Internet application security protection method and system based on behavior analysis

Abstract

The present application provides a method and system for Internet application security protection based on behavioral analysis. Among them, user interaction behaviors in Internet applications are monitored, and the user interaction behaviors include login attempts, access frequency, operation modes, and session durations; a user behavior baseline is constructed based on the user interaction behaviors, and the user behavior baseline is used to reflect the behavior patterns of normal users; the user interaction behaviors are compared with the user behavior baseline to identify abnormal behavior patterns; when the abnormal behavior patterns are detected, security policies are triggered to protect the Internet applications from potential threats, and the security policies include increasing authentication strength, restricting access rights, or implementing account locks. The technical solution provided by the present application effectively improves the security of Internet applications and provides users with a safer and more reliable usage environment.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of security protection technology, and in particular, to a method and system for Internet application security protection based on behavior analysis. Background Art

[0002] With the development of Internet technology and its wide application in various fields, more and more services and businesses rely on online platforms. In this context, protecting user data security and personal privacy has become a vital task. Especially for applications involving sensitive information processing, such as online payment, financial services, medical health, etc., the security of user interaction behavior is particularly important. Therefore, it is necessary to develop a security protection technology that can effectively monitor user interaction behavior and detect abnormal behavior in a timely manner to protect Internet applications from potential threats.

[0003] In the current Internet application security protection system, many platforms have adopted a variety of security measures to monitor user interaction behaviors. These measures include but are not limited to rule-based security detection methods, simple statistical analysis, and behavioral pattern matching technologies. For example, by setting a fixed access frequency cap to limit frequent access in a short period of time, or by recording the number of login attempts to identify possible brute force attacks.

[0004] Although existing security protection solutions can provide basic security protection to a certain extent, they still have some shortcomings. First, traditional security measures are usually based on static rules and lack a deep understanding of user behavior patterns and the ability to dynamically adjust, which leads to high false alarm and missed alarm rates. Secondly, most of the existing security policies are fixed and difficult to make real-time adjustments according to the ever-changing network security environment, which in turn affects the overall protection effect of the system. Finally, when faced with new attack methods, existing solutions often appear powerless because they are not flexible enough to adapt to new threat situations. Therefore, there is an urgent need for a technical solution that can automatically monitor user interaction behaviors and dynamically adjust security policies based on real-time data analysis. Summary of the invention

[0005] The embodiments of the present application provide a method and system for Internet application security protection based on behavior analysis, which are used to solve the problem that the prior art lacks flexibility and is difficult to adapt to changing security needs.

[0006] In a first aspect, an embodiment of the present application provides an Internet application security protection method based on behavior analysis, including:

[0007] Monitor user interaction behaviors in Internet applications, including login attempts, access frequency, operation patterns, and session duration;

[0008] Building a user behavior baseline according to the user interaction behavior, wherein the user behavior baseline is used to reflect the behavior pattern of a normal user;

[0009] comparing the user interaction behavior with the user behavior baseline to identify abnormal behavior patterns;

[0010] When the abnormal behavior pattern is detected, a security policy is triggered to protect the Internet application from potential threats, wherein the security policy includes increasing authentication strength, restricting access rights, or implementing account locking.

[0011] Optionally, the monitoring of user interaction behaviors in Internet applications, wherein the user interaction behaviors include login attempt behaviors, access frequency, operation modes, and session duration, includes:

[0012] The logging system deployed on the Internet application server collects and records the user's login attempt behavior, including login timestamp, login device information, login geographic location information, and status information of whether the login is successful;

[0013] Using traffic monitoring tools to capture user access requests to the Internet application in real time, and counting the number of user accesses per unit time to form a quantitative indicator of access frequency;

[0014] Capturing the user's operation patterns within the Internet application through a behavioral analysis engine, including click paths, dwell time, page switching sequence, and function usage;

[0015] Monitor the session connection status between the user and the Internet application, record the start and end time of each session, and calculate the session duration of each session.

[0016] Optionally, constructing a user behavior baseline according to the user interaction behavior, wherein the user behavior baseline is used to reflect a behavior pattern of a normal user, includes:

[0017] Classifying the collected user interaction behavior data to identify major behavior pattern clusters;

[0018] The center point or average value of each behavior pattern cluster is used as a reference point of the user behavior baseline, and the user behavior baseline is used to reflect the behavior pattern of a normal user.

[0019] Optionally, comparing the user interaction behavior with the user behavior baseline to identify abnormal behavior patterns includes:

[0020] Calculating a behavior deviation index between the user interaction behavior and the user behavior baseline;

[0021] Determining whether the user interaction behavior is a normal user behavior pattern based on the behavior deviation index;

[0022] The determining whether the user interaction behavior is a normal user behavior pattern based on the behavior deviation index includes:

[0023] An abnormal threshold corresponding to the abnormal behavior pattern is set, and if the behavior deviation index is greater than the abnormal threshold, the user interaction behavior is determined to be an abnormal behavior pattern.

[0024] Optionally, when the abnormal behavior pattern is detected, a security policy is triggered to protect the Internet application from potential threats, the security policy includes increasing authentication strength, restricting access rights, or implementing account locking, including:

[0025] When the abnormal behavior pattern is detected, a security response mechanism is triggered to activate a preset security policy, and the security policy can perform a graded response according to the severity of the abnormal behavior pattern;

[0026] For mild abnormal behavior, increase the authentication strength, which at least includes requiring the user to provide additional identity verification information to confirm the authenticity of the user's identity;

[0027] For moderately abnormal behaviors, restrict access rights, which at least includes temporarily reducing the user's access level to sensitive functions or important resources;

[0028] For severe abnormal behavior, account locking is implemented, and the implementation of account locking at least includes temporarily freezing the user account.

[0029] Optionally, calculating a behavior deviation index between the user interaction behavior and the user behavior baseline includes:

[0030] Determine a login behavior index of a login attempt behavior in the user interaction behavior;

[0031] Determine an access behavior index of access frequency in the user interaction behavior;

[0032] Determine an operation behavior index of an operation mode in the user interaction behavior;

[0033] Determine a session behavior index of a session duration in the user interaction behavior;

[0034] Calculating a behavior deviation index according to the login behavior index, the access behavior index, the operation behavior index, the session behavior index and the user behavior baseline;

[0035] The login behavior index is calculated by the following formula:

[0036] ;

[0037] in, Indicates at time The login behavior index corresponding to the login attempt behavior, and are the functions of the current and baseline login attempts over time, is the standard deviation over time, is a constant that controls the weight of speed differences; Indicates the rate of change of the current number of login attempts over time; Indicates the rate of change of the number of login attempts in the user behavior baseline over time;

[0038] The access behavior index is calculated by the following formula:

[0039] ;

[0040] in, Indicates at time The access behavior index corresponding to the access frequency, Indicates the current time User access frequency; Indicates at the same time , the expected value of access frequency in the user behavior baseline; Indicates time The standard deviation of the access frequency at time Represents a very small positive value that prevents division by zero errors. represents a constant that controls the relative bias weight; Indicates the relative deviation of access frequency from the user behavior baseline;

[0041] The operation behavior index is calculated by the following formula:

[0042] ;

[0043] in, Indicates at time The operation behavior index corresponding to the operation mode; Indicates the current time User operation mode The value of a feature; Indicates at the same time In the user behavior baseline, the operation mode The expected value of a feature; Indicates time Operation mode The standard deviation of the feature; Indicates the characteristics of a given operating mode The weight of represents a constant that controls the sum of squares of total deviations;

[0044] The session behavior index is calculated by the following formula:

[0045] ;

[0046] in, Indicates at time The session behavior index corresponding to the session duration; Indicates the current time The user's session duration; Indicates at the same time , the expected value of session duration in the user behavior baseline; Indicates time The standard deviation of session duration; A constant that controls the square of the relative deviation; Indicates the relative deviation of session duration from the user behavior baseline;

[0047] Wherein, the behavior deviation index is calculated by the following formula:

[0048] Calculate the comprehensive abnormality index :

[0049] ;

[0050] in, Indicates at time Behavioral Deviation Index; represents the weight coefficient assigned to each behavioral index; represents the constant that controls the interaction effect between different behaviors; Indicates at time Login behavior index corresponding to login attempt behavior; Indicates at time The access behavior index corresponding to the access frequency; Indicates at time The operation behavior index corresponding to the operation mode; Indicates at time The session behavior index corresponding to the session duration.

[0051] Optionally, when the abnormal behavior pattern is detected, triggering a security policy to protect the Internet application from potential threats includes:

[0052] Calculating the Security Response Level :

[0053] ;

[0054] in, Indicates at time The security response level; and is the threshold that varies over time; Indicates at time Behavioral deviation index.

[0055] Relationship between response level and security policy:

[0056] ;

[0057] Among them, Security Policy Indicates at time Security policies that are enforced.

[0058] In a second aspect, the embodiment of the present application provides an Internet application security protection system based on behavior analysis, including:

[0059] A monitoring module, used to monitor user interaction behaviors in Internet applications, wherein the user interaction behaviors include login attempts, access frequency, operation mode, and session duration;

[0060] A construction module, used to construct a user behavior baseline according to the user interaction behavior, wherein the user behavior baseline is used to reflect the behavior pattern of a normal user;

[0061] A comparison module, configured to compare the user interaction behavior with the user behavior baseline to identify abnormal behavior patterns;

[0062] The detection module is used to trigger a security policy to protect the Internet application from potential threats when the abnormal behavior pattern is detected. The security policy includes increasing authentication strength, restricting access rights, or implementing account locking.

[0063] In a third aspect, an embodiment of the present application provides a computing device, comprising a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement an Internet application security protection method based on behavioral analysis as described in any one of the first aspects.

[0064] In a fourth aspect, an embodiment of the present application provides a computer storage medium storing a computer program. When the computer program is executed by a computer, it implements an Internet application security protection method based on behavioral analysis as described in any one of the first aspects.

[0065] In the embodiment of the present application, user interaction behaviors in Internet applications are monitored, and the user interaction behaviors include login attempts, access frequency, operation modes, and session duration; a user behavior baseline is constructed based on the user interaction behaviors, and the user behavior baseline is used to reflect the behavior patterns of normal users; the user interaction behaviors are compared with the user behavior baseline to identify abnormal behavior patterns; when the abnormal behavior patterns are detected, a security policy is triggered to protect the Internet application from potential threats, and the security policy includes increasing authentication strength, restricting access rights, or implementing account lockout. The technical solution provided by the present application effectively improves the security of Internet applications and provides users with a safer and more reliable use environment.

[0066] These and other aspects of the present application will become more clearly understood in the description of the following embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0068] Figure 1 A flowchart of an Internet application security protection method based on behavior analysis provided in an embodiment of the present application;

[0069] Figure 2 A schematic diagram of the structure of an Internet application security protection system based on behavior analysis provided in an embodiment of the present application;

[0070] Figure 3 A schematic diagram of the structure of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0071] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0072] In some of the processes described in the specification and claims of this application and the above-mentioned figures, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this article or executed in parallel. The serial numbers of the operations, such as 101, 102, etc., are only used to distinguish between different operations, and the serial numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this article are used to distinguish different messages, devices, modules, etc., do not represent the order of precedence, and do not limit the "first" and "second" to be different types.

[0073] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0074] Figure 1 A flowchart of an Internet application security protection method based on behavior analysis is provided for an embodiment of the present application, such as Figure 1 As shown, the method includes:

[0075] 101. Monitor user interaction behaviors in Internet applications, including login attempts, access frequency, operation mode, and session duration;

[0076] Optionally, the monitoring of user interaction behavior in the Internet application in step 101, wherein the user interaction behavior includes login attempt behavior, access frequency, operation mode and session duration, includes: collecting and recording the user's login attempt behavior through a log recording system deployed on the Internet application server, wherein the login attempt behavior includes login timestamp, login device information, login geographic location information and status information of whether the login is successful; using a traffic monitoring tool to capture the user's access request to the Internet application in real time, and counting the number of user visits per unit time to form a quantitative indicator of access frequency; capturing the user's operation mode in the Internet application through a behavior analysis engine, including click path, dwell time, page switching sequence and function usage; monitoring the session connection status between the user and the Internet application, recording the start and end time of each session, and calculating the session duration of each session.

[0077] In this step, the concepts involved include user interaction behavior, login attempt behavior, access frequency, operation mode, and session duration. User interaction behavior refers to various interactive activities between users and Internet applications, including but not limited to login attempts, page browsing, form submission, etc. Login attempt behavior specifically refers to the behavior of users trying to enter the Internet application system, including login timestamp, login device information (such as IP address, browser type), login geographic location information (such as geographic location obtained through IP address resolution), and status information on whether the login is successful. Access frequency refers to the number of times a user accesses an Internet application within a certain period of time, which reflects the user's activity. Operation mode refers to the specific behavior pattern of users when using Internet applications, including click paths, dwell time, page switching order, and function usage. Session duration refers to the length of time a single session connection between a user and an Internet application lasts.

[0078] In the embodiment of the present application, a specific example will be used to illustrate how to implement the above steps:

[0079] Login attempt monitoring:

[0080] The logging system deployed on the Internet application server collects and records the user's login attempts. For example, every time a user attempts to log in, the system will record the following information:

[0081] Login timestamp: For example, the user attempted to log in at 16:14:00 on 14 September 2024.

[0082] Login device information: The device IP address is 192.168.1.100, and the browser used is MozillaFirefox.

[0083] Login geographic location information: Through IP address resolution, it is known that the user is located at Zhongguancun Street, Haidian District, Beijing.

[0084] Status information of whether the login is successful: This login is successful.

[0085] Statistics of access frequency:

[0086] Use traffic monitoring tools to capture user access requests to Internet applications in real time and count the number of user visits per unit time. For example, collect data every one minute and count the number of user visits within a certain minute. Assuming that from 16:14:00 to 16:15:00, the user visited the website 5 times, then the access frequency within that minute is 5 times / minute.

[0087] Capture of operation mode:

[0088] The behavior analysis engine is used to capture the user's operation mode in the Internet application. For example, when a user visits a website, the system records the user's click path (such as homepage > product > detail page), the time spent on each page (for example, 30 seconds on the homepage and 1 minute on the product page), the page switching sequence (from the homepage to the product page and then to the detail page), and the use of functions (such as whether the shopping cart has been viewed, whether a search has been conducted, etc.).

[0089] Recording of session duration:

[0090] Monitor the session connection status between users and Internet applications, record the start and end time of each session, and calculate the session duration of each session. For example, if a user starts using an application at 16:14:00 and ends at 16:20:00, the duration of this session is 6 minutes.

[0091] Assume that user Zhang San performs a series of operations on an e-commerce website. You can monitor his behavior by following the steps below:

[0092] Login attempt behavior monitoring: Zhang San tried to log in to the website using the Firefox browser through his home network (IP address: 192.168.1.100) at 16:14:00 and successfully logged in. The system recorded the login timestamp, device information, geographic location, and login status information.

[0093] Access frequency statistics: From 16:14:00 to 16:15:00, Zhang San visited 5 different pages in total, and the system recorded the access frequency during this period.

[0094] Operation mode capture: The system records Zhang San's operation path on the website: jumping from the homepage to the product list page, then selecting a product to enter the detail page, staying for about 1 minute, and then returning to the product list page to continue browsing other products. The system captures these click paths, stay time, and page switching order.

[0095] Session duration record: Zhang San's session started at 16:14:00 and ended at 16:20:00, during which he completed multiple page views and product inspections. The system recorded the duration of this session as 6 minutes.

[0096] Through such a monitoring mechanism, a baseline of Zhang San's behavior can be constructed and compared with the behavior patterns of normal users to identify any potential abnormal behavior patterns. For example, if Zhang San's login attempts become frequent in a short period of time, or his access frequency suddenly surges, the system may regard it as abnormal behavior and trigger corresponding security policies, such as increasing authentication strength, restricting access rights, or implementing account lockouts.

[0097] 102. Constructing a user behavior baseline according to the user interaction behavior, wherein the user behavior baseline is used to reflect the behavior pattern of a normal user;

[0098] Optionally, the step 102 of constructing a user behavior baseline based on the user interaction behavior, wherein the user behavior baseline is used to reflect the behavior pattern of a normal user, includes: classifying the collected user interaction behavior data to identify major behavior pattern clusters; and taking the center point or average value of each behavior pattern cluster as a reference point for the user behavior baseline, wherein the user behavior baseline is used to reflect the behavior pattern of a normal user.

[0099] In this step, the concepts involved include the classification of user interaction behavior data, the identification of behavior pattern clusters, and the construction of user behavior baselines. User interaction behavior data covers various online activities of users, such as login attempts, access frequency, operation patterns, and session duration. Classifying this data means clustering similar behavior patterns together to form several behavior pattern clusters. Behavior pattern clusters are obtained by analyzing user interaction behavior data to find a set of behavior patterns with common characteristics. The user behavior baseline is calculated by calculating the center point or average value of these behavior pattern clusters to reflect the behavior pattern of normal users, so as to facilitate subsequent abnormal behavior detection.

[0100] In the embodiment of the present application, a specific example will be used to illustrate how to implement the above steps:

[0101] Classification of user interaction behavior data:

[0102] First, the collected user interaction behavior data needs to be classified to identify the main behavior pattern clusters. For example, a clustering algorithm (such as the K-Means clustering algorithm) can be used to process the user's behavior data and group users with similar behavior characteristics into the same cluster.

[0103] Build a user behavior baseline:

[0104] Next, the center point or average value of each behavior pattern cluster is used as the reference point of the user behavior baseline. The center point or average value here refers to the typical form of user interaction behavior within each behavior pattern cluster. By calculating these typical forms, a baseline that can represent the normal user behavior pattern can be obtained.

[0105] Suppose there is an e-commerce website, and has collected user interaction behavior data over a period of time. Now we want to build a user behavior baseline based on this data.

[0106] Data preparation: Have data on users' login attempts, access frequency, operation patterns, and session duration in the past month.

[0107] Data classification: The K-Means clustering algorithm was used to process the above data, and K=5 was set (here K represents the hope to identify five main behavior pattern clusters). Through clustering, five user behavior pattern clusters were obtained.

[0108] Build a behavioral baseline: For each behavioral pattern cluster, calculate the average or center point of its login attempt behavior, access frequency, operation mode, and session duration. For example, for the first cluster, the following data is obtained:

[0109] Login attempt behavior: An average of 2 login attempts per hour;

[0110] Visit frequency: The website is visited 10 times per hour on average;

[0111] Operation mode: The average stay time per visit is 3 minutes;

[0112] Session Duration: The average session duration per hour is 15 minutes.

[0113] Determine the behavior baseline: Take the average or center point of these five clusters as the reference point for the user behavior baseline, for example:

[0114] Login attempt behavior: 2.5 login attempts per hour on average;

[0115] Frequency of visits: The average number of visits to the website is 12 per hour;

[0116] Operation mode: The average stay time per visit is 3.5 minutes;

[0117] Session Duration: The average session duration per hour is 16 minutes.

[0118] In this way, a user behavior baseline is obtained, which can be used to reflect the behavior patterns of normal users and will play an important role in subsequent abnormal behavior detection.

[0119] Through the above embodiments, we can see how to construct a user behavior baseline by classifying user interaction behavior data and identifying behavior pattern clusters. This will help to more accurately identify abnormal behavior patterns and take corresponding security measures.

[0120] 103. Compare the user interaction behavior with the user behavior baseline to identify abnormal behavior patterns;

[0121] Optionally, the comparing the user interaction behavior with the user behavior baseline to identify abnormal behavior patterns in step 103 includes: calculating a behavior deviation index between the user interaction behavior and the user behavior baseline; and judging whether the user interaction behavior is a normal user behavior pattern based on the behavior deviation index;

[0122] The determining whether the user interaction behavior is a normal user behavior pattern based on the behavior deviation index includes: setting an abnormal threshold corresponding to the abnormal behavior pattern, and if the behavior deviation index is greater than the abnormal threshold, determining that the user interaction behavior is an abnormal behavior pattern.

[0123] Optionally, the calculating of the behavior deviation index between the user interaction behavior and the user behavior baseline in step 103 includes:

[0124] Determine a login behavior index of a login attempt behavior in the user interaction behavior;

[0125] Determine an access behavior index of access frequency in the user interaction behavior;

[0126] Determine an operation behavior index of an operation mode in the user interaction behavior;

[0127] Determine a session behavior index of a session duration in the user interaction behavior;

[0128] Calculating a behavior deviation index according to the login behavior index, the access behavior index, the operation behavior index, the session behavior index and the user behavior baseline;

[0129] The login behavior index is calculated by the following formula:

[0130] ;

[0131] in, Indicates at time The login behavior index corresponding to the login attempt behavior, and are the functions of the current and baseline login attempts over time, is the standard deviation over time, is a constant that controls the weight of speed differences; Indicates the rate of change of the current number of login attempts over time; Indicates the rate of change of the number of login attempts in the user behavior baseline over time;

[0132] The access behavior index is calculated by the following formula:

[0133] ;

[0134] in, Indicates at time The access behavior index corresponding to the access frequency, Indicates the current time User access frequency; Indicates at the same time , the expected value of access frequency in the user behavior baseline; Indicates time The standard deviation of the access frequency at time Represents a very small positive value that prevents division by zero errors. represents a constant that controls the relative bias weight; Indicates the relative deviation of access frequency from the user behavior baseline;

[0135] The operation behavior index is calculated by the following formula:

[0136] ;

[0137] in, Indicates at time The operation behavior index corresponding to the operation mode; Indicates the current time User operation mode The value of a feature; Indicates at the same time In the user behavior baseline, the operation mode The expected value of a feature; Indicates time Operation mode The standard deviation of the feature; Indicates the characteristics of a given operating mode The weight of represents a constant that controls the sum of squares of total deviations;

[0138] The session behavior index is calculated by the following formula:

[0139] ;

[0140] in, Indicates at time The session behavior index corresponding to the session duration; Indicates the current time The user's session duration; Indicates at the same time , the expected value of session duration in the user behavior baseline; Indicates time The standard deviation of session duration; A constant that controls the square of the relative deviation; Indicates the relative deviation of session duration from the user behavior baseline;

[0141] Wherein, the behavior deviation index is calculated by the following formula:

[0142] Calculate the comprehensive abnormality index :

[0143] ;

[0144] in, Indicates at time Behavioral Deviation Index; represents the weight coefficient assigned to each behavioral index; represents the constant that controls the interaction effect between different behaviors; Indicates at time Login behavior index corresponding to login attempt behavior; Indicates at time The access behavior index corresponding to the access frequency; Indicates at time The operation behavior index corresponding to the operation mode; Indicates at time The session behavior index corresponding to the session duration.

[0145] In this step, the concepts involved include behavior deviation index, login behavior index, access behavior index, operation behavior index, and session behavior index. These indexes are used to measure the degree of deviation between user interaction behavior and user behavior baseline, so as to determine whether user behavior deviates from the normal mode. Specifically:

[0146] Login Behavior Index (LBI): Measures the deviation of login attempt behavior from a baseline.

[0147] Frequency Behavior Index (FFI): Measures the deviation of access frequency from a baseline.

[0148] Operation Behavior Index (OBI): Measures the deviation of the operating mode from the baseline.

[0149] Session Behavior Index (SBI): Measures the deviation of session duration from a baseline.

[0150] Behavior Deviation Index (BDI): A combination of the above behavior indices to ultimately determine whether user behavior is abnormal.

[0151] In the embodiment of the present application, a specific example will be used to illustrate how to implement the above steps:

[0152] Calculate the behavior deviation index between the user interaction behavior and the user behavior baseline:

[0153] First, it is necessary to calculate the login behavior index, access behavior index, operation behavior index and session behavior index, and calculate the comprehensive behavior deviation index based on these indices.

[0154] Set the abnormal threshold corresponding to the abnormal behavior pattern:

[0155] An abnormal threshold is set. If the behavior deviation index exceeds this threshold, the user's interactive behavior pattern is considered abnormal.

[0156] Suppose there is an online shopping platform, and a user behavior baseline has been built based on previous data. Now we need to monitor a user's behavior in real time and determine whether it is an abnormal behavior pattern.

[0157] Login behavior index calculation:

[0158] Assume that the current number of login attempts changes over time The baseline number of login attempts increases by 1 per minute, and the function of the change in time The increase is 0.5 beats per minute. Standard deviation 0.2 times / minute, is 0.1. Then:

[0159] ;

[0160] Access behavior index calculation:

[0161] Assuming the current access frequency The baseline access frequency is 10 times per minute. The standard deviation is 8 visits per minute. 1 time / minute, 0.5, a very small positive value Set to 0.0001. Then:

[0162] ;

[0163] Operational behavior index calculation:

[0164] Assume that a certain characteristic value of the current operating mode is 100, while the same characteristic value of the baseline operation mode is 80. Standard deviation for Set to 1, is 0.2. Then:

[0165] ;

[0166] Conversational Behavior Index calculation:

[0167] Assuming the current session duration The baseline session duration was 10 minutes. 8 minutes. Standard deviation For 1 minute, is 0.5. Then:

[0168] ;

[0169] Calculation of comprehensive behavioral deviation index: Combining the above indexes and assuming ,but:

[0170]

[0171] Determine whether it is abnormal: Assume that the abnormal threshold is set to 50. is greater than 50, so the user interaction behavior is determined to be an abnormal behavior pattern.

[0172] Through the above embodiments, we can see how to calculate the login behavior index, access behavior index, operation behavior index and session behavior index, and finally calculate the behavior deviation index to determine whether the user interaction behavior deviates from the normal user behavior pattern. This helps to timely discover and deal with potential security threats.

[0173] 104. When the abnormal behavior pattern is detected, a security policy is triggered to protect the Internet application from potential threats, wherein the security policy includes increasing authentication strength, restricting access rights, or implementing account locking.

[0174] Optionally, in step 104, when the abnormal behavior pattern is detected, triggering a security policy to protect the Internet application from potential threats, the security policy including increasing authentication strength, restricting access rights, or implementing account lockout, includes: when the abnormal behavior pattern is detected, triggering a security response mechanism to activate a preset security policy;

[0175] Among them, the security policy can respond in a graded manner according to the severity of the abnormal behavior pattern; for mild abnormal behavior, the authentication strength is increased, and the increased authentication strength at least includes requiring the user to provide additional identity authentication information to confirm the authenticity of the user's identity; for moderate abnormal behavior, access rights are restricted, and the restricted access rights at least include temporarily reducing the user's access level to sensitive functions or important resources; for severe abnormal behavior, account locking is implemented, and the implementation of account locking at least includes temporarily freezing the user account.

[0176] In this step, the concepts involved include security response mechanism, graded response of security policy, increasing authentication strength, restricting access rights, and implementing account lockout. Security response mechanism refers to a series of protection measures that can be automatically triggered when the system detects abnormal behavior patterns. Graded response of security policy refers to taking different levels of security measures according to the severity of abnormal behavior patterns. Increasing authentication strength means confirming the authenticity of the user's identity by adding additional identity verification steps, such as requiring a verification code or biometric verification. Restricting access rights means temporarily reducing the user's access level to sensitive functions or important resources to reduce the impact of potential threats. Implementing account lockout means temporarily freezing the user's account to prevent further abnormal activities.

[0177] In the embodiment of the present application, a specific example will be used to illustrate how to implement the above steps:

[0178] Triggering the security response mechanism:

[0179] When an abnormal behavior pattern is detected, the system will trigger the security response mechanism and activate the preset security policy. The security policy will respond in a graded manner based on the severity of the abnormal behavior pattern.

[0180] Hierarchical response of security policy:

[0181] Mild abnormal behavior: Increase authentication strength.

[0182] Moderately abnormal behavior: restricted access.

[0183] Severe abnormal behavior: Account lockout.

[0184] Assume that the above security protection method is implemented in an online banking system. Now, the system detects that a user's login behavior is abnormal.

[0185] Mildly abnormal behavior - increase authentication strength:

[0186] The system detects that the user has frequent login attempts in a short period of time, but there are no other significant abnormal behaviors. At this time, the system decides to increase the authentication strength and requires the user to enter a mobile phone verification code in addition to the password to complete the login. For example:

[0187] When the user tries to log in, the system prompts: "To verify your identity, please enter your mobile phone number."

[0188] After the user enters the mobile phone number, the system sends a verification code to the mobile phone number.

[0189] After the user enters the verification code, the system verifies that the verification code is correct and allows the user to log in.

[0190] Moderately Anomalous Behavior - Limited Access:

[0191] If the system further detects that the user frequently attempts to access sensitive functions, such as the transfer function, within a short period of time, but has no other extremely abnormal behavior, the system will restrict the user's access to sensitive functions. For example:

[0192] The system prompts the user: "Because abnormal behavior has been detected in your account, you can only view the account balance at present, and cannot perform transfer operations."

[0193] When a user tries to transfer money, the system displays: "Your account is temporarily unavailable for this operation."

[0194] Severe abnormal behavior - account lockout:

[0195] If the system detects that the user's behavior pattern deviates significantly from the normal behavior baseline, such as multiple illegal login attempts in a short period of time and attempts to access multiple sensitive functions, the system will implement account lockout. For example:

[0196] The system prompts the user: "Due to the detection of serious abnormal behavior in your account, your account has been temporarily frozen. Please contact customer service to unfreeze your account."

[0197] Users cannot log into their accounts or perform any operations.

[0198] Assume that in a specific scenario, user Zhang San fails to log into his bank account more than 5 times within 1 hour, and tries to access the transfer function several times but fails to log in successfully. Based on the behavior baseline analysis, the system considers this to be a mild abnormal behavior and takes measures to increase the authentication strength.

[0199] Mildly abnormal behavior - increase authentication strength:

[0200] The system records Zhang San's login attempts and sends a verification code to Zhang San's registered mobile phone.

[0201] Zhang San successfully logs in after entering the verification code, and the system restores normal operating permissions.

[0202] If Zhang San continues to try to log in illegally and attempts multiple illegal operations in a short period of time, the system further detects moderate abnormal behavior.

[0203] The system restricts Zhang San's access rights to only allow him to view the account balance.

[0204] When Zhang San tried to transfer money, the system rejected it and prompted: "Your account is temporarily unable to transfer money."

[0205] If Zhang San's behavior becomes more serious, such as trying to log in using multiple different IP addresses and attempting to illegally operate sensitive functions, the system will determine it as severe abnormal behavior.

[0206] The system automatically locks Zhang San's account and sends an email and text message to notify Zhang San to contact customer service.

[0207] Zhang San's account is temporarily unavailable until its identity is verified by customer service.

[0208] Through the above embodiments, we can see how to effectively protect Internet applications from potential threats through the hierarchical response mechanism of security policies. This method can take different security measures according to the severity of abnormal behavior patterns, thereby improving the overall security of the system.

[0209] Optionally, in step 104, when the abnormal behavior pattern is detected, triggering a security policy to protect the Internet application from potential threats includes:

[0210] Calculating the Security Response Level :

[0211] ;

[0212] in, Indicates at time The security response level; and is the threshold that varies over time; Indicates at time Behavioral Deviation Index;

[0213] Relationship between response level and security policy:

[0214] ;

[0215] Among them, Security Policy Indicates at time Security policies that are enforced.

[0216] In this step, the concepts involved include security response level, time-varying threshold, behavior deviation index, and the relationship between response level and security policy. Security response level refers to the response level determined according to the severity of the abnormal behavior pattern detected. Time-varying threshold refers to the critical value used to distinguish different security response levels, and these thresholds can be dynamically adjusted according to time changes. Behavior deviation index refers to the index calculated by monitoring the deviation between user interaction behavior and user behavior baseline, which is used to determine whether user behavior is abnormal. The relationship between response level and security policy refers to deciding which security policy to implement based on the security response level.

[0217] In the embodiment of the present application, a specific example will be used to illustrate how to implement the above steps:

[0218] Calculate the security response level:

[0219] When an abnormal behavior pattern is detected, the security response level is calculated based on the behavior deviation index. The security response level is divided according to different intervals of the behavior deviation index.

[0220] Relationship between response level and security policy:

[0221] The security policy to be executed is determined based on the calculated security response level.

[0222] Assume that there is an online payment platform and a user behavior baseline has been built based on previous data. Now we need to monitor a user's behavior in real time and determine the corresponding security strategy based on their behavior deviation index.

[0223] Calculating the Security Response Level Three security response levels are set:

[0224] Indicates mildly abnormal behavior;

[0225] Indicates moderately abnormal behavior;

[0226] Indicates severe abnormal behavior;

[0227] And set two thresholds that change over time and , used to distinguish different security response levels.

[0228] Assume the current time is , Behavioral Deviation Index is 55. Set the threshold and According to the formula:

[0229] ;

[0230] Substitute specific values:

[0231] ;

[0232] because ,so .

[0233] The relationship between response level and security policy is based on The value of determines the security policy to be executed:

[0234] ;

[0235] because , so the security policy implemented is "restrict access rights".

[0236] Through the above embodiments, we can see how to determine which security policy to execute by calculating the security response level, thereby effectively protecting Internet applications from potential threats. This method can dynamically adjust the security policy according to the size of the behavior deviation index, thereby improving the security and flexibility of the system.

[0237] Figure 2 A schematic diagram of the structure of an Internet application security protection system based on behavior analysis is provided for the embodiment of the present application. Figure 2 As shown, the system includes:

[0238] A monitoring module 21, used to monitor user interaction behaviors in Internet applications, wherein the user interaction behaviors include login attempts, access frequency, operation mode, and session duration;

[0239] A construction module 22, configured to construct a user behavior baseline according to the user interaction behavior, wherein the user behavior baseline is used to reflect the behavior pattern of a normal user;

[0240] A comparison module 23, used to compare the user interaction behavior with the user behavior baseline to identify abnormal behavior patterns;

[0241] The detection module 24 is used to trigger a security policy to protect the Internet application from potential threats when the abnormal behavior pattern is detected. The security policy includes increasing authentication strength, restricting access rights, or implementing account locking.

[0242] Figure 2 The Internet application security protection system based on behavior analysis can perform Figure 1The implementation principle and technical effect of the Internet application security protection method based on behavior analysis described in the illustrated embodiment will not be described in detail. The specific way in which each module and unit performs operations in the Internet application security protection system based on behavior analysis in the above embodiment has been described in detail in the embodiment of the method, and will not be elaborated here.

[0243] In one possible design, Figure 2 The Internet application security protection system based on behavior analysis of the illustrated embodiment can be implemented as a computing device, such as Figure 3 As shown, the computing device may include a storage component 31 and a processing component 32;

[0244] The storage component 31 stores one or more computer instructions, wherein the one or more computer instructions are called and executed by the processing component 32 .

[0245] The processing component 32 is used to: monitor user interaction behavior in Internet applications, the user interaction behavior including login attempt behavior, access frequency, operation mode and session duration; construct a user behavior baseline based on the user interaction behavior, the user behavior baseline is used to reflect the behavior pattern of normal users; compare the user interaction behavior with the user behavior baseline to identify abnormal behavior patterns; when the abnormal behavior pattern is detected, trigger a security policy to protect the Internet application from potential threats, the security policy including increasing authentication strength, restricting access rights or implementing account lockout.

[0246] The processing component 32 may include one or more processors to execute computer instructions to complete all or part of the steps in the above method. Of course, the processing component may also be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors or other electronic components to perform the above method.

[0247] The storage component 31 is configured to store various types of data to support operations at the terminal. The storage component can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0248] Of course, the computing device may also include other components, such as input / output interfaces, display components, communication components, etc.

[0249] The input / output interface provides an interface between the processing component and the peripheral interface module, which may be an output device, an input device, etc.

[0250] The communication component is configured to facilitate, among other things, wired or wireless communications between the computing device and other devices.

[0251] Among them, the computing device can be a physical device or an elastic computing host provided by a cloud computing platform, etc. In this case, the computing device can refer to a cloud server, and the above-mentioned processing components, storage components, etc. can be basic server resources rented or purchased from the cloud computing platform.

[0252] The present application also provides a computer storage medium storing a computer program, wherein the computer program can achieve the above-mentioned Figure 1 The illustrated embodiment is an Internet application security protection method based on behavioral analysis.

[0253] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0254] The system embodiment described above is merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art may understand and implement it without creative work.

[0255] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0256] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for Internet application security protection based on behavior analysis, characterized in that: include: Monitor user interaction behaviors in Internet applications, including login attempts, access frequency, operation patterns, and session duration; Building a user behavior baseline according to the user interaction behavior, wherein the user behavior baseline is used to reflect the behavior pattern of a normal user; comparing the user interaction behavior with the user behavior baseline to identify abnormal behavior patterns; When the abnormal behavior pattern is detected, triggering a security policy to protect the Internet application from potential threats, the security policy including increasing authentication strength, restricting access rights, or implementing account locking; Wherein, comparing the user interaction behavior with the user behavior baseline to identify abnormal behavior patterns includes: Calculating a behavior deviation index between the user interaction behavior and the user behavior baseline; Determining whether the user interaction behavior is a normal user behavior pattern based on the behavior deviation index; The determining whether the user interaction behavior is a normal user behavior pattern based on the behavior deviation index includes: Setting an abnormal threshold corresponding to the abnormal behavior mode, and if the behavior deviation index is greater than the abnormal threshold, determining that the user interaction behavior is an abnormal behavior mode; The calculating the behavior deviation index between the user interaction behavior and the user behavior baseline includes: Determine a login behavior index of a login attempt behavior in the user interaction behavior; Determine an access behavior index of access frequency in the user interaction behavior; Determine an operation behavior index of an operation mode in the user interaction behavior; Determine a session behavior index of a session duration in the user interaction behavior; Calculating a behavior deviation index according to the login behavior index, the access behavior index, the operation behavior index, the session behavior index and the user behavior baseline; The login behavior index is calculated by the following formula: ； in, Indicates at time The login behavior index corresponding to the login attempt behavior, and are the functions of the current and baseline login attempts over time, is the standard deviation over time, is a constant that controls the weight of speed differences; Indicates the rate of change of the current number of login attempts over time; Indicates the rate of change of the number of login attempts in the user behavior baseline over time; The access behavior index is calculated by the following formula: ； in, Indicates at time The access behavior index corresponding to the access frequency, Indicates the current time User access frequency; Indicates at the same time , the expected value of access frequency in the user behavior baseline; Indicates time The standard deviation of the access frequency at time Represents a very small positive value to prevent division by zero errors, represents a constant that controls the relative bias weight; Indicates the relative deviation of access frequency from the user behavior baseline; The operation behavior index is calculated by the following formula: ； in, Indicates at time The operation behavior index corresponding to the operation mode; Indicates the current time User operation mode The value of a feature; Indicates at the same time In the user behavior baseline, the operation mode The expected value of a feature; Indicates time Operation mode The standard deviation of the feature; Indicates the characteristics of a given operating mode The weight of represents a constant that controls the sum of squares of total deviations; The session behavior index is calculated by the following formula: ； in, Indicates at time The session behavior index corresponding to the session duration; Indicates the current time The user's session duration; Indicates at the same time , the expected value of session duration in the user behavior baseline; Indicates time The standard deviation of session duration; A constant that controls the square of the relative deviation; Indicates the relative deviation of session duration from the user behavior baseline; Wherein, the behavior deviation index is calculated by the following formula: Calculate the comprehensive abnormality index : ； in, Indicates at time Behavioral Deviation Index; represents the weight coefficient assigned to each behavioral index; represents the constant that controls the interaction effect between different behaviors; Indicates at time Login behavior index corresponding to login attempt behavior; Indicates at time The access behavior index corresponding to the access frequency; Indicates at time The operation behavior index corresponding to the operation mode; Indicates at time The session behavior index corresponding to the session duration; When the abnormal behavior pattern is detected, a security policy is triggered to protect the Internet application from potential threats, including: Calculating the Security Response Level : ； in, Indicates at time The security response level; and is the threshold that varies over time; Indicates at time Behavioral Deviation Index; Relationship between response level and security policy: ； Among them, Security Policy Indicates at time Security policies that are enforced.

2. The method according to claim 1, characterized in that: The monitoring of user interaction behaviors in Internet applications, including login attempts, access frequency, operation mode, and session duration, includes: The logging system deployed on the Internet application server collects and records the user's login attempt behavior, including login timestamp, login device information, login geographic location information, and status information of whether the login is successful; Using traffic monitoring tools to capture user access requests to the Internet application in real time, and counting the number of user accesses per unit time to form a quantitative indicator of access frequency; Capturing the user's operation patterns within the Internet application through a behavioral analysis engine, including click paths, dwell time, page switching sequence, and function usage; Monitor the session connection status between the user and the Internet application, record the start and end time of each session, and calculate the session duration of each session.

3. The method according to claim 1, characterized in that The step of constructing a user behavior baseline according to the user interaction behavior, wherein the user behavior baseline is used to reflect the behavior pattern of a normal user, includes: Classifying the collected user interaction behavior data to identify major behavior pattern clusters; The center point or average value of each behavior pattern cluster is used as a reference point of the user behavior baseline, and the user behavior baseline is used to reflect the behavior pattern of a normal user.

4. The method according to claim 1, characterized in that: When the abnormal behavior pattern is detected, a security policy is triggered to protect the Internet application from potential threats, wherein the security policy includes increasing authentication strength, restricting access rights, or implementing account lockout, including: When the abnormal behavior pattern is detected, a security response mechanism is triggered to activate a preset security policy, and the security policy can perform a graded response according to the severity of the abnormal behavior pattern; For mild abnormal behavior, increase the authentication strength, which at least includes requiring the user to provide additional identity verification information to confirm the authenticity of the user's identity; For moderately abnormal behaviors, restrict access rights, which at least includes temporarily reducing the user's access level to sensitive functions or important resources; For severe abnormal behavior, account locking is implemented, and the implementation of account locking at least includes temporarily freezing the user account.

5. A behavior analysis-based Internet application security protection system, used to execute the behavior analysis-based Internet application security protection method described in any one of claims 1 to 4, characterized in that: include: A monitoring module, used to monitor user interaction behaviors in Internet applications, wherein the user interaction behaviors include login attempts, access frequency, operation mode, and session duration; A construction module, used to construct a user behavior baseline according to the user interaction behavior, wherein the user behavior baseline is used to reflect the behavior pattern of a normal user; A comparison module, configured to compare the user interaction behavior with the user behavior baseline to identify abnormal behavior patterns; The detection module is used to trigger a security policy to protect the Internet application from potential threats when the abnormal behavior pattern is detected. The security policy includes increasing authentication strength, restricting access rights, or implementing account locking.

6. A computing device, characterized in that It comprises a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement the Internet application security protection method based on behavior analysis as described in any one of claims 1 to 4.

7. A computer storage medium, characterized in that: A computer program is stored, and when the computer program is executed by a computer, the Internet application security protection method based on behavior analysis as described in any one of claims 1 to 4 is implemented.

Images