A data service interface authentication method

Abstract

The present invention relates to the technical field of access rights, and in particular to an authentication method for a data service interface. The method divides time periods according to the number of accesses at an interface to obtain analysis time periods, determines abnormal time periods by analyzing access changes in time periods and user access durations, and screens out malicious attack segments in combination with similar distributions with other time periods; obtains correlation indicators by analyzing similarities between time periods and the distribution of malicious attack segments between interfaces; obtains behavioral abnormality and determines abnormal users based on the correlation indicators of user access to interfaces in time sequence and the possibility of abnormal access in combination with the number of accesses; and performs interface authorization restrictions based on the abnormal degree of abnormal users. The present invention screens malicious attack parts based on access changes between multiple time periods, and in combination with the association relationship between interfaces, makes the abnormal analysis of user interface access behavior more accurate, and then restricts permissions based on abnormal behavior, making the authorization restrictions of interfaces safer and more reliable.

Description

Technical Field

[0001] The present invention relates to the technical field of access rights, and in particular to an authentication method for a data service interface. Background Art

[0002] Data service interface authentication is to authenticate the user's identity and determine whether the user has the authority to access the interface or operate related information, so that the user's access to the interface is safe and controllable, thereby maintaining the security of the system and protecting user data. However, in actual use, there are malicious attacks or theft behaviors, which threaten information security. Therefore, it is necessary to accurately identify abnormal access and promptly reject the corresponding user's related operations.

[0003] As network traffic continues to grow, malicious access attacks will flow in with a large amount of traffic from access interfaces. The malicious attack part increases the difficulty of interface association analysis and has an impact on the deviation analysis of user access behavior. When the abnormal part is analyzed inaccurately, the difficulty of user abnormal analysis is increased. Inaccurate analysis of user abnormal access will make the control security of interface access rights insecure, bringing greater information security risks. Summary of the invention

[0004] In order to solve the technical problem that the inaccurate analysis of abnormal user access in the prior art will make the control of interface access rights insecure, the purpose of the present invention is to provide an authentication method for a data service interface, and the technical solution adopted is as follows:

[0005] The present invention provides a data service interface authentication method, the method comprising:

[0006] In each sampling period of the historical period, the interface, access time and access duration of each user at each time are obtained; based on the similarity of the number of accesses of each interface at adjacent times in each sampling period, the analysis period of each interface in each sampling period is obtained;

[0007] According to the duration and number of visits of each interface in each analysis period, and the consistency of the visit duration of different users, the abnormal possibility of each analysis period is obtained; the abnormal period is determined from the analysis period according to the abnormal possibility; according to the difference between the abnormal period and each other abnormal period in duration and abnormal possibility, the similarity index between the abnormal period and each other abnormal period is obtained; and the similar period of each abnormal period is determined according to the similarity index;

[0008] According to the number and interval distribution of all similar time periods corresponding to each abnormal time period, the malicious attack segments are screened out from all abnormal time periods in combination with the size of the similarity index; based on the distribution of malicious attack segments between each interface and other interfaces in different sampling periods, according to the similarity between the number of accesses and the user access duration in the analysis period, the correlation index of each interface with other interfaces is obtained;

[0009] According to the correlation index between the interface accessed by each user each time and the interface accessed last time in the time sequence, combined with the abnormal possibility corresponding to the interface at the access time and the number of user visits, the behavior abnormality degree of each user is obtained; abnormal users are determined from the users according to the behavior abnormality degree;

[0010] According to the distribution of abnormal user accesses and the degree of abnormal behavior in the current period, the restricted interface access number of abnormal users is obtained.

[0011] Furthermore, the method for obtaining the analysis period includes:

[0012] For any sampling period of any interface, the range of the number of accesses corresponding to the time in the sampling period is taken as the range change value;

[0013] The difference in the number of visits between each moment and the previous moment in the time series is taken as the visit difference at each moment; the ratio of the range change value to the visit difference at each moment is taken as the similarity index at each moment;

[0014] Traverse all moments in the sampling period, and when the similarity index is greater than the preset similarity threshold, merge each moment with the previous moment to obtain the initial period; take the average of all the access numbers in each initial period as the period access volume of each initial period;

[0015] After the traversal, when there are unmerged moments, if there is an adjacent initial time period for the unmerged moment, merge the corresponding unmerged moment with the adjacent initial time period and update the initial time period; if there are two adjacent initial time periods for the unmerged moment, calculate the difference between the number of visits of the unmerged moment and the number of visits of each adjacent initial time period as the merge deviation, merge the adjacent initial time period corresponding to the smallest merge deviation with the corresponding unmerged moment, and update the initial time period; iterate the merge until there are no unmerged moments, and use each initial time period as the analysis time period of the sampling cycle.

[0016] Furthermore, the method for obtaining the abnormal possibility degree includes:

[0017] For an analysis period of any interface, the quantity anomaly index of the analysis period is obtained according to the proportion of the number of accesses in the analysis period in the sampling period;

[0018] According to the chaotic distribution of the access time of all users in the analysis period, the user access abnormality index of the analysis period is obtained;

[0019] According to the difference between the duration of the analysis period and the average duration of all analysis periods in the sampling period, the duration anomaly index of the analysis period is obtained;

[0020] The abnormality possibility of the analysis period is obtained by combining the quantity abnormality index, user access abnormality index and duration abnormality index of the analysis period.

[0021] Furthermore, the method for obtaining the similarity index includes:

[0022] In any sampling period of any interface, the time difference between each abnormal period and each other abnormal period in the sampling period is used as the time difference degree;

[0023] The difference in the abnormal possibility between each abnormal period and each other abnormal period in the sampling period is taken as the abnormal difference degree;

[0024] The product of the time difference and the abnormal difference between each abnormal period and each other abnormal period in the sampling period is negatively correlated and normalized to obtain the similarity index between each abnormal moment and each other abnormal period.

[0025] Furthermore, the method of filtering out malicious attack segments from all abnormal time periods according to the number and interval distribution of all similar time periods corresponding to each abnormal time period and the size of the similarity index includes:

[0026] For any abnormal period, obtain the mean value of the number of similar periods of each abnormal period in the sampling period where the abnormal period is located, and obtain the cycle similarity number of the abnormal period; take the ratio of the number of similar periods of the abnormal period to the cycle similarity number as the quantity index of the abnormal period;

[0027] Among all similar time periods of the abnormal time period, the maximum time interval between the center points of two similar time periods is obtained as the interval index of the abnormal time period;

[0028] Calculate the average of the similarity indexes between the abnormal period and all similar periods to obtain the similarity mean index of the abnormal period;

[0029] Combine the quantity index, interval index and similarity mean index of the abnormal period to obtain the possibility of malicious attack in the abnormal period;

[0030] When the possibility of a malicious attack is greater than a preset attack threshold, the corresponding abnormal period is regarded as a malicious attack period.

[0031] Furthermore, the method for obtaining the correlation index includes:

[0032] The analysis period of each non-malicious attack segment of each interface in each sampling period is used as the correlation analysis period of each interface;

[0033] For any interface, match each correlation analysis period of the interface in each sampling cycle with the correlation analysis period of each other interface in the same sampling cycle to obtain the matching period of each correlation analysis period of the interface in each sampling cycle with each other interface;

[0034] For any other interface of the interface, the difference in the number of visits between each associated analysis period and the matching period of the other interface is used as the associated visit volume deviation of each associated analysis period; the mean of the access duration of all users in each associated analysis period is calculated as the access duration distribution of each associated analysis period; the difference in the access duration distribution between each associated analysis period and the matching period of the other interface is used as the associated access duration deviation of each associated analysis period;

[0035] Calculate the product of the associated access time deviation and the associated access volume deviation in each associated analysis period and perform negative correlation mapping to obtain the matching similarity of each associated analysis period;

[0036] According to the number of malicious attack segments of the interface and the other interface in each sampling period and the matching similarity of all correlation analysis time periods, the correlation index between the interface and the other interface is obtained.

[0037] Furthermore, the method for obtaining the matching period includes:

[0038] The central moment of each correlation analysis period is taken as the distribution moment of each correlation analysis period;

[0039] For any other interface, for any correlation analysis period in any sampling period of the interface, calculate the time difference between the distribution time of the correlation analysis period and the distribution time of all correlation analysis periods in the other interface;

[0040] The association analysis period in the other interface corresponding to the association analysis period when the minimum time difference occurs is used as the matching period between the association analysis period and the other interface.

[0041] Furthermore, obtaining the correlation index between the interface and the other interface according to the number of malicious attack segments of the interface and the other interface in each sampling period and the matching similarity of all correlation analysis periods includes:

[0042] The average of the number of malicious attack segments of the interface and the other interface in each sampling period is negatively correlated and mapped as the analysis confidence of the interface and the other interface in each sampling period;

[0043] The sum of the matching similarities between the interface and the other interface in all associated analysis periods in each sampling period is used as the matching similarity index between the interface and the other interface in each sampling period;

[0044] In each sampling period of the interface and the other interface, the product of the matching similarity index and the analysis confidence is calculated to obtain the period correlation index of the interface and the other interface in each sampling period;

[0045] An average value of the period correlation index between the interface and the other interface in all sampling periods is used as the correlation index between the interface and the other interface.

[0046] Furthermore, the method for obtaining the degree of behavioral abnormality includes:

[0047] For any user, the inverse proportional value of the correlation index between the interface accessed by the user each time and the interface accessed last time in time sequence is used as the correlation abnormality degree of each access by the user;

[0048] The abnormal possibility of the access time of each visit of the user in the analysis period corresponding to the access interface is used as the abnormality degree of each access time of the user;

[0049] The product of the association abnormality degree and the time abnormality degree of each visit of the user is used as the visit abnormality degree of each visit of the user;

[0050] The user's behavior abnormality is obtained by combining the access abnormality of all the user's accesses and the total number of accesses of the user.

[0051] Furthermore, the method for obtaining the limited interface access number includes:

[0052] For any abnormal user in the current period, negative correlation mapping is performed on the mean of the time intervals of the abnormal user's visits in the current period to obtain the access frequency of the abnormal user; the product of the access frequency and the number of visits of the abnormal user in the current period is used as the access risk of the abnormal user;

[0053] Normalizing the product of the abnormal user's access risk and behavior abnormality to obtain the abnormal user's authorization restriction degree;

[0054] The product of the value of the negative correlation mapping of the authorization restriction degree of the abnormal user and the preset interface access number is rounded down to obtain the restricted interface access number of the abnormal user.

[0055] The present invention has the following beneficial effects:

[0056] The present invention divides the access situation on the interface into time periods for analysis of abnormalities, confirms the preliminary abnormal period through the access changes in the time period and the user access duration, and considers the characteristics of the exploratory attack and the staged multiple attacks of the malicious attack, and combines with the similar distribution of other time periods to more accurately screen out the time period with malicious attacks, and can reduce the analysis impact brought by the malicious attack situation in the subsequent association analysis. Further, through the similar situation between time periods in the sampling cycle and the distribution of the malicious attack segments, the degree of association between the interfaces is analyzed as a whole, so as to facilitate the subsequent screening of users with more abnormal interface access behavior deviations. Through the association of the user's access to the interface in time sequence and the possibility that the access itself is in an abnormal period, and considering the characteristics that the abnormal behavior user is usually a new user, combined with the user's access number, the behavior abnormality is obtained to determine the abnormal user, and the interface restriction of authorized access is performed based on the abnormal behavior of the abnormal user. The present invention screens the part with malicious attacks based on the change of access situation between multiple time periods, determines a more accurate interface association relationship in combination with the access difference, provides a reliable basis for the subsequent user interface access behavior deviation analysis, obtains more accurate abnormal users and behavior abnormalities to restrict access, and makes the authorization restriction of the interface safer and more reliable. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0058] Figure 1 A flow chart of an authentication method for a data service interface provided by an embodiment of the present invention;

[0059] Figure 2 A schematic diagram of the change in the number of accesses to a single interface in a sampling period provided by an embodiment of the present invention;

[0060] Figure 3 A flow chart of a method for obtaining anomaly probability provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0061] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the following is a detailed description of the authentication method of a data service interface proposed by the present invention, its specific implementation method, structure, features and effects, in conjunction with the accompanying drawings and preferred embodiments. In the following description, different "one embodiment" or "another embodiment" does not necessarily refer to the same embodiment. In addition, specific features, structures or characteristics in one or more embodiments may be combined in any suitable form.

[0062] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0063] The following is a detailed description of a specific scheme of an authentication method for a data service interface provided by the present invention in conjunction with the accompanying drawings.

[0064] See also Figure 1 , which shows a flow chart of an authentication method for a data service interface provided by an embodiment of the present invention, the method comprising the following steps:

[0065] S1: In each sampling period of the historical period, obtain the interface, access time and access duration of each user at each time; based on the similarity of the number of accesses of each interface at adjacent times in each sampling period, obtain the analysis period of each interface in each sampling period.

[0066] For the authorization adjustment of the user access interface, the deviation of the access behavior of each user is analyzed. The malicious access in the large number of accesses of multiple interfaces will affect the analysis of the deviation of user behavior. Therefore, in order to analyze abnormal users more accurately, the malicious attack analysis is first performed in time sequence according to the access volume between interfaces. Therefore, in the embodiment of the present invention, the access data at each moment is recorded at each interface. The access data includes the access duration of each user, that is, each access of each user corresponds to an access interface and access time, as well as the access duration of the access. The total number of accesses of all users at each moment of each interface is the number of accesses at each moment. Please refer to Figure 2 , which shows a schematic diagram of the change in the number of accesses to a single interface in a sampling period provided by an embodiment of the present invention.

[0067] In a specific embodiment of the present invention, the historical period is set to two weeks, the sampling period is one day, and the sampling frequency of the moment is recorded once per minute. The implementer of the specific collection process can adjust it according to the specific implementation scenario, and no limitation is made here.

[0068] Malicious access usually interferes with the normal operation of the interface by exhausting server resources, that is, a large number of concentrated accesses to the interface interfere with normal access behavior or even make it impossible to access the interface normally. Normal user access to the interface is usually evenly distributed in various time periods, so it is necessary to divide the time periods so that the subsequent division and analysis of the time periods that are attacked by malicious attacks can be carried out.

[0069] When an interface is maliciously accessed, the access volume of the interface will have certain abnormal changes compared with normal access, and the access volume at different times during the malicious access will be relatively similar. Therefore, the similarity of the number of accesses between adjacent times in the sampling period can be used to merge the moments of similar access numbers at the interface, so as to divide the sampling period and obtain the analysis period of each interface in each sampling period.

[0070] S2: Obtain the abnormal possibility of each analysis period based on the duration and number of visits of each interface in each analysis period, as well as the consistency of the visit duration of different users; determine the abnormal period from the analysis period based on the abnormal possibility; obtain the similarity index between the abnormal period and each other abnormal period based on the difference between the duration and abnormal possibility of the abnormal period and each other abnormal period; determine the similar period of each abnormal period based on the similarity index.

[0071] For the different divided time periods, we further analyze the possibility of abnormal access. The access of normal users is usually evenly distributed in each time period, which is quite different from the short-term changes caused by the attack. Therefore, considering that the access volume will increase suddenly when the attack produces abnormal output, and the access behavior of most abnormal users during the attack is consistent, that is, the access duration is more consistent, we analyze the possible abnormalities in each analysis period.

[0072] The higher the overall number of visits in a time period, the shorter the duration ratio, and the more consistent the user access duration, the higher the possibility of abnormality in the time period. The time period with a higher possibility of abnormality is then preliminarily screened out to obtain the abnormal time period.

[0073] However, the normal behavior of users themselves will also have a certain degree of randomness, and there may also be a sudden increase in the number of visits in a certain period of time, that is, occasional access anomalies caused by normal access behavior, but this anomaly is more random and changes faster, and is quite different from the anomalies between other access anomaly periods. Compared with malicious access, there are probing attacks or multiple consistent attacks in stages. The similarities between the abnormal period and other abnormal periods can be further analyzed from the differences in duration and abnormal possibility.

[0074] The more consistent the time distribution is, the more consistent the anomaly possibility is, which means that the consistency of user abnormal behavior in the time period is high, and the higher the similarity index is, and then other abnormal time periods with higher similarity indexes in the abnormal time period are determined as similar time periods, providing an analytical basis for further determining the attacked time period.

[0075] S3: According to the number and interval distribution of all similar time periods corresponding to each abnormal time period, the malicious attack segments are screened out from all abnormal time periods in combination with the size of the similarity index; based on the distribution of malicious attack segments between each interface and other interfaces in different sampling periods, according to the similarity between the number of accesses and the user access duration in the analysis period, the correlation index of each interface with other interfaces is obtained.

[0076] When the frequency of the same abnormal access behavior is high, and the consistency of each abnormal access behavior is high, that is, there is a high possibility of a probing attack or multiple attacks in stages, that is, there are more periods with similar behaviors to the abnormal period, and the similarity is high, then the abnormal period is likely to be under malicious attack, and it is more likely to be a malicious attack period. Therefore, for each abnormal period, the number and interval distribution of similar periods are analyzed to reflect the similar number and frequency of occurrence, and combined with the size of the similarity index, the overall similarity is reflected to determine whether it is a malicious attack period.

[0077] Since there is a certain correlation between normal user interface access behaviors, for example, in a self-service recharge system, users usually need to access the login interface, balance query interface, and recharge interface to complete the recharge. The access order of the interfaces is relatively similar and the access time is relatively concentrated. Malicious access usually does not follow a regular pattern and has a high degree of random influence. When there is malicious access, it will affect the current correlation analysis between interfaces.

[0078] If the access volume and user access duration of an interface and another interface in the system where the interface is located in the corresponding analysis segment during all cycles are relatively similar, and the degree of interference from malicious attacks in all cycles is relatively small, it reflects that the overall user access habits on the two interfaces are relatively similar and have periodic similarities, that is, the overall user access to the two interfaces is highly correlated.

[0079] Therefore, the distribution of malicious attack segments between the two interfaces is used to avoid the impact of malicious attack time periods on correlation analysis. The similarity of the number of accesses and user access duration in other analysis time periods with higher credibility is analyzed to reflect whether the access behaviors of the two interfaces in the corresponding time periods during the week are relatively consistent. The correlation indicators of the two interfaces are obtained to reflect the degree of correlation.

[0080] S4: Obtain the behavior abnormality of each user based on the correlation index between the interface accessed by each user each time and the interface accessed last time in time, combined with the abnormal possibility corresponding to the interface at the access time and the number of user visits; determine the abnormal users from the users based on the behavior abnormality.

[0081] Therefore, abnormal behavior deviations can be analyzed based on the user's coordination in calling interfaces. For example, users usually call the payment interface after calling the order query interface, that is, the access correlation between the two interfaces is high. If there are two interfaces that the user visits successively that do not conform to the overall user's associated access habits, that is, the corresponding correlation when the user visits the two interfaces is poor, then the user's access behavior is likely to be abnormal, and the corresponding user's abnormality level is high.

[0082] Because when the interface is maliciously accessed, the account usually used is a new user, that is, the historical access level of users in the system to the interface is low, the user is more likely to have an abnormal risk, and the more likely the user's behavior in accessing the interface is to deviate from normal access habits during the time period, the higher the risk of user abnormality. Therefore, the possibility of abnormality in the user's access behavior to the interface can be further reflected from the number of historical visits of each user and the possibility of abnormality in the time period corresponding to the interface at the time of access, the historical access level and the degree of abnormality at the time of access.

[0083] For example, the self-service recharge system usually has a relatively stable user usage distribution, that is, the proportion of resident users is relatively large and the number of visits to the interface is relatively stable. Therefore, the more recent a user's access to the interface in the system is, and the more likely it is that the access behavior of the corresponding user is abnormal, the greater the possibility that it is abnormal.

[0084] Therefore, we comprehensively consider the correlation of each user's interface access in time sequence, the total number of user accesses, and the abnormal possibility of the corresponding interface at the access time, analyze the abnormal behavior of each user, screen out users with higher behavioral abnormalities, obtain abnormal users, and more accurately screen out abnormal users to restrict interface permissions.

[0085] S5: According to the distribution of abnormal user accesses and the degree of abnormal behavior in the current period, the restricted interface access number of the abnormal user is obtained.

[0086] In order to make the user's access to the interface safe and controllable, it is necessary to adjust the scope of the corresponding user's access permissions according to the abnormal degree of the abnormal user's access behavior. When there are abnormal users in the current period, the shorter the interval between the abnormal user's access behavior and the higher the degree of abnormal historical behavior, the greater the possibility of abnormal behavior by the user in the short term, and the greater the need to reduce the scope of the interface's permissions.

[0087] Therefore, the number of restricted interface accesses by abnormal users is obtained through the distribution of abnormal user accesses and the degree of abnormal behavior in the current period. Security is improved by limiting the number of authorized interfaces that users are allowed to access. In the embodiment of the present invention, when the calculated number of restricted interface accesses is less than the preset warning value, it indicates that the degree of rejection abnormality is too high, and an alarm needs to be issued for protection such as blocking.

[0088] In an embodiment of the present invention, access data of each interface is recorded and stored in a storage device, access data in the storage device is read, and abnormal users are screened through the access interface behavior of a single user and the overall user access behavior. The authority scope of the abnormal user is adjusted according to the degree of abnormal access of the abnormal user, and the access of abnormal users with too high anomaly degree, that is, too small authority scope, is rejected. Alarm information is output through the output module, that is, the information access record of the abnormal user in the current period.

[0089] In a specific implementation of the present invention, the preset warning value can be set to 3. The specific value can be adjusted by the implementer according to the specific implementation scenario. In other embodiments of the present invention, the warning judgment can also be made by limiting the proportion of the number of interface accesses to the total number of interfaces, which is not limited here.

[0090] In summary, the present invention divides the access situation on the interface into time periods for analysis of anomalies, confirms the preliminary abnormal time period through the access changes in the time period and the user's access duration, and considers the tentative attack and stage multi-attack characteristics of malicious attacks, combined with similar distributions with other time periods, more accurately screens out the time period with malicious attacks, and can reduce the analysis impact brought by the malicious attack situation in subsequent association analysis. Further, through the difference between time periods in the sampling cycle and the distribution of malicious attack segments, the degree of association between interfaces is analyzed as a whole, so as to facilitate the subsequent screening of users whose interface access behavior deviates from more abnormal. Through the association of the user's access to the interface in time sequence and the possibility that the access itself is in an abnormal period, and considering the characteristics that the abnormal behavior user is usually a new user, combined with the number of user accesses, the abnormal behavior degree is obtained to determine the abnormal user, and the interface restriction of authorized access is performed based on the abnormal behavior degree of the abnormal user. The present invention screens the part with malicious attacks based on the changes in access situation between multiple time periods, determines a more accurate interface association relationship in combination with the access difference, provides a reliable basis for the subsequent user interface access behavior deviation analysis, obtains more accurate abnormal users and abnormal behavior conditions to restrict access, and makes the authorization restriction of the interface safer and more reliable.

[0091] Preferably, in some possible implementations of the embodiments of the present invention, the method for obtaining the analysis period includes:

[0092] First, for any sampling period of any interface, the extreme difference of the number of accesses corresponding to the moment in the sampling period is used as the range change value, which reflects the degree of change of the number of accesses within the period, and is used to standardize and quantify the subsequent differences for easy analysis.

[0093] The difference in the number of accesses between each moment and the previous moment in the time series is further taken as the access difference at each moment, reflecting the degree of deviation of the access situation between moments. The ratio of the range change value to the access difference at each moment is taken as the similarity index at each moment to quantify the difference. The smaller the difference, the larger the similarity index, and the more consistent the corresponding access situation at the two moments.

[0094] Traverse all the moments in the sampling period. When the similarity index is greater than the preset similarity threshold, it means that the access situation between the two moments is relatively similar. Merge each moment with the previous moment to obtain the initial period. It should be noted that for the first moment without the previous moment, there is no need to merge forward. The average of all the access numbers in each initial period is used as the period access volume of each initial period, reflecting the average access situation of the entire period.

[0095] After the traversal is completed, there will be some isolated moments that do not meet the requirements. In this case, the isolated moments will also be merged. When there are unmerged moments, if there is an adjacent initial time period for the unmerged moments, the corresponding unmerged moments can be merged with the adjacent initial time period to update the initial time period.

[0096] If there are two adjacent initial time periods in the unmerged moment, merge the unmerged moment with the time period with the smaller difference in access situation, calculate the difference between the number of visits at the unmerged moment and the number of visits in each adjacent initial time period as the merge deviation, merge the adjacent initial time period corresponding to the smallest merge deviation with the corresponding unmerged moment, and update the initial time period.

[0097] It should be noted that when there are no adjacent initial time periods, it means that the adjacent moments are isolated. At this time, iterative merging is performed until there is a merged situation on the left and right moments, and then the merged situation is analyzed. Therefore, iterative merging is performed until there are no unmerged moments, and each initial time period is used as the analysis period of the sampling cycle.

[0098] At this point, the initial division of time periods is completed.

[0099] Preferably, in some possible implementations of the embodiments of the present invention, the method for obtaining the abnormal possibility degree can be found in Figure 3 , which shows a flow chart of a method for obtaining an abnormality possibility provided by an embodiment of the present invention, the method comprising the following steps:

[0100] S201: For an analysis period of any interface, according to the relative proportion of the number of accesses in the analysis period in the sampling cycle, obtain the quantity anomaly index of the analysis period.

[0101] Considering that the higher the number of visits in a time period, the more likely it is that an abnormal situation of being attacked will occur, when the number of visits in the analysis period is larger than the overall number of visits in the sampling period, the more significant the abnormality is.

[0102] In the embodiment of the present invention, the average of the number of visits at all times in the sampling period of the analysis period is used as the periodic visit volume of the analysis period, reflecting the overall level of the number of visits in the period. The ratio of the minimum number of visits in the analysis period to the periodic visit volume is used as the quantity anomaly index, and the relative proportion of the minimum number of visits reflects the degree of deviation of the number of visits. The larger the quantity anomaly index, the more significant the abnormality of the period.

[0103] S202: Obtaining a user access anomaly index for the analysis period according to the chaotic distribution of access durations of all users in the analysis period.

[0104] The more consistent the user access time behavior is within the time period, the greater the possibility that the user will attack the intelligent control. Through the chaotic distribution analysis of the access time, in an embodiment of the present invention, the variance of the access time of all users in the analysis period is negatively correlated to obtain the user access anomaly index of the analysis period. The chaotic distribution is reflected by the variance. When the variance is smaller, the consistency is higher, and the user access anomaly index is larger.

[0105] It should be noted that negative correlation mapping is a technical means well known to those skilled in the art, and may be implemented in an inverse proportional or negative exponential idempotent manner, which is not limited here.

[0106] S203: Obtain a duration anomaly index of the analysis period according to a difference between the duration of the analysis period and the average duration of all analysis periods in the sampling period.

[0107] Considering that the abnormal situation is a random situation that is affected by the timing, the duration is shorter than the normally distributed access situation. Therefore, in an embodiment of the present invention, the mean duration of all analysis periods in the sampling period in which the analysis period is located is used as the mean cycle duration of the analysis period; the ratio of the mean cycle duration to the duration of the analysis period is used as the duration abnormality indicator of the analysis period. When the duration of the analysis period is smaller than the overall duration of the cycle, it means that there are fewer similar moments in the analysis period and the possibility of abnormality is higher.

[0108] S204: Combining the quantity anomaly index, the user access anomaly index and the duration anomaly index of the analysis period, obtain the anomaly possibility of the analysis period.

[0109] Therefore, the quantity anomaly index, user access anomaly index and duration anomaly index of the time period are comprehensively analyzed to obtain the anomaly possibility. In an embodiment of the present invention, the product of the quantity anomaly index, user access anomaly index and duration anomaly index is normalized as the anomaly possibility of the analysis time period. The larger the quantity anomaly index, user access anomaly index and duration anomaly index, the more significant the anomaly in the time period, and therefore the greater the anomaly possibility.

[0110] It should be noted that normalization processing is a technical means well known to those skilled in the art, and the normalization options may be linear normalization or standard normalization, etc. The specific normalization method is not limited here.

[0111] Preferably, in an embodiment of the present invention, the method for obtaining the abnormal time period includes:

[0112] When the abnormal possibility is greater than the preset abnormal threshold, it means that the abnormality of the access during the analysis period is more significant, and the corresponding analysis period is regarded as the abnormal period. In the embodiment of the present invention, the preset abnormal threshold can be set to 0.6, and the specific value can be adjusted by the implementer, and is not limited here.

[0113] Preferably, in some possible implementations of the embodiments of the present invention, the method for obtaining the similarity index includes:

[0114] By analyzing the difference between the duration of the abnormal period and the significance of the abnormality, the similarity between the abnormal periods is analyzed. The smaller the difference, the higher the similarity. For the trial attack or multi-stage attack with malicious access, the abnormal performance between the abnormal periods is more consistent. Analyzing the similarity index facilitates the subsequent analysis of the malicious access period.

[0115] In any sampling cycle of any interface, the time difference between each abnormal period and each other abnormal period in the sampling cycle is taken as the time difference degree, reflecting the difference degree of abnormal duration between abnormal periods in the same sampling cycle. The difference in abnormal probability between each abnormal period and each other abnormal period in the sampling cycle is taken as the abnormal difference degree, reflecting the difference degree of abnormal significance between abnormal periods in the same sampling cycle.

[0116] The product of the time difference and the abnormality difference between each abnormal period and each other abnormal period in the sampling period is further negatively correlated and normalized to obtain the similarity index between each abnormal moment and each other abnormal period. The smaller the time difference and the abnormality difference, the greater the similarity, reflecting a higher similarity index, and similar situations can be further screened through the similarity index.

[0117] Preferably, in the embodiment of the present invention, determining the similar time period of each abnormal time period according to the similarity index includes:

[0118] For any abnormal period, when the similarity index between the abnormal period and other abnormal periods is greater than the preset similarity threshold, it indicates that the abnormal periods are highly similar, and the corresponding other abnormal periods are taken as similar periods of the abnormal period. In the embodiment of the present invention, the preset similarity threshold can be set to 0.6, and the specific value can be adjusted by the implementer, and is not limited here.

[0119] Preferably, in some possible implementations of the embodiments of the present invention, based on the number and interval distribution of all similar time periods corresponding to each abnormal time period, combined with the size of the similarity index, malicious attack segments are screened out from all abnormal time periods, including:

[0120] The occurrence and distribution interval of similar segments in the abnormal access period reflect the frequency distribution of time periods similar to the abnormal period. The more likely the abnormal period is to be a period of malicious attack, the higher the possibility of probing attacks or multiple attacks in stages, indicating that multiple similar situations occur more frequently and the degree of similarity will be higher.

[0121] For any abnormal period, obtain the mean number of similar periods of each abnormal period in the sampling period where the abnormal period is located, obtain the cycle similarity number of the abnormal period, and use the ratio of the number of similar periods of the abnormal period to the cycle similarity number as the quantity index of the abnormal period. According to the relative distribution degree of the number of similar periods of the abnormal period in the sampling period, it reflects the possible occurrence degree of the same abnormality.

[0122] Furthermore, among all similar time periods of the abnormal time period, the maximum time interval between the center moments of any two similar time periods is obtained as the interval index of the abnormal time period. The time interval between the center moments of each two similar time periods is analyzed to reflect the distribution degree of the abnormality. The larger the maximum time interval, the wider the distribution range of similar abnormal situations.

[0123] The average of the similarity indexes between the abnormal period and all similar periods is further calculated to obtain the similarity mean index of the abnormal period. The larger the similarity mean index is, the higher the similarity of the abnormal behavior is, and the higher the possibility that the abnormal period is a malicious attack.

[0124] Finally, the possibility of malicious attack in the abnormal period is obtained by combining the quantity index, interval index and similarity mean index of the abnormal period. In the embodiment of the present invention, the ratio of the quantity index and the interval index of the abnormal period is used as the frequency index of the abnormal period, and the product of the frequency index of the abnormal moment and the similarity mean index is normalized as the possibility of malicious attack in the abnormal period. When the quantity index is larger, the interval index is smaller, and the similarity mean index is larger, it means that the abnormal situation corresponding to the abnormal period has a higher frequency of occurrence in the time series and the more consistent the abnormality is, the more significant the malicious attack is.

[0125] When the malicious attack possibility is greater than the preset attack threshold, it indicates that the malicious attack is more significant, and the corresponding abnormal period is regarded as the malicious attack period. In the embodiment of the present invention, the preset attack threshold is set to 0.7, and the specific value can be adjusted by the implementer, and is not limited here.

[0126] Preferably, in some possible implementations of the embodiments of the present invention, the method for obtaining the correlation index includes:

[0127] For different interfaces, when there is a certain correlation between user behaviors between interfaces, there will be relatively similar access behaviors in the same time period in each sampling cycle. The greater the similarity of the access situations, the more likely the access behaviors in the same time period are to be correlated. At the same time, the impact of malicious attack segments on the analysis is avoided. When there are more malicious attack segments, the degree of interference in the analysis of normal time periods is higher. Therefore, the correlation index is obtained by matching the similarity of the analysis and adjusting the analysis of the trustworthiness through the distribution of malicious attack segments.

[0128] First, the analysis period of each non-malicious attack segment of each interface in each sampling period is used as the associated analysis period of each interface, and only the period of the non-malicious attack segment is analyzed.

[0129] Furthermore, for any interface, each associated analysis time period of the interface in each sampling cycle is matched with the associated analysis time period of each other interface in the same sampling cycle to obtain the matching time period of each associated analysis time period of the interface in each sampling cycle with each other interface. Corresponding analysis is performed on the two interfaces in the same period in each cycle, so the time periods need to be matched first.

[0130] In an embodiment of the present invention, a method for obtaining a matching period includes: taking the central moment of each association analysis period as the distribution moment of each association analysis period, and matching by the position of the distribution moment. For any other interface, for any association analysis period under any sampling period of the interface, the time difference between the distribution moment of the association analysis period and the distribution moment of all association analysis periods in the other interface is calculated, and the association analysis period in the other interface corresponding to the association analysis period with the minimum time difference is taken as the matching period between the association analysis period and the other interface. Under each sampling period, the two association analysis periods with the closest distribution moments between the two interfaces are taken as mutually matching periods, and are approximately regarded as the same period for subsequent similar association analysis.

[0131] For any other interface of the interface, the difference in the number of visits between each associated analysis period and the matching period of the other interface is taken as the associated visit volume deviation of each associated analysis period, reflecting similar situations from the overall distribution characteristics of the visits. The mean of the access duration of all users in each associated analysis period is calculated as the access duration distribution degree of each associated analysis period, and the difference in the access duration distribution degree between each associated analysis period and the matching period of the other interface is taken as the associated access duration deviation of each associated analysis period, reflecting similar situations from the distribution characteristics of the user access duration.

[0132] Combining the two deviations, we calculate the product of the deviation of the associated access duration and the deviation of the associated access volume for each associated analysis period and perform negative correlation mapping to obtain the matching similarity of each associated analysis period. The smaller the deviation, the higher the similarity of the access behaviors between the periods, and the higher the possibility of access association between the periods.

[0133] Further, according to the number of malicious attack segments of the interface and the other interface in each sampling period and the matching similarity of all correlation analysis time periods, the correlation index between the interface and the other interface is obtained, and the credibility of the correlation analysis is adjusted according to the number distribution of malicious attack segments.

[0134] In an embodiment of the present invention, a method for obtaining correlation indicators includes: taking the mean of the number of malicious attack segments of the interface and the other interface in each sampling period and performing negative correlation mapping as the analysis confidence of the interface and the other interface in each sampling period. The more the number distribution, the higher the possibility of being affected when the correlation analysis is performed in the same time period, and the lower the credibility of the similar analysis results.

[0135] Further, the sum of the matching similarities of the interface and the other interface in all associated analysis time periods in each sampling cycle is used as the matching similarity index between the interface and the other interface in each sampling cycle to reflect the overall similarity in the cycle.

[0136] In each sampling period of the interface and the other interface, the product of the matching similarity index and the analysis confidence is calculated to obtain the period correlation index of the interface and the other interface in each sampling period, reflecting the adjusted correlation result of each sampling period.

[0137] Finally, the average of the periodic correlation indexes of the interface and the other interfaces in all sampling periods is taken as the correlation index between the interface and the other interfaces, and the overall correlation between the interfaces is obtained by combining the adjusted correlation results in all sampling periods.

[0138] Preferably, in some possible implementations of the embodiments of the present invention, the method for obtaining the degree of behavioral abnormality includes:

[0139] For each user, the lower the user's total historical access to the system interface, the more untrustworthy the user is, and the more likely abnormal behavior is to occur. At the same time, when the correlation between multiple accesses to the interface is poor and the access time is more abnormal, it also indicates that the user's access behavior is more likely to deviate from normal habits and the possibility of abnormality is high.

[0140] First, for any user, the inverse proportional value of the correlation index between the interface accessed by the user each time and the interface accessed last time in time sequence is used as the correlation abnormality of each visit of the user. The lower the correlation index, the more likely the access behavior is to deviate from the normal state.

[0141] Furthermore, the abnormal possibility of the access time of each user in the analysis period corresponding to the access interface is used as the abnormality of the user's access time, reflecting the degree of abnormal behavior in the interface at the time of each user's access. When the user's access time itself is in a time period with a higher possibility of abnormal situations, the possibility of abnormality in user access is also higher.

[0142] The product of the association abnormality and the time abnormality of each visit of the user is further used as the access abnormality of each visit of the user. Combined with the abnormal possibility of each visit of the user in the interface access and the access time, the abnormal significance of each visit of the user is characterized.

[0143] Finally, the user's access anomaly degree of all visits and the user's total number of visits are combined to obtain the user's behavior anomaly degree. In the embodiment of the present invention, the product of the value of the total number of visits of the user after negative correlation mapping and the accumulated value of the access anomaly degree of all visits is normalized to obtain the user's behavior anomaly degree. The smaller the total number of visits of the user, the more likely the user is a new user. The higher the total access anomaly degree, the more significant the access behavior anomaly is. The more abnormal the user's overall access behavior is, the less trustworthy the user is.

[0144] Preferably, in the embodiment of the present invention, determining abnormal users from users according to the degree of abnormal behavior includes:

[0145] When the user's behavior abnormality is greater than the preset behavior threshold, it means that the user's behavior deviates from the normal situation, and the corresponding user is regarded as an abnormal user. In the embodiment of the present invention, the preset behavior threshold is set to 0.5, and the specific value can be adjusted by the implementer.

[0146] Preferably, in some possible implementations of the embodiments of the present invention, the method for obtaining the limited interface access number includes:

[0147] During the current authorization period, abnormal users screened based on historical analysis will have their authority scope further narrowed according to the degree of danger caused by their current behavior. The more frequent the abnormal user's access behavior, the higher the possibility of abnormal behavior in a short period of time. Certain authority restrictions are required to ensure the security of interface access.

[0148] First, for any abnormal user in the current period, negative correlation mapping is performed on the mean time interval of the abnormal user's access in the current period to obtain the abnormal user's access frequency. The shorter the access interval, the greater the possibility of abnormal access by the abnormal user. The product of the abnormal user's access frequency and access number in the current period is taken as the access risk of the abnormal user. The higher the abnormal user's access frequency and the larger the access number, the higher the access risk of the user and the lower the credibility of his access behavior.

[0149] The product of the abnormal user's access risk and behavior abnormality is further normalized to obtain the authorization restriction of the abnormal user. The higher the user's historical behavior abnormality in the current period and the greater the abnormal risk that the current access may cause, the higher the degree of restriction on its interface authority.

[0150] Finally, the product of the negatively correlated value of the abnormal user's authorization restriction and the preset interface access number is rounded down to obtain the restricted interface access number of the abnormal user. The interface access number allowed by the user itself is adjusted and rounded to obtain the restricted authorized access number. The greater the degree of restriction, the smaller the allowed access number is, so as to improve the security of interface access.

[0151] It should be noted that the sequence of the above embodiments of the present invention is only for description and does not represent the advantages and disadvantages of the embodiments. The processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0152] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

Claims

1. A data service interface authentication method, characterized in that: The method comprises: In each sampling period of the historical period, the interface, access time and access duration of each user at each time are obtained; based on the similarity of the number of accesses of each interface at adjacent times in each sampling period, the analysis period of each interface in each sampling period is obtained; According to the duration and number of visits of each interface in each analysis period, and the consistency of the visit duration of different users, the abnormal possibility of each analysis period is obtained; the abnormal period is determined from the analysis period according to the abnormal possibility; according to the difference between the abnormal period and each other abnormal period in duration and abnormal possibility, the similarity index between the abnormal period and each other abnormal period is obtained; and the similar period of each abnormal period is determined according to the similarity index; According to the number and interval distribution of all similar time periods corresponding to each abnormal time period, the malicious attack segments are screened out from all abnormal time periods in combination with the size of the similarity index; based on the distribution of malicious attack segments between each interface and other interfaces in different sampling periods, according to the similarity between the number of accesses and the user access duration in the analysis period, the correlation index of each interface with other interfaces is obtained; According to the correlation index between the interface accessed by each user each time and the interface accessed last time in the time sequence, combined with the abnormal possibility corresponding to the interface at the access time and the number of user visits, the behavior abnormality degree of each user is obtained; abnormal users are determined from the users according to the behavior abnormality degree; According to the distribution of abnormal user access and the degree of abnormal behavior in the current period, the number of restricted interface accesses by abnormal users is obtained; The method for obtaining the abnormal possibility degree includes: For an analysis period of any interface, the quantity anomaly index of the analysis period is obtained according to the proportion of the number of accesses in the analysis period in the sampling period; According to the chaotic distribution of the access time of all users in the analysis period, the user access abnormality index of the analysis period is obtained; According to the difference between the duration of the analysis period and the average duration of all analysis periods in the sampling period, the duration anomaly index of the analysis period is obtained; Combine the quantity anomaly index, user access anomaly index and duration anomaly index of the analysis period to obtain the anomaly possibility of the analysis period; The method for obtaining the similarity index includes: In any sampling period of any interface, the time difference between each abnormal period and each other abnormal period in the sampling period is used as the time difference degree; The difference in the abnormal possibility between each abnormal period and each other abnormal period in the sampling period is taken as the abnormal difference degree; The product of the time difference and the abnormal difference between each abnormal period and each other abnormal period in the sampling period is negatively correlated and normalized to obtain a similarity index between each abnormal moment and each other abnormal period; The method for obtaining the associated index includes: The analysis period of each non-malicious attack segment of each interface in each sampling period is used as the correlation analysis period of each interface; For any interface, match each correlation analysis period of the interface in each sampling cycle with the correlation analysis period of each other interface in the same sampling cycle to obtain the matching period of each correlation analysis period of the interface in each sampling cycle with each other interface; For any other interface of the interface, the difference in the number of visits between each associated analysis period and the matching period of the other interface is used as the associated visit volume deviation of each associated analysis period; the mean of the access duration of all users in each associated analysis period is calculated as the access duration distribution of each associated analysis period; the difference in the access duration distribution between each associated analysis period and the matching period of the other interface is used as the associated access duration deviation of each associated analysis period; Calculate the product of the associated access time deviation and the associated access volume deviation in each associated analysis period and perform negative correlation mapping to obtain the matching similarity of each associated analysis period; Obtaining a correlation index between the interface and the other interface according to the number of malicious attack segments of the interface and the other interface in each sampling period and the matching similarity of all correlation analysis periods; The method for obtaining the matching period includes: The central moment of each correlation analysis period is taken as the distribution moment of each correlation analysis period; For any other interface, for any correlation analysis period in any sampling period of the interface, calculate the time difference between the distribution time of the correlation analysis period and the distribution time of all correlation analysis periods in the other interface; The association analysis period in the other interface corresponding to the association analysis period when the minimum time difference is reached is used as the matching period between the association analysis period and the other interface; The obtaining of the correlation index between the interface and the other interface according to the number of malicious attack segments of the interface and the other interface in each sampling period and the matching similarity of all correlation analysis periods includes: The average of the number of malicious attack segments of the interface and the other interface in each sampling period is negatively correlated and mapped as the analysis confidence of the interface and the other interface in each sampling period; The sum of the matching similarities between the interface and the other interface in all associated analysis periods in each sampling period is used as the matching similarity index between the interface and the other interface in each sampling period; In each sampling period of the interface and the other interface, the product of the matching similarity index and the analysis confidence is calculated to obtain the period correlation index of the interface and the other interface in each sampling period; The average value of the period correlation index between the interface and the other interface in all sampling periods is used as the correlation index between the interface and the other interface; The method for obtaining the behavior abnormality degree includes: For any user, the inverse proportional value of the correlation index between the interface accessed by the user each time and the interface accessed last time in time sequence is used as the correlation abnormality degree of each access by the user; The abnormal possibility of the access time of each visit of the user in the analysis period corresponding to the access interface is used as the abnormality degree of the time of each visit of the user; The product of the association abnormality degree and the time abnormality degree of each visit of the user is used as the visit abnormality degree of each visit of the user; The user's behavior abnormality is obtained by combining the access abnormality of all the user's accesses and the total number of accesses of the user.

2. The data service interface authentication method according to claim 1, characterized in that: The method for obtaining the analysis period includes: For any sampling period of any interface, the range of the number of accesses corresponding to the time in the sampling period is taken as the range change value; The difference in the number of visits between each moment and the previous moment in the time series is taken as the visit difference at each moment; the ratio of the range change value to the visit difference at each moment is taken as the similarity index at each moment; Traverse all moments in the sampling period, and when the similarity index is greater than the preset similarity threshold, merge each moment with the previous moment to obtain the initial period; take the average of all the access numbers in each initial period as the period access volume of each initial period; After the traversal, when there are unmerged moments, if there is an adjacent initial time period for the unmerged moment, merge the corresponding unmerged moment with the adjacent initial time period and update the initial time period; if there are two adjacent initial time periods for the unmerged moment, calculate the difference between the number of visits of the unmerged moment and the number of visits of each adjacent initial time period as the merge deviation, merge the adjacent initial time period corresponding to the smallest merge deviation with the corresponding unmerged moment, and update the initial time period; iterate the merge until there are no unmerged moments, and use each initial time period as the analysis time period of the sampling cycle.

3. The data service interface authentication method according to claim 1, characterized in that: The method of filtering out malicious attack segments from all abnormal time periods based on the number and interval distribution of all similar time periods corresponding to each abnormal time period and the size of the similarity index includes: For any abnormal period, obtain the mean value of the number of similar periods of each abnormal period in the sampling period where the abnormal period is located, and obtain the cycle similarity number of the abnormal period; take the ratio of the number of similar periods of the abnormal period to the cycle similarity number as the quantity index of the abnormal period; Among all similar time periods of the abnormal time period, the maximum time interval between the center points of two similar time periods is obtained as the interval index of the abnormal time period; Calculate the average of the similarity indexes between the abnormal period and all similar periods to obtain the similarity mean index of the abnormal period; Combine the quantity index, interval index and similarity mean index of the abnormal period to obtain the possibility of malicious attack in the abnormal period; When the possibility of a malicious attack is greater than a preset attack threshold, the corresponding abnormal period is regarded as a malicious attack period.

4. The data service interface authentication method according to claim 1, characterized in that: The method for obtaining the limited interface access number includes: For any abnormal user in the current period, negative correlation mapping is performed on the mean of the time intervals of the abnormal user's visits in the current period to obtain the access frequency of the abnormal user; the product of the access frequency and the number of visits of the abnormal user in the current period is used as the access risk of the abnormal user; Normalizing the product of the abnormal user's access risk and behavior abnormality to obtain the abnormal user's authorization restriction degree; The product of the value of the negative correlation mapping of the authorization restriction degree of the abnormal user and the preset interface access number is rounded down to obtain the restricted interface access number of the abnormal user.

Images