Program abnormal access identification method and device, electronic equipment and computer medium

Abstract

The embodiment of the invention discloses a program abnormal access identification method and device, electronic equipment and a computer medium. A specific embodiment of the method comprises: in response to a detected real-time access behavior of a target user, determining whether behavior path information corresponding to the real-time access behavior exists in a pre-stored target container, the behavior path information representing an access behavior path corresponding to a historical access behavior; in response to determining that the behavior path information corresponding to the real-time access behavior exists, performing path updating on the behavior path information according to the real-time access behavior; according to the updated behavior path information and a pre-trained program abnormal access identification model, generating a program abnormal access identification result corresponding to the real-time access behavior; and in response to determining that the program abnormal access identification result represents abnormal access, performing forbidding processing on the target user. According to the embodiment, the accuracy of abnormal access identification is improved, and the network security is improved.

Description

Technical Field

[0001] The embodiments of the present disclosure relate to the computer field, and in particular to a method, device, electronic device and computer medium for identifying abnormal program access. Background Art

[0002] Abnormal program access identification refers to the operation of identifying and detecting user access behaviors. For example, a Trojan virus can perform malicious operations on a computer operating system, maliciously tamper with data, etc. At present, the commonly used method for abnormal program access identification is to perform abnormal access identification by comparing features through an abnormal access feature library.

[0003] However, when the above method is used, the following technical problems often occur: abnormal access features often have various forms of variants, which can hide their own behavior paths in the form of disguise. It is difficult to effectively identify the variant program access behavior by feature matching, resulting in reduced accuracy in abnormal access identification and reduced network security.

[0004] The above information disclosed in this Background section is only for enhancement of understanding of the background of the inventive concept and therefore it may contain information that does not form the prior art that is already known in this country to a person of ordinary skill in the art. Summary of the invention

[0005] The content of this disclosure is used to introduce concepts in a brief form, which will be described in detail in the detailed implementation section below. The content of this disclosure is not intended to identify the key features or essential features of the technical solution claimed for protection, nor is it intended to limit the scope of the technical solution claimed for protection.

[0006] Some embodiments of the present disclosure propose a method, an apparatus, an electronic device, and a computer-readable medium for identifying abnormal program access to solve one or more of the technical problems mentioned in the above background technology section.

[0007] In a first aspect, some embodiments of the present disclosure provide a method for identifying abnormal program access, the method comprising: in response to detecting real-time access behavior of a target user, determining whether there is behavior path information corresponding to the real-time access behavior in a pre-stored target container, wherein the behavior path information represents the access behavior path corresponding to the historical access behavior, and the real-time access behavior corresponds to the same behavior initiation node and behavior path as the historical access behavior; in response to determining that there is behavior path information corresponding to the real-time access behavior, updating the behavior path information according to the real-time access behavior to generate updated behavior path information; generating a program abnormal access identification result corresponding to the real-time access behavior according to the updated behavior path information and a pre-trained program abnormal access identification model; in response to determining that the program abnormal access identification result represents abnormal access, banning the target user.

[0008] In a second aspect, some embodiments of the present disclosure provide a device for identifying abnormal program access, the device comprising: a determination unit, configured to, in response to detecting the real-time access behavior of a target user, determine whether there is behavior path information corresponding to the real-time access behavior in a pre-stored target container, wherein the behavior path information represents the access behavior path corresponding to the historical access behavior, and the real-time access behavior corresponds to the same behavior initiation node and behavior path as the historical access behavior; an update unit, configured to, in response to determining that there is behavior path information corresponding to the real-time access behavior, perform path update on the behavior path information according to the real-time access behavior to generate updated behavior path information; a generation unit, configured to generate a program abnormal access identification result corresponding to the real-time access behavior according to the updated behavior path information and a pre-trained program abnormal access identification model; a blocking unit, configured to, in response to determining that the program abnormal access identification result represents abnormal access, block the target user.

[0009] In a third aspect, some embodiments of the present disclosure provide an electronic device comprising: one or more processors; a storage device on which one or more programs are stored, and when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any implementation manner of the above-mentioned first aspect.

[0010] In a fourth aspect, some embodiments of the present disclosure provide a computer-readable medium having a computer program stored thereon, wherein when the program is executed by a processor, the method described in any implementation manner of the above-mentioned first aspect is implemented.

[0011] The above-mentioned embodiments of the present disclosure have the following beneficial effects: through the program abnormal access identification method of some embodiments of the present disclosure, the accuracy of abnormal access identification is improved, and the network security is improved. Specifically, the reason for the reduction in the accuracy of abnormal access identification and the reduction in network security is that: abnormal access features often have multiple forms of variants, which can hide their own behavior paths in the form of disguise, and it is difficult to effectively identify the variant program access behaviors by using feature comparison. Based on this, the program abnormal access identification method of some embodiments of the present disclosure, first, in response to detecting the real-time access behavior of the target user, determines whether there is behavior path information corresponding to the above-mentioned real-time access behavior in the pre-stored target container. Among them, the above-mentioned behavior path information represents the access behavior path corresponding to the historical access behavior, and the above-mentioned real-time access behavior corresponds to the same behavior initiation node and behavior path as the above-mentioned historical access behavior. Therefore, for malicious access behavior, it often uses disguised form to achieve the purpose of tampering with and collecting the content in the computer operating system, so it corresponds to the corresponding behavior execution path. At the same time, for the code carried by the latent malicious access behavior, its tampering and collection often have a certain frequency. Therefore, by judging whether there is behavior path information corresponding to the real-time access behavior, it is possible to determine whether there is an access behavior with the same behavior path and the same behavior initiating node. Then, in response to determining that there is behavior path information corresponding to the above-mentioned real-time access behavior, the above-mentioned behavior path information is updated according to the above-mentioned real-time access behavior to generate updated behavior path information. Then, based on the above-mentioned updated behavior path information and the pre-trained program abnormal access identification model, a program abnormal access identification result corresponding to the above-mentioned real-time access behavior is generated. Finally, in response to determining that the above-mentioned program abnormal access identification result represents an abnormal access, the above-mentioned target user is banned. Thus, combining historical access behavior and current access behavior, from the perspective of access behavior at different times, it is analyzed whether the real-time access behavior is an abnormal access. Thereby, the accuracy of abnormal access identification is improved, and network security is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar figure labels represent the same or similar elements. It should be understood that the drawings are schematic and that the components and elements are not necessarily drawn to scale.

[0013] Figure 1 is a flowchart of some embodiments of the method for identifying abnormal program access according to the present disclosure;

[0014] Figure 2 is a flowchart of some embodiments of a program abnormal access identification device according to the present disclosure;

[0015] Figure 3 It is a schematic diagram of the structure of an electronic device suitable for implementing some embodiments of the present disclosure. DETAILED DESCRIPTION

[0016] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0017] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present disclosure can be combined with each other.

[0018] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0019] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0020] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0021] The present disclosure will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0022] Figure 1 1 is a flowchart of some embodiments of the method for identifying abnormal program access according to the present disclosure. 100 of some embodiments of the method for identifying abnormal program access according to the present disclosure is shown. The method for identifying abnormal program access comprises the following steps:

[0023] Step 101 , in response to detecting a real-time access behavior of a target user, determining whether there is behavior path information corresponding to the real-time access behavior in a pre-stored target container.

[0024] In some embodiments, the execution subject (e.g., a computing device) of the program abnormal access identification method can determine whether there is behavior path information corresponding to the above-mentioned real-time access behavior in the pre-stored target container in response to detecting the real-time access behavior of the target user. Among them, the above-mentioned behavior path information represents the access behavior path corresponding to the historical access behavior, and the above-mentioned real-time access behavior corresponds to the same behavior initiation node and behavior path as the above-mentioned historical access behavior. Among them, the behavior path information represents the behavior path corresponding to the historical access behavior. In practice, the behavior path represents each specific access behavior of the historical access behavior in time sequence. For example, the historical access behavior may include access behavior A and access behavior B, and access behavior A can be executed at time T1 and access behavior B can be executed at time T2. Among them, time T1 is earlier than time T2. Among them, access behavior A can be used to obtain access rights for files. Access behavior B can be tampering with the file content after executing the access behavior. The real-time access behavior corresponds to the same behavior initiation node and behavior path as the above-mentioned historical access behavior. The behavior initiation node can be a terminal that initiates the access behavior. The terminal that initiates the access behavior corresponding to the same IP address as the historical access behavior and the real-time access behavior. Here, the target container may be a storage database storing various behavior paths, and it may be determined whether there is behavior path information identical to the above-mentioned real-time access behavior in the target container.

[0025] In practice, the execution subject may determine whether there is behavior path information corresponding to the real-time access behavior in the pre-stored target container by the following steps:

[0026] The first step is to activate the target container. The target container is an isolated container. The target container can replicate the container of resources stored in the server cluster. By setting the target container, it is possible to avoid the real-time network behavior from damaging the resources in the server when the behavior type of the real-time access behavior is not determined.

[0027] The second step, in response to successful activation, executes the above-mentioned real-time access behavior in the above-mentioned target container, and records the execution content of the above-mentioned real-time access behavior when it is executed as the alternative behavior path information. Among them, the above-mentioned alternative behavior path information includes: an alternative behavior path node queue, and the alternative behavior nodes in the above-mentioned alternative behavior path node queue include: behavior commands, behavior execution environment, behavior execution status, and behavior operation content. Among them, the above-mentioned alternative behavior path information includes: an alternative behavior path node queue. The alternative behavior nodes in the above-mentioned alternative behavior path node queue include: behavior commands, behavior execution environment, behavior execution status, and behavior operation content. In practice, the above-mentioned real-time access behavior can be executed in the target container to obtain each specific access behavior operation of the above-mentioned real-time access behavior in time sequence as an alternative behavior path node queue. The behavior command represents a specific straight behavior command. For example, the behavior command can be "reg add XX", which means to modify the registration list.

[0028] The third step is to perform the following path search steps based on the candidate behavior node sequence:

[0029] 1. The candidate behavior path node at the head of the queue in the candidate behavior path node queue is determined as the target behavior path node.

[0030] 2. According to the behavior commands, behavior execution environment, and behavior execution status included in the target behavior path node, traverse the behavior path graph to determine whether the target behavior path node is included in the behavior path graph. Among them, the behavior path graph is a directed graph generated according to different access behaviors. The behavior path graph can be a path graph constructed according to various historical operation behaviors before the real-time operation behavior. In practice, the above-mentioned execution subject can determine whether there is a path node in the behavior path graph that has the same behavior commands, behavior execution environment, and behavior execution status as the target behavior path node by traversing the graph.

[0031] 3. In response to the non-existence, generate a determination result indicating that the above-mentioned behavior path information does not exist.

[0032] 4. In response to the existence of a candidate behavior node sequence excluding the target behavior path node and being empty, a determination result indicating the existence of the above-mentioned behavior path information is generated.

[0033] In the fourth step, in response to the existence of the candidate behavior node sequence excluding the target behavior path node and being non-empty, the candidate behavior node sequence excluding the target behavior path node is used as the candidate behavior node sequence, and the above path search step is performed again.

[0034] Step 102 , in response to determining that there is behavior path information corresponding to the real-time access behavior, update the behavior path information according to the real-time access behavior to generate updated behavior path information.

[0035] In some embodiments, the execution subject may, in response to determining that there is behavior path information corresponding to the real-time access behavior, perform a path update on the behavior path information according to the real-time access behavior to generate updated behavior path information. In practice, since the real-time access behavior corresponds to the same behavior path as the historical access behavior, one alternative behavior path node corresponds to one behavior path node. Thus, for each behavior path node in the behavior path node sequence, the execution subject may update the behavior execution status and behavior operation content included in the behavior path node according to the corresponding alternative behavior path node. In practice, the update method does not use an overwrite update, but an append update to record changes to the same path node at different times.

[0036] Step 103: Generate a program abnormal access identification result corresponding to the real-time access behavior according to the update behavior path information and the pre-trained program abnormal access identification model.

[0037] In some embodiments, the execution subject may generate a program abnormal access identification result corresponding to the real-time access behavior based on the updated behavior path information and a pre-trained program abnormal access identification model. The program abnormal access identification model may be a pre-trained neural network model that takes the behavior path information as input and the program abnormal access identification result as output. For example, the program abnormal access identification model may be a CNN convolutional neural network model.

[0038] The program abnormal access recognition model can be trained through the following steps:

[0039] The first step is to obtain a behavior path information sample set, wherein the behavior path information samples in the behavior path information sample set include: sample behavior path information and sample information labels.

[0040] The second step is to determine the initial program abnormal access recognition model. The above-mentioned initial program abnormal access recognition model includes: an initial feature extraction network, an initial access information detection network, the initial feature extraction network includes: an initial convolution model sequence, and the initial convolution model in the initial convolution model sequence includes: an initial sub-convolution model and an initial activation model. Here, the input of the initial convolution sub-model included in the initial convolution model in the initial convolution model sequence can be: the output of the initial activation model included in the previous initial convolution model. The input of the initial convolution sub-model included in the first initial convolution model in the initial convolution model sequence can be: sample behavior path information. The input of the initial activation model of the initial convolution model in the initial convolution model sequence can be: the output of the initial convolution sub-model included in the initial convolution model. For example, the number of initial convolution models in the initial convolution model sequence can be 20. The initial access information detection network can be a Template2Vec model and a Log2Vec model.

[0041] The third step is to select a target behavior path information sample from the above behavior path information sample set. A behavior path information sample can be randomly selected from the above behavior path information sample set as the target behavior path information sample.

[0042] The fourth step is to input the sample behavior path information included in the target behavior path information sample into the initial program abnormal access recognition model to obtain the initial program abnormal access recognition result.

[0043] Step 5: Determine the error value between the above-mentioned initial program abnormal access identification result and the corresponding sample information label. The error value between the above-mentioned initial program abnormal access identification result and the corresponding sample information label can be determined by a preset loss function. For example, the preset loss function can be a hinge loss function or a cross entropy loss function.

[0044] In a sixth step, in response to determining that the error value is less than or equal to a preset error value, the initial program abnormal access recognition model is determined as a trained program abnormal access recognition model.

[0045] Step 104: in response to determining that the abnormal access identification result of the program indicates abnormal access, the target user is blocked.

[0046] In some embodiments, the execution subject may block the target user in response to determining that the abnormal access identification result of the program indicates abnormal access. For example, the user account of the target user may be blocked.

[0047] Optionally, in response to determining that there is no behavior path information corresponding to the real-time access behavior, an access behavior feature corresponding to the real-time access behavior is generated.

[0048] In some embodiments, the execution subject may generate an access behavior feature corresponding to the real-time access behavior in response to determining that there is no behavior path information corresponding to the real-time access behavior.

[0049] In practice, the execution subject may generate access behavior features corresponding to the real-time access behavior through the following steps:

[0050] In the first step, for each candidate behavior path node in the candidate behavior path node queue, the following feature processing steps are performed:

[0051] 1. Disassemble the behavior commands included in the alternative behavior path node to generate an assembly instruction set. The behavior commands included in the alternative behavior path node can be disassembled by dynamic debugging tools and static debugging tools to generate an assembly instruction set. In practice, due to differences in language formats corresponding to different high-level languages, the behavior commands included in the alternative behavior path node can be converted into an assembly instruction set of the same expression form through disassembly.

[0052] 2. Perform instruction feature extraction on each assembly instruction in the above assembly instruction set to generate instruction features and obtain an instruction feature set. The instruction feature extractor included in the access behavior feature extractor can be used to perform instruction feature extraction on the assembly instruction to generate instruction features. Specifically, the instruction feature extractor can be a downsampling network consisting of 5 layers of serially connected convolutional layers. Specifically, the streamlined network structure can reduce the amount of feature processing in the feature extraction process. In addition, the network structure design of the downsampling network can reduce the feature length.

[0053] 3. Extract environmental features of the behavior execution environment included in the above-mentioned alternative behavior path node to obtain environmental features. This can be done by accessing the environmental feature extractor included in the behavior feature extractor. In practice, the environmental feature extractor can extract indicator features of key execution indicators in the behavior execution environment. The above-mentioned execution subject can use the environmental feature extractor to extract indicator features of key execution indicators in the behavior execution environment to obtain environmental features. In practice, key indicators may include: read operation permission status, current process list, current hardware resource occupancy status, etc.

[0054] 4. State mapping is performed on the behavior execution states included in the candidate behavior path nodes to obtain a behavior execution state vector. A one-hot encoding method can be used to state map the behavior execution states included in the candidate behavior path nodes to obtain a behavior execution state vector.

[0055] 5. Extract the behavior operation content included in the candidate behavior path node to generate the operation content feature. The execution subject can extract the behavior operation content included in the candidate behavior path node by accessing the operation content extraction model included in the behavior feature extractor to generate the operation content feature. The operation content extraction model adopts the Word2Vec model to embed the behavior operation content included in the candidate behavior path node to obtain the operation content feature.

[0056] 6. Feature mapping is performed on the above-mentioned instruction feature set, the above-mentioned environmental features, the above-mentioned behavior execution state vector and the above-mentioned operation content features to obtain mapped features. The above-mentioned execution subject can access the first upsampling network, the second upsampling network, the third upsampling network and the fourth upsampling network included in the behavior feature extractor. Among them, the first upsampling network is used to perform feature upsampling on the instruction feature set. The second upsampling network is used to perform feature upsampling on the environmental features. The third upsampling network is used to perform feature upsampling on the behavior execution state vector. The fourth upsampling network is used to perform feature upsampling on the operation content features. Among them, the feature dimensions output by the first upsampling network, the second upsampling network, the third upsampling network and the fourth upsampling network are N×M1, N×M2, N×M3, and N×M4 respectively. Then, since the horizontal dimensions of the dimensions of the output features are the same, the features output by different upsampling networks can be vertically spliced ​​as the above-mentioned mapped features.

[0057] In the second step, each mapped feature in the obtained mapped feature set is concatenated to obtain a mapped feature graph for the above real-time access behavior as the above access behavior feature.

[0058] Thus, when the real-time access behavior is the first access behavior, the corresponding behavior type is determined. Specifically, first, for each candidate behavior path node, the present disclosure extracts features from the perspectives of behavior command, behavior execution environment, behavior execution status, and behavior operation content. Next, considering that different access behaviors contain different numbers of behavior path nodes, resulting in differences in the size of the access behavior features obtained, in this way, when the real-time access behavior is the first access behavior, the corresponding behavior type is determined.

[0059] Optionally, an access behavior type corresponding to the real-time access behavior is generated according to the access behavior characteristics and a pre-trained access behavior type classification model.

[0060] In some embodiments, the execution subject may generate an access behavior type corresponding to the real-time access behavior based on the access behavior characteristics and a pre-trained access behavior type classification model. The access behavior types include: a first behavior type and a second behavior type, the first behavior type characterizing that the real-time access behavior does not contain malicious code, and the second behavior type characterizing that the real-time access behavior contains malicious code. The access behavior type classification model may be a pulse neural network model, which may include 1 input layer, M hidden layers and 1 output layer. The hidden layer contains W neurons. Compared with traditional neural network models, the calculation speed is faster, and for access behaviors with a higher proportion of zero, feature extraction can be better performed to determine the corresponding access behavior type.

[0061] The access behavior type classification model can be trained through the following steps:

[0062] The first step is to obtain a set of access behavior feature training samples, wherein the access behavior feature training samples include: access behavior feature samples and sample labels.

[0063] The second step is to determine the initial access behavior type classification model. The initial access behavior type classification model includes: an initial access behavior feature extractor and an initial behavior type classifier. The initial access behavior feature extractor is used to generate access behavior features based on the above-mentioned real-time access behavior. The initial behavior type classifier may include K deep feature extractors, a feature overlay layer, and a binary classifier. Among them, the network structures of the K deep feature extractors are the same and are arranged in parallel. The deep feature extractor adopts the ResNet model. The K deep feature extractors are connected to 1 feature overlay layer, which is used to implement the Add operation to superimpose the features output by the K deep feature extractors. The classifier is used to output the behavior type.

[0064] The third step is to select a target access behavior feature training sample from the access behavior feature training sample set. An access behavior feature training sample can be randomly selected from the access behavior feature training sample set as the target access behavior feature training sample.

[0065] In the fourth step, the access behavior feature samples included in the target access behavior feature training samples are input into the initial access behavior type classification model to obtain the initial access behavior type classification result.

[0066] Step 5: Determine the loss value between the initial access behavior type classification result and the corresponding sample label. The loss value between the initial access behavior type classification result and the corresponding sample label can be determined by a preset loss function. For example, the preset loss function can be a hinge loss function or a cross entropy loss function.

[0067] In a sixth step, in response to determining that the above loss value is less than or equal to the preset loss value, the initial access behavior type classification model is determined as the trained access behavior type classification model.

[0068] Optionally, in response to determining that the access behavior type indicates that the real-time access behavior contains malicious code, the target user is blocked.

[0069] In some embodiments, the execution subject may ban the target user in response to determining that the access behavior type indicates that the real-time access behavior contains malicious code.

[0070] Further references Figure 2 As an implementation of the methods shown in the above figures, the present disclosure provides some embodiments of a program abnormal access identification device. These program abnormal access identification device embodiments are similar to Figure 1 Corresponding to the method embodiments shown, the program abnormal access identification device can be specifically applied to various electronic devices.

[0071] like Figure 2 As shown, the program abnormal access identification device 200 of some embodiments includes: a determination unit 201, an update unit 202, a generation unit 203 and a banning unit 204. The determination unit 201 is configured to, in response to detecting the real-time access behavior of the target user, determine whether there is behavior path information corresponding to the real-time access behavior in the pre-stored target container, wherein the behavior path information represents the access behavior path corresponding to the historical access behavior, and the real-time access behavior corresponds to the same behavior initiation node and behavior path as the historical access behavior; the update unit 202 is configured to, in response to determining that there is behavior path information corresponding to the real-time access behavior, perform path update on the behavior path information according to the real-time access behavior to generate updated behavior path information; the generation unit 203 is configured to generate a program abnormal access identification result corresponding to the real-time access behavior according to the updated behavior path information and the pre-trained program abnormal access identification model; the banning unit 204 is configured to, in response to determining that the program abnormal access identification result represents abnormal access, ban the target user.

[0072] It can be understood that the various units recorded in the program abnormal access identification device 200 are similar to the reference Figure 1 Therefore, the operations, features and beneficial effects described above for the method are also applicable to the program abnormal access identification device 200 and the units included therein, and will not be described in detail here.

[0073] Reference below Figure 3, which shows a schematic diagram of the structure of an electronic device (e.g., a computing device) 300 suitable for implementing some embodiments of the present disclosure. The electronic devices in some embodiments of the present disclosure may include, but are not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (e.g., vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 3 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0074] like Figure 3 As shown, the electronic device 300 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 302 or a program loaded from a storage device 308 into a random access memory (RAM) 303. In the RAM 303, various programs and data required for the operation of the electronic device 300 are also stored. The processing device 301, the ROM 302, and the RAM 303 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0075] Typically, the following devices may be connected to the I / O interface 305: input devices 306 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; output devices 307 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 308 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 309. The communication devices 309 may allow the electronic device 300 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 3 The electronic device 300 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead. Figure 3 Each block shown in the figure may represent one device, or may represent multiple devices as required.

[0076] In particular, according to some embodiments of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, some embodiments of the present disclosure include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In some such embodiments, the computer program can be downloaded and installed from the network through the communication device 309, or installed from the storage device 308, or installed from the ROM 302. When the computer program is executed by the processing device 301, the above-mentioned functions defined in the method of some embodiments of the present disclosure are executed.

[0077] It should be noted that the computer-readable medium recorded in some embodiments of the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In some embodiments of the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In some embodiments of the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0078] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0079] The computer-readable medium may be included in the electronic device; or it may exist independently without being installed in the electronic device. The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device: in response to detecting the real-time access behavior of the target user, determines whether there is behavior path information corresponding to the real-time access behavior in the pre-stored target container, wherein the behavior path information represents the access behavior path corresponding to the historical access behavior, and the real-time access behavior corresponds to the same behavior initiation node and behavior path as the historical access behavior; in response to determining that there is behavior path information corresponding to the real-time access behavior, the behavior path information is updated according to the real-time access behavior to generate updated behavior path information; based on the updated behavior path information and the pre-trained program abnormal access identification model, a program abnormal access identification result corresponding to the real-time access behavior is generated; in response to determining that the program abnormal access identification result represents abnormal access, the target user is banned.

[0080] Computer program code for performing the operations of some embodiments of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0081] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0082] The units described in some embodiments of the present disclosure may be implemented by software or by hardware. The described units may also be provided in a processor, for example, may be described as: a processor comprising: a determination unit, an update unit, a generation unit and a blocking unit. Among them, the names of these units do not constitute a limitation on the unit itself under certain circumstances, for example, the blocking unit may also be described as "a unit that blocks the above-mentioned target user in response to determining that the above-mentioned program abnormal access identification result represents abnormal access".

[0083] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0084] The above descriptions are only some preferred embodiments of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the embodiments of the present disclosure is not limited to the technical solutions formed by a specific combination of the above-mentioned technical features, but should also cover other technical solutions formed by any combination of the above-mentioned technical features or their equivalent features without departing from the above-mentioned inventive concept. For example, the above-mentioned features are replaced with the technical features with similar functions disclosed in the embodiments of the present disclosure (but not limited to) and the technical solutions formed.

Claims

1. A method for identifying abnormal program access, comprising: In response to detecting the real-time access behavior of the target user, determining whether there is behavior path information corresponding to the real-time access behavior in a pre-stored target container, wherein the behavior path information represents the access behavior path corresponding to the historical access behavior, and the real-time access behavior corresponds to the same behavior initiation node and behavior path as the historical access behavior; In response to determining that there is behavior path information corresponding to the real-time access behavior, updating the behavior path information according to the real-time access behavior to generate updated behavior path information; Generate a program abnormal access identification result corresponding to the real-time access behavior according to the update behavior path information and a pre-trained program abnormal access identification model; In response to determining that the program abnormal access identification result represents abnormal access, the target user is blocked.

2. The method according to claim 1, wherein: The method further comprises: In response to determining that there is no behavior path information corresponding to the real-time access behavior, generating an access behavior feature corresponding to the real-time access behavior; Generate an access behavior type corresponding to the real-time access behavior according to the access behavior characteristics and a pre-trained access behavior type classification model, wherein the access behavior type includes: a first behavior type and a second behavior type, the first behavior type characterizing that the real-time access behavior does not contain malicious code, and the second behavior type characterizing that the real-time access behavior contains malicious code; In response to determining that the access behavior type indicates that the real-time access behavior contains malicious code, the target user is blocked.

3. The method according to claim 2, wherein: Before generating the access behavior type corresponding to the real-time access behavior according to the access behavior characteristics and the pre-trained access behavior type classification model, the method further includes: Obtaining an access behavior feature training sample set, wherein the access behavior feature training sample includes: an access behavior feature sample and a sample label; Determine the initial access behavior type classification model; Selecting a target access behavior feature training sample from the access behavior feature training sample set; Inputting the access behavior feature samples included in the target access behavior feature training samples into the initial access behavior type classification model to obtain the initial access behavior type classification result; Determine a loss value between the initial access behavior type classification result and the corresponding sample label; In response to determining that the loss value is less than or equal to the preset loss value, the initial access behavior type classification model is determined as the trained access behavior type classification model.

4. The method according to claim 1, wherein: Before generating a program abnormal access identification result corresponding to the real-time access behavior according to the update behavior path information and the pre-trained program abnormal access identification model, the method further includes: Acquire a behavior path information sample set, wherein the behavior path information samples in the behavior path information sample set include: sample behavior path information and sample information labels; Determine an initial program abnormal access recognition model, wherein the initial program abnormal access recognition model includes: an initial feature extraction network, an initial access information detection network, the initial feature extraction network includes: an initial convolution model sequence, and the initial convolution model in the initial convolution model sequence includes: an initial sub-convolution model and an initial activation model; Selecting a target behavior path information sample from the behavior path information sample set; Inputting the sample behavior path information included in the target behavior path information sample into the initial program abnormal access recognition model to obtain the initial program abnormal access recognition result; Determine an error value between the initial program abnormal access identification result and the corresponding sample information label; In response to determining that the error value is less than or equal to the preset error value, the initial program abnormal access recognition model is determined as the trained program abnormal access recognition model.

5. A device for identifying abnormal program access, comprising: A determination unit is configured to, in response to detecting a real-time access behavior of a target user, determine whether there is behavior path information corresponding to the real-time access behavior in a pre-stored target container, wherein the behavior path information represents an access behavior path corresponding to a historical access behavior, and the real-time access behavior corresponds to the same behavior initiation node and behavior path as the historical access behavior; an updating unit, configured to, in response to determining that there is behavior path information corresponding to the real-time access behavior, perform path update on the behavior path information according to the real-time access behavior to generate updated behavior path information; A generating unit configured to generate a program abnormal access identification result corresponding to the real-time access behavior according to the update behavior path information and a pre-trained program abnormal access identification model; The blocking unit is configured to block the target user in response to determining that the program abnormal access identification result represents abnormal access.

6. An electronic device comprising: one or more processors; a storage device having one or more programs stored thereon; When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 4.

7. A computer readable medium having a computer program stored thereon, wherein: When the program is executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images