Network security dynamic management method based on IP verification and related device

Abstract

The invention relates to a network security dynamic management method based on IP verification and a related device. The method comprises the steps of identifying a current access behavior of a user IP based on a constructed dynamic identification model, extracting a first behavior feature of the current access behavior, and judging whether the current access behavior of the user IP is an abnormal behavior or not according to the first behavior feature; if the current access behavior is not the abnormal behavior, allowing the user IP to access, otherwise, generating a limiting signal; in response to the limiting signal, determining a current risk score of the user IP according to the first behavior feature, and matching the current risk score with a risk score threshold to determine an abnormal level of the user IP; responding to the current access behavior of the user IP according to the abnormal level; and dynamically updating the risk score threshold. Compared with the prior art, the abnormal access behavior can be efficiently identified and processed, the corresponding strategy is adopted for the access behavior of the user in a targeted mode, the adaptability is good, and the flexibility is high.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network security dynamic management method based on IP verification and related devices. Background Art

[0002] With the rapid development of Internet technology, network applications are becoming more and more widespread. IP (Internet Protocol) addresses, as the unique identifier of network devices, play a vital role in network communications. IP security access technology, as an important means to ensure secure access to network resources, aims to effectively identify and control access requests to specific network resources through a series of strategies and mechanisms to prevent unauthorized access and protect the confidentiality, integrity and availability of data. Traditional IP security access technology covers a variety of methods, such as IP address-based access control lists (ACLs), firewall rules, and the behavior-based intrusion detection systems (IDS) and intrusion prevention systems (IPS) that have emerged in recent years.

[0003] In the existing IP security access technology system, a common and direct method is to implement access control by monitoring and counting the number of user visits. The basic logic of this strategy is: when an IP address initiates access requests exceeding the preset threshold in a short period of time, the system will automatically regard the IP as a potential security threat or malicious attack source, and then take blocking measures, such as temporarily or permanently rejecting its subsequent access requests. This simple blocking mechanism based on the number of visits can, to a certain extent, resist certain types of flood attacks (such as SYN Flood, UDP Flood, etc.), reduce server load, and protect the system from damage caused by excessive requests.

[0004] Although the crude blocking strategy based on the number of accesses has enhanced the security of the network to a certain extent, its inherent limitations are also becoming increasingly prominent. First, since the strategy only makes judgments based on the number of accesses and lacks comprehensive consideration of other contextual information, the legitimate access of normal users may also be incorrectly restricted due to high-frequency requests in a short period of time. For example, when a user tries to log in to the system, he may submit multiple requests due to network delays or operational errors, thereby triggering the blocking mechanism, affecting the user experience and the success rate of system login; second, the strategy based on fixed thresholds is difficult to adapt to the changing network environment. Different application scenarios, time periods, and user groups have significant differences in the demand for access frequency. Fixed-mode restrictions are difficult to match accurately, which may over-restrict legitimate users and relax vigilance against malicious behavior. Summary of the invention

[0005] Based on this, it is necessary to provide a network security dynamic management method and related devices based on IP verification that can flexibly respond to changes in the network environment and user access requirements to improve user experience in response to the above technical problems.

[0006] In a first aspect, the present application provides a method for dynamic network security management based on IP verification, the method comprising:

[0007] In response to an identification signal, identifying the current access behavior of the user IP based on the constructed dynamic identification model, extracting a first behavior feature of the current access behavior, and determining whether the current access behavior of the user IP is an abnormal behavior according to the first behavior feature;

[0008] If the current access behavior is not an abnormal behavior, the user IP is allowed to access, otherwise, a restriction signal is generated;

[0009] In response to the restriction signal, determining a current risk score of the user IP according to the first behavior feature, and matching the current risk score with a risk score threshold to determine an abnormality level of the user IP;

[0010] Respond to the current access behavior of the user IP according to the abnormality level;

[0011] The risk score threshold is dynamically updated.

[0012] In one embodiment, in response to an identification signal, identifying the current access behavior of the user IP based on the constructed dynamic identification model, extracting the first behavior feature of the current access behavior, and determining whether the current access behavior of the user IP is an abnormal behavior according to the first behavior feature, further includes:

[0013] Collect the historical access behavior of the user IP, extract the second behavior feature of the historical access behavior, and build an IP behavior feature library;

[0014] A dynamic recognition model is constructed, and the dynamic recognition model is trained based on the IP behavior feature library to obtain a trained dynamic recognition model.

[0015] In one embodiment, in response to the restriction signal, determining a current risk score of the user IP according to the first behavior feature, and matching the current risk score with a risk score threshold to determine an abnormality level of the user IP includes:

[0016] In response to the restriction signal, determining a current risk score of the user IP according to the first behavior feature; the risk score threshold includes a low risk threshold, a medium risk threshold and / or a high risk threshold;

[0017] matching the current risk score with the low risk threshold, the medium risk threshold and / or the high risk threshold respectively;

[0018] The abnormality level of the user IP is determined according to the low risk threshold, the medium risk threshold and / or the high risk threshold; the abnormality level includes low risk abnormality, medium risk abnormality and / or high risk abnormality.

[0019] In one embodiment, responding to the current access behavior of the user IP includes marking the user IP for access, temporarily restricting the user IP for access, and / or restricting the user IP for access for a long time;

[0020] The responding to the current access behavior of the user IP according to the abnormal level includes:

[0021] Determine the abnormality level of the user IP;

[0022] When the abnormality level of the user IP is a low-risk abnormality, the user IP is marked for access and the user IP is allowed to access;

[0023] When the abnormality level of the user IP is medium-risk abnormality, temporarily restrict the access of the user IP and start IP verification. After the user IP verification passes, the user IP is allowed to access;

[0024] When the abnormality level of the user IP is a high-risk abnormality, the user IP is subject to long-term access restrictions and the user IP is restricted from accessing.

[0025] In one embodiment, dynamically updating the risk score threshold comprises:

[0026] Dynamically update the risk score threshold based on the user IP's current access behavior and current risk score; and / or

[0027] The risk score threshold is dynamically updated based on real-time access data from the network.

[0028] In one embodiment, in response to an identification signal, identifying the current access behavior of the user IP based on the constructed dynamic identification model, extracting the first behavior feature of the current access behavior, and determining whether the current access behavior of the user IP is an abnormal behavior according to the first behavior feature, further includes:

[0029] Determine the list attributes of the user's IP; the list attributes include whitelist IP and blacklist IP;

[0030] If the user IP is a whitelist IP, the user IP is allowed to access;

[0031] If the user IP is a blacklist IP, the user IP is prohibited from accessing;

[0032] If the user IP does not belong to the whitelist IP and does not belong to the blacklist IP, the identification signal is generated.

[0033] In a second aspect, the present application further provides a network security dynamic management device based on IP verification, the device comprising:

[0034] An abnormal behavior identification module is used to respond to an identification signal, identify the current access behavior of the user IP based on the constructed dynamic identification model, extract the first behavior feature of the current access behavior, and determine whether the current access behavior of the user IP is an abnormal behavior based on the first behavior feature;

[0035] A judgment module, used for allowing the user IP to access if the current access behavior is not abnormal, otherwise, generating a restriction signal;

[0036] an abnormality level matching module, configured to determine, in response to the restriction signal, a current risk score of the user IP according to the first behavior feature, and match the current risk score with a risk score threshold to determine an abnormality level of the user IP;

[0037] A policy response module, used to respond to the current access behavior of the user IP according to the abnormal level;

[0038] A dynamic update module is used to dynamically update the risk score threshold.

[0039] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above-mentioned method when executing the computer program.

[0040] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the method described above are implemented.

[0041] In a fifth aspect, the present application also provides a computer program product, including a computer program, which implements the steps of the method described above when executed by a processor.

[0042] The above-mentioned network security dynamic management method and related device based on IP verification identify the current access behavior of the user IP through the constructed dynamic recognition model, extract the first behavior feature of the current access behavior, and judge whether the current access behavior of the user IP is an abnormal behavior according to the first behavior feature. If the current access behavior is not an abnormal behavior, the user IP is allowed to access, otherwise, a restriction signal is generated, and in response to the restriction signal, the current risk score of the user IP is determined according to the first behavior feature, and the current risk score is matched with the risk score threshold to determine the abnormal level of the user IP, and the current access behavior of the user IP is responded to according to the abnormal level, and the risk score threshold is dynamically updated; based on the unique and unchangeable characteristics of the user IP combined with the dynamic algorithm strategy, it is possible to efficiently identify and process abnormal access behaviors, and by scoring the abnormal behavior of the user IP and matching the corresponding threshold, the abnormal behavior of the user IP can be graded, so as to adopt corresponding strategies for the user's access behavior in a targeted manner, so that the system has adaptability and flexibility, and can cope with the security needs of various business scenarios, which can not only enhance the security of the system, but also can be customized and optimized according to business needs. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0044] FIG1 is an application environment diagram of a method for dynamic network security management based on IP verification in one embodiment;

[0045] Figure 2 A schematic diagram of a flow chart of a method for dynamic network security management based on IP verification in one embodiment;

[0046] Figure 3 A schematic diagram of a process for determining an abnormal level of a user IP in one embodiment;

[0047] Figure 4 A schematic diagram of a process for constructing a dynamic recognition model in one embodiment;

[0048] Figure 5 A structural block diagram of a network security dynamic management device based on IP verification in one embodiment;

[0049] FIG. 6 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0051] The network security dynamic management method based on IP verification provided by the embodiment of the present application can be applied to the application environment shown in Figure 1. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. The server 104 uses a dynamic recognition model to identify the behavior of the user IP when the user accesses and extracts the behavior characteristics corresponding to the access behavior. By analyzing the behavior characteristics, it is determined whether the access behavior of the user IP is abnormal. For abnormal access behavior, the abnormal level is determined in combination with the historical access of the user IP, and finally the user IP of abnormal access is executed. The corresponding restriction strategy is implemented to flexibly respond to the user's access; in addition, the threshold parameters are adaptively adjusted with the changes in the system's access volume and the current access behavior of the user IP to maintain the accuracy of the recognition so that the system can flexibly respond to different business scenarios. Among them, the terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car devices, projection devices, etc. The portable wearable device may be a smart watch, a smart bracelet, etc. The server 104 may be an independent physical server, or a server cluster or a distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0052] In an exemplary embodiment, Figure 2 As shown, a method for dynamic network security management based on IP verification is provided, which is described by taking the method applied to the server in FIG. 1 as an example, and includes the following steps S201 to S205. Among them:

[0053] Step S201, in response to an identification signal, identify the current access behavior of the user IP based on the constructed dynamic identification model, extract the first behavior feature of the current access behavior, and determine whether the current access behavior of the user IP is abnormal behavior based on the first behavior feature.

[0054] Among them, the identification signal refers to the signal that the system (or server, or network system) can respond to when there is a need to identify the user IP and start the dynamic identification model to identify the user IP. User IP refers to the Internet Protocol Address, which is a digital label used to identify devices on the Internet (such as computers, mobile phones, tablets, etc.); when a device is connected to the Internet, the device will be assigned an IP address as the user's user IP. These addresses enable devices to communicate with each other and transmit data on the network, and the user IP has a unique and unchangeable feature and can be used as the unique identifier of the user.

[0055] The dynamic identification model refers to a model that can identify the access behavior of the user IP through a rule engine and / or machine learning algorithm and extract the behavioral features of the user IP access behavior to determine whether the behavior of the user IP is abnormal; and the dynamic identification model can also be adaptively updated according to the current access behavior of the user IP to achieve the purpose of dynamic identification. When the dynamic identification model identifies the access behavior of the user IP, it mainly identifies the current access behavior of the user IP.

[0056] Among them, current access behavior refers to the network access behavior of the user IP at the current moment. Access behavior includes but is not limited to basic access behavior (such as web browsing, resource downloading, online communication, etc.), advanced access behavior (such as e-commerce transactions, online services, online games, etc.) and abnormal access behavior.

[0057] Among them, the first behavior feature is the feature carried in the current access behavior, and the first behavior feature includes but is not limited to the user's current IP address, access frequency, access duration and time interval, geographic location change, rationality of business interface, and information on dimensions such as failed login and abnormal status code. Access frequency refers to the number of visits per unit time, which is used to identify abnormal behaviors with too high access frequency; too high access frequency means that the number of visits here within a period of time reaches the threshold of the number of visits set by the system. Access duration and time interval refer to the length of time of continuous access and the time interval between two visits, which are used to identify unconventional high-frequency and short-term access behaviors; unconventional high-frequency and short-term access behaviors refer to the number of frequent visits reaching the set frequency threshold within the time set by the system. Geographic location change refers to the change in the geographic location of the accessing user IP. If a user IP frequently changes the access location in a short period of time, there may be malicious behavior (such as a proxy network). The rationality of the business interface refers to the user function module corresponding to the user IP and the interface corresponding to the function module and permission of the user. If not, there may be malicious access behavior (such as manual access interface, tampering data access interface, etc.). Failed logins and abnormal status codes are used to monitor the number of failed logins and the return frequency of abnormal status codes for a specific IP to identify malicious cracking attack attempts.

[0058] Among them, abnormal behavior refers to the behavior that the current access behavior of the user IP is inconsistent with the historical business behavior of the user IP. The historical business behavior of the user IP refers to the behavior of the user IP in the historical access process, which is stored in the data storage system in the form of historical business data. The historical business data includes the user's account information, transaction behavior, access records, etc. The access records contain the historical access IP address, historical access frequency, historical access duration and time interval, historical geographic location, historical business interface, and historical failed login and abnormal status code information of the user IP. By performing pattern analysis on the historical business data of the user IP, the abnormal behavior of the user IP during access can be identified. The abnormal behavior of this embodiment includes but is not limited to IP address inconsistency, too high access frequency, too long continuous access time, unconventional high-frequency short-time access, frequent login failures, sudden increase in interface request frequency, the geographical location of the user IP during access is inconsistent with the historical geographical location of the user IP, and access to interfaces that the user IP business does not want to manage, etc.

[0059] Specifically, the server responds to an identification signal, obtains the current access behavior of the user IP and a pre-built dynamic identification model according to the identification signal, inputs the current access behavior of the user IP into the dynamic identification model, performs pattern analysis on the current access behavior of the user IP through the dynamic identification model, and extracts the first behavior feature of the current access behavior; then, the server matches the extracted first behavior feature with the historical business behavior of the user IP to determine whether the current access behavior of the user IP is abnormal behavior.

[0060] Step S202: If the current access behavior is not an abnormal behavior, the user IP is allowed to access; otherwise, a restriction signal is generated.

[0061] The restriction signal refers to a signal that triggers an abnormal level determination of the current access behavior and executes a corresponding policy when the current access behavior of the user IP is determined to be abnormal.

[0062] Specifically, the server determines abnormal behavior based on the current access behavior identified by the dynamic recognition model. If the current access behavior of the user IP is not abnormal, it means that the current access of the user IP does not pose a risk to the network. In this case, the current access behavior of the user IP is not restricted, and the user IP is allowed to access the network. If the current access behavior of the user IP is abnormal, it means that the current access behavior of the user IP poses a risk to the network. At this time, a restriction signal is generated to enable the system to continue to execute subsequent steps.

[0063] Step S203, in response to the restriction signal, determining the current risk score of the user IP according to the first behavior feature, and matching the current risk score with the risk score threshold to determine the abnormality level of the user IP.

[0064] The current risk score refers to a score for the risk level of the current access behavior of the user IP based on the first behavior feature of the user IP.

[0065] Among them, the risk score threshold refers to the value set by the system that can be identified as a certain risk; the abnormal level refers to the risk level of the current access behavior of the user IP determined according to the risk score threshold. In this embodiment, there can be multiple risk score thresholds, and the abnormal level corresponds to the risk score threshold, and there can also be multiple. In this way, the current risk score of the user IP can be matched with multiple risk score thresholds, and then the current access behavior of the user IP can be classified into the corresponding abnormal level, so as to implement a restriction strategy of lenient and strict matching of the access behavior of the user IP, thereby improving the flexibility and robustness of the system.

[0066] Specifically, the server responds to the restriction signal and determines the current risk score of the user IP based on the first behavioral feature; then, the server matches the current risk score with the risk score threshold set by the system, determines which risk score threshold the current risk score of the user IP reaches, and correspondingly determines the current access behavior of the user IP as the corresponding abnormal level.

[0067] In specific implementation, the risk score threshold includes a low risk threshold, a medium risk threshold and / or a high risk threshold, and the corresponding abnormality level includes a low risk abnormality, a medium risk abnormality and / or a high risk abnormality. Low risk abnormalities are relatively minor abnormalities, which may usually be caused by short-term network problems or non-malicious user operations. When the current risk score of the user IP reaches the low risk threshold, it can be identified as a low risk abnormality; medium risk abnormalities are abnormalities with a general risk level, which are usually manifested as frequent access failures, cross-regional logins (i.e., changes in geographical location), etc. When the current risk score of the user IP reaches the medium risk threshold, it can be identified as a medium risk abnormality; high risk abnormalities are abnormalities with a higher risk level, which are usually manifested as frequent abnormal access, extremely abnormal access patterns, malicious crawlers or obvious signs of attacks, etc. When the current risk score of the user IP reaches the high risk threshold, it can be identified as a high risk abnormality. For the settings of low risk, medium risk, high risk thresholds and exceptions, all three levels can be set or one or two of them can be set according to actual needs. Additional levels can also be added in addition to the aforementioned three levels to further improve the diversity and flexibility of the system's response. The specific number of levels is not limited in this embodiment.

[0068] Step S204, responding to the current access behavior of the user IP according to the abnormality level.

[0069] Among them, responding to the current access behavior of the user IP means restricting the user IP when accessing the network according to the abnormal level of the user IP to ensure the security of the network. In this embodiment, responding to the current access behavior of the user IP includes access marking the user IP, temporarily restricting the user IP, and / or restricting the user IP for a long time.

[0070] Specifically, the server matches corresponding response measures according to the abnormal level of the current access behavior of the user IP, so as to carry out targeted processing on the access of the user IP.

[0071] Step S205: dynamically update the risk score threshold.

[0072] Among them, dynamic update refers to adjusting the risk score threshold after the current user IP accesses or according to the real-time status of the current network to relax or tighten the detection conditions to ensure normal user access.

[0073] Specifically, after the current user IP accesses, the server dynamically adjusts the corresponding risk score threshold according to the access behavior and / or risk score of the user IP and / or the server dynamically adjusts the system risk score threshold according to the real-time status of the current network.

[0074] In the above-mentioned network security dynamic management method based on IP verification, the current access behavior of the user IP is identified by the constructed dynamic recognition model, the first behavior feature of the current access behavior is extracted, and whether the current access behavior of the user IP is an abnormal behavior is determined according to the first behavior feature. If the current access behavior is not an abnormal behavior, the user IP is allowed to access, otherwise, a restriction signal is generated, and in response to the restriction signal, the current risk score of the user IP is determined according to the first behavior feature, and the current risk score is matched with the risk score threshold, the abnormal level of the user IP is determined, and the current access behavior of the user IP is responded to according to the abnormal level, and the risk score threshold is dynamically updated; based on the unique and unchangeable characteristics of the user IP combined with the dynamic algorithm strategy, the abnormal access behavior can be efficiently identified and processed, and by scoring the abnormal behavior of the user IP and matching the corresponding threshold, the abnormal behavior of the user IP can be graded, so that the corresponding strategy is adopted for the user's access behavior in a targeted manner, so that the system has adaptability and flexibility, and can cope with the security needs of various business scenarios, which can not only enhance the security of the system, but also can be customized and adjusted and optimized according to business needs.

[0075] In one embodiment, Figure 3 As shown, step S203 includes the following steps S301 to S303. Among them:

[0076] Step S301, in response to a restriction signal, determining a current risk score of the user IP according to a first behavior feature.

[0077] Specifically, the server receives and responds to the restriction signal, and scores each first behavior feature according to the first behavior feature of the user IP's current access behavior extracted by the dynamic recognition model, and then integrates the scores of each first behavior feature by simple addition or weighted addition to obtain the current risk score of the user IP.

[0078] Among them, when scoring each first behavior feature, the first behavior feature of the user IP can be divided according to the risk level of the behavior to the network and then set the corresponding score level; for example, for the access frequency, the PING value of the user IP when accessing can be obtained, and the value can be divided into multiple intervals according to a certain gradient, and a score value can be set for each interval. According to the actual PING value of the current access behavior of the user IP, it is determined which interval it belongs to, and then the score value corresponding to the interval is assigned to the user IP. When setting, the higher the risk, the greater the score; and so on, the current risk score of the user IP is determined by combining all the first behavior features of the current access behavior of the user IP. In addition, each first behavior feature can also be scored by a machine algorithm or the like, and this embodiment does not make specific restrictions.

[0079] Step S302: Match the current risk score with a low risk threshold, a medium risk threshold and / or a high risk threshold of the risk score threshold.

[0080] Specifically, the server will determine the current risk score of the user IP and match it with the low risk threshold, the medium risk threshold and / or the high risk threshold, respectively, so as to determine which risk threshold the current risk score of the user IP can reach. When matching, which levels of risk thresholds the current risk score matches is determined by the system. For example, if the system sets the risk score threshold to include three levels: low, medium, and high, the server will match the current risk score with all three of them. The matching order can be from low to high, from high to low, or in any order, or the three can be matched simultaneously. The specific order is not limited in this embodiment. Of course, if the system sets the risk score threshold to include only low, medium, or medium and high levels, the server will match the corresponding quantity and level thresholds.

[0081] Step S303: determining the abnormality level of the user IP according to the low risk threshold, the medium risk threshold and / or the high risk threshold.

[0082] Specifically, the server determines which abnormal level the current access behavior of the user IP belongs to based on the matching result of the current risk score of the user IP with the low risk threshold, the medium risk threshold and / or the high risk threshold. For example, when the current risk score of the user IP reaches the low risk threshold, its current access behavior is determined as a low risk abnormality; when the current risk score of the user IP reaches the medium risk threshold, its current access behavior is determined as a medium risk abnormality; when the current risk score of the user IP reaches the high risk threshold, its current access behavior is determined as a high risk abnormality.

[0083] In this embodiment, the current risk score of the determined user IP is matched one by one with the low risk threshold, the medium risk threshold and / or the high risk threshold to obtain the risk level of the current access behavior of the user IP. In this way, the current access behavior of the user IP is classified according to its risk level to the network, which is conducive to a relaxed response strategy for access behaviors with slight risks and a strict response strategy for access behaviors with high risks, thereby responding to the user's access behavior in a targeted manner to ensure that the system can flexibly respond to different business scenarios.

[0084] In one embodiment, when step S204 responds to the current access behavior of the user IP, this embodiment introduces an automatic freezing and unfreezing mechanism to respond to different levels of access behaviors.

[0085] Among them, the freezing mechanism means that when the system detects that a user IP or other business users associated with it have medium or high risk abnormal behaviors, the system will automatically freeze the access rights of the user IP and its business users. The freezing mechanism includes temporary freezing and permanent freezing; temporary freezing means restricting the access rights of the user IP for a short period of time, which is applicable to temporary abnormal behaviors (i.e. medium risk abnormalities); permanent freezing means that when frequent malicious behaviors are detected, the system will permanently ban the user IP and / or its business users and prohibit their access to ensure network security.

[0086] The unfreezing mechanism refers to that for a frozen user IP, the system will monitor the subsequent behavior of the user IP. When the risk is confirmed to be eliminated, the system can automatically unfreeze the user IP, and the administrator can also manually unfreeze the user IP through the console to improve the flexibility of the system. However, it should be noted that the automatic unfreezing mechanism and the administrator manual unfreezing mechanism of this embodiment are usually applicable to temporarily frozen user IPs, and for permanently frozen user IPs, since there is no subsequent access behavior, the system will not monitor its behavior in the next step, so it needs to be manually unfrozen by the administrator.

[0087] The response to the current access behavior of the user IP includes:

[0088] Determine the abnormal level of the user IP to determine whether the current access behavior of the user IP is a low-risk abnormality, a medium-risk abnormality, or a high-risk abnormality, and then respond according to the different levels of abnormal behavior and implement different restriction strategies for the user IP.

[0089] When the abnormality level of the user IP is low-risk, the user IP is marked for access and the user IP is allowed to access. Specifically, low-risk abnormalities are minor abnormalities, usually caused by short-term network problems or non-malicious user operations. At this time, the system can only make a record and not take freezing measures on the user IP, but mark the IP as "under observation" to ensure that the user IP can access normally and avoid misjudgment.

[0090] When the user IP abnormality level is medium-risk abnormality, temporary access restrictions are imposed on the user IP, and IP verification is initiated. After the user IP verification is passed, the user IP is allowed to access. Specifically, medium-risk abnormalities are general abnormalities, usually manifested as frequent access failures, cross-regional logins, etc. At this time, the system will trigger a temporary freeze and require the user to further verify his or her identity by entering a verification code.

[0091] When the abnormality level of the user IP is high-risk, the user IP will be subject to long-term access restrictions and restricted from accessing. Specifically, high-risk anomalies are serious anomalies, usually manifested as frequent abnormal access, extremely abnormal access patterns, malicious crawlers or obvious signs of attacks. At this time, the system will immediately trigger a permanent freeze and restrict the access of the user IP and its associated users.

[0092] In this embodiment, the risk level of abnormal behavior is judged and a corresponding strategy is adopted to respond, which is beneficial to improving the flexibility and robustness of the system.

[0093] In one embodiment, step S205 dynamically updates the risk score threshold, including dynamically updating the risk score threshold based on the user IP and / or dynamically updating the risk score threshold based on the system. When updating, the risk score threshold can be dynamically updated based on the current access behavior and current risk score of the user IP, or it can be dynamically updated based on the real-time access data of the network. The two can be performed either one or simultaneously.

[0094] Among them, the dynamic update of the risk score threshold based on the user IP means that the system analyzes and dynamically updates the risk score threshold of a user IP based on the historical access behavior of a user IP or the access behavior in the past period of time and the current access behavior. That is, each time the user IP visits, its risk score threshold is updated once according to the aforementioned process, so as to comprehensively consider the historical access behavior and current access behavior of the user IP when accessing; for example, for the long-term access behavior of the user IP, it can dynamically decide whether it is necessary to relax its access restrictions, or appropriately relax the detection rules for user IPs with long-term stable access, so as to improve the user experience.

[0095] Among them, the dynamic update of the system-based risk score threshold means that the system analyzes and dynamically updates the risk score threshold of the entire system according to the fluctuations of the real-time network traffic. That is, the system can dynamically adjust the risk score threshold according to the real-time access traffic and business scenarios (such as a surge in access during activities); for example, when the system detects a sudden increase in access volume, the system will automatically relax the risk score threshold for detection to avoid false alarms, and when the traffic returns to normal, the system will automatically restore the risk score threshold to ensure network security.

[0096] In this embodiment, by dynamically updating the risk threshold score of the system or user IP, the judgment of user access behavior is adaptive and flexible, and can meet the security requirements of various business scenarios. It can not only enhance the security of the system, but also perform customized adjustments and optimizations according to business needs.

[0097] In one embodiment, Figure 4 As shown, before step S201, the following steps S401 to S402 are also included. Among them:

[0098] Step S401, collecting the historical access behaviors of the user IP, extracting the second behavior features of the historical access behaviors, and constructing an IP behavior feature library.

[0099] The historical access behavior of a user IP refers to the network access behavior of the user IP in the past period of time, which includes but is not limited to basic access behaviors (such as web browsing, resource downloading, online communication, etc.), advanced access behaviors (such as e-commerce transactions, online services, online games, etc.) and abnormal access behaviors, etc. Historical access behaviors are usually stored in the access log data of the system, including both normal access behavior data and known abnormal access behavior data.

[0100] Among them, the second behavior feature is similar to the first behavior feature. For details, please refer to the description of the first behavior feature above, and no further details will be given here.

[0101] Specifically, the server obtains the historical access behavior of all user IPs from the system's access log data, extracts and collects information such as IP addresses, geographic locations, operators, etc. in the historical access behavior of user IPs, and performs denoising, cleaning, feature encoding (such as encoding IP addresses and URL paths) and other pre-processing on the data corresponding to the extracted second behavior features to form an IP behavior feature library.

[0102] Step S402: construct a dynamic recognition model, and train the dynamic recognition model based on the IP behavior feature library to obtain a trained dynamic recognition model.

[0103] Among them, the dynamic recognition model uses machine learning (such as random forest, etc.) and is trained based on the IP behavior feature library to obtain an automatic classification to distinguish normal access behavior from abnormal access behavior, thereby realizing the identification of abnormal behavior.

[0104] Specifically, the server inputs the IP behavior feature library into the dynamic recognition model, uses the abnormal access data of known malicious user IPs (including user IPs with abnormal behaviors identified by the system and user IPs blacklisted by the system, and the blacklisted user IPs are recorded later) as positive examples, that is, abnormal behaviors that need to be identified, and uses the user's normal access data as negative examples to perform model training to obtain a trained dynamic recognition model. Whenever a new access request (that is, access behavior) arrives from a user IP, the system will use the trained dynamic recognition model to perform real-time identification of the access request to determine whether it is an abnormal access.

[0105] In this embodiment, an IP behavior feature library is constructed by collecting historical access behaviors and a dynamic recognition model is trained. The dynamic recognition model uses a classification model to train a classifier, which can accurately distinguish whether the access behavior of the user IP is abnormal behavior.

[0106] In one embodiment, before step S201, a process of judging the list attributes of the user IP is also included. By adding a blacklist and whitelist mechanism, certain specific user IPs can be exempted and some known malicious IPs can be permanently restricted. For user IPs that are neither in the whitelist nor in the blacklist, the above method is used to identify abnormal behaviors to enhance the security of the system.

[0107] Among them, the list attributes include whitelist IP and blacklist IP. Whitelist IP refers to the user IP included in the whitelist. The user IP in the whitelist will be exempted by the system. When a user IP is included in the whitelist, the system will not identify its abnormal behavior. Regardless of whether the access behavior conforms to the normal mode, it can be accessed normally to avoid being affected by the freezing mechanism. The whitelist mechanism can be used to protect specific business partners, internal users, etc. to ensure normal access to specific key users or businesses. Blacklist IP refers to the user IP included in the blacklist. The user IP in the blacklist will be permanently banned. No matter how its subsequent behavior changes, it will not be able to access. The blacklist mechanism can be used to defend against long-term malicious attackers and enhance system security by manually adding user IPs with long-term malicious behavior. Administrators can manually change the user IPs in the blacklist and whitelist through the management console to flexibly respond to special situations.

[0108] The specific judgment of the list attributes of the user IP includes:

[0109] Determine the list attribute of the user IP, that is, determine whether the user IP is a user IP in the whitelist or a user IP in the blacklist. If the user IP is a whitelist IP, the user IP is allowed to access, and the subsequent abnormal behavior identification operation is no longer performed on the user IP; if the user IP is a blacklist IP, the user IP is prohibited from accessing; if the user IP is neither a whitelist IP nor a blacklist IP, an identification signal is generated so that the dynamic identification model responds to the identification signal and performs abnormal behavior identification on the user IP.

[0110] In this embodiment, by setting up blacklists and whitelists, the user IP is judged on the blacklist and whitelist before the dynamic recognition model performs abnormal behavior recognition. The user IPs in the blacklist and whitelist can be simply screened in advance, and the user IPs in the whitelist are exempted from abnormal recognition so that they can access quickly and normally. The user IPs in the blacklist are directly intercepted and are not allowed to access. In this way, subsequent abnormal behavior recognition will not be performed for this part of user IPs, which is beneficial to saving computing resources.

[0111] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0112] Based on the same inventive concept, the embodiment of the present application also provides a network security dynamic management device based on IP verification for implementing the network security dynamic management method based on IP verification involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more embodiments of the network security dynamic management device based on IP verification provided below can refer to the limitations of the network security dynamic management method based on IP verification above, and will not be repeated here.

[0113] In an exemplary embodiment, Figure 5 As shown, a network security dynamic management device based on IP verification is provided, including: an abnormal behavior identification module 501, a judgment module 502, an abnormal level matching module 503, a policy response module 504 and a dynamic update module 505, wherein:

[0114] The abnormal behavior identification module 501 is used to respond to an identification signal, identify the current access behavior of the user IP based on the constructed dynamic identification model, extract the first behavior feature of the current access behavior, and determine whether the current access behavior of the user IP is abnormal behavior based on the first behavior feature.

[0115] The judgment module 502 is used to allow the user IP to access if the current access behavior is not abnormal, otherwise, generate a restriction signal.

[0116] The abnormality level matching module 503 is used to determine the current risk score of the user IP according to the first behavior feature in response to the restriction signal, and match the current risk score with the risk score threshold to determine the abnormality level of the user IP.

[0117] The policy response module 504 is used to respond to the current access behavior of the user IP according to the abnormality level.

[0118] The dynamic updating module 505 is used to dynamically update the risk score threshold.

[0119] In an optional embodiment, the abnormality level matching module 503 is also used to respond to the restriction signal and determine the current risk score of the user IP according to the first behavior feature; the risk score threshold includes a low risk threshold, a medium risk threshold and / or a high risk threshold; the current risk score is matched with the low risk threshold, the medium risk threshold and / or the high risk threshold respectively; the abnormality level of the user IP is determined according to the low risk threshold, the medium risk threshold and / or the high risk threshold; the abnormality level includes a low risk abnormality, a medium risk abnormality and / or a high risk abnormality.

[0120] In an optional embodiment, responding to the current access behavior of the user IP includes marking the user IP for access, temporarily restricting the user IP for access, and / or restricting the user IP for long-term access. The policy response module 504 is also used to determine the abnormality level of the user IP; when the abnormality level of the user IP is a low-risk abnormality, the user IP is marked for access and the user IP is allowed to access; when the abnormality level of the user IP is a medium-risk abnormality, the user IP is temporarily restricted in access, and IP verification is started, and the user IP is allowed to access after the user IP verification passes; when the abnormality level of the user IP is a high-risk abnormality, the user IP is subject to long-term access restrictions, and the user IP is restricted from accessing.

[0121] In an optional embodiment, the dynamic update module 505 is also used to dynamically update the risk score threshold based on the current access behavior and current risk score of the user IP; and / or dynamically update the risk score threshold based on real-time access data of the network.

[0122] In an optional embodiment, the above-mentioned network security dynamic management device based on IP verification further includes:

[0123] The feature extraction module is used to collect the historical access behavior of the user IP, extract the second behavior feature of the historical access behavior, and build an IP behavior feature library.

[0124] The model training module is used to build a dynamic recognition model and train the dynamic recognition model based on the IP behavior feature library to obtain a trained dynamic recognition model.

[0125] In an optional embodiment, the above-mentioned network security dynamic management device based on IP verification further includes:

[0126] The list attribute determination module is used to determine the list attribute of the user IP; the list attribute includes whitelist IP and blacklist IP; if the user IP is a whitelist IP, the user IP is allowed to access; if the user IP is a blacklist IP, the user IP is prohibited from accessing; if the user IP does not belong to the whitelist IP and does not belong to the blacklist IP, an identification signal is generated.

[0127] Each module in the above-mentioned network security dynamic management device based on IP verification can be implemented in whole or in part by software, hardware and their combination. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the corresponding operations of each of the above modules.

[0128] In an exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be shown in FIG6. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data such as the current access behavior of the user IP, the first behavior feature, the second behavior feature, the IP behavior feature library, the risk score threshold whitelist IP and the blacklist IP. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a dynamic network security management method based on IP verification is implemented.

[0129] Those skilled in the art will understand that the structure shown in FIG. 6 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0130] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the method for dynamic network security management based on IP verification of the above embodiment is implemented.

[0131] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the network security dynamic management method based on IP verification of the above embodiment is implemented.

[0132] In one embodiment, a computer program product is provided, including a computer program, which, when executed by a processor, implements the IP verification-based dynamic network security management method of the above embodiment.

[0133] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0134] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0135] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0136] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A network security dynamic management method based on IP verification, characterized in that: The method comprises: In response to an identification signal, identifying the current access behavior of the user IP based on the constructed dynamic identification model, extracting a first behavior feature of the current access behavior, and determining whether the current access behavior of the user IP is an abnormal behavior according to the first behavior feature; If the current access behavior is not an abnormal behavior, the user IP is allowed to access, otherwise, a restriction signal is generated; In response to the restriction signal, determining a current risk score of the user IP according to the first behavior feature, and matching the current risk score with a risk score threshold to determine an abnormality level of the user IP; Respond to the current access behavior of the user IP according to the abnormality level; The risk score threshold is dynamically updated.

2. The method according to claim 1, characterized in that The method further includes: identifying the current access behavior of the user IP based on the constructed dynamic recognition model in response to an identification signal, extracting the first behavior feature of the current access behavior, and determining whether the current access behavior of the user IP is an abnormal behavior based on the first behavior feature. Collect the historical access behavior of the user IP, extract the second behavior feature of the historical access behavior, and build an IP behavior feature library; A dynamic recognition model is constructed, and the dynamic recognition model is trained based on the IP behavior feature library to obtain a trained dynamic recognition model.

3. The method according to claim 1, characterized in that The step of responding to the restriction signal, determining a current risk score of the user IP according to the first behavior feature, and matching the current risk score with a risk score threshold to determine an abnormality level of the user IP includes: In response to the restriction signal, determining a current risk score of the user IP according to the first behavior feature; the risk score threshold includes a low risk threshold, a medium risk threshold and / or a high risk threshold; matching the current risk score with the low risk threshold, the medium risk threshold and / or the high risk threshold respectively; The abnormality level of the user IP is determined according to the low risk threshold, the medium risk threshold and / or the high risk threshold; the abnormality level includes low risk abnormality, medium risk abnormality and / or high risk abnormality.

4. The method according to claim 3, characterized in that Responding to the current access behavior of the user IP includes marking the user IP for access, temporarily restricting the user IP for access, and / or permanently restricting the user IP for access; The responding to the current access behavior of the user IP according to the abnormal level includes: Determine the abnormality level of the user IP; When the abnormality level of the user IP is a low-risk abnormality, the user IP is marked for access and the user IP is allowed to access; When the abnormality level of the user IP is medium-risk abnormality, temporarily restrict the access of the user IP and start IP verification. After the user IP verification passes, the user IP is allowed to access; When the abnormality level of the user IP is a high-risk abnormality, the user IP is subject to long-term access restrictions and the user IP is restricted from accessing.

5. The method according to claim 1, characterized in that The dynamically updating the risk score threshold comprises: Dynamically update the risk score threshold based on the user IP's current access behavior and current risk score; and / or The risk score threshold is dynamically updated based on real-time access data from the network.

6. The method according to any one of claims 1 to 5, characterized in that: The method further includes: identifying the current access behavior of the user IP based on the constructed dynamic recognition model in response to an identification signal, extracting the first behavior feature of the current access behavior, and determining whether the current access behavior of the user IP is an abnormal behavior based on the first behavior feature. Determine the list attributes of the user's IP; the list attributes include whitelist IP and blacklist IP; If the user IP is a whitelist IP, the user IP is allowed to access; If the user IP is a blacklist IP, the user IP is prohibited from accessing; If the user IP does not belong to the whitelist IP and does not belong to the blacklist IP, the identification signal is generated.

7. A network security dynamic management device based on IP verification, characterized in that: The device comprises: An abnormal behavior identification module is used to respond to an identification signal, identify the current access behavior of the user IP based on the constructed dynamic identification model, extract the first behavior feature of the current access behavior, and determine whether the current access behavior of the user IP is an abnormal behavior based on the first behavior feature; A judgment module, used for allowing the user IP to access if the current access behavior is not abnormal, otherwise, generating a restriction signal; an abnormality level matching module, configured to determine, in response to the restriction signal, a current risk score of the user IP according to the first behavior feature, and match the current risk score with a risk score threshold to determine an abnormality level of the user IP; A policy response module, used to respond to the current access behavior of the user IP according to the abnormal level; A dynamic update module is used to dynamically update the risk score threshold.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images