User outlier behavior recognition and similar behavior recommendation method based on domain name access

Abstract

The invention discloses a user outlier behavior recognition and similar behavior recommendation method based on domain name access, which belongs to the technical field of network security, and specifically comprises the following steps: constructing a domain name evaluation index system according to behavior characteristics such as domain name access frequency and domain name access frequency of a user, quantizing the concentration degree and the dispersion degree of domain name access behaviors of global users from multi-dimensional features; based on a domain name evaluation system, an outlier degree of a domain name access behavior of a user is quantified through an outlier detection method, so that a domain name access extreme outlier behavior recognition system of the user is built; users with common domain name access behaviors are associated with domain names as bridges, behavior characteristics of domain name access of the users are described by an outlier degree characteristic matrix, and in combination with a machine learning algorithm, in-depth similarity analysis is carried out on user behaviors; therefore, potential abnormal behavior modes and similar behavior users can be identified.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology, and in particular relates to a method for identifying user outlier behaviors and recommending similar behaviors based on a global domain name access system. Background Art

[0002] With the rapid development of Internet technology, the network has become the core platform for information transmission and communication. The analysis of enterprise user traffic is of great significance for maintaining network order and ensuring data security. However, with the continuous advancement of network technology, the encryption and anonymization of user traffic are becoming more and more common, and the diversity and complexity of user behavior are increasing, which makes the traditional content analysis-based traffic anomaly identification method face huge challenges. Traditional anomaly detection technologies, such as system identification that relies on fixed rules or traffic data payload analysis methods, usually show insufficient adaptability when facing the upgrading of network protocols and encryption technologies. Summary of the invention

[0003] The technical problem to be solved by the present invention is to provide a method for identifying user outlier behaviors and recommending similar behaviors based on a global domain name system in response to the deficiencies of the background technology. The method identifies abnormal behaviors and recommends similar behaviors for the access domain name related traffic generated by the user's Internet border gateway.

[0004] The present invention adopts the following technical solutions to solve the above technical problems: The method for identifying user outlier behaviors and recommending similar behaviors based on domain name access specifically includes the following steps; Step 1: construct a domain name evaluation index system based on the frequency of users accessing domain names and the behavioral characteristics of the frequency of accessing domain names, and quantify the concentration and dispersion of the domain name access behaviors of all users in the domain from multi-dimensional characteristics; Step 2: Based on the domain name evaluation system, the degree of outlier of user access to domain names is quantified by using the Tukey's Test outlier detection method, so as to build an identification system for extreme outlier behavior of user access to domain names; Tukey's Test is a Tukey test; Step 3: Use domain names as a bridge to associate users with common domain name access behaviors, use the outlier degree feature matrix to characterize the behavioral characteristics of users accessing domain names, and combine machine learning algorithms to conduct in-depth similarity analysis on user behaviors; thereby identifying potential abnormal behavior patterns and users with similar behaviors.

[0005] As a further preferred solution of the method for identifying user outlier behaviors and recommending similar behaviors based on domain name access of the present invention, in step 1, the collected message data is merged into session communication data, and a domain name evaluation index system is constructed based on the hypertext transfer protocol HTTP and secure hypertext transfer protocol HTTPS application layer protocol related traffic in the global ultra-large-scale network traffic; Filter the session communication data and extract the session domain information. Each session flow is represented as follows: ,in, is the user sequence of the i-th session traffic; is the source IP; is the destination IP; is the source port; is the sink port; is the domain name; Capture time for the session.

[0006] As a further preferred solution of the method for identifying user outlier behaviors and recommending similar behaviors based on domain name access of the present invention, in step 2, a domain name evaluation index system is established, which is specifically as follows: based on HTTP and HTTPS application layer protocol session data, from each peer accessed by the user Let's consider any , the user sequence set that communicates with it within a day is ,Will access Behavioral features form an ordered feature sequence according to size, thus constructing A 15-dimensional evaluation index system for the object.

[0007] As a further preferred solution of the method for identifying user outlier behaviors and recommending similar behaviors based on domain name access of the present invention, in step 2, the domain name evaluation index system specifically includes the following: 1) Domain name overall attributes: by calculating the specified date Inside The number of peer users is used to quantify the user access to the domain name. Based on the number of user visits, we design a secondary derived indicator, namely, the popularity of the domain name, which is to use the cumulative distribution curve to Divide domain names into super unpopular domain names, unpopular domain names, popular domain names, and popular domain names according to the number of user visits; calculate the number of host IPs associated with the domain name to indicate the number of server IP distribution of the domain name; form a three-dimensional indicator of the overall attributes of the domain name; Number of users accessing the domain name: , Number of server IP addresses associated with the domain name: , Domain popularity: , in, is a distinct count function; 2) Domain name access characteristics: specify the date Inside access Frequency characteristics, frequent characteristics, The IP number features of the associated server are formed into an ordered feature sequence according to size, which is used to quantify The first and third digits, mean, standard deviation, and coefficient of variation of the session frequency when the user visits the session are related statistics to characterize the user visit The overall preference, central tendency and discrete tendency of session frequency form 12-dimensional indicators of domain name access characteristics; the statistical characteristics of user access domain names and the calculation formula of domain name indicators are as follows: Frequency of visiting domain name: ; Visit frequency quantile: ; Average visit frequency: ; Visit frequency standard deviation: ; Coefficient of variation of access frequency: ; Frequency of visiting domain names: ; Visit frequency quantile: ; Average access frequency: ; Standard deviation of access frequency: ; Coefficient of variation of access frequency: ; Number of IP addresses associated with the domain name: ; Percentile of associated IP number: ; Average number of associated IP addresses: ; Standard deviation of the number of associated IPs: ; Coefficient of variation of associated IP number: ; is a quantile function, is the tertile function; is the counting function, is the mean function, is the standard deviation function, is a discrete coefficient function.

[0008] As a further preferred solution of the method for identifying user outlier behaviors and recommending similar behaviors based on domain name access of the present invention, in step 3, the user outlier feature matrix is ​​constructed: based on the domain name behavior index system and user access domain name feature index constructed in step 2, the Tukey's test outlier identification method is used to quantify the degree of user outlier. The principle is to calculate the quartiles and interquartile range (IQR) of the data set, i.e., the tertiles. With a quantile The difference between , to judge the degree of data outlier; Combining Tukey's outlier identification method and IQR rule, the distribution The data of The data is regarded as positive extreme outliers; the present invention focuses on the identification of extreme outliers; Quantify the outlier value of user access behavior characteristics, for any domain name , calculate the number of users within a day access Behavioral characteristics The positive extreme outlier degree value ,when When access Possessing extreme outlier behavior characteristics; Sequence skewness correction: Considering the problem of data distribution skewness of feature sequences in non-experimental environments, a logarithmic skewness correction with a base of 10 is performed on the feature sequences involved, denoted as ; Combined with the domain name evaluation index system, the revised outlier value calculation formula of the frequency, frequency of user access to the domain name, and the number of associated server IP addresses is as follows: 1) Outlier value of the frequency of user access to the domain name: ; 2) User access name frequency outlier value: ; 3) The outlier value of the number of server IP addresses associated with the domain name accessed by the user: ; For n users , m domain names , the present invention constructs an n*m*3 dimensional user outlier feature matrix.

[0009] As a further preferred solution of the method for identifying user outlier behaviors and recommending similar behaviors based on domain name access of the present invention, a user access domain name outlier feature matrix constructed according to Tukey's test outlier data detection method is constructed, when the outlier degree value of the frequency of user access to the domain name, the outlier degree value of the frequency of user access to the domain name, and the outlier degree value of the number of IP addresses associated with the domain name accessed by the user are greater than a specified threshold in a certain dimension The situation, that is , then in this dimension, the user's behavior of accessing the domain name is higher than that of other users who access the domain name, and it is determined that the user has extreme outlier behavior when accessing the domain name; the present invention combines multiple factors such as the number of users, data distribution, and domain name service category, and sets different outlier judgment thresholds according to the popularity of different domain names. .

[0010] As a further preferred solution of the method for identifying user outlier behaviors and recommending similar behaviors based on domain name access of the present invention, in step 3, based on the constructed n*m*3-dimensional user access domain name outlier feature matrix, the user input domain name outlier feature matrix is ​​constructed. , extract the domain name set D visited within the specified time range and the user outlier feature matrix A, As a bridge, associate users who have accessed domain name set D And the corresponding user outlier feature matrix , using cosine similarity as the metric for feature similarity, by calculating the input user outlier feature matrix A and the associated user outlier feature matrix The cosine similarity distance is used to recommend users whose domain name access behavior is highly similar to the input user.

[0011] Compared with the prior art, the present invention adopts the above technical solution and has the following technical effects: The present invention deeply mines the behavioral characteristics of border gateway user traffic data, uses advanced statistics and machine learning algorithms to conduct detailed outlier analysis of user behavior, and can more accurately discover potential abnormal behaviors by identifying outliers that are significantly different from most user behaviors. The present invention builds a user traffic behavior feature system based on the global domain name from the perspective of user session behavior, without the need to decrypt the payload of user traffic data, effectively protecting the privacy of user data and solving the problem that secure transmission protocol messages cannot be cracked. The present invention can effectively solve the problem of needing to retrain the model due to protocol updates. By calculating the relative index of outlier behavior based on global user traffic, it can effectively adapt to the high-speed changes in network traffic, reduce the dependence on labeled training set data, and improve the efficiency and accuracy of abnormal user behavior identification. The present invention proposes a generalized recommendation algorithm that can identify and recommend users with similar traffic behavior patterns to the target user, thereby greatly simplifying the process of analyzing the network behavior characteristics of different users one by one. By characterizing the outlier characteristics based on the commonly visited domain names, the system can automatically calculate the similarity of the commonly visited domain name characteristics and provide more accurate personalized recommendations; this method not only improves the efficiency of the recommendation system, but also enhances its applicability and accuracy in a diverse user group. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without paying any creative work.

[0013] Figure 1 This is the overall framework diagram of the user outlier behavior recognition and similar behavior recommendation technology based on the global domain name system of the present invention; Figure 2 It is a flow chart of user outlier behavior identification and similar behavior recommendation based on the global domain name system of the present invention. DETAILED DESCRIPTION

[0014] The technical solution of the present invention is further described in detail below in conjunction with the accompanying drawings: The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. The present invention is described in detail below based on the drawings and preferred embodiments, and the purpose and effect of the present invention will become clearer. It should be understood that the specific embodiments described here are only used to explain the present invention and are not used to limit the present invention.

[0015] The specific implementation of this patent will be further described in detail below in conjunction with the accompanying drawings, and this patent will be explained with actual operating examples, so that its ultimate purpose, advantages and features will be better understood.

[0016] Figure 1This is the overall framework diagram of the user outlier behavior identification and similar behavior recommendation technology based on the global domain name system. The identification and recommendation system of the present invention is divided into four parts. First, the global traffic data of the specified date is merged into session metadata, including relevant attributes; secondly, the session traffic is preliminarily filtered and screened according to the application layer protocols HTTP and HTTP, and the whitelist traffic of the session is filtered using the popular domain name knowledge base, and only the non-whitelist session traffic generated by the user accessing the domain name is retained; then the 15-dimensional index system of the domain name is characterized from the two aspects of the overall attributes of the domain name and the characteristics of the domain name being accessed, and the attribute characteristics of the domain name and the concentration and discreteness of user access are described in multiple dimensions; based on the global domain name index system, combined with the outlier identification algorithm, the degree of outlier behavior of users in three dimensions when accessing domain names is quantified, and the outlier feature matrix of user access domain names is constructed, and users with extreme outlier behavior are filtered out by setting the outlier threshold; finally, based on the outlier feature matrix of user access domain names, combined with the cosine similarity algorithm, a user similar behavior recommendation system is constructed, and by feeding in any user and date, the TOP10 users with similar domain name access behaviors are recommended; The present invention adopts Tukey's test outlier data detection technology to quantify the degree of outlier of user access behavior. By serializing the user access domain name features of different dimensions, the IQR rule is combined to detect data points with extreme outlier behavior in the sequence. The specific user access domain name feature sequence outlier detection and similarity recommendation flow chart is as follows: Figure 2 As shown; This system can realize two kinds of application technology services: identification of extreme outlier behavior based on the global domain name system and recommendation of users with similar behavior. The first application service can detect extreme outlier users who access the domain name by inputting a specified domain name and date, thereby improving the system computing performance; the second application service can narrow the system computing scope by inputting a specified user and date, and recommend the top 10 users with similar access behavior to the input user domain name; Regarding application technology service 1, considering that the number of users accessing domain names with different popularity levels varies greatly, the system of the present invention adopts a difference threshold filtering principle for domain names with different popularity levels when detecting whether users have extreme access behaviors. For example, the outlier threshold for unpopular domain names is set to 1, the outlier threshold for popular domain names is set to 1.5, and the outlier threshold for popular domain names is set to 3; For application technology service 2, when calculating the similarity between the input user and the user associated with the bridge domain name, the weighted cosine similarity algorithm is introduced to adjust the similarity error caused by the difference in the magnitude of the bridge domain names between any two users; in view of the differences in the nature of business domain names brought about by different application scenarios, this system provides similarity recommendation strategies with different levels of popularity, such as the unpopular domain name similarity recommendation strategy. When the domain name related to the business scenario is an unpopular domain name, only the unpopular domain name in the input user domain name set is extracted for similarity recommendation, so as to achieve calibration of the focus direction of the similarity recommendation results.

[0017] The present invention relates to the field of network security, focusing on detecting abnormal behaviors and recommending similar behaviors through the user access domain names in the border gateways and network data of super-large-scale organizations. Based on the HTTP (Hypertext Transfer Protocol) and HTTPS (Secure Hypertext Transfer Protocol) traffic in the global super-large-scale network traffic, a domain name evaluation index system is constructed to comprehensively characterize the domain name attribute characteristics and the concentration and discreteness of user access domain names, and combined with the sequence outlier detection algorithm, the degree of outlier behavior of user access to domain names is quantified, and the user outlier behavior similarity recommendation system is constructed in combination with the cosine similarity algorithm, so as to identify potential abnormal behavior patterns and users with similar behaviors. It can be used to identify users with extreme behaviors in malicious scanning, group control software use, pornographic and gambling web browsing, etc., and recommend user behaviors with similar traffic characteristics.

[0018] The purpose of this patent is to identify abnormal behaviors and recommend similar behaviors for the domain name-related traffic generated by the border gateway when users surf the Internet, in the context of Internet security. First, a domain name evaluation index system is constructed based on the behavioral characteristics such as the frequency of users accessing domain names and the frequency of accessing domain names, and the concentration and dispersion of domain name access behaviors of users across the domain are quantified from multi-dimensional characteristics; secondly, based on the domain name evaluation system, the degree of outliers in users' domain name access behaviors is quantified through the Tukey's Test outlier detection method, so as to build a system for identifying extreme outlier behaviors in users' domain name access; then, domain names are used as a bridge to associate users with common domain name access behaviors, and the behavioral characteristics of users' domain name access are characterized by the outlier degree feature matrix, and in-depth similarity analysis of user behaviors is conducted in combination with machine learning algorithms.

[0019] Therefore, the method system of this patent includes four major steps: building a domain name evaluation index system, constructing a user outlier feature matrix, detecting extreme outlier behavior, and recommending a user similarity algorithm. The specific steps are as follows: 1. Data collection and filtering: The collected message data is merged into session communication data. The research object of this patent is the traffic related to the HTTP (Hypertext Transfer Protocol) and HTTPS (Secure Hypertext Transfer Protocol) application layer protocols. Therefore, the session communication data is filtered and the session domain name information is extracted from SNI. Each session traffic is represented as follows: , we define the frequency of user sessions accessing a domain name as , define the first 11 digits of the ten-minute mark, i.e. the time string of the session occurrence, as the frequency measurement object. For example, the ten-minute mark of 202408301543 (15:44 on August 30, 2024) is 20240830154. The access frequency is obtained by de-duplicating the ten-minute marks of the domain name accessed by the user within a unit of time. The above session expressions correspond to: user sequence, source IP, sink IP, source port, sink port, domain name, and session capture time of the i-th session flow.

[0020] 2. Establishment of domain name evaluation index system: Based on HTTP and HTTPS application layer protocol session data, from each peer visited by the user Let's consider any , the user sequence set that communicates with it within a day is ,Will access

[0021] Behavioral features form an ordered feature sequence according to size, thus constructing The 15-dimensional evaluation index system for the object, the details of the 15-dimensional indicators of the domain name evaluation index system are shown in Table 1 below: Table 1 , Domain name overall properties: by calculating the specified date Inside The number of peer users is used to quantify the user visits of the domain name, and a secondary derived indicator based on the user visits is designed - the popularity of the domain name, that is, the cumulative distribution curve is used to According to the number of user visits, domain names are divided into super unpopular domain names, unpopular domain names, popular domain names, and popular domain names; the number of server IP distribution of domain names is expressed by calculating the number of host IPs associated with the domain name, forming a three-dimensional indicator of the overall attributes of the domain name.

[0022] Number of users accessing the domain name: , the number of server IP addresses associated with the domain name: , domain popularity: , Is a distinct count function.

[0023] Domain name access characteristics: specify the date Inside access Frequency characteristics, frequent characteristics, The IP number features of the associated server are formed into an ordered feature sequence according to size, which is used to quantify The first and third digits, mean, standard deviation, and coefficient of variation of the session frequency when the user visits the session are related statistics to characterize the user visit The overall preference, central tendency and discrete tendency of session frequency form 12-dimensional indicators of domain name access characteristics. The statistical characteristics of user access domain names and the calculation formula of domain name indicators are as follows: Frequency of visiting domain name: ; Visit frequency quantile: ; Average visit frequency: ; Visit frequency standard deviation: ; Coefficient of variation of access frequency: ; Frequency of visiting domain names: ; Visit frequency quantile: ; Average access frequency: ; Standard deviation of access frequency: ; Coefficient of variation of access frequency: ; Number of IP addresses associated with the domain name: ; Percentile of associated IP number: ; Average number of associated IP addresses: ; Standard deviation of the number of associated IPs: ; Coefficient of variation of associated IP number: ; is a quantile function, is the tertile function, is the counting function, is the mean function, is the standard deviation function, is a discrete coefficient function.

[0024] User outlier feature matrix construction: Based on the domain name behavior indicator system and user access domain name feature indicators, this paper uses Tukey's test outlier identification method to quantify the degree of user outlier. The principle is to calculate the quartile and interquartile range (IQR) of the data set, that is, the tertile With a quantile The difference between and is used to determine the degree of data outlier. Combining Tukey’s outlier identification method and IQR rule, The data of The data of is regarded as positive extreme outliers. The present invention focuses on the identification of extreme outliers.

[0025] Quantify the outlier value of user access behavior characteristics, for any domain name , calculate the number of users within a day access Behavioral characteristics The positive extreme outlier degree value ,when When access Sometimes they have extreme outlier behavior characteristics.

[0026] Sequence skewness correction: Considering the problem of data distribution skewness of feature sequences in non-experimental environments, a logarithmic skewness correction with a base of 10 is performed on the feature sequences involved, denoted as Combined with the domain name evaluation index system, the revised outlier value calculation formula of the frequency, frequency of user access to the domain name, and the number of associated server IP addresses is as follows: 1) Outlier value of user access to the domain name frequency: ; 2) User access domain name frequency outlier value: ; 3) The outlier value of the number of server IP addresses associated with the domain name accessed by the user: For n users , m domain names , the present invention constructs an n*m*3 dimensional user outlier feature matrix.

[0027] Extreme outlier behavior detection technology: Based on the user access domain name outlier feature matrix constructed according to the Tukey's test outlier data detection method in step 3, when the outlier degree value of the user access domain name frequency, the outlier degree value of the user access domain name frequency, and the outlier degree value of the number of server IP addresses associated with the user access domain name are greater than the specified threshold in one dimension The situation, that is , then in this dimension, the user's behavior of accessing the domain name is higher than that of other users who access the domain name, and it is determined that the user has extreme outlier behavior when accessing the domain name. The present invention combines multiple factors such as the number of users, data distribution, and domain name service category, and sets different outlier judgment thresholds according to the popularity of different domain names. .

[0028] User similarity recommendation algorithm: Based on the n*m*3-dimensional user access domain name outlier feature matrix constructed in step 3, , extract the domain name set D visited within the specified time range and the user outlier feature matrix A, As a bridge, associate users who have accessed domain name set D And the corresponding user outlier feature matrix The present invention adopts cosine similarity as the metric of feature similarity, and calculates the input user outlier feature matrix A and the associated user outlier feature matrix The cosine similarity distance is used to recommend users whose domain name access behavior is highly similar to the input user.

[0029] This patented technology can be applied to a variety of business scenarios, including but not limited to the identification of extreme access behaviors of niche web pages, identification of usage behaviors of special software such as group control, etc. It can identify extreme outlier behaviors in domain name access behaviors, and can also be used to feed similar recommendation scenarios of domain name behaviors into specified users.

[0030] Those skilled in the art can understand that the above are only preferred examples of the invention and are not intended to limit the invention. Although the invention is described in detail with reference to the above examples, those skilled in the art can still modify the technical solutions recorded in the above examples or replace some of the technical features with equivalents. Any modification, equivalent replacement, etc. made within the spirit and principle of the invention should be included in the protection scope of the invention. All technical features in this embodiment can be freely combined according to actual needs.

[0031] Finally, it should be noted that the above is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments or to make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for identifying user outlier behaviors and recommending similar behaviors based on domain name access, characterized by: The specific steps include: Step 1: construct a domain name evaluation index system based on the frequency of users accessing domain names and the behavioral characteristics of the frequency of accessing domain names, and quantify the concentration and dispersion of the domain name access behaviors of all users in the domain from multi-dimensional characteristics; Step 2: Based on the domain name evaluation system, the degree of outlier of user access to domain names is quantified by using the Tukey's Test outlier detection method, so as to build an identification system for extreme outlier behavior of user access to domain names; Tukey's Test is a Tukey test; Step 3: Use domain names as a bridge to associate users with common domain name access behaviors, use the outlier degree feature matrix to characterize the behavioral characteristics of users accessing domain names, and combine machine learning algorithms to conduct in-depth similarity analysis on user behaviors; thereby identifying potential abnormal behavior patterns and users with similar behaviors.

2. The method for identifying user outlier behaviors and recommending similar behaviors based on domain name access according to claim 1, characterized in that: In step 1, the collected message data is merged into session communication data, and a domain name evaluation index system is constructed based on the hypertext transfer protocol HTTP and secure hypertext transfer protocol HTTPS application layer protocol related traffic in the global ultra-large-scale network traffic; Filter the session communication data and extract the session domain information. Each session flow is represented as follows: ,in, is the user sequence of the i-th session traffic; is the source IP; is the destination IP; is the source port; is the sink port; is the domain name; Capture time for the session.

3. The method for identifying user outlier behaviors and recommending similar behaviors based on domain name access according to claim 1, characterized in that: In step 2, the domain name evaluation index system is established as follows: Based on the HTTP and HTTPS application layer protocol session data, from each peer accessed by the user Let's consider any , the user sequence set that communicates with it within a day is ,Will access Behavioral features form an ordered feature sequence according to size, thus constructing A 15-dimensional evaluation index system for the object.

4. The method for identifying user outlier behaviors and recommending similar behaviors based on domain name access according to claim 3 is characterized by: In step 2, the domain name evaluation index system specifically includes the following: 1) Domain name overall attributes: by calculating the specified date Inside The number of peer users is used to quantify the user visits of the domain name, and a secondary derived indicator based on the user visits is designed - the popularity of the domain name, that is, the cumulative distribution curve is used to Divide domain names into super unpopular domain names, unpopular domain names, popular domain names, and popular domain names according to the number of user visits; calculate the number of host IPs associated with the domain name to indicate the number of server IP distribution of the domain name; form a three-dimensional indicator of the overall attributes of the domain name; Number of users accessing the domain name: , the number of server IP addresses associated with the domain name: , domain popularity: ,in, is a distinct count function; 2) Domain name access characteristics: specify the date Inside access The frequency feature, frequentness feature, and number of associated server IP features are respectively formed into an ordered feature sequence according to size to quantify The first and third digits, mean, standard deviation, and coefficient of variation of the session frequency when the user visits the session are related statistics to characterize the user visit The overall preference, central tendency and discrete tendency of session frequency form 12-dimensional indicators of domain name access characteristics; the statistical characteristics of user access domain names and the calculation formula of domain name indicators are as follows: Frequency of visiting domain name: ; Visit frequency quantile: ; Average visit frequency: ; Visit frequency standard deviation: ; Coefficient of variation of access frequency: ; Frequency of visiting domain names: ; Visit frequency quantile: ; Average access frequency: ; Standard deviation of access frequency: ; Coefficient of variation of access frequency: ; Number of IP addresses associated with the domain name: ; Percentile of associated IP number: ; Average number of associated IP addresses: ; Standard deviation of the number of associated IPs: ; Coefficient of variation of associated IP number: ; is a quantile function, is the tertile function; is the counting function, is the mean function, is the standard deviation function, is the discrete coefficient function.

5. The method for identifying user outlier behaviors and recommending similar behaviors based on domain name access according to claim 1, characterized in that: In step 3, the user outlier feature matrix is ​​constructed: based on the domain name behavior indicator system and user access domain name feature indicators built in step 2, the Tukey's test outlier identification method is used to quantify the degree of user outlier. The principle is to calculate the quartile and interquartile range (IQR) of the data set. With a quantile The difference between , to judge the degree of data outlier; Combining Tukey's outlier identification method and IQR rule, the distribution The data of The data is regarded as positive extreme outliers; the present invention focuses on the identification of extreme outliers; Quantify the outlier value of user access behavior characteristics, for any domain name , calculate the number of users within a day access Behavioral characteristics The positive extreme outlier degree value ,when When access Possessing extreme outlier behavior characteristics; Sequence skewness correction: Considering the problem of data distribution skewness of feature sequences in non-experimental environments, a logarithmic skewness correction with a base of 10 is performed on the feature sequences involved, denoted as ; Combined with the domain name evaluation index system, the corrected calculation formula for the frequency, frequency of user access to the domain name, and the outlier degree value of the number of associated server IP addresses is as follows: 1) The frequency of users accessing domain names outliers: ; 2) User access frequency outlier value of domain name: ; 3) The outlier value of the number of server IP addresses associated with the domain name accessed by the user: ; For n users , m domain names , the present invention constructs an n*m*3 dimensional user outlier feature matrix.

6. The method for identifying user outlier behaviors and recommending similar behaviors based on domain name access according to claim 5, characterized in that: According to the Tukey's test outlier data detection method, the user access domain name outlier feature matrix is ​​constructed when the user access domain name frequency outlier value, the user access domain name frequency outlier value, and the user access domain name associated server IP number outlier value exist in a certain dimension greater than the specified threshold The situation, that is , then in this dimension, the user's behavior of accessing the domain name is higher than that of other users who access the domain name, and it is determined that the user has extreme outlier behavior when accessing the domain name; the present invention combines multiple factors such as the number of users, data distribution, and domain name service category, and sets different outlier judgment thresholds according to the popularity of different domain names. .

7. The method for identifying user outlier behaviors and recommending similar behaviors based on domain name access according to claim 1, characterized in that: In step 3, based on the constructed n*m*3-dimensional user access domain name outlier feature matrix, , extract the domain name set D visited within the specified time range and the user outlier feature matrix A, As a bridge, associate users who have accessed domain name set D And the corresponding user outlier feature matrix , using cosine similarity as the metric for feature similarity, by calculating the input user outlier feature matrix A and the associated user outlier feature matrix The cosine similarity distance is used to recommend users whose domain name access behavior is highly similar to the input user.

Images