user experience requirements. Summary of the invention

[0004] The embodiment of the present application provides an information processing method and device, which can improve the security of data resources. The above technical solution is as follows:

[0005] In a first aspect, an embodiment of the present application provides an information processing method, the method comprising:

[0006] Acquire at least one request information received from a terminal device within a preset time period, wherein the request information includes a user account corresponding to the terminal device and user operation data corresponding to the terminal device;

[0007] Analyze the at least one request information to generate a user score corresponding to the user account;

[0008] Determine whether the user score exceeds a preset score threshold;

[0009] When it is determined that the user score exceeds the preset score threshold, an alarm message for the user account is issued, and the alarm message is used to indicate abnormal access to the user account.

[0010] In a possible implementation, after determining that the user score exceeds the preset score threshold, the method further includes:

[0011] Calculate the number of times the user score is continuously determined to exceed the preset score threshold;

[0012] When the number of times exceeds a preset threshold, the user account is determined as an illegal account to restrict the user account from accessing the server.

[0013] In a possible implementation, analyzing the at least one request information to generate a user score corresponding to the user account includes:

[0014] Analyze each of the at least one request information to obtain a request score corresponding to each of the request information;

[0015] The user score corresponding to the user account is determined according to the request score corresponding to each of the request information.

[0016] In a possible implementation, analyzing each of the at least one request information to obtain a request score corresponding to each of the request information includes:

[0017] Decrypt the request information using the preset private key;

[0018] If the decryption is successful, the user operation data included in the decrypted request information is obtained, and it is determined whether the user operation data includes the first position, the second position and the dwell time corresponding to the second position, wherein the first position is the position of the mouse cursor of the terminal device at the moment of triggering the first page element corresponding to the request information, the second position is the previous position where the mouse cursor stayed before moving to the first position, and the dwell time corresponding to the second position is the length of time the mouse cursor stayed at the second position;

[0019] In a case where the user operation data includes the first position, the second position and the stay duration, the first position, the second position and the stay duration are analyzed to obtain a request score corresponding to the request information.

[0020] In a possible implementation, the analyzing each request information in the at least one request information to obtain a request score corresponding to each request information further includes:

[0021] If the decryption fails, the first preset score is determined as the request score corresponding to the request information; or,

[0022] In a case where the user operation data does not include the first position, the second position and the stay duration, the first preset score is determined as the request score corresponding to the request information, and the first preset score is greater than or equal to the preset score threshold.

[0023] In a possible implementation, analyzing the first location, the second location, and the stay duration to obtain a request score corresponding to the request information includes:

[0024] Determine a first page where the first page element at the first position is located, and a second page where the second page element at the second position is located;

[0025] Determine whether the first page and the second page are the same page;

[0026] In the case that the first page and the second page are not the same page, determining whether the second page is a previous page of the first page, wherein the previous page of the first page is a page that needs to be accessed before accessing the first page;

[0027] If not, the second preset score is determined as the request score corresponding to the above request information.

[0028] In a possible implementation, analyzing the first location, the second location, and the stay duration to obtain a request score corresponding to the request information includes:

[0029] In the case that the first page and the second page are the same page, determining whether the second page element is a preceding page element of the first page element, wherein the preceding page element of the first page element is a page element that needs to be triggered before triggering the first page element;

[0030] If not, the third preset score is determined as the request score corresponding to the above request information.

[0031] In a possible implementation, analyzing the first location, the second location, and the stay duration to obtain a request score corresponding to the request information includes:

[0032] In the case where the second page element is a preceding page element of the first page element, obtaining a target response time corresponding to the second page element, where the target response time is the time required to call an application programming interface corresponding to the second page element;

[0033] Determine whether the above-mentioned stay time is less than the above-mentioned target response time;

[0034] If so, the fourth preset score is determined as the request score corresponding to the request information.

[0035] In a possible implementation, when the number of the at least one request information is multiple, after obtaining the request score corresponding to each of the request information, the method further includes:

[0036] determining whether the at least one request information indicates a continuous operation behavior;

[0037] If not, then analyzing each of the at least one request information to obtain a request score corresponding to each of the request information includes:

[0038] The request score corresponding to each of the request information and the fifth preset score are accumulated to obtain the user score corresponding to the user account.

[0039] In a second aspect, an embodiment of the present application provides an information processing method, which is applied to a terminal device, including:

[0040] When a call request for an application programming interface is detected, a user account corresponding to the terminal device and user operation data corresponding to the terminal device are obtained;

[0041] Generate request information according to the user account and the user operation data, wherein the request information includes the user account and the user operation data;

[0042] The request information is sent to the server, so that the server obtains at least one request information received from the terminal device within a preset time period, and analyzes the at least one request information to generate a user score corresponding to the user account, and then determines whether the user score exceeds the preset score threshold; and when it is determined that the user score exceeds the preset score threshold, an alarm message for the user account is issued, and the alarm message is used to indicate abnormal access to the user account.

[0043] In a possible implementation, the user operation data includes a first position, a second position, and a dwell time corresponding to the second position, wherein the first position is the position of the mouse cursor of the terminal device at the moment of triggering the first page element corresponding to the request information, the second position is the position of the second page element where the mouse cursor stays before moving to the first position, and the dwell time corresponding to the second position is the length of time the mouse cursor stays at the second position.

[0044] In a third aspect, an embodiment of the present application provides an information processing device, the device comprising:

[0045] A first acquisition module, configured to acquire at least one request information received from a terminal device within a preset time period, wherein the request information includes a user account corresponding to the terminal device and user operation data corresponding to the terminal device;

[0046] An analysis module, configured to analyze the at least one request information and generate a user score corresponding to the user account;

[0047] A judgment module, used to judge whether the user score exceeds a preset score threshold;

[0048] The alarm module is used to issue an alarm message for the user account when it is determined that the user score exceeds the preset score threshold, and the alarm message is used to indicate abnormal access to the user account.

[0049] In a possible implementation, the above device further includes:

[0050] A calculation module, used to calculate the number of times the user score is continuously determined to exceed the preset score threshold;

[0051] The first determination module is used to determine the user account as an illegal account to restrict the user account from accessing the server when the number of times exceeds a preset number threshold.

[0052] In a possible implementation, the above analysis module includes:

[0053] A first analyzing unit, configured to analyze each of the at least one request information to obtain a request score corresponding to each of the request information;

[0054] The first determining unit is configured to determine a user score corresponding to the user account according to a request score corresponding to each of the request information.

[0055] In a possible implementation, the first analysis unit includes:

[0056] A decryption subunit, used to decrypt the request information using a preset private key;

[0057] A first determining subunit is used to obtain the user operation data included in the decrypted request information when the decryption is successful, and determine whether the user operation data includes a first position, a second position, and a dwell time corresponding to the second position, wherein the first position is the position of the mouse cursor of the terminal device at the moment of triggering the first page element corresponding to the request information, the second position is the previous position where the mouse cursor stayed before moving to the first position, and the dwell time corresponding to the second position is the length of time the mouse cursor stayed at the second position;

[0058] The analyzing subunit is used to analyze the first position, the second position and the stay time when the user operation data includes the first position, the second position and the stay time, so as to obtain a request score corresponding to the request information.

[0059] In a possible implementation, the first analysis unit further includes:

[0060] A second determining subunit is configured to determine, when decryption fails, the first preset score as the request score corresponding to the request information; or

[0061] The second determination subunit is used to determine the first preset score as the request score corresponding to the request information when the user operation data does not include the first position, the second position and the stay duration, and the first preset score is greater than or equal to the preset score threshold.

[0062] In a possible implementation, the above analysis subunit is specifically used to:

[0063] Determine a first page where the first page element at the first position is located, and a second page where the second page element at the second position is located;

[0064] Determine whether the first page and the second page are the same page;

[0065] In the case that the first page and the second page are not the same page, determining whether the second page is a previous page of the first page, wherein the previous page of the first page is a page that needs to be accessed before accessing the first page;

[0066] If not, the second preset score is determined as the request score corresponding to the above request information.

[0067] In a possible implementation, the above analysis subunit is specifically used to:

[0068] In the case that the first page and the second page are the same page, determining whether the second page element is a preceding page element of the first page element, wherein the preceding page element of the first page element is a page element that needs to be triggered before triggering the first page element;

[0069] If not, the third preset score is determined as the request score corresponding to the above request information.

[0070] In a possible implementation, the above analysis subunit is specifically used to:

[0071] In the case where the second page element is a preceding page element of the first page element, obtaining a target response time corresponding to the second page element, where the target response time is the time required to call an application programming interface corresponding to the second page element;

[0072] Determine whether the above-mentioned stay time is less than the above-mentioned target response time;

[0073] If so, the fourth preset score is determined as the request score corresponding to the request information.

[0074] In a possible implementation, when the number of the at least one request information is multiple, after obtaining the request score corresponding to each of the request information, the apparatus further includes:

[0075] A second determination module, configured to determine whether the at least one request information indicates a continuous operation behavior;

[0076] If not, the first determining unit includes:

[0077] The third determining subunit is used to accumulate the request score corresponding to each of the request information and the fifth preset score to obtain the user score corresponding to the user account.

[0078] In a fourth aspect, an embodiment of the present application provides an information processing device, including:

[0079] A second acquisition module is used to acquire a user account corresponding to the terminal device and user operation data corresponding to the terminal device when a call request for the application programming interface is detected;

[0080] A generating module, used to generate request information according to the user account and the user operation data, wherein the request information includes the user account and the user operation data;

[0081] The sending module is used to send the above-mentioned request information to the server, so that the above-mentioned server obtains at least one request information received from the terminal device within a preset time period, and analyzes the above-mentioned at least one request information to generate a user score corresponding to the above-mentioned user account, and then determines whether the above-mentioned user score exceeds the preset score threshold; and when it is determined that the above-mentioned user score exceeds the above-mentioned preset score threshold, an alarm message for the above-mentioned user account is issued, and the above-mentioned alarm message is used to indicate abnormal access to the above-mentioned user account.

[0082] In one possible implementation, the user operation data includes a first position, a second position, and a dwell time corresponding to the second position, wherein the first position is the position of the mouse cursor of the terminal device at the moment of triggering the first page element corresponding to the request information, the second position is the previous position where the mouse cursor stayed before moving to the first position, and the dwell time corresponding to the second position is the length of time the mouse cursor stays at the second position.

[0083] In a fifth aspect, an embodiment of the present application provides an electronic device, including: a processor and a memory;

[0084] The above-mentioned memory stores a computer program, and the above-mentioned computer program is suitable for being loaded by the above-mentioned processor and executing the steps of the method provided by the first aspect of the embodiment of the present application or any possible implementation of the first aspect, or the second aspect of the embodiment of the present application or any possible implementation of the second aspect.

[0085] In a sixth aspect, an embodiment of the present application provides a computer storage medium, wherein the computer storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor and executing the steps of the method provided by the first aspect of the embodiment of the present application or any possible implementation of the first aspect, or the second aspect of the embodiment of the present application or any possible implementation of the second aspect.

[0086] The embodiment of the present application obtains at least one request information received from a terminal device within a preset time period, wherein the request information includes a user account corresponding to the terminal device and user operation data corresponding to the terminal device; analyzes the at least one request information to generate a user score corresponding to the user account; determines whether the user score exceeds a preset score threshold; and when it is determined that the user score exceeds the preset score threshold, issues an alarm message for the user account, wherein the alarm message is used to indicate abnormal access to the user account. By regularly collecting and analyzing the user's operation data and generating a corresponding user score, abnormal or suspicious behavior patterns can be detected, so that when the user score exceeds a certain value, an alarm message is issued to notify relevant personnel to take timely measures to reduce the probability of exploitation of security vulnerabilities or malicious attacks, thereby improving the security of data resources and the reliability of data access; and the data collection and analysis process is automatically performed in the background without the user having to perform additional operations or provide additional information, thereby reducing user interference and improving user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0087] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0088] Figure 1 A schematic diagram of the structure of an information processing system provided for an exemplary embodiment of the present application;

[0089] Figure 2 A flowchart of an information processing method provided for an exemplary embodiment of the present application;

[0090] Figure 3 A schematic diagram of a first page provided for an exemplary embodiment of the present application;

[0091] Figure 4 A flowchart of a method for determining a request score provided by an exemplary embodiment of the present application;

[0092] Figure 5 A flowchart of another information processing method provided for an exemplary embodiment of the present application;

[0093] Figure 6 A schematic diagram of the structure of an information processing device provided by an exemplary embodiment of the present application;

[0094] Figure 7 A schematic diagram of the structure of another information processing device provided by an exemplary embodiment of the present application;

[0095] Figure 8 A schematic structural diagram of an electronic device provided as an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0096] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0097] The terms "first", "second", "third", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices.

[0098] Please refer to the following Figure 1 , which exemplarily shows a structural diagram of an information processing system provided by an embodiment of the present application. Figure 1 As shown, the system includes a server 110 and a terminal device 120. The server 110 and the terminal device 120 can be directly or indirectly connected via wired or wireless communication, which is not limited in the present application.

[0099] In some embodiments, server 110 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), big data and artificial intelligence platforms.

[0100] In some embodiments, the terminal device 120 may be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart home appliance, etc., but is not limited thereto. Those skilled in the art may know that the number of the terminal devices 120 may be more or less. For example, the terminal device 120 may be only one, or the terminal device 120 may be dozens or hundreds, or more. The embodiment of the present application does not limit the number and device type of the terminal device 120.

[0101] In some embodiments, the terminal device 120 may be installed with relevant application software. The server 110 is the background server of the application software. The terminal device 120 may send a request to the server 110, and the server 110 may process the request and return a response.

[0102] In some embodiments, the server 110 is used to perform the following steps: obtain at least one request message received from a terminal device within a preset time period, wherein the request message includes a user account corresponding to the terminal device and user operation data corresponding to the terminal device; analyze the at least one request message to generate a user score corresponding to the user account; determine whether the user score exceeds a preset score threshold; when it is determined that the user score exceeds the preset score threshold, issue an alarm message for the user account, wherein the alarm message is used to indicate abnormal access to the user account.

[0103] In some embodiments, the terminal device 120 is used to perform the following steps: when a call request for an application programming interface is detected, obtain a user account corresponding to the terminal device and user operation data corresponding to the terminal device; generate request information based on the user account and the user operation data, wherein the request information includes the user account and the user operation data; and send the request information to the server.

[0104] Optionally, the preset time period may be a time period before the current moment, and the preset time period is the same as the preset cycle.

[0105] Optionally, the request information includes the user account and the user operation data. The user account may be an account used by the user to log in to the application installed in the terminal device. The user operation data may be various operation data performed by the user when using the application software through the terminal device.

[0106] Optionally, the user score corresponding to the user account is used to characterize an abnormality index of the user account.

[0107] Optionally, the preset score threshold may be a critical value of an abnormality index preset by relevant personnel.

[0108] Optionally, the warning information may be in any one or more forms such as text message, sound, etc. The warning message may be used to prompt relevant personnel to confirm the user score and take relevant measures to avoid wasting system resources, data leakage and service interruption.

[0109] An exemplary embodiment of the present application provides an information processing method. The information processing method can be applied to the above-mentioned server. For details, please refer to Figure 2 , which exemplarily shows a flow chart of an information processing method provided by an embodiment of the present application. Figure 2 As shown, the information processing method includes the following S21-S24:

[0110] S21. Acquire at least one request message received from a terminal device within a preset time period, wherein the request message includes a user account corresponding to the terminal device and user operation data corresponding to the terminal device.

[0111] In some embodiments, when the terminal device detects a call request for an application programming interface, it obtains the user account corresponding to the terminal device and the user operation data corresponding to the terminal device, generates request information based on the user account and the user operation data, and then sends the request information to the server. After receiving the request information sent by the terminal device, the server can store the request information in a local preset cache area, and obtain at least one request information received from the terminal device within a preset time period from the preset cache area based on a preset period.

[0112] The preset time period may be a time period before the current moment, and the preset time period is the same as the preset period. For example, the preset time period may be 2 hours, that is, at least one request information received from the terminal device in the past 2 hours is obtained from the preset cache area every 2 hours. The number of request information may be one or more.

[0113] In some embodiments, the request information includes the user account and the user operation data, wherein the user account may be an account used by the user to log in to an application installed in the terminal device.

[0114] In some embodiments, user operation data may be various operation data performed by the user when using the application software through the terminal device. These operation data may include, but are not limited to, the following: click operation (records of the user clicking buttons, links or other interactive page elements on the screen), input operation (text content or digital information entered by the user in the input box), page browsing (user's stay time in the page of the application software, page access path, function usage frequency, etc.), etc. Specifically, the user operation information may include the first position, the second position and the stay time corresponding to the second position, wherein the first position is the position of the mouse cursor of the terminal device at the moment of triggering the first page element corresponding to the request information, the second position is the previous position where the mouse cursor stays before moving to the first position, and the stay time corresponding to the second position is the length of time the mouse cursor stays at the second position. Among them, the first page element is a component of the page, which can be any one of a window, a link, a button, a list, a picture, etc.

[0115] S22: Analyze the at least one request information to generate a user score corresponding to the user account.

[0116] In some embodiments, the user score corresponding to the user account is used to characterize the abnormality index of the user account. The higher the user score is, the higher the abnormality index of the corresponding user account is.

[0117] S23: Determine whether the user score exceeds a preset score threshold.

[0118] In some embodiments, the preset score threshold may be a critical value of an abnormality index pre-set by relevant personnel.

[0119] S24. When it is determined that the user score exceeds the preset score threshold, an alarm message is issued for the user account, where the alarm message is used to indicate abnormal access to the user account.

[0120] In some embodiments, the above-mentioned alarm information can be in any one or more forms such as text message, sound, etc. The alarm message can be used to prompt relevant personnel to confirm the user score and take relevant measures to avoid wasting system resources, data leakage and service interruption.

[0121] The embodiment of the present application obtains at least one request information received from a terminal device within a preset time period, wherein the request information includes a user account corresponding to the terminal device and user operation data corresponding to the terminal device; analyzes the at least one request information to generate a user score corresponding to the user account; determines whether the user score exceeds a preset score threshold; and when it is determined that the user score exceeds the preset score threshold, issues an alarm message for the user account, wherein the alarm message is used to indicate abnormal access to the user account. By regularly collecting and analyzing the user's operation data and generating a corresponding user score, abnormal or suspicious behavior patterns can be detected, so that when the user score exceeds a certain value, a warning is issued to notify relevant personnel to take timely measures to reduce the probability of exploitation of security vulnerabilities or malicious attacks, thereby improving the security of data resources and the reliability of data access; and the data collection and analysis process is automatically performed in the background without the user having to perform additional operations or provide additional information, thereby reducing user interference and improving user experience.

[0122] In some embodiments, after issuing the warning information for the user account in S24, the method further includes S25-S26:

[0123] S25: Calculate the number of times the user score is continuously determined to exceed the preset score threshold.

[0124] S26. When the number of times exceeds a preset number threshold, the user account is determined as an illegal account to restrict the user account from accessing the server.

[0125] In some embodiments, the preset number threshold can be flexibly set by relevant personnel, for example, the preset number threshold can be 3. For example, when the preset time period is 2 hours, if the user score is determined to exceed the preset score threshold for 3 consecutive times within 6 hours, the user account is determined to be an illegal account to restrict the user account from accessing the server. For example, the user account can be restricted from logging into the corresponding application software.

[0126] In some embodiments, if the number of times does not exceed a preset number threshold, no processing may be performed on the user account.

[0127] In some embodiments, after determining that the user score exceeds the preset score threshold, the number of times the user score has been determined to exceed the preset score threshold can be recorded, such as the consecutive number of times and the cumulative number of times. Then, each time the user score is subsequently determined to exceed the preset score threshold, the step of S25 and calculating the number of consecutive determinations that the user score exceeds the preset score threshold is performed based on the consecutive number of times.

[0128] In some embodiments, after issuing an alarm message for the user account, the method further includes: obtaining the cumulative number of times the user score exceeds the preset score threshold; judging whether the cumulative number exceeds the preset cumulative number threshold, if so, determining the user account as an illegal account to restrict the user account from accessing the server, if not, not taking any action on the user account for the time being.

[0129] In the embodiment of the present application, by detecting user behavior and calculating whether the user score exceeds the preset score threshold, potential illegal accounts or abnormal operation behaviors can be effectively identified. By restricting the access of these illegal accounts, the probability of being attacked maliciously, leaking data or other security threats is reduced, and the security of server data is effectively improved. In addition, by recording the cumulative number and continuous number of times the user score exceeds the preset threshold, a more in-depth analysis of the user operation data can be performed, which can provide data support for subsequent security policy optimization and help identify more complex attack behaviors. And if the preset threshold is not reached, restrictive measures can be temporarily not taken to avoid excessive intervention in normal users. This hierarchical processing mechanism makes the processing of potential threats more accurate, reduces unnecessary interference to users, and improves the user experience.

[0130] In some embodiments, in S22, the at least one request information is analyzed to generate a user score corresponding to the user account, including S221-S222:

[0131] S221. Analyze each request information in the at least one request information to obtain a request score corresponding to each request information.

[0132] Among them, the request information and the request score correspond one to one.

[0133] S222: Determine a user score corresponding to the user account according to the request score corresponding to each of the request information.

[0134] In some embodiments, in S222, determining the user score corresponding to the user account according to the request score corresponding to each request information includes: adding the request scores corresponding to each request information in all the request information to determine the user score corresponding to the user account.

[0135] In other embodiments, when the number of the at least one request information is multiple, after obtaining the request score corresponding to each of the request information, the method further includes: determining whether the at least one request information indicates a continuous operation behavior; if not, then in S222, determining the user score corresponding to the user account based on the request score corresponding to each of the request information, including: adding the request score corresponding to each of the request information and the fifth preset score to obtain the user score corresponding to the user account.

[0136] In some embodiments, the above-mentioned determination of whether the at least one request message indicates a continuous operation behavior includes: obtaining a preset number of consecutive request messages received from the at least one request message, and determining whether the preset number of request messages include adjacent positions based on the first position and the second position in each request message in the preset number of request messages. If so, it is determined that the at least one request message indicates a continuous operation behavior; if not, it is determined that the at least one request message does not indicate a continuous operation behavior.

[0137] For example, assuming the preset number is 10, if in at least one request message, there are 10 consecutive request messages whose positions are not connected or continuous (that is, the click positions are scattered, without regularity or logic), then these request messages may not be the behavior of a normal user. For example, a normal user may have a certain logical order or similar click positions when clicking on a page, but if these positions are completely random and scattered, it can be considered that these behaviors are generated by automatic scripts or robots, rather than by human users. Therefore, it is necessary to add a fifth preset score to the sum of the request scores corresponding to each request message in all request messages, and use the result of the addition as the user score corresponding to the above-mentioned user account. Among them, the fifth preset score can be set flexibly, for example, the fifth preset score can be 5.

[0138] In the embodiment of the present application, by analyzing the location and continuity of the location included in the request information, it is possible to effectively distinguish normal user operation data from user operation data that may be generated by an automatic script or machine. Continuous and logical operation data usually represents normal user behavior, while scattered and irregular operation data may be abnormal behavior or illegal behavior. By identifying these abnormal behaviors, a more accurate, reliable and comprehensive user score can be obtained, making the judgment of risk more detailed and accurate, and effectively improving the security of data.

[0139] In some embodiments, in S221, the request information is analyzed to obtain a request score corresponding to the request information, including S2211-S2213:

[0140] S2211. Decrypt the request information using a preset private key.

[0141] In some embodiments, the request information is information encrypted by the terminal device using a preset public key. The preset private key corresponds to the preset public key, that is, the preset private key is used to decrypt information encrypted by the preset public key. The preset public key may be a public key of the RSA algorithm (an asymmetric encryption algorithm).

[0142] S2212. If the decryption is successful, the user operation data included in the decrypted request information is obtained, and it is determined whether the user operation data includes the first position, the second position and the dwell time corresponding to the second position, wherein the first position is the position of the mouse cursor of the terminal device at the moment of triggering the first page element corresponding to the request information, the second position is the previous position where the mouse cursor stayed before moving to the first position, and the dwell time corresponding to the second position is the length of time the mouse cursor stays at the second position.

[0143] In some embodiments, the first position and the second position can be represented by coordinates. The first position, the second position, and the dwell time corresponding to the second position can be collected by the terminal device when detecting a call request for an application programming interface. Specifically, the terminal device can obtain the coordinates through JavaScript (a lightweight, interpreted or just-in-time compiled programming language with function priority) to obtain the first position and the second position. For example, the mouse cursor operated by the user stays at the position (24,80) for 5 seconds and then moves to the position (30,100). The coordinates after moving are (30,100), and then stays at the position (30,100) for 1 second before calling the interface, such as / api / data / getlist (a path for requesting a data list from a server). The first position can be represented as (30,100), the second position can be represented as (24,80), and the dwell time corresponding to the second position is 5 seconds. Furthermore, the first position, the second parameter, and the dwell time corresponding to the second position may be concatenated into the following key-value pair data (JavaScript Object Notation, JSON) string: [{"x":24,"y":80,"t":5000},{"x":30,"y":100,"t":1000}], and the JSON string is encrypted using a preset public key to generate request information and send it to the server. Among them, x represents the horizontal axis, y represents the vertical axis, and t represents the duration (milliseconds).

[0144] S2213. When the user operation data includes the first position, the second position and the stay duration, analyze the first position, the second position and the stay duration to obtain a request score corresponding to the request information.

[0145] By analyzing the first location, second location, and dwell time, potentially malicious behavior can be detected, such as rapid, illogical clicks through automated scripts, thereby improving the overall security of the application and preventing interface abuse.

[0146] In some embodiments, in S221, the request information is analyzed to obtain a request score corresponding to the request information, and further includes S2214-S2215:

[0147] S2214. If the decryption fails, the first preset score is determined as the request score corresponding to the request information; or,

[0148] S2215. In a case where the user operation data does not include the first position, the second position and the stay duration, the first preset score is determined as the request score corresponding to the request information, and the first preset score is greater than or equal to the preset score threshold.

[0149] In some embodiments, if the decryption of the request information using the preset private key fails, or the user operation data does not include the first position, the second position, and the duration of stay, it may be that the data format of the request information generated by the automated tool or script involved in the illegal call interface is incorrect, the field is incomplete, or it has been tampered with. Since asymmetric encryption relies on the integrity of the data, any tampering with the encrypted data will cause decryption failure; it may also be that the illegal call interface repeatedly sends the previously legal request information, which will be detected as a replay attack causing the decryption failure. In order to prevent the above situation from causing data leakage, the first preset score can be determined as the request score corresponding to the request information, so as to issue an alarm message to prompt relevant personnel.

[0150] In some embodiments, when the preset score threshold is 100, the first preset score may also be 100.

[0151] In an embodiment of the present application, by using a preset public key to encrypt the request information and using the corresponding private key to decrypt it on the server side, it can be ensured that the user operation data will not be obtained or tampered with by an unauthorized third party during the transmission process. The asymmetric encryption method can effectively protect the security of user sensitive information and prevent man-in-the-middle attacks and data leakage.

[0152] In some embodiments, in S2213, the first position, the second position and the stay duration are analyzed to obtain a request score corresponding to the request information, including S01-S04:

[0153] S01. Determine a first page where the first page element at the first position is located, and a second page where the second page element at the second position is located.

[0154] In some embodiments, the above-mentioned request information may also include a first page identifier corresponding to the first position and a second page identifier corresponding to the second position, the first page identifier is used to indicate the first page where the above-mentioned first page element at the above-mentioned first position is located, and the second page identifier is used to indicate the second page where the above-mentioned second page element at the second position is located.

[0155] S02: Determine whether the first page and the second page are the same page.

[0156] When the first page identifier and the second page identifier included in the above request information are the same, it is determined that the above first page and the above second page are the same page. When the first page identifier and the second page identifier included in the above request information are different, it is determined that the above first page and the above second page are not the same page.

[0157] S03. When the first page and the second page are not the same page, determine whether the second page is a previous page of the first page, wherein the previous page of the first page is a page that needs to be accessed before accessing the first page.

[0158] In some embodiments, the hierarchical relationship or link relationship between the various pages of the application software is pre-configured, and whether the second page is a preceding page of the first page can be determined through the configuration information of the application software.

[0159] S04: If the second page is not a preceding page of the first page, a second preset score is determined as a request score corresponding to the request information.

[0160] In some embodiments, the second preset score can be flexibly set by relevant personnel. For example, the second preset score can be 10.

[0161] Figure 3 A schematic diagram of a first page provided for an exemplary embodiment of the present application, such as Figure 3 As shown, assuming that the above application software is a search engine, Figure 3The page 30 in the figure is the homepage of the search engine, and the page 30 includes at least the following page elements: the name 301 of the application software, the search box 302, the search button 3021 included in the search box 302, the page navigation bar 303, and the search result list 304. The page navigation bar 303 also includes a web page navigation button 3031, an information navigation button 3032, and an AI Q&A navigation button, a Q&A navigation button, a video navigation button, a picture navigation button, a medical navigation button, a map navigation button, an encyclopedia navigation button, a library navigation button, a software navigation button, a translation navigation button, etc. When a user searches through the search box 302, he can select the corresponding navigation button in the page navigation bar 303, and then the search result list corresponding to the navigation button can be displayed. Figure 3 The search result list 304 is the search result list corresponding to the web page navigation button 3031, and the search result list 304 includes items such as search result 3041 and search result 3042. When a trigger operation for any search result is detected, the search result page corresponding to the search result is displayed. In other words, the user needs to first access the current page 30 and perform a series of operations on the page 30 before being able to access the search result page corresponding to the search result, that is, page 30 is the front page of the search result page.

[0162] In the embodiment of the present application, by judging the page identifier, it can be ensured that the user has visited the necessary prerequisite pages before performing certain operations. This verification mechanism can generate a more comprehensive and reliable user score, thereby effectively preventing potential attacks, reducing the probability of data resource loss due to attacks, and improving data security.

[0163] In some embodiments, in S2213, the first position, the second position and the stay duration are analyzed to obtain a request score corresponding to the request information, including S05-S06:

[0164] S05. In the case that the first page and the second page are the same page, determine whether the second page element is a preceding page element of the first page element, wherein the preceding page element of the first page element is a page element that needs to be triggered before triggering the first page element.

[0165] In some embodiments, in each page of the application software, the relationship between each page element is pre-configured, and whether the second page element is a preceding page element of the first page element can be determined through the relevant page configuration information of the application software.

[0166] Still with the above Figure 3For example, when it is detected that the search button 3021 is triggered, the search result list 304 and the search result 3041, search result 3042 and other items in the search list 304 are displayed. In other words, the user needs to trigger the search button 3021 first before the search result 3041 can be triggered in the search list 304, that is, the page element search button 3021 is the preceding page element of the page element search result 3041.

[0167] S306: If the second page element is not a preceding page element of the first page element, determine a third preset score as a request score corresponding to the request information.

[0168] The third preset score may be flexibly set by relevant personnel. For example, the third preset score may be 10 points.

[0169] In an embodiment of the present application, by determining whether the second page element is a predecessor page element of the first page element, requests that do not conform to normal operating procedures can be identified, and the rationality of user operations can be accurately determined, so that the order and logic of operations are correctly maintained, effectively improving the reliability and accuracy of user scores.

[0170] In some embodiments, in S2213, the first position, the second position and the stay duration are analyzed to obtain a request score corresponding to the request information, including S07-S09:

[0171] S07. In the case where the second page element is a preceding page element of the first page element, a target response time corresponding to the second page element is obtained. The target response time is the time required to call an application programming interface corresponding to the second page element.

[0172] In some embodiments, the target response time corresponding to each page element is preconfigured. The target response time is the time required from the user triggering a page element to completing the operation and returning the result.

[0173] S08: Determine whether the above-mentioned stay time is less than the above-mentioned target response time.

[0174] S09: If yes, determine the fourth preset score as the request score corresponding to the request information.

[0175] In some embodiments, since the second page element is a preceding page element of the first page element, the first page element can be triggered only after the second page element is called and the target response time has passed. Figure 3For example, assuming that the search button 3021 is the second page element, the time from the moment when the user triggers the second page element to the moment when the search result list 304 is displayed is the target response time corresponding to the search button 3021. Assuming that the target response time corresponding to the search button 3021 is 5 seconds, and the dwell time is 1 second, that is, only 1 second after calling the second page element search button 3021, the first page element (such as the search result 3041 in the search result list 304) is triggered. This means that the search button 3021 may not go through the complete processing flow after being triggered. It may be through simulating a click on the search button 3021 and then forging the display of the search result page before processing, or bypassing the normal processing time through some means, and directly requesting or accessing the search results. Therefore, it may be a sign that the interface has been maliciously accessed. This situation usually needs to attract the attention of relevant personnel, and may require further security checks or protective measures to prevent the interface from being abused.

[0176] In some embodiments, if the above-mentioned dwell time is not less than the above-mentioned target response time, the request score corresponding to the above-mentioned request information is not calculated, or the request score corresponding to the request information is determined to be 0 points.

[0177] In the embodiment of the present application, by introducing the comparison between the target response time and the dwell time, a more accurate abnormal risk assessment can be performed on each request information. If the dwell time is too short, a certain request score can be automatically assigned to the request information, thereby triggering further security checks or protective measures in a timely manner, which helps to better distinguish between normal and abnormal behaviors and improves data security. By monitoring and analyzing the dwell time between page elements, the system can identify and handle potential attacks (such as simulated clicks, interface abuse, etc.) before they actually cause damage, which helps prevent the system from suffering large-scale attacks, improves defense capabilities, and effectively avoids the leakage of data resources.

[0178] Furthermore, the present application is described below in conjunction with specific embodiments.

[0179] Figure 4 A flowchart of a method for determining a request score provided by an exemplary embodiment of the present application is shown in FIG. Figure 4 As shown, the request score determination method includes S401-S413:

[0180] S401: Decrypt the request information using a preset private key.

[0181] S402: Determine whether the decryption is successful. If not, execute S403; if yes, execute S404.

[0182] S403: Determine the first preset score as the request score corresponding to the request information.

[0183] S404: Determine whether the user operation data includes the first location, the second location, and the duration of stay corresponding to the second location. If not, execute S403; if yes, execute S405-S413.

[0184] S405: Determine a first page where the first page element at the first position is located, and a second page where the second page element at the second position is located.

[0185] S406, determine whether the first page and the second page are the same page; if so, execute S407-S411; if not, execute S412-S413.

[0186] S407: Determine whether the second page element is a preceding page element of the first page element. If yes, execute S408-S410; if no, execute S411.

[0187] S408: Obtain the target response time corresponding to the second page element.

[0188] S409: Determine whether the stay time is less than the target response time.

[0189] S410: Determine a fourth preset score as a request score corresponding to the request information.

[0190] S411. Determine a third preset score as a request score corresponding to the request information.

[0191] S412: Determine whether the second page is a preceding page of the first page.

[0192] S413: Determine the second preset score as the request score corresponding to the request information.

[0193] The specific steps of the request score determination method have been described in detail in the above content and will not be repeated here.

[0194] In some embodiments, the corresponding user's preference information can also be analyzed based on the user operation data. For example, by analyzing the advertisements or recommended content clicked by the user, the user's browsing preferences, consumption intentions or potential needs can be understood. In addition, the user's browsing path and click sequence on the page can help understand the user's behavior patterns, such as which types of information they prefer to view first, so as to subsequently recommend to the user content, products or services that are more in line with their interests, thereby improving user experience and satisfaction.

[0195] An exemplary embodiment of the present application provides an information processing method. The information processing method can be applied to the above terminal device. For details, please refer to Figure 5 , which exemplarily shows a flow chart of another information processing method provided by an embodiment of the present application. Figure 5 As shown, the information processing method includes the following S51-S53:

[0196] S51. When a call request for an application programming interface is detected, a user account corresponding to a terminal device and user operation data corresponding to the terminal device are obtained.

[0197] In some embodiments, the user operation data include a first position, a second position and a dwell time corresponding to the second position, wherein the first position is the position of the mouse cursor of the terminal device at the moment of triggering the first page element corresponding to the request information, the second position is the previous position where the mouse cursor stayed before moving to the first position, and the dwell time corresponding to the second position is the length of time the mouse cursor stays at the second position.

[0198] In some embodiments, when a call request for an application programming interface is detected, a user account corresponding to the terminal device and user operation data corresponding to the terminal device are obtained, and request information is generated based on the user account and the user operation data, and then the request information is sent to the server.

[0199] In some embodiments, the request information includes the user account and the user operation data, wherein the user account may be an account used by the user to log in to an application installed in the terminal device.

[0200] In some embodiments, user operation data may be various operation data performed by the user when using the application software through the terminal device. These operation data may include, but are not limited to, the following: click operation (records of the user clicking buttons, links or other interactive page elements on the screen), input operation (text content or digital information entered by the user in the input box), page browsing (user's stay time in the page of the application software, page access path, function usage frequency, etc.), etc. Specifically, the user operation information may include the first position, the second position and the stay time corresponding to the second position, wherein the first position is the position of the mouse cursor of the terminal device at the moment of triggering the first page element corresponding to the request information, the second position is the previous position where the mouse cursor stays before moving to the first position, and the stay time corresponding to the second position is the length of time the mouse cursor stays at the second position. Among them, the first page element and the second page element are components of the page, which may be any of a window, a link, a button, a list, a picture, etc.

[0201] S52: Generate request information according to the user account and the user operation data, wherein the request information includes the user account and the user operation data.

[0202] In some embodiments, the user account and the user operation data may be added as positioning parameters (loc parameters) and encrypted using a preset public key to generate request information.

[0203] S53, sending the request information to the server, so that the server obtains at least one request information received from the terminal device within a preset time period, and analyzes the at least one request information to generate a user score corresponding to the user account, and then determines whether the user score exceeds the preset score threshold; and when it is determined that the user score exceeds the preset score threshold, issuing an alarm message for the user account, the alarm message is used to indicate abnormal access to the user account.

[0204] The embodiment of the present application obtains the user account corresponding to the terminal device and the user operation data corresponding to the terminal device when a call request for an application programming interface is detected; generates request information according to the user account and the user operation data, wherein the request information includes the user account and the user operation data; sends the request information to the server so that the server obtains at least one request information received from the terminal device within a preset time period, and analyzes the at least one request information to generate a user score corresponding to the user account; determines whether the user score exceeds the preset score threshold; when it is determined that the user score exceeds the preset score threshold, issues an alarm message for the user account, and the alarm message is used to indicate abnormal access to the user account. By regularly collecting and analyzing the user's operation data and generating the corresponding user score, abnormal or suspicious behavior patterns can be detected, so that when the user score exceeds a certain value, an alarm message is issued to notify relevant personnel to take measures in time, reduce the probability of exploitation of security vulnerabilities or malicious attacks, thereby improving the security of data resources and the reliability of data access; and the data collection and analysis process is automatically performed in the background, without the user performing additional operations or providing additional information, reducing user interference and improving user experience.

[0205] Please refer to the following Figure 6 , which is a schematic diagram of the structure of an information processing device provided by an exemplary embodiment of the present application. Figure 6 As shown, the information processing device 600 includes:

[0206] A first acquisition module 601 is used to acquire at least one request information received from a terminal device within a preset time period, wherein the request information includes a user account corresponding to the terminal device and user operation data corresponding to the terminal device;

[0207] An analysis module 602 is used to analyze the at least one request information and generate a user score corresponding to the user account;

[0208] A determination module 603 is used to determine whether the user score exceeds a preset score threshold;

[0209] The alarm module 604 is used to issue an alarm message for the user account when it is determined that the user score exceeds the preset score threshold, and the alarm message is used to indicate abnormal access to the user account.

[0210] In a possible implementation, the above device further includes:

[0211] A calculation module, used to calculate the number of times the user score is continuously determined to exceed the preset score threshold;

[0212] The first determination module is used to determine the user account as an illegal account to restrict the user account from accessing the server when the number of times exceeds a preset number threshold.

[0213] In a possible implementation, the analysis module 602 includes:

[0214] A first analyzing unit, configured to analyze each of the at least one request information to obtain a request score corresponding to each of the request information;

[0215] The first determining unit is configured to determine a user score corresponding to the user account according to a request score corresponding to each of the request information.

[0216] In a possible implementation, the first analysis unit includes:

[0217] A decryption subunit, used to decrypt the request information using a preset private key;

[0218] A first determining subunit is used to obtain the user operation data included in the decrypted request information when the decryption is successful, and determine whether the user operation data includes a first position, a second position, and a dwell time corresponding to the second position, wherein the first position is the position of the mouse cursor of the terminal device at the moment of triggering the first page element corresponding to the request information, the second position is the previous position where the mouse cursor stayed before moving to the first position, and the dwell time corresponding to the second position is the length of time the mouse cursor stayed at the second position;

[0219] The analysis subunit is used to analyze the first position, the second position and the stay time when the user operation data includes the first position, the second position and the stay time, so as to obtain a request score corresponding to the request information.

[0220] In a possible implementation, the first analysis unit further includes:

[0221] A second determining subunit is configured to determine, when decryption fails, the first preset score as the request score corresponding to the request information; or

[0222] The second determination subunit is used to determine the first preset score as the request score corresponding to the request information when the user operation data does not include the first position, the second position and the stay duration, and the first preset score is greater than or equal to the preset score threshold.

[0223] In a possible implementation, the above analysis subunit is specifically used to:

[0224] Determine a first page where the first page element at the first position is located, and a second page where the second page element at the second position is located;

[0225] Determine whether the first page and the second page are the same page;

[0226] In the case that the first page and the second page are not the same page, determining whether the second page is a previous page of the first page, wherein the previous page of the first page is a page that needs to be accessed before accessing the first page;

[0227] If not, the second preset score is determined as the request score corresponding to the above request information.

[0228] In a possible implementation, the above analysis subunit is specifically used to:

[0229] In the case that the first page and the second page are the same page, determining whether the second page element is a preceding page element of the first page element, wherein the preceding page element of the first page element is a page element that needs to be triggered before triggering the first page element;

[0230] If not, the third preset score is determined as the request score corresponding to the above request information.

[0231] In a possible implementation, the above analysis subunit is specifically used to:

[0232] In the case where the second page element is a preceding page element of the first page element, obtaining a target response time corresponding to the second page element, where the target response time is the time required to call an application programming interface corresponding to the second page element;

[0233] Determine whether the above-mentioned stay time is less than the above-mentioned target response time;

[0234] If so, the fourth preset score is determined as the request score corresponding to the request information.

[0235] In a possible implementation, when the number of the at least one request information is multiple, after obtaining the request score corresponding to each of the request information, the apparatus further includes:

[0236] A second determination module, configured to determine whether the at least one request information indicates a continuous operation behavior;

[0237] If not, the first determining unit includes:

[0238] The third determining subunit is used to accumulate the request score corresponding to each request information and the fifth preset score to obtain the user score corresponding to the above user account.

[0239] Please refer to the following Figure 7 , which is a schematic diagram of the structure of another information processing device provided by an exemplary embodiment of the present application. Figure 7 As shown, the information processing device 700 includes:

[0240] The second acquisition module 701 is used to acquire the user account corresponding to the terminal device and the user operation data corresponding to the terminal device when a call request for the application programming interface is detected;

[0241] A generating module 702, configured to generate a request message according to the user account and the user operation data, wherein the request message includes the user account and the user operation data;

[0242] The sending module 703 is used to send the above-mentioned request information to the server, so that the above-mentioned server obtains at least one request information received from the terminal device within a preset time period, and analyzes the above-mentioned at least one request information to generate a user score corresponding to the above-mentioned user account, and then determines whether the above-mentioned user score exceeds the preset score threshold; and when it is determined that the above-mentioned user score exceeds the above-mentioned preset score threshold, an alarm message for the above-mentioned user account is issued, and the above-mentioned alarm message is used to indicate abnormal access to the above-mentioned user account.

[0243] In one possible implementation, the user operation data includes a first position, a second position, and a dwell time corresponding to the second position, wherein the first position is the position of the mouse cursor of the terminal device at the moment of triggering the first page element corresponding to the request information, the second position is the previous position where the mouse cursor stayed before moving to the first position, and the dwell time corresponding to the second position is the length of time the mouse cursor stays at the second position.

[0244] The division of each module in the above-mentioned information processing device 600 and the information processing device 700 is only for illustration. In other embodiments, the information processing device can be divided into different modules as needed to complete all or part of the functions of the above-mentioned information processing device. The implementation of each module in the information processing device provided in the embodiments of this specification can be in the form of a computer program. The computer program can be run on a terminal or a server. The program modules constituted by the computer program can be stored in the memory of the terminal or the server. When the computer program is executed by the processor, all or part of the steps of the information processing method described in the embodiments of this specification are implemented.

[0245] See next Figure 8 , which is a schematic diagram of the structure of an electronic device provided by an exemplary embodiment of the present application. Figure 8 As shown, the electronic device 800 may include: a processor 810 and a memory 820 , and may also include a user interface 830 , a network interface 840 and a communication bus 850 .

[0246] Among them, the processor 810 may include one or more processing cores. The processor 810 uses various interfaces and lines to connect various parts of the entire electronic device 800, and executes various functions and processes data of the electronic device 800 by running or executing instructions, programs, code sets or instruction sets stored in the memory 820, and calling data stored in the memory 820. Optionally, the processor 810 can be implemented in at least one hardware form of digital signal processing (Digital Signal Processing, DSP), field programmable gate array (Field-Programmable Gate Array, FPGA), and programmable logic array (Programmable Logic Array, PLA). The processor 810 can integrate one or a combination of a central processing unit (Central Processing Unit, CPU), a graphics processing unit (Graphics Processing Unit, GPU) and a modem. Among them, the CPU mainly processes the operating system and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 810, but implemented separately through a chip.

[0247] Among them, the memory 820 may include a random access memory (Random Access Memory, RAM) and may also include a read-only memory (Read-Only Memory). Optionally, the memory 820 includes a non-transitory computer-readable storage medium. The memory 820 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 820 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a receiving function, a control function, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data involved in the above-mentioned various method embodiments, etc. The memory 820 may also be optionally at least one storage device located away from the aforementioned processor 810. As Figure 8 As shown, the memory 820 as a computer storage medium may include an operating system, a network communication module, a user interface module, and program instructions.

[0248] Optionally, the communication bus 850 is used to realize the connection and communication between these components. The user interface 830 may include a display screen (Display), a camera (Camera), and may also include a standard wired interface and a wireless interface; the network interface 840 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface).

[0249] In some embodiments, Figure 8 In the electronic device 800 shown, the processor 810 may be used to call the program instructions stored in the memory 820 and specifically perform the following operations:

[0250] Acquire at least one request information received from a terminal device within a preset time period, wherein the request information includes a user account corresponding to the terminal device and user operation data corresponding to the terminal device;

[0251] Analyze the at least one request information to generate a user score corresponding to the user account;

[0252] Determine whether the user score exceeds a preset score threshold;

[0253] When it is determined that the user score exceeds the preset score threshold, an alarm message for the user account is issued, and the alarm message is used to indicate abnormal access to the user account.

[0254] In a possible implementation, after determining that the user score exceeds the preset score threshold, the method further includes:

[0255] Calculate the number of times the user score is continuously determined to exceed the preset score threshold;

[0256] When the number of times exceeds a preset threshold, the user account is determined as an illegal account to restrict the user account from accessing the server.

[0257] In a possible implementation, analyzing the at least one request information to generate a user score corresponding to the user account includes:

[0258] Analyze each of the at least one request information to obtain a request score corresponding to each of the request information;

[0259] The user score corresponding to the user account is determined according to the request score corresponding to each of the request information.

[0260] In a possible implementation, analyzing each request information in the at least one request information to obtain a request score corresponding to each request information includes:

[0261] Decrypt the request information using the preset private key;

[0262] If the decryption is successful, the user operation data included in the decrypted request information is obtained, and it is determined whether the user operation data includes the first position, the second position and the dwell time corresponding to the second position, wherein the first position is the position of the mouse cursor of the terminal device at the moment of triggering the first page element corresponding to the request information, the second position is the previous position where the mouse cursor stayed before moving to the first position, and the dwell time corresponding to the second position is the length of time the mouse cursor stayed at the second position;

[0263] In a case where the user operation data includes the first position, the second position and the stay duration, the first position, the second position and the stay duration are analyzed to obtain a request score corresponding to the request information.

[0264] In a possible implementation, the analyzing each request information in the at least one request information to obtain a request score corresponding to each request information further includes:

[0265] If the decryption fails, the first preset score is determined as the request score corresponding to the request information; or,

[0266] In a case where the user operation data does not include the first position, the second position and the stay duration, the first preset score is determined as the request score corresponding to the request information, and the first preset score is greater than or equal to the preset score threshold.

[0267] In a possible implementation, analyzing the first location, the second location, and the stay duration to obtain a request score corresponding to the request information includes:

[0268] Determine a first page where the first page element at the first position is located, and a second page where the second page element at the second position is located;

[0269] Determine whether the first page and the second page are the same page;

[0270] In the case that the first page and the second page are not the same page, determining whether the second page is a previous page of the first page, wherein the previous page of the first page is a page that needs to be accessed before accessing the first page;

[0271] If not, the second preset score is determined as the request score corresponding to the above request information.

[0272] In a possible implementation, analyzing the first location, the second location, and the stay duration to obtain a request score corresponding to the request information includes:

[0273] In the case that the first page and the second page are the same page, determining whether the second page element is a preceding page element of the first page element, wherein the preceding page element of the first page element is a page element that needs to be triggered before triggering the first page element;

[0274] If not, the third preset score is determined as the request score corresponding to the above request information.

[0275] In a possible implementation, analyzing the first location, the second location, and the stay duration to obtain a request score corresponding to the request information includes:

[0276] In the case where the second page element is a preceding page element of the first page element, obtaining a target response time corresponding to the second page element, where the target response time is the time required to call an application programming interface corresponding to the second page element;

[0277] Determine whether the above-mentioned stay time is less than the above-mentioned target response time;

[0278] If so, the fourth preset score is determined as the request score corresponding to the request information.

[0279] In a possible implementation, when the number of the at least one request information is multiple, after obtaining the request score corresponding to each of the request information, the method further includes:

[0280] determining whether the at least one request information indicates a continuous operation behavior;

[0281] If not, then analyzing each of the at least one request information to obtain a request score corresponding to each of the request information includes:

[0282] The request score corresponding to each of the request information and the fifth preset score are accumulated to obtain the user score corresponding to the user account.

[0283] In other embodiments, Figure 8 In the electronic device 800 shown, the processor 810 may also be used to call program instructions stored in the memory 820 and specifically perform the following operations:

[0284] When a call request for an application programming interface is detected, a user account corresponding to the terminal device and user operation data corresponding to the terminal device are obtained;

[0285] Generate request information according to the user account and the user operation data, wherein the request information includes the user account and the user operation data;

[0286] The request information is sent to the server, so that the server obtains at least one request information received from the terminal device within a preset time period, and analyzes the at least one request information to generate a user score corresponding to the user account, and then determines whether the user score exceeds the preset score threshold; and when it is determined that the user score exceeds the preset score threshold, an alarm message for the user account is issued, and the alarm message is used to indicate abnormal access to the user account.

[0287] In a possible implementation, the user operation data includes a first position, a second position and a dwell time corresponding to the second position, wherein the first position is the position of the mouse cursor of the terminal device at the moment of triggering the first page element corresponding to the request information, the second position is the previous position where the mouse cursor stayed before moving to the first position, and the dwell time corresponding to the second position is the length of time the mouse cursor stays at the second position.

[0288] The embodiment of the present application also provides a computer-readable storage medium, which stores instructions, and when the instructions are executed on a computer or a processor, the computer or the processor executes one or more steps in the above embodiment. If the components of the above information processing device are implemented in the form of software functional units and sold or used as independent products, they can be stored in the above computer-readable storage medium.

[0289] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The above computer program product includes one or more computer instructions. When the above computer program instructions are loaded and executed on a computer, the above process or function according to the embodiment of the present application is generated in whole or in part. The above computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The above computer instructions may be stored in a computer-readable storage medium or transmitted through the above computer-readable storage medium. The above computer instructions may be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (Digital Subscriber Line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The above computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The above-mentioned available media can be magnetic media (for example, floppy disks, hard disks, tapes), optical media (for example, digital versatile discs (DVD)), or semiconductor media (for example, solid state drives (SSD)), etc.

[0290] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other media that can store program codes. In the absence of conflict, the technical features in this embodiment and the implementation scheme can be combined arbitrarily.

[0291] The above-mentioned embodiments are merely preferred embodiments of the present application and are not intended to limit the scope of the present application. Without departing from the design spirit of the present application, various modifications and improvements made to the technical solutions of the present application by ordinary technicians in this field should fall within the protection scope determined by the claims of the present application.

Claims

1. An information processing method, characterized in that: Applicable to servers, including: Acquire at least one request information received from a terminal device within a preset time period, wherein the request information includes a user account corresponding to the terminal device and user operation data corresponding to the terminal device; Analyze each request information in the at least one request information to obtain a request score corresponding to each request information; Determine a user score corresponding to the user account according to the request score corresponding to each request information; Determine whether the user score exceeds a preset score threshold; When it is determined that the user score exceeds the preset score threshold, issuing an alarm message for the user account, wherein the alarm message is used to indicate abnormal access to the user account; The analyzing each of the at least one request information to obtain a request score corresponding to each of the request information includes: Decrypting the request information using a preset private key; If the decryption is successful, the user operation data included in the decrypted request information is obtained, and it is determined whether the user operation data includes a first position, a second position, and a dwell time corresponding to the second position, wherein the first position is the position of the mouse cursor of the terminal device at the moment of triggering the first page element corresponding to the request information, the second position is the previous position where the mouse cursor stayed before moving to the first position, and the dwell time corresponding to the second position is the length of time the mouse cursor stayed at the second position; In a case where the user operation data includes the first position, the second position, and the stay duration, determining a first page where the first page element at the first position is located, and a second page where the second page element at the second position is located; Determining whether the first page and the second page are the same page; In the case that the first page and the second page are not the same page, determine whether the second page is a previous page of the first page; if not, determine a second preset score as the request score corresponding to the request information, wherein the previous page of the first page is a page that needs to be accessed before accessing the first page.

2. The method according to claim 1, characterized in that The analyzing each of the at least one request information to obtain a request score corresponding to each of the request information further includes: If the decryption fails, the first preset score is determined as the request score corresponding to the request information; or, When the user operation data does not include the first position, the second position, and the stay duration, the first preset score is determined as the request score corresponding to the request information, and the first preset score is greater than or equal to the preset score threshold.

3. The method according to claim 1, characterized in that The method further comprises: In the case where the second page element is a preceding page element of the first page element, obtaining a target response time corresponding to the second page element, the target response time being the time required to call an application programming interface corresponding to the second page element; Determining whether the dwell time is less than the target response time; If so, the fourth preset score is determined as the request score corresponding to the request information.

4. The method according to claim 1, characterized in that When the number of the at least one request information is multiple, after obtaining the request score corresponding to each request information, the method further includes: determining whether the at least one request information indicates a continuous operation behavior; If not, analyzing each of the at least one request information to obtain a request score corresponding to each of the request information includes: The request score corresponding to each request information and the fifth preset score are accumulated to obtain the user score corresponding to the user account.

5. An information processing method, characterized in that: Applied to terminal equipment, including: When a call request for an application programming interface is detected, obtaining a user account corresponding to the terminal device and user operation data corresponding to the terminal device; Generate request information according to the user account and the user operation data, wherein the request information includes the user account and the user operation data; sending the request information to a server so that the server obtains at least one request information received from a terminal device within a preset time period, and analyzes the at least one request information to generate a user score corresponding to the user account, and then determines whether the user score exceeds a preset score threshold; and when it is determined that the user score exceeds the preset score threshold, issuing an alarm message for the user account, the alarm message is used to indicate abnormal access to the user account; Wherein, the server is used for: Decrypting the request information using a preset private key; If the decryption is successful, the user operation data included in the decrypted request information is obtained, and it is determined whether the user operation data includes a first position, a second position, and a dwell time corresponding to the second position, wherein the first position is the position of the mouse cursor of the terminal device at the moment of triggering the first page element corresponding to the request information, the second position is the previous position where the mouse cursor stayed before moving to the first position, and the dwell time corresponding to the second position is the length of time the mouse cursor stayed at the second position; In a case where the user operation data includes the first position, the second position, and the stay duration, determining a first page where the first page element at the first position is located, and a second page where the second page element at the second position is located; Determining whether the first page and the second page are the same page; In the case that the first page and the second page are not the same page, determining whether the second page is a previous page of the first page, the previous page of the first page being a page that needs to be accessed before accessing the first page; If not, the second preset score is determined as the request score corresponding to the request information, and then the user score corresponding to the user account is determined according to the request score corresponding to the request information.

6. An information processing device, characterized in that: include: A first acquisition module, configured to acquire at least one request information received from a terminal device within a preset time period, wherein the request information includes a user account corresponding to the terminal device and user operation data corresponding to the terminal device; An analysis module, configured to analyze the at least one request information and generate a user score corresponding to the user account; A determination module, used to determine whether the user score exceeds a preset score threshold; An alarm module, configured to issue an alarm message for the user account when it is determined that the user score exceeds the preset score threshold, wherein the alarm message is used to indicate abnormal access to the user account; The analysis module comprises: A first analyzing unit, configured to analyze each request information in the at least one request information to obtain a request score corresponding to each request information; A first determining unit, configured to determine a user score corresponding to the user account according to a request score corresponding to each request information; The first analysis unit comprises: A decryption subunit, used to decrypt the request information using a preset private key; a first determining subunit, configured to, when decryption is successful, obtain the user operation data included in the decrypted request information, and determine whether the user operation data includes a first position, a second position, and a dwell time corresponding to the second position, wherein the first position is a position of a mouse cursor of the terminal device at the moment of triggering a first page element corresponding to the request information, the second position is a previous position where the mouse cursor stayed before moving to the first position, and the dwell time corresponding to the second position is a length of time the mouse cursor stayed at the second position; an analyzing subunit, configured to analyze the first position, the second position, and the stay duration in a case where the user operation data includes the first position, the second position, and the stay duration, to obtain a request score corresponding to the request information; The analysis subunit is specifically used to: determine a first page where the first page element at the first position is located, and a second page where the second page element at the second position is located; determine whether the first page and the second page are the same page; if the first page and the second page are not the same page, determine whether the second page is a previous page of the first page, wherein the previous page of the first page is a page that needs to be visited before accessing the first page; if not, determine a second preset score as the request score corresponding to the request information.

7. An information processing device, characterized in that: include: A second acquisition module is used to acquire a user account corresponding to the terminal device and user operation data corresponding to the terminal device when a call request for the application programming interface is detected; A generating module, configured to generate request information according to the user account and the user operation data, wherein the request information includes the user account and the user operation data; a sending module, configured to send the request information to a server, so that the server obtains at least one request information received from a terminal device within a preset time period, analyzes the at least one request information, generates a user score corresponding to the user account, and then determines whether the user score exceeds a preset score threshold; and when it is determined that the user score exceeds the preset score threshold, issues an alarm message for the user account, wherein the alarm message is used to indicate abnormal access to the user account; Wherein, the server is used for: Decrypting the request information using a preset private key; If the decryption is successful, the user operation data included in the decrypted request information is obtained, and it is determined whether the user operation data includes a first position, a second position, and a dwell time corresponding to the second position, wherein the first position is the position of the mouse cursor of the terminal device at the moment of triggering the first page element corresponding to the request information, the second position is the previous position where the mouse cursor stayed before moving to the first position, and the dwell time corresponding to the second position is the length of time the mouse cursor stayed at the second position; In a case where the user operation data includes the first position, the second position, and the stay duration, determining a first page where the first page element at the first position is located, and a second page where the second page element at the second position is located; Determining whether the first page and the second page are the same page; In the case that the first page and the second page are not the same page, determining whether the second page is a previous page of the first page, the previous page of the first page being a page that needs to be accessed before accessing the first page; If not, the second preset score is determined as the request score corresponding to the request information, and then the user score corresponding to the user account is determined according to the request score corresponding to the request information.

Images