Information determination method, device and equipment, computer storage medium and computer program product

Abstract

The embodiment of the invention discloses an information determination method. The method comprises the steps of obtaining historical operation data of assets in a network system, first data of the assets for historical access requests and second data of the assets for target access requests; based on the historical operation data, the first data and the second data, generating target detection information of services provided for the assets; and obtaining target data of the asset for the to-be-processed access request, and determining a target service of the asset for the to-be-processed access request from a target database based on the target data and the target detection information. The embodiment of the invention further discloses an information determination device and equipment, a computer storage medium and a computer program product.

Description

Technical Field

[0001] The present application relates to information determination technology in the computer field, and in particular to an information determination method, device, equipment, computer storage medium and computer program product. Background Art

[0002] With the popularization of the Internet and the advancement of technology, the security threats to assets in network systems are becoming increasingly serious. Based on this, how to improve the security of assets in network systems has become increasingly important. However, since the open source framework is used when deploying applications on assets, the assets themselves have serious security vulnerabilities. This requires pre-detection of the services provided by assets in the network system, and real-time monitoring of asset information based on the detection results, so as to timely foresee possible risk events for assets, thereby improving the security of assets in the network system. At present, the relevant technology uses regular expressions and keyword matching to detect specific services corresponding to assets in specific scenarios. However, the detection service detection method in the relevant technology has the problem of low accuracy of service detection. Summary of the invention

[0003] To solve the above technical problems, the embodiments of the present application hope to provide an information determination method, apparatus, device, storage medium and computer program product, which solve the problem of low accuracy of service detection when performing service detection in the related art.

[0004] A method for determining information, the method comprising:

[0005] Acquire historical operation data of an asset in a network system, first data of the asset for historical access requests, and second data of the asset for target access requests;

[0006] Generate target detection information for a service based on the historical operation data, the first data, and the second data; wherein the service is a service provided by the asset;

[0007] Target data of the asset for the access request to be processed is obtained, and based on the target data and the target detection information, a target service of the asset for the access request to be processed is determined from a target database.

[0008] In the above solution, generating target detection information for a service based on the historical operation data, the first data and the second data includes:

[0009] generating initial detection information for the service based on the historical operation data and the first data;

[0010] The initial detection information is corrected based on the second data to obtain the target detection information.

[0011] In the above solution, generating initial detection information for the service based on the historical operation data and the first data includes:

[0012] Determining target detection parameters for the service based on the historical operation data and the first data;

[0013] Determine a target detection method and a target detection type for the service; wherein the target detection type represents the type of data that can be detected;

[0014] The initial detection information is generated based on the target detection parameter, the target detection mode and the target detection type.

[0015] In the above solution, determining the target detection parameter for the service based on the historical operation data and the first data includes:

[0016] Processing the historical operation data and the first data to obtain a plurality of different characteristic parameters of the service;

[0017] An object detection parameter for the service is determined from the multiple different feature parameters.

[0018] In the above solution, determining the target service of the asset for the pending access request from a target database based on the target data and the target detection information includes:

[0019] Processing the target data to obtain processed target data;

[0020] Based on the target detection information, matching the processed target data with the data in the target database;

[0021] If there is first matching data in the target database that matches all different characteristic parameters of the processed target data, it is determined that the service corresponding to the first matching data is the target service.

[0022] In the above scheme, the method further includes:

[0023] If the matching data does not exist in the target database, determining the number of feature parameters among the different feature parameters that do not match each feature parameter of the data in the target database;

[0024] determining a target value based on the quantity;

[0025] If the target value is less than or equal to the target threshold, first data to be matched is determined from the target database, and a service corresponding to the first data to be matched is determined to be the target service.

[0026] In the above scheme, the method further includes:

[0027] If the target value is greater than the target threshold, determining second to-be-matched data from the target database based on the target value;

[0028] Based on the target detection information, matching the second to-be-matched data with the processed target data;

[0029] If there is second matching data matching all the different characteristic parameters in the second to-be-matched data, determining that the service corresponding to the second matching data is the target service;

[0030] If the second matching data does not exist in the second data to be matched, the processed target data is processed using a target self-learning algorithm to obtain target feature information of the processed target data and store it in the target database.

[0031] In the above scheme, the method further includes:

[0032] Based on the target data, using a target time series model to predict target access data of the asset;

[0033] generating a risk access policy for the asset for the pending access request based on the target access data;

[0034] Based on the risk access policy, the target access data and different characteristic parameters of the target service, a risk assessment result of the asset for the pending access request is determined.

[0035] In the above solution, determining the risk assessment result of the asset for the pending access request based on the risk access policy, the target access data and different characteristic parameters of the target service includes:

[0036] Determining a target risk value of the access request to be processed based on the target access data, different characteristic parameters of the target service and a target risk library;

[0037] Determining a target trust level of the pending access request;

[0038] Based on the risk access policy, the target risk value and the target trust level, a risk assessment result of the asset for the pending access request is determined.

[0039] An information determination device, the device comprising:

[0040] An acquisition unit, configured to acquire historical operation data of an asset in a network system, first data of the asset for historical access requests, and second data of the asset for target access requests;

[0041] a processing unit, configured to generate target detection information for a service based on the historical operation data, the first data, and the second data; wherein the service is a service provided by the asset;

[0042] A determination unit is used to obtain target data of the asset for the access request to be processed, and determine a target service of the asset for the access request to be processed from a target database based on the target data and the target detection information.

[0043] An information determination device, the device comprising: a processor, a memory, and a communication bus;

[0044] The communication bus is used to realize the communication connection between the processor and the memory;

[0045] The processor is used to execute the information determination program in the memory to implement the steps of the above-mentioned information determination method.

[0046] A computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the above-mentioned information determination method.

[0047] A computer program product comprises a computer program, wherein the computer program implements the above-mentioned information determination method when executed by a processor.

[0048] The information determination method, apparatus, device, computer storage medium and computer program product provided in the embodiments of the present application can obtain the historical operation data of the asset in the network system, the first data of the asset for the historical access request and the second data of the asset for the target access request, and generate the target detection information for the service provided by the asset based on the historical operation data, the first data and the second data, and obtain the target data of the asset for the access request to be processed, and determine the target service of the asset for the access request to be processed from the target database based on the target data and the target detection information; in this way, the target detection information for all services provided by the asset can be generated according to the data of multiple dimensions of the asset, and the target service of the asset for the access request to be processed is determined by combining the target detection information and the target data of the asset for the access request to be processed, so that the data of each dimension of the asset is taken into account when generating the target detection information for the service, so that the generated target detection information can detect different services in different scenarios, instead of only detecting specific services in specific scenarios as in the related art, which solves the problem of low accuracy of service detection when performing service detection in the related art. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 A flowchart of an information determination method provided in an embodiment of the present application;

[0050] Figure 2 A flowchart of another information determination method provided in an embodiment of the present application;

[0051] Figure 3 A schematic diagram of a system structure corresponding to an information determination method provided in an embodiment of the present application;

[0052] Figure 4 A schematic diagram of a flow chart of a method for generating a risk access strategy in an information determination method provided in an embodiment of the present application;

[0053] Figure 5 A schematic diagram of a risk assessment method in an information determination method provided in an embodiment of the present application;

[0054] Figure 6 A schematic diagram of the structure of an information determination device provided in an embodiment of the present application;

[0055] Figure 7 A schematic diagram of the structure of an information determination device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0056] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0057] It should be understood that the "embodiments of the present application" or "the aforementioned embodiments" mentioned throughout the specification mean that specific features, structures or characteristics related to the embodiments are included in at least one embodiment of the present application. Therefore, "in the embodiments of the present application" or "in the aforementioned embodiments" appearing throughout the specification may not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics may be combined in one or more embodiments in any suitable manner. In the various embodiments of the present application, the size of the sequence numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application. The above-mentioned sequence numbers of the embodiments of the present application are for description only and do not represent the advantages and disadvantages of the embodiments.

[0058] Unless otherwise specified, the electronic device performs any step in the embodiments of the present application, and the processor of the electronic device may perform the step. It is also worth noting that the embodiments of the present application do not limit the order in which the electronic device performs the following steps. In addition, the methods used to process data in different embodiments may be the same method or different methods. It should also be noted that any step in the embodiments of the present application can be independently executed by the electronic device, that is, when the electronic device executes any step in the following embodiments, it may not rely on the execution of other steps.

[0059] It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0060] The present application embodiment provides an information determination method, which can be applied to an information determination device, referring to Figure 1 As shown, the method may include the following steps:

[0061] Step 101: Obtain historical operation data of assets in a network system, first data of assets for historical access requests, and second data of assets for target access requests.

[0062] In the embodiment of the present application, the asset may refer to a network device deployed in the network system, the historical operation data may refer to the historical security log of the network device, the first data may refer to the historical data of the network device in the network system for various service access requests collected, and the second data may refer to the response data of the network device in the network system for specific access requests collected. It should be noted that the network device may include physical devices and virtual devices; the historical operation log may be obtained through the Network Detection and Response (NDR) technology and the Web Application Firewall (WAF) intrusion prevention system, and the historical security log includes relevant data on attack behaviors against the asset and relevant data on the services provided by the asset.

[0063] Step 102: Generate target detection information for the service based on the historical operation data, the first data and the second data.

[0064] Among them, services are services that assets can provide. In one achievable way, services can refer to services that can be provided by open source frameworks, middleware, and application components corresponding to applications deployed on assets.

[0065] In an embodiment of the present application, the target detection information can be used to detect a specified service from multiple services of an asset. In an achievable manner, the target detection information can include detection parameters required for detecting the service, a specific detection method, and the type of data that can be detected.

[0066] In an embodiment of the present application, initial detection information can be determined based on historical operation data and first data of assets for historical access requests, and then the initial detection information can be adjusted based on second data of assets for target access requests to obtain final target detection information.

[0067] In an embodiment of the present application, by obtaining the historical operation data of the asset, the first data of the asset for historical access requests, and the second data of the asset for target access requests, target detection information can be generated for services provided by the open source framework corresponding to the application, services provided by the middleware, and services provided by the application components. In this way, the target detection information can be used to detect the services provided by the open source framework, middleware, etc. corresponding to the application, thereby significantly improving the coverage of service detection.

[0068] Step 103: Obtain target data of the asset for the access request to be processed, and determine the target service of the asset for the access request to be processed from the target database based on the target data and the target detection information.

[0069] The pending access request may refer to a real-time access request for a network device; the target data may refer to the response data of the asset to the pending access request; the target database may be a preset database, and the target database includes data related to various services provided by the asset. In an achievable manner, the data related to various services may include data such as the service name, the port corresponding to the service, and a specific description of the service.

[0070] In an embodiment of the present application, after the target data is acquired, the target data can be matched with each data in the target database according to pre-generated target detection information, and the target service of the asset for the access request to be processed can be determined based on the multiple matching results obtained.

[0071] In other embodiments of the present application, by acquiring data of various dimensions of assets, target detection information for all services provided by the assets can be generated, and then the target detection information can be used to detect various services in various scenarios, thereby improving the accuracy and efficiency of service detection.

[0072] The information determination method provided in the embodiment of the present application can generate target detection information for all services provided by the asset based on data of multiple dimensions of the asset, and determine the target service of the asset for the pending access request by combining the target detection information and the target data of the asset for the pending access request, thereby taking into account the data of various dimensions of the asset when generating the target detection information for the service. In this way, the generated target detection information can detect different services in different scenarios, rather than only being able to detect specific services in specific scenarios as in the related art, thereby solving the problem of low accuracy of service detection when performing service detection in the related art.

[0073] Based on the above embodiments, the embodiments of the present application provide an information determination method, referring to Figure 2 As shown, the method may include the following steps:

[0074] Step 201: The information determination device obtains historical operation data of assets in the network system, first data of assets for historical access requests, and second data of assets for target access requests.

[0075] In the embodiments of the present application, Figure 3The system corresponding to the information determination device shown may include a source data unit and an auxiliary unit. The source data unit includes initial operation data, first initial data, and second initial data. Specifically, the initial operation data of the asset, the first initial data of the asset for historical access requests, and the second initial data of the asset for target access requests can be obtained from the source data unit in the system corresponding to the information determination device. After that, the service name, service version, and operating system corresponding to the service in the initial operation data and the first initial data are marked to obtain the marked historical operation data and the first data.

[0076] It should be noted that if Figure 3 The system corresponding to the information determination device shown also includes an auxiliary unit, and the auxiliary unit includes a request response module, a traffic collection module and a log synchronization module. The traffic collection module is used to receive the first initial data of the asset for historical access requests and the second initial data for target access requests. The log synchronization module is used to receive the security log of the asset (i.e., historical operation data).

[0077] Step 202: The information determination device generates initial detection information for the service based on the historical operation data and the first data.

[0078] In an embodiment of the present application, the information determination device processes the historical operation data and the first data to obtain detection parameters for the service, and determines the detection method and detection type for the service, and then generates initial detection information in combination with the detection parameters, detection method and detection type. Among them, the detection parameters may refer to the detection fields required when detecting the service.

[0079] It should be noted that assets can provide a variety of different services through open source frameworks, middleware and application components, and an initial detection information can be generated for each service, that is, one service corresponds to one initial detection information.

[0080] In the embodiment of the present application, step 202 can be implemented by steps 202a to 202c:

[0081] Step 202a: The information determination device determines target detection parameters for the service based on the historical operation data and the first data.

[0082] In an embodiment of the present application, the information determination device may process the historical operation data and the first data to obtain multiple characteristic parameters of the service, and screen the multiple characteristic parameters to obtain the target detection parameters. In an achievable manner, the multiple characteristic parameters of the service may refer to the service name, the operating system corresponding to the service, the port information corresponding to the service, the middleware providing the service, the basic information of the application plug-in and the application component, etc.

[0083] In the embodiment of the present application, step 202a can be implemented by steps 202a1 to 202a2:

[0084] Step 202a1: The information determination device processes the historical operation data and the first data to obtain a plurality of different characteristic parameters of the service.

[0085] In the embodiments of the present application, Figure 3 As shown, the system corresponding to the information determination device also includes a data processing unit, and the data processing unit includes a data initialization module and a data cleaning module. Specifically, the data initialization module is used to format the acquired historical data or real-time data; the data cleaning module is used to filter out some abnormal data in the data obtained after formatting by the data initialization module.

[0086] In an embodiment of the present application, the historical operation data and the first data may be formatted first to convert the historical operation data and the first data into data of a specified format, and then the formatted data may be processed to obtain transmission data corresponding to the service, and then the transmission data may be processed to obtain a plurality of different characteristic parameters of the service. Specifically, the information determination device may first format the historical operation data and the first data through a data initialization module in a data processing unit, and then filter the formatted data for abnormal data through a data cleaning module, and then the filtered data may be processed through a data processing tool to obtain transmission data corresponding to the service. The transmission data may refer to the specific data of the transmission protocol used when the asset provides services.

[0087] In one practicable manner, the data processing tool may refer to Wireshark software or a network data collection and analysis tool; the transmission protocol may include Hypertext Transfer Protocol (HTTP) and Transmission Control Protocol (TCP).

[0088] For example, if the transmission protocol is HTTP, the transmission data may be as follows:

[0089] POST / login.php HTTP / 1.1\r\n#Transmission protocol name

[0090] Expert Info(Chat / Sequence):POST / login.php HTTP / 1.1\r\n

[0091] POST / hacker.php HTTP / 1.1\r\n

[0092] Severity level:Chat

[0093] Request Method: POST#HTTP Request Method (HTTP Method)

[0094] Request URI: / hacker.php

[0095] Request Version: HTTP / 1.1

[0096] #HTTP header

[0097] User-Agent:Java / 1.8.0_112\r\n

[0098] Host:192.168.193.129:8080\r\n

[0099] Accept: text / html,image / gif,image / jpeg,*; q=.2,* / *; q=.2\r\n

[0100] Connection: keep-alive\r\n

[0101] #HTTP request body

[0102] Content-type: application / x-www-form-urlencoded\r\n#Payload information

[0103] Content-Length: 633\r\n

[0104] Content length: 633

[0105] Full request URI: http: / / 192.168.193.129 / hacker.php#Requested URL

[0106] HTTP request 1 / 1

[0107] Further, the session identifier carried in the transmission data can be used as a benchmark, and a clustering algorithm can be used to group the obtained transmission data, that is, the data belonging to the same session in the transmission data is grouped, and the repeated data in each request group data is deduplicated according to the attribute information of the network data, and then the data in each group of transmission data is arranged according to the IP address and timing information to obtain a group of transmission data with context association, and then the obtained transmission data is processed using a data analysis tool to obtain a plurality of different characteristic parameters corresponding to different services. It should be noted that the attribute information of the network data may include the source IP address, the destination IP address, the source port number, the destination port number and the name of the transmission protocol, and the data analysis tool may refer to the PyShark module in Python. In an achievable manner, if the protocol corresponding to the service is the Hypertext Transfer Protocol, it is necessary to simultaneously deduplicate the repeated data in each group of data according to the attribute information of the network data, the payload information in the HTTP request header (HTTP header) and the data in the HTTP request body (HTTP body).

[0108] In the embodiment of the present application, different services and their corresponding characteristic parameters may be combined into data for different services, and the plurality of data may be sent to the characteristic library in the knowledge base unit for storage.

[0109] Step 202a2: The information determination device determines target detection parameters for the service from a plurality of different feature parameters.

[0110] In an embodiment of the present application, the frequency of each characteristic parameter of the service appearing in the transmission data can be counted, and the frequency of each characteristic parameter can be compared with a preset threshold, and then the characteristic parameters with a frequency higher than the preset threshold can be screened out from a plurality of different characteristic parameters according to the comparison results. Specifically, the characteristic parameters with a frequency higher than the preset threshold can be used as the final detection parameters (i.e., target detection parameters) for the service, and the characteristic parameters with a frequency less than the preset threshold can be directly discarded. It should be noted that the target detection parameters determined for different services may be different.

[0111] Step 202b: The information determination device determines the target detection method and target detection type for the service.

[0112] Among them, the target detection type represents the type of data that can be detected.

[0113] In the embodiment of the present application, the target detection method may refer to a method of matching the target data with the data in the target database. In an achievable manner, the target detection method may include a method of matching by regular expression, a method of matching by global matching, and / or a method of matching by uniform resource locator (URL); the target detection type may include a string type and a text type.

[0114] It should be noted that the target detection method also includes other matching methods, which are not specifically limited here.

[0115] Step 202c: The information determination device generates initial detection information based on the target detection parameters, the target detection method and the target detection type.

[0116] In one achievable manner, the initial detection information may be as shown in Table 1 below:

[0117]

[0118] Table 1

[0119] Among them, the detection parameters in Table 1 are target detection parameters, and include service name, service version, service description and reference information of the service; the detection method is the target detection method, and includes three methods: regular expression, global matching and URL matching; the detection type is the target detection type, and includes string type and text type. It should be noted that the fields in the initial detection information can be increased or decreased accordingly for different application scenarios, that is, the specific contents in the detection parameters, detection methods and detection types can be increased or decreased accordingly, and the fields in the initial detection information can also be changed according to user needs.

[0120] Exemplarily, the specific code program of the initial detection information can be as follows:

[0121]

[0122] :text=>'org.apache.struts.',},{:url=>' / ? actionErrors=notfoundnotfound',:regexp=> / (Struts Problem Report|org.apache.struts2|struts.devMode|struts-tags|There is no Actionmapped for namespace) / }]#Detection method (i.e. target detection method) and detection type (i.e. target detection type)

[0123] Step 203: The information determination device corrects the initial detection information based on the second data to obtain target detection information.

[0124] In an embodiment of the present application, the second data may be format-converted first to convert the second data into second data of a specified format, and then the initial detection information may be corrected according to the second data after the format conversion to obtain the target detection information. Specifically, the information determination device may use the second data to verify the validity of the generated multiple initial detection information, and determine the final target detection information according to the verification result. Specifically, the second data may be processed by a data processing tool and a data parsing tool to obtain the processed second data, and then the processed second data may be matched with the data in the feature library according to the initial detection information, and the initial detection information may be adjusted according to the matching result to obtain the final multiple target detection information. It should be noted that the processed second data may include feature parameters of multiple different services, that is, when matching, the information determination device may match the processed second data with multiple different data in the feature library according to different initial detection information to determine multiple services.

[0125] Specifically, for initial detection information with high matching frequency and high recognition rate, the detection parameters and detection methods in the initial detection information can be adjusted, and the adjusted initial detection information can be used as the target detection information. In one achievable method, the initial detection information can be adjusted by reducing the additional wildcard characters in the regular expression. It should be noted that the matching frequency may refer to the ratio of the number of times a certain initial detection information is used in the matching process to the total number of times all initial detection information is used; the recognition rate may refer to the ratio of the number of initial detection information that can ultimately detect the service to the number of all initial detection information used in the matching process, and a high recognition rate may refer to a recognition rate greater than 95%.

[0126] Accordingly, initial detection information with high matching frequency and low recognition rate can be merged or directly deleted; initial detection information with low matching frequency and high recognition rate does not need to be changed and can be directly used as target detection information; other initial detection information that is not used in the matching process can be directly deleted.

[0127] Step 204: The information determination device obtains the target data of the asset for the access request to be processed, and processes the target data to obtain processed target data.

[0128] In the embodiments of the present application, Figure 3As shown, the auxiliary unit may further include a request response module. Specifically, the information determination device may receive the response data (i.e., target data) of the asset for the access request to be processed through the request response module in the auxiliary unit, and then format the acquired target data through the data initialization module, and then filter out abnormal data in the formatted target data through the data cleaning module in the data processing unit, and then process the filtered target data through the data processing tool and the data analysis tool to obtain processed target data with different characteristic parameters.

[0129] Step 205: The information determination device matches the processed target data with the data in the target database based on the target detection information.

[0130] In the embodiments of the present application, Figure 3 As shown, the system corresponding to the information determination device may also include a knowledge base unit, and the knowledge base unit includes a feature library, a historical analysis library and a classification knowledge base, wherein the feature library is used to store data including various feature parameters of different services provided by different assets; the classification knowledge base is used to store service data indexed by each feature parameter of the service; the historical analysis library is used to analyze target data that does not match the data in the target database, and store the analysis results.

[0131] In the embodiment of the present application, the target database may refer to Figure 3 The information determination device shown corresponds to a knowledge base unit in the system. Specifically, the information determination device can match the characteristic parameters of the processed target data with the characteristic parameters of the data in the characteristic library in the knowledge base unit (i.e., the target database) according to the target detection information through the service matching module in the data processing unit, and then determine the target service of the asset for the access request to be processed according to the matching result.

[0132] In the embodiment of the present application, step 206 or steps 207 to 209 may be executed after step 205 .

[0133] Step 206: If there is first matching data in the target database that matches all different characteristic parameters of the processed target data, the information determination device determines that the service corresponding to the first matching data is the target service.

[0134] In the embodiments of the present application, Figure 3The data processing unit shown may also include a service matching module. Specifically, the service matching module is used to match the target data of the access request to be processed with the data in the target database. Specifically, if the service matching module determines that multiple characteristic parameters of the processed target data match multiple characteristic parameters of a certain data in the characteristic library of the target database, then the data is the matching data that completely matches the target data (i.e., the first matching data), and the service corresponding to the first matching data can be determined as the target service. In an achievable manner, if multiple characteristic parameters of the processed target data match multiple characteristic parameters of multiple data in the target database, then the service corresponding to each matching data can be determined as multiple target services of the access request to be processed.

[0135] Step 207: If there is no matching data in the target database, the information determination device determines the number of feature parameters among the different feature parameters that do not match any feature parameter of the data in the target database.

[0136] In the embodiment of the present application, if there is no matching data in the feature library of the target database, the number of feature parameters that do not match the feature parameters of the data in the feature library can be determined from multiple different feature parameters of the target data. Specifically, if there is no matching data in the feature library that matches multiple feature parameters of the processed target data, that is, there is a conflict between the processed target data and the data in the feature library, then the information determination device can be used as follows: Figure 3 The data classification module in the data processing unit shown divides the target data according to different characteristic parameters to obtain data corresponding to each characteristic parameter, and then determines the characteristic parameters that do not match the characteristic parameters of the data in the target database from multiple characteristic parameters, and determines the number of unmatched characteristic parameters.

[0137] Step 208: The information determination device determines a target value based on the quantity.

[0138] In the embodiment of the present application, the target value may refer to a conflict coefficient. Specifically, the information determination device may determine the amount of target detection information used in the matching process, and then determine the target value according to the number of unmatched feature parameters and the amount of target detection information used in the matching process. It should be noted that the conflict coefficient may characterize the degree of matching between the processed target data and the data in the target database.

[0139] In the embodiment of the present application, step 209 or steps 210 to 211 may be executed after step 208 .

[0140] Step 209: If the target value is less than or equal to the target threshold, the information determination device determines the first data to be matched from the target database, and determines that the service corresponding to the first data to be matched is the target service.

[0141] In an embodiment of the present application, after determining the target value, the target value can be compared with the target threshold. If the target value is less than or equal to the target threshold (i.e., the conflict coefficient is small), the information determination device can determine the data (i.e., the first data to be matched) with the successfully matched feature parameters as the index from the classification knowledge base in the knowledge base unit (i.e., the target database). After that, the similarity between multiple first data to be matched and the processed target data can be calculated, and the data whose similarity meets the threshold is used as the final first data to be matched. Finally, the service corresponding to the screened first data to be matched is used as the final target service to be determined. It should be noted that the target threshold is set based on historical data and actual application scenarios.

[0142] In an achievable manner, if the processed target data includes three characteristic parameters: service version, service port, and operating system corresponding to the service, and there is no data matching the service version in the data of the characteristic library, then Figure 3 The classification knowledge base in the target database shown in the figure selects data indexed by the service port and the operating system corresponding to the service as the first data to be matched, and takes the service corresponding to the first data to be matched as the final target service. The data indexed by the service port includes not only the specific data of the service port, but also the specific data of the service version and the specific data of the operating system corresponding to the service; and the data indexed by the operating system corresponding to the service also includes not only the specific data of the operating system corresponding to the service, but also the specific data of the service version and the specific data of the service port.

[0143] Step 210: If the target value is greater than the target threshold, the information determination device determines second data to be matched from the target database based on the target value.

[0144] In the embodiment of the present application, if the target value is greater than the target threshold (i.e., the conflict coefficient is large), it means that there is no first matching data matching the target data in the classification knowledge base in the target database. At this time, the information determination device can select data close to the target value of the processed target data from the historical judgment library according to the target value corresponding to each data in the historical judgment library of the knowledge base unit (i.e., the target database) as the second data to be matched. It should be noted that there can be multiple second data to be matched.

[0145] Step 211: The information determination device matches the second to-be-matched data with the processed target data based on the target detection information.

[0146] In an embodiment of the present application, a service matching module in a data processing unit can match characteristic parameters of processed target data and characteristic parameters of second data to be matched based on target detection information, and then determine a target service for the access request to be processed based on the matching result.

[0147] In the embodiment of the present application, step 212 or step 213 may be executed after step 211 .

[0148] Step 212: If there is second matching data in the second to-be-matched data that matches all different characteristic parameters of the processed target data, the information determination device determines that the service corresponding to the second matching data is the target service.

[0149] In an embodiment of the present application, if the characteristic parameters of a certain data in the second data to be matched match all the different characteristic parameters of the processed target data, then the information determination device will determine the service corresponding to the data (i.e., the second matching data) as the target service of the asset for the access request to be processed.

[0150] Step 213: If the second matching data does not exist in the second data to be matched, the information determination device uses a target self-learning algorithm to process the processed target data, obtains target feature information of the processed target data, and stores it in a target database.

[0151] In the embodiment of the present application, if there is still no second matching data in the second to-be-matched data that completely matches the characteristic parameters of the processed target data, the information determination device will perform the following steps: Figure 3 The feature self-learning module in the data processing unit shown uses a self-learning algorithm to extract and learn features of the processed target data, that is, to mine the characteristics of the target service, obtain the target feature information of the processed target data, and store the target feature information in the feature library of the target database to provide better data support for subsequent service detection.

[0152] In an embodiment of the present application, during the service detection process, if there is no service matching the target data in the target database, the target data is re-detected by calculating the target value, which significantly improves the accuracy of the target service detection.

[0153] In other embodiments of the present application, the following steps may be performed after step 213:

[0154] Step 214: The information determination device predicts the target access data of the asset using the target time series model based on the target data.

[0155] In an embodiment of the present application, the target time series model may be used to predict the access data of an asset in the future (i.e., the target access data), and the target access data may be data generated after a target access operation is performed on the asset, and the target access data may include the number of accesses to the asset, the login data of the user corresponding to the target access operation, and the address of the terminal corresponding to the target access operation. In an achievable manner, the target time series model may refer to an auto-regression moving average (ARMA).

[0156]

[0157] In an embodiment of the present application, the initial time series model can be trained first to obtain a target time series model. After that, the information determination device can input the target data into the target time series model. After the target time series model processes the target data of the asset for real-time access requests, the target access data of the asset can be obtained.

[0158] In the embodiments of the present application, Figure 4 The target time series model shown can be obtained through methods A1 to A4:

[0159] A1. Obtain threat intelligence data and security information and event management (SIEM) logs of assets. SIEM logs may be collected through SIEM systems. Threat intelligence data may refer to potential or ongoing threat information against assets. It should be noted that the information determination device may also obtain other information sources that obtain security information related to assets from other channels.

[0160] In one achievable manner, the threat intelligence data of an asset may be as shown in Table 2 below:

[0161]

[0162] Table 2

[0163] It should be noted that the threat intelligence data shown in Table 2 may include specific data such as number, IP address, IP location, reverse lookup domain name information, label, intelligence data and request parameters, wherein the number may refer to the number of the threat event; the IP address may refer to the IP address that initiates the threat event; the IP location may refer to the specific location of the IP address corresponding to the threat event; the reverse lookup domain name information may refer to the domain name information of the physical device corresponding to the threat event; the label refers to the type of threat event; the intelligence data may refer to data such as the time when the threat event occurred; and the request data may refer to the information of the request message sent to the asset.

[0164] In one possible implementation, the SIEM log of an asset may be as shown in Table 3 below:

[0165]

[0166] Table 3

[0167] It should be noted that the SIEM log shown in Table 3 contains relevant data of attack events against assets. Among them, the number may refer to the number of the attack event; the attack time may refer to the time when the attack event occurred; the attack source may refer to the IP address that initiated the attack event; the attacked domain name may refer to the domain name information of the asset attacked by the attack event; the attack type may refer to the type of attack event; the URL may refer to the URL corresponding to the attack event; the request parameter may refer to the region where the IP address corresponding to the attack event is located; the danger level may refer to the severity of the attack event; and the processing action may refer to the way the asset handles the attack event.

[0168] A2. Process the historical operation data to obtain an asset access list. In one achievable method, the asset access list may be as shown in Table 4 below:

[0169] location Application Name Data classification Description of sensitive information Sensitivity Level IP address of the terminal ** ＊＊＊* A2-1 User access password Level 4 172.26.110.44 ** ＊＊＊* A1-5 User Address Level 4 172.26.110.44 ** ＊＊＊* A1-2 User's mobile phone number and email address Level 2 172.26.110.44 ** ＊＊＊* C1-4 Location data Level 3 172.26.110.44

[0170] Table 4

[0171] It should be noted that the access list of the assets shown in Table 4 may refer to the access data when the access operation is performed on the assets, wherein the access list may include the location of the assets, the name of the accessed application, the type of access data (data classification), the access information corresponding to the access data (description of sensitive information), the importance of the access data (sensitivity level) and the IP address of the terminal corresponding to the access operation.

[0172] A3. Format the access list, SIEM log and threat intelligence data to obtain formatted data in a unified format, and perform clustering and association operations on the formatted data to associate the formatted data according to the timing information of the data to obtain sample data.

[0173] The sample data is data used to train the initial time series prediction model. Specifically, the sample data may include the number of visits to the asset in the past period of time, the login data of the user who accesses the asset, and the address of the terminal corresponding to the access operation.

[0174] A4. Use sample data to train the initial time series model to obtain the target time series model.

[0175] In an embodiment of the present application, historical data in a preset database can be obtained, and the data can be preprocessed to obtain processed data that meets the preset format requirements. Afterwards, the processed data is checked for sequence stationarity. If the processed data is stationary, an initial time series model that meets expectations is constructed through the autocorrelation function and the partial autocorrelation function, combined with the Akaike information criterion (AIC) and the Bayesian Information Criterion (BIC). If the processed data is not stationary, it is necessary to first perform a differential operation on the processed data. If the data obtained after the operation is stationary, the initial time series model can be directly constructed through the autocorrelation, partial autocorrelation function, AIC criterion and BIC criterion. If the data after the operation is still not stationary, it is necessary to continue to perform a differential operation on the data until stable data is obtained, and then a model can be constructed based on the stable data. Afterwards, the initial time series model can be trained using sample data to obtain a target time series model.

[0176] Step 215: The information determination device generates a risk access policy for the asset for the pending access request based on the target access data.

[0177] In the embodiments of the present application, Figure 4 The information shown determines that after the device determines the target access data of the asset, it can generate an initial risk access policy for the pending access request, and then adjust the initial risk access policy according to the existing historical access policy to obtain the final risk access policy. In an achievable manner, the initial risk access policy can also be adjusted in combination with the experience of experts.

[0178] Step 216: The information determination device determines a risk assessment result of the asset for the pending access request based on the risk access policy, the target access data, and different characteristic parameters of the target service.

[0179] In the embodiments of the present application, Figure 5 The information shown determines that the device can first determine the target risk value of the access request to be processed based on multiple different characteristic parameters of the target risk library, target access data and target service, and then determine the target trust of the access request to be processed. After that, the final risk assessment result can be determined by combining the target risk value, target trust and the generated risk access policy.

[0180] In the embodiment of the present application, step 216 can be implemented by steps 216a to 216c:

[0181] Step 216a: The information determination device determines the target risk value of the access request to be processed based on the target access data, different characteristic parameters of the target service and the target risk library.

[0182] In the embodiment of the present application, the information determination device can determine the first risk value of the user corresponding to the target access operation and the second risk value of the terminal corresponding to the target access operation according to the target access data and the target risk library. After that, the third risk value of the target service can also be determined according to the different characteristic parameters of the target service and the target risk library. Finally, the first risk value, the second risk value and the third risk value can be multiplied by the corresponding weights respectively to obtain the final target risk value of the access request to be processed. It should be noted that the target risk library is pre-set according to the actual application scenario; the weight can be set according to historical data and the actual application scenario.

[0183] Step 216b: The information determination device determines the target trust level of the access request to be processed.

[0184] The target trust level may refer to the trust level of the asset in processing the access request.

[0185] In the embodiment of the present application, the information determination device can determine the target trust of the asset for the pending access request from the target information library. It should be noted that the target information library is pre-set according to the actual application scenario.

[0186] Step 216c: The information determination device determines a risk assessment result of the asset for the pending access request based on the risk access policy, the target risk value, and the target trust level.

[0187] In an embodiment of the present application, the information determination device can determine the risk assessment result of the asset for the access request to be processed by combining the generated risk access policy, the target risk value of the access request to be processed, and the target trust level of the access request to be processed.

[0188] The information determination method provided in the embodiment of the present application can generate target detection information for all services provided by the asset based on data of multiple dimensions of the asset, and determine the target service of the asset for the pending access request by combining the target detection information and the target data of the asset for the pending access request, thereby taking into account the data of various dimensions of the asset when generating the target detection information for the service. In this way, the generated target detection information can detect different services in different scenarios, rather than only being able to detect specific services in specific scenarios as in the related art, thereby solving the problem of low accuracy of service detection when performing service detection in the related art.

[0189] Based on the above embodiments, the present invention provides an information determination device, which can be applied to Figures 1-2 In the information determination method provided in the corresponding embodiment, refer to Figure 6 As shown, the information determination device 3 may include: an acquisition unit 31, a processing unit 32 and a determination unit 33, wherein:

[0190] An acquisition unit 31 is used to acquire historical operation data of an asset in the network system, first data of an asset for historical access requests, and second data of an asset for target access requests;

[0191] A processing unit 32, configured to generate target detection information for a service based on the historical operation data, the first data, and the second data; wherein the service is a service provided by the asset;

[0192] The determination unit 33 is used to obtain target data of the asset for the access request to be processed, and determine the target service of the asset for the access request to be processed from the target database based on the target data and the target detection information.

[0193] In other embodiments of the present application, the processing unit 32 is further configured to perform the following steps:

[0194] generating initial detection information for the service based on the historical operation data and the first data;

[0195] The initial detection information is corrected based on the second data to obtain target detection information.

[0196] In other embodiments of the present application, the processing unit 32 is further configured to perform the following steps:

[0197] Determining target detection parameters for the service based on the historical operation data and the first data;

[0198] Determine the target detection method and target detection type for the service; wherein the target detection type represents the type of data that can be detected;

[0199] Initial detection information is generated based on target detection parameters, target detection method and target detection type.

[0200] In other embodiments of the present application, the processing unit 32 is further configured to perform the following steps:

[0201] Processing the historical operation data and the first data to obtain a plurality of different characteristic parameters of the service;

[0202] An object detection parameter for a service is determined from a plurality of different feature parameters.

[0203] In other embodiments of the present application, the determining unit 33 is further configured to perform the following steps:

[0204] Processing the target data to obtain processed target data;

[0205] Based on the target detection information, the processed target data is matched with the data in the target database;

[0206] If there is first matching data in the target database that matches all different characteristic parameters of the processed target data, it is determined that the service corresponding to the first matching data is the target service.

[0207] In other embodiments of the present application, the determining unit 33 is further configured to perform the following steps:

[0208] If there is no matching data in the target database, determining the number of feature parameters among the different feature parameters that do not match each feature parameter of the data in the target database;

[0209] Determine target values ​​based on quantity;

[0210] If the target value is less than or equal to the target threshold, the first data to be matched is determined from the target database, and the service corresponding to the first data to be matched is determined to be the target service.

[0211] In other embodiments of the present application, the determining unit 33 is further configured to perform the following steps:

[0212] If the target value is greater than the target threshold, determining second to-be-matched data from the target database based on the target value;

[0213] Based on the target detection information, matching the second to-be-matched data with the processed target data;

[0214] If there is second matching data matching all the different characteristic parameters in the second to-be-matched data, determining that the service corresponding to the second matching data is the target service;

[0215] If the second matching data does not exist in the second data to be matched, the processed target data is processed using a target self-learning algorithm to obtain target feature information of the processed target data and store it in a target database.

[0216] In other embodiments of the present application, the determining unit 33 is further configured to perform the following steps:

[0217] Based on the target data, a target time series model is used to predict the target access data of the asset;

[0218] Generate risk access policies for pending access requests of assets based on target access data;

[0219] Based on the risk access policy, target access data and different characteristic parameters of the target service, the risk assessment result of the asset for the pending access request is determined.

[0220] In other embodiments of the present application, the determining unit 33 is further configured to perform the following steps:

[0221] Determine the target risk value of the access request to be processed based on the target access data, different characteristic parameters of the target service and the target risk library;

[0222] Determine the target trust level of the pending access request;

[0223] Determine the risk assessment result of the asset for pending access requests based on the risk access policy, target risk value, and target trust.

[0224] It should be noted that the specific description of the steps performed by each unit can be found in Figures 1-2 The information determination method provided in the corresponding embodiment will not be repeated here.

[0225] The information determination device provided in the embodiment of the present application can generate target detection information for all services provided by the asset based on data of multiple dimensions of the asset, and determine the target service of the asset for the access request to be processed by combining the target detection information and the target data of the asset for the access request to be processed, thereby taking into account the data of various dimensions of the asset when generating the target detection information for the service. In this way, the generated target detection information can detect different services in different scenarios, rather than only being able to detect specific services in specific scenarios as in the related art, thereby solving the problem of low accuracy of service detection when performing service detection in the related art.

[0226] Based on the above embodiments, the embodiments of the present application provide an information determination device, which can be applied to Figures 1-2 In the information determination method provided in the corresponding embodiment, refer to Figure 7 As shown, the information determination device 4 may include: a processor 41, a memory 42 and a communication bus 43, wherein:

[0227] The communication bus 43 is used to realize the communication connection between the processor 41 and the memory 42;

[0228] The processor 41 is used to execute the information determination program in the memory 42 to implement the following steps:

[0229] Acquire historical operation data of assets in the network system, first data of assets for historical access requests, and second data of assets for target access requests;

[0230] Generate target detection information for a service based on the historical operation data, the first data, and the second data; wherein the service is a service provided by the asset;

[0231] Obtain target data of the asset for the pending access request, and determine a target service of the asset for the pending access request from a target database based on the target data and target detection information.

[0232] In other embodiments of the present application, the processor 41 is used to execute the information determination program in the memory 42 to generate target detection information for the service based on the historical operation data, the first data, and the second data to implement the following steps:

[0233] generating initial detection information for the service based on the historical operation data and the first data;

[0234] The initial detection information is corrected based on the second data to obtain target detection information.

[0235] In other embodiments of the present application, the processor 41 is used to execute the information determination program in the memory 42 to generate initial detection information for the service based on the historical operation data and the first data, so as to implement the following steps:

[0236] Determining target detection parameters for the service based on the historical operation data and the first data;

[0237] Determine the target detection method and target detection type for the service; wherein the target detection type represents the type of data that can be detected;

[0238] Initial detection information is generated based on target detection parameters, target detection method and target detection type.

[0239] In other embodiments of the present application, the processor 41 is used to execute the information determination program in the memory 42 to determine the target detection parameters for the service based on the historical operation data and the first data, so as to implement the following steps:

[0240] Processing the historical operation data and the first data to obtain a plurality of different characteristic parameters of the service;

[0241] An object detection parameter for a service is determined from a plurality of different feature parameters.

[0242] In other embodiments of the present application, the processor 41 is used to execute the information determination program in the memory 42 to determine the target service of the asset for the access request to be processed from the target database based on the target data and the target detection information, so as to implement the following steps:

[0243] Processing the target data to obtain processed target data;

[0244] Based on the target detection information, the processed target data is matched with the data in the target database;

[0245] If there is first matching data in the target database that matches all different characteristic parameters of the processed target data, it is determined that the service corresponding to the first matching data is the target service.

[0246] In other embodiments of the present application, the processor 41 is used to execute the information determination program in the memory 42 to implement the following steps:

[0247] If there is no matching data in the target database, determining the number of feature parameters among the different feature parameters that do not match each feature parameter of the data in the target database;

[0248] Determine target values ​​based on quantity;

[0249] If the target value is less than or equal to the target threshold, the first data to be matched is determined from the target database, and the service corresponding to the first data to be matched is determined to be the target service.

[0250] In other embodiments of the present application, the processor 41 is used to execute the information determination program in the memory 42 to implement the following steps:

[0251] If the target value is greater than the target threshold, determining second to-be-matched data from the target database based on the target value;

[0252] Based on the target detection information, matching the second to-be-matched data with the processed target data;

[0253] If there is second matching data matching all the different characteristic parameters in the second to-be-matched data, determining that the service corresponding to the second matching data is the target service;

[0254] If the second matching data does not exist in the second data to be matched, the processed target data is processed using a target self-learning algorithm to obtain target feature information of the processed target data and store it in a target database.

[0255] In other embodiments of the present application, the processor 41 is used to execute the information determination program in the memory 42 to implement the following steps:

[0256] Based on the target data, a target time series model is used to predict the target access data of the asset;

[0257] Generate risk access policies for pending access requests of assets based on target access data;

[0258] Based on the risk access policy, target access data and different characteristic parameters of the target service, the risk assessment result of the asset for the pending access request is determined.

[0259] In other embodiments of the present application, the processor 41 is used to execute the information determination program in the memory 42 to implement the following steps:

[0260] Determine the target risk value of the access request to be processed based on the target access data, different characteristic parameters of the target service and the target risk library;

[0261] Determine the target trust level of the pending access request;

[0262] Determine the risk assessment result of the asset for pending access requests based on the risk access policy, target risk value, and target trust.

[0263] It should be noted that the specific description of the steps executed by the processor can be referred to Figures 1-2 The information determination method provided in the corresponding embodiment will not be repeated here.

[0264] The information determination device provided in the embodiment of the present application can generate target detection information for all services provided by the asset based on data of multiple dimensions of the asset, and determine the target service of the asset for the pending access request by combining the target detection information and the target data of the asset for the pending access request, thereby taking into account the data of various dimensions of the asset when generating the target detection information for the service. In this way, the generated target detection information can detect different services in different scenarios, rather than only being able to detect specific services in specific scenarios as in the related art, thereby solving the problem of low accuracy of service detection when performing service detection in the related art.

[0265] Based on the foregoing embodiments, the embodiments of the present application provide a computer-readable storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement Figures 1-2 The corresponding embodiments provide steps of the information determination method.

[0266] Based on the above embodiments, the embodiments of the present application provide a computer program product, the computer program product includes a computer program, the computer program is executed by the processor 41 to implement Figures 1-2 The corresponding embodiments provide steps of the information determination method.

[0267] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of hardware embodiments, software embodiments, or embodiments in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) that contain computer-usable program code.

[0268] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0269] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0270] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0271] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for determining information, characterized in that: The method comprises: Acquire historical operation data of an asset in a network system, first data of the asset for historical access requests, and second data of the asset for target access requests; Generate target detection information for a service based on the historical operation data, the first data, and the second data; wherein the service is a service provided by the asset; Target data of the asset for the access request to be processed is obtained, and based on the target data and the target detection information, a target service of the asset for the access request to be processed is determined from a target database.

2. The method according to claim 1, characterized in that The generating target detection information for the service based on the historical operation data, the first data and the second data includes: generating initial detection information for the service based on the historical operation data and the first data; The initial detection information is corrected based on the second data to obtain the target detection information.

3. The method according to claim 2, characterized in that The generating initial detection information for the service based on the historical operation data and the first data includes: Determining target detection parameters for the service based on the historical operation data and the first data; Determine a target detection method and a target detection type for the service; wherein the target detection type represents the type of data that can be detected; The initial detection information is generated based on the target detection parameter, the target detection mode and the target detection type.

4. The method according to claim 3, characterized in that The determining, based on the historical operation data and the first data, a target detection parameter for the service includes: Processing the historical operation data and the first data to obtain a plurality of different characteristic parameters of the service; An object detection parameter for the service is determined from the multiple different feature parameters.

5. The method according to claim 1, characterized in that The determining, from a target database, a target service of the asset for the pending access request based on the target data and the target detection information, comprises: Processing the target data to obtain processed target data; Based on the target detection information, matching the processed target data with the data in the target database; If there is first matching data in the target database that matches all different characteristic parameters of the processed target data, it is determined that the service corresponding to the first matching data is the target service.

6. The method according to claim 5, characterized in that The method further comprises: If the matching data does not exist in the target database, determining the number of feature parameters among the different feature parameters that do not match each feature parameter of the data in the target database; determining a target value based on the quantity; If the target value is less than or equal to the target threshold, first data to be matched is determined from the target database, and a service corresponding to the first data to be matched is determined to be the target service.

7. The method according to claim 6, characterized in that The method further comprises: If the target value is greater than the target threshold, determining second to-be-matched data from the target database based on the target value; Based on the target detection information, matching the second to-be-matched data with the processed target data; If there is second matching data matching all the different characteristic parameters in the second to-be-matched data, determining that the service corresponding to the second matching data is the target service; If the second matching data does not exist in the second data to be matched, the processed target data is processed using a target self-learning algorithm to obtain target feature information of the processed target data and store it in the target database.

8. The method according to claim 1, characterized in that The method further comprises: Based on the target data, using a target time series model to predict target access data of the asset; generating a risk access policy for the asset for the pending access request based on the target access data; Based on the risk access policy, the target access data and different characteristic parameters of the target service, a risk assessment result of the asset for the pending access request is determined.

9. The method according to claim 8, characterized in that The determining, based on the risk access policy, the target access data and different characteristic parameters of the target service, a risk assessment result of the asset for the pending access request comprises: Determining a target risk value of the access request to be processed based on the target access data, different characteristic parameters of the target service and a target risk library; Determining a target trust level of the pending access request; Based on the risk access policy, the target risk value and the target trust level, a risk assessment result of the asset for the pending access request is determined.

10. An information determination device, characterized in that: The device comprises: An acquisition unit, configured to acquire historical operation data of an asset in a network system, first data of the asset for historical access requests, and second data of the asset for target access requests; a processing unit, configured to generate target detection information for a service based on the historical operation data, the first data, and the second data; wherein the service is a service provided by the asset; A determination unit is used to obtain target data of the asset for the access request to be processed, and determine a target service of the asset for the access request to be processed from a target database based on the target data and the target detection information.

11. An information determination device, characterized in that: The device comprises: a processor, a memory and a communication bus; The communication bus is used to realize the communication connection between the processor and the memory; The processor is used to execute the information determination program in the memory to implement the steps of the information determination method according to any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the information determination method according to any one of claims 1 to 9.

13. A computer program product, comprising a computer program, characterized in that: When the computer program is executed by a processor, the computer program implements the information determination method according to any one of claims 1 to 9.

Images