Network behavior management and control method and device, electronic equipment and storage medium
By extracting and matching the account information and entity information sets in communication messages, the problem that traditional technology cannot accurately monitor and control user network behavior is solved, and higher network security control accuracy is achieved.
Patent Information
- Application Number
- CN202411434201.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-14
- Publication Date
- 2025-02-18
AI Technical Summary
Traditional risk monitoring products cannot accurately monitor and control the network behavior of user entities, resulting in insufficient accuracy of network security control.
By obtaining communication messages from multiple users within the target time period, extracting account information, and matching the entity information set through the local database, the user's network behavior is then securely controlled.
Accurate network behavior monitoring and control of user entities is achieved, and the accuracy of network security control is improved.
Smart Images
Figure CN119484014A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of computer technology, and more specifically, to a method, device, electronic device and storage medium for controlling network behavior. Background Art
[0002] In traditional risk monitoring products, when accessing a network application server, the accessing subject can usually only display the corresponding source address and source port information, and cannot accurately monitor the user entity, and thus cannot accurately control the network behavior of the user entity. Summary of the invention
[0003] In view of the above problems, the present application proposes a method, device, electronic device and storage medium for controlling network behavior.
[0004] In the first aspect, an embodiment of the present application provides a method for controlling network behavior, the method comprising: obtaining multiple communication messages corresponding to multiple users within a target time period; obtaining multiple account information based on the multiple communication messages; matching the multiple account information through a local database to obtain entity information sets corresponding to each user; the entity information set of each user includes the user's application system account, user personal information and user position information; and performing security control on the network behavior of each user based on the entity information set of each user.
[0005] In some implementations, obtaining multiple account information based on the multiple communication messages includes: determining communication logs corresponding to the multiple communication messages based on the multiple communication messages; and extracting the multiple account information from the communication logs.
[0006] In some embodiments, extracting the multiple account information from the communication log includes: inputting the communication log into an account information extraction model, the account information extraction model is trained through multiple different log sample sets, the different log sample sets include multiple types of sample logs and a method for extracting account information in each type of log; using the account information extraction model to obtain the multiple account information in the communication log.
[0007] In some embodiments, after inputting the communication log into the account information extraction model, the method further includes: if not all account information is extracted from the communication log, obtaining a user login log from a user access management system according to the target time period, the user access management system being a system for managing user network access, the user login log including at least one user login source address; and extracting the multiple account information from the communication log according to the user login source address.
[0008] In some embodiments, before inputting the communication log into the account information extraction model, the method further includes: using preset account rules to extract multiple account information that conform to the preset account rules from the communication log to obtain extraction results; inputting the communication log into the account information extraction model includes: if the extraction result indicates that the account information is not extracted according to the preset account rules, then inputting the communication log into the account information extraction model.
[0009] In some implementations, before matching the multiple account information through a local database to obtain entity information sets corresponding to each user, the method further includes: pre-configuring entity information sets of multiple users to the local database.
[0010] In some implementations, the security management and control is at least one of user network access permission control, user network behavior audit, and user network access risk warning.
[0011] In the second aspect, an embodiment of the present application provides a network behavior control device, the device comprising: a communication message acquisition module, used to obtain multiple communication messages corresponding to multiple users within a target time period; an account information acquisition module, used to obtain multiple account information based on the multiple communication messages; an entity information set acquisition module, used to match the multiple account information through a local database to obtain entity information sets corresponding to each user, the entity information set of each user including the user's application system account, user personal information and user position information; a security control module, used to perform security control on the network behavior of each user based on the entity information set of each user.
[0012] In a third aspect, an embodiment of the present application provides an electronic device, comprising: one or more processors; a memory; one or more applications, wherein the one or more applications are stored in the memory and configured to be executed by the one or more processors, and the one or more programs are configured to execute the network behavior management and control method provided in the first aspect above.
[0013] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which a program code is stored. The program code can be called by a processor to execute the network behavior control method provided in the first aspect above.
[0014] The solution provided by the present application obtains communication messages corresponding to multiple users within a target time period, and obtains account information in the communication messages based on the communication messages. The network behavior of each user within the target time period can be determined based on the account information and the communication messages, and then the network behavior that matches the identity of each user can be determined based on the entity information set of each user. The network behavior of each user entity within the target time period can then be monitored and controlled based on the entity information set, so that network control can control user entities, thereby improving the accuracy of network security control. BRIEF DESCRIPTION OF THE DRAWINGS
[0015] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.
[0016] Figure 1 A flow chart of a method for controlling network behavior provided in an embodiment of the present application is shown.
[0017] Figure 2 A flow chart of a method for controlling network behavior provided in another embodiment of the present application is shown.
[0018] Figure 3 A schematic diagram showing the establishment of a correspondence between user information and account information in an IAM system.
[0019] Figure 4 A schematic diagram of a login authentication process for account information is shown.
[0020] Figure 5 A structural block diagram of an account identity recognition device provided in an embodiment of the present application is shown.
[0021] Figure 6 A structural block diagram of an electronic device provided in an embodiment of the present application for executing a method for controlling network behavior according to an embodiment of the present application is shown.
[0022] Figure 7 A storage medium provided in an embodiment of the present application for storing or carrying program codes for implementing a method for controlling network behavior according to an embodiment of the present application is shown. DETAILED DESCRIPTION
[0023] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.
[0024] In response to the problems in the background technology, the inventors have proposed a method, device, electronic device and storage medium for controlling network behavior provided by the embodiments of the present application. By obtaining communication messages corresponding to multiple users within a target time period, and obtaining account information in the communication messages according to the communication messages, the network behavior of each user within the target time period can be determined according to the account information and the communication messages, and then the network behavior that meets the identity of each user can be determined according to the entity information set of each user, and then the network behavior of each user entity within the target time period can be monitored and controlled according to the entity information set, so that network control can control user entities, thereby improving the accuracy of network security control.
[0025] The following will describe in detail the network behavior control method, device, electronic device and storage medium provided in the embodiments of the present application in conjunction with the accompanying drawings.
[0026] See also Figure 1 , Figure 1 The flowchart of the network behavior control method provided in the embodiment of the present application is shown. The network behavior control method can be applied to Figure 5 The network behavior control device 300 and the electronic device 100 equipped with the network behavior control device 300 are shown in FIG. Figure 6 ).
[0027] The network behavior control method may specifically include the following steps:
[0028] Step S110: Acquire multiple communication messages corresponding to multiple users within a target time period.
[0029] Among them, the communication message is a data block transmitted at one time during data transmission, and the communication message contains complete information about the data to be transmitted. The communication message includes a message header, a message body, and a message tail. Among them, the message header contains information such as the source address, destination address, transmission time, and other control information of the data transmission, the message body includes the actual information transmitted, and the message tail is used to mark the end of the message, which can be omitted in some specific cases. The user corresponding to the communication message can be determined by the message header of the communication message.
[0030] In an embodiment of the present application, the communication message may be obtained by obtaining it from the network transport layer according to the message header in response to the target time period determined by the user, or by obtaining it from the memory of the terminal. The method for obtaining the communication message is not specifically limited herein.
[0031] Step S120: obtaining multiple account information according to the multiple communication messages.
[0032] The account information may be the name, cover, introduction, etc. registered by the user in the Internet information service.
[0033] In an embodiment of the present application, the method of obtaining the account information from the communication message may be to obtain the information matching the account rule from the communication message as the account information according to the account rule of the account information. The method of obtaining the account information from the communication message may also be to input the communication message into a pre-trained account information extraction model. The method of obtaining the account information from the communication message may also be to parse each communication message to obtain the account information in the communication message. The method of obtaining the account information from the communication message may also be to parse and extract in combination with the above-mentioned multiple methods. The method of obtaining the account information is not specifically limited here.
[0034] Step S130: Match the multiple account information through the local database to obtain the entity information set corresponding to each user; the entity information set of each user includes the user's application system account, user personal information and user position information.
[0035] Among them, the local database stores entity information sets of multiple users. The entity information set in the local database can be configured by the user in the terminal and stored in the local database. It can also be that the user pre-configures the entity information set of each user in the identity management system and imports the configured entity information set into the local database of the terminal. The import method can be plug-in import, or the entity information set can be sent to the terminal through a communication file, and the entity information set is stored in the local database through the terminal. The configuration method of the entity information set in the local database is not specifically limited here.
[0036] Furthermore, an entity refers to an object with a real form or structure. In the embodiment of the present application, an entity refers to a user entity. Entity information includes but is not limited to user's personal information, application system account, and user position information.
[0037] In an embodiment of the present application, the matching method between the account information and the local database may be based on a preset correspondence relationship. The preset correspondence relationship refers to the correspondence between the account information and the entity information set. When configuring the entity information set, one or more account information corresponding to the entity may be input to further determine the preset correspondence between the account information and the entity information. The entity information set may also include the account information. When the account information is matched in the local database, the entity information set in the local database may be searched based on the account information to determine the entity information corresponding to the account information. The matching method is not specifically limited here.
[0038] Step S140: Perform security control on the network behavior of each user according to the entity information set of each user.
[0039] Among them, security control includes but is not limited to user network access permission control, user network behavior auditing, and user network access risk warning. Among them, user network access permission control refers to determining whether a user can access the network or business. Network behavior auditing refers to comprehensive, detailed, and systematic recording and review of user network behavior. This process achieves real-time monitoring and post-event tracing of network usage through the collection, analysis, and storage of information such as network traffic, user operations, and system logs. Risk warnings for network access refer to reminders of security risks and potential threats that may be encountered during network access.
[0040] Furthermore, network behaviors include but are not limited to network access, network download, network upload, and other behaviors, all of which will be recorded in the communication log. The types of network behaviors are not specifically limited here.
[0041] In the embodiment of the present application, whether the destination corresponding to each user's access behavior has access rights is determined based on each user's entity information set, and the user's access behavior is monitored in real time using the entity information set. When the user's access behavior has risks or potential threats, the user's access behavior is promptly warned to ensure the security of network access.
[0042] For example, the entity information set corresponding to user 1 includes user 1's application system account number xiaoming, user 1's personal information age 22, email address 123456.com, work number 123, mobile phone number 11113333555, and user 1's job position information cloud computing development engineer. User 1 is only allowed to change customer information. If user 1's network behavior indicates that user 1 has accessed the company's local development system, then user 1's network behavior is determined to be abnormal, and user 1's entity information set is traced back to facilitate the enterprise to control user 1's abnormal network behavior.
[0043] The solution provided in this embodiment obtains communication messages corresponding to multiple users within a target time period, and obtains account information in the communication messages based on the communication messages. The network behavior of each user within the target time period can be determined based on the account information and the communication messages, and then the network behavior that matches the identity of each user can be determined based on the entity information set of each user. The network behavior of each user entity within the target time period can be monitored and controlled based on the entity information set, so that network control can control user entities, thereby improving the accuracy of network security control.
[0044] See also Figure 2 , Figure 2 A flow chart of a method for controlling network behavior provided in another embodiment of the present application is shown.
[0045] Step S210: pre-configure entity information sets of multiple users into the local database.
[0046] The configuration method may be that the local database configures the entity information of multiple users based on the user's input instructions as the entity information set of each user. Alternatively, multiple users may first input the corresponding entity information in the identity management system, and obtain the entity information set of each user based on the user information, and finally import the entity information set of each user in the identity management system into the local database. The data import method may be to use a database management tool to import data, or to use a data migration tool to import data. The data import method in the local database is not specifically limited, and the configuration method of the entity information set in the local database is not specifically limited.
[0047] For example, the identity management system is an identity identification and access management (IAM) system. Figure 3 , Figure 3 The configuration diagram of the entity information set in the IAM system is shown. First log in to the IAM system, edit the application system account in the user management interface of the IAM system, and enter the user information corresponding to the account information under the account information. The user's personal information can be information such as name, email address, work number, and mobile phone number. User position information includes but is not limited to information such as department to which he belongs and time of joining the company. And in response to the user's submission instruction, the user's entity information set is determined. For example, the account information is xm, the user information is xiaoming, the email address is 123456.com, the work number is 123, the mobile phone number is 11113333555, and the department is the sales department. At this time, in response to the user's submission instruction, the entity information set of user xiaoming will be obtained.
[0048] Step S220: Acquire multiple communication messages corresponding to multiple users within the target time period.
[0049] For the detailed description of step S220 , please refer to the detailed description of step S110 in the above embodiment, which will not be repeated here.
[0050] Step S230: Determine, according to the plurality of communication messages, communication logs corresponding to the plurality of communication messages.
[0051] Among them, the communication log is the recorded information about the network generated by the computer system, application or service to record various activities, events and states of the network in the computer system, application or service. In the embodiment of the present application, the communication log is a log obtained after recording the communication message. In the electronic device, the communication log can be stored in a preset file directory or in a disk, and the storage location of the communication log is not limited here.
[0052] In the embodiment of the present application, the communication log can be obtained by filtering multiple records in the preset file directory according to the preset target time period to obtain the communication log. The acquisition method can also be to filter the record information in the disk using the target time period to obtain the communication log. The acquisition method of obtaining the communication log in the target time period is not specifically limited here.
[0053] Step S240: extracting the multiple account information from the communication log.
[0054] In an embodiment of the present application, the method for extracting multiple account information from a communication log may be to extract the account according to a preset account rule, for example, to obtain one or more regular expressions corresponding to the account information, and then traverse the communication log according to the regular expression to extract at least one account information. The extraction method may also be to extract through an extraction model, and the extraction model is trained based on multiple sample communication logs. The extraction method may also analyze the communication log to obtain at least one source address in the target communication log, and then extract the account information based on the source address. The account information extraction method is not specifically limited here.
[0055] In some embodiments, extracting the multiple account information from the communication log includes: inputting the communication log into an account information extraction model, the account information extraction model is trained through multiple different log sample sets, the different log sample sets include multiple types of sample logs and a method for extracting account information in each type of log; using the account information extraction model to obtain the multiple account information in the communication log.
[0056] The account information extraction model is a network model obtained by training the account information extraction algorithm through multiple sample communication logs. The account information extraction algorithm can be a natural language processing technology (NLP), and the account information extraction algorithm can also be an information extraction technology (IE). The login status recognition algorithm can be a logistic regression algorithm, and the login status recognition algorithm can also be a naive Bayes method. The account information and login status recognition algorithms are not specifically limited here.
[0057] In this embodiment, the account information in the first target log and the login status corresponding to each account information are first extracted by the extraction model, and then all the extracted account information is classified according to the login status to obtain the account information whose login status meets the preset login status, and the account information whose login status meets the preset login status is taken as the second extraction result, and the communication log for which the account information extraction is not completed is extracted from the first target log as the second target log. In this embodiment, the preset login status is preferably logged in.
[0058] In an optional embodiment, before inputting the communication log into the account information extraction model, the method further includes: using preset account rules to extract multiple account information that conform to the preset account rules from the communication log to obtain extraction results; inputting the communication log into the account information extraction model includes: if the extraction result indicates that the account information is not extracted according to the preset account rules, then inputting the communication log into the account information extraction model.
[0059] Since users will establish standard account information according to preset account rules, in order to avoid wasting the computing power of the extraction model, the account information in the communication log can be initially extracted through the preset account rules corresponding to the account information. Among them, the preset account rules can be customized rules based on the standard accounts of the application system, and the preset account rules can also be regular expressions generated by combining the standard accounts of multiple application systems. The acquisition of preset account rules is not specifically limited here.
[0060] For example, the account information in sample communication log 1 is user / password, and the account information in sample communication log 2 is username / pass. After learning based on sample communication log 1 and sample communication log 2, when encountering account information of user / pass, the extraction model can extract the account information.
[0061] In other embodiments, if not all account information is extracted from the communication log, a user login log is obtained from a user access management system based on the target time period. The user access management system is a system for managing user network access, and the user login log includes at least one user login source address; based on the user login source address, the multiple account information is extracted from the communication log.
[0062] The source address refers to the source IP address. The source address can be obtained by analyzing the communication log, or by connecting to the IAM system to obtain the user's login log, then filtering the login log according to the target time period, obtaining the login log within the target time period, and finally obtaining the user's source address based on the login log. The method for obtaining the source address is not specifically limited here.
[0063] In some further embodiments, at least one account identifier existing within a target time period is extracted from the communication log, and the account information corresponding to the at least one account identifier is determined based on the correspondence between the account identifier and the account information, as the at least one account information existing within the target time period, wherein the account identifier is obtained after login authentication is performed on the account information and the authentication is passed.
[0064] Among them, the account identifier can be an account token, which is a string used as a temporary secret key after the account is authenticated during the login authentication process. After the user logs in and passes the authentication, the subsequent network access will carry the token for access, rather than the account information. The use of the token can ensure the security of the account information. It should be noted that the token is a temporary string. When the user logs in incorrectly, the token will be updated to further ensure the security of the account information. The account identifier can also be a ticket granting cookie (TGC). TGC is a small text file used to store user identity authentication credentials in the single sign-on system. Since TGC is used to store user identity authentication credentials, there is a corresponding relationship between TGC and user identity. The account identifier can also be a user-defined identifier. After the user logs in and passes the authentication, the identifier is used to access in the subsequent network access process to ensure the security of the account information. The specific form of the account identifier is not limited here. In the implementation of the present application, since the account identifier has a corresponding relationship with the account information, and only the account identifier can be extracted from some communication logs, the corresponding relationship between the account information and the account identifier can be used to determine the account information corresponding to the account identifier. Then determine the account information corresponding to the communication log. First, extract at least one account identifier from the target communication log within the target time period, then determine at least one account information extracted from the target communication log based on the correspondence between the account identifier and the account information, and then determine the account information corresponding to the target user information from the at least one account information based on the correspondence between the account information and the target user information, so as to realize the identification of the user information corresponding to the account information, and then accurately monitor the user entity.
[0065] Exemplarily, taking the account identifier as a token, Open Authorization (OAuth) stipulates that there are four ways to obtain a token, including an authorization code acquisition method, a hidden acquisition method, a password acquisition method, and a client credential acquisition method. Among them, the authorization code acquisition method refers to obtaining an authorization code before obtaining a token, and issuing a token after the authorization code is correct. The hidden acquisition method refers to directly sending a token acquisition request to obtain the token. The password acquisition method means that the token will only be issued after the correct key is entered. The client credential acquisition method is suitable for command line applications without a front end, that is, requesting a token under the command line. The token given in this way is for third-party applications, not for users, that is, it is possible that multiple users share the same token. The token acquisition method in the embodiment of the present application is not specifically limited here.
[0066] See also Figure 4 , Figure 4 A schematic diagram of the login authentication process of account information is shown. The basic principle of login authentication is to capture the account (account) of the employee during the application login process, obtain the returned token, and associate the account back through the token in the subsequent request process. This ensures that the account information is retained for each access. When a user accesses the application system through a terminal and is not logged in, the account login is performed. During the account login process, the user name and account password with the account information will be carried to log in. At this time, the account information will be sent to the authentication system. After the authentication is passed, the token will be returned to the terminal. In the subsequent application system access process, the token will be carried to access the application system, and the application system will return the accessed content. When the application system is accessed using the token method and the access times out, the account login authentication will be performed again, and after the authentication is passed, the authentication system will return a new token to the terminal so that the terminal can use the new token to access the application system.
[0067] Step S250: Match the multiple account information through the local database to obtain the entity information set corresponding to each user; the entity information set of each user includes the user's application system account, user personal information and user position information.
[0068] Step S260: Perform security control on the network behavior of each user based on the entity information set of each user.
[0069] For the detailed description of steps S250 to S260 , please refer to the detailed description of steps S130 to S140 in the aforementioned embodiment, which will not be repeated here.
[0070] The solution provided by this embodiment first pre-configures the entity information of multiple users in the local database, thereby improving the efficiency of obtaining the entity information, then obtains the communication messages corresponding to the multiple users within the target time period, and determines the account information based on the communication log corresponding to the communication message, and determines the network behavior of each user within the target time period based on the account information and the communication log, and then determines the network behavior that matches the identity of each user based on the entity information set of each user, and then can monitor and control the network behavior of each user entity within the target time period based on the entity information set, so that network control can control the user entity, thereby improving the accuracy of network security control.
[0071] See also Figure 5, which shows a structural block diagram of a network behavior control device 300 provided in an embodiment of the present application. The network behavior control device 300 is applied to an electronic device 100, and the network behavior control device 300 includes: a communication message acquisition module 310, which is used to obtain multiple communication messages corresponding to multiple users within a target time period; an account information acquisition module 320, which is used to obtain multiple account information according to the multiple communication messages; an entity information set acquisition module 330, which is used to match the multiple account information through a local database to obtain the entity information set corresponding to each user, and each user's entity information set includes the user's application system account, user personal information and user position information; a security control module 340, which is used to perform security control on the network behavior of each user according to the entity information set of each user.
[0072] In some embodiments of the present application, the account information obtaining module 320 includes: a communication log determination submodule, used to determine the communication logs corresponding to the multiple communication messages based on the multiple communication messages; and an account information extraction submodule, used to extract the multiple account information from the communication log.
[0073] In some embodiments of the present application, the account information acquisition module 320 includes: an account information extraction model input submodule, used to input the communication log into the account information extraction model, the account information extraction model is obtained by training through multiple different log sample sets, and the different log sample sets include multiple types of sample logs and the method of extracting account information in each type of log; a first account information acquisition submodule, used to use the account information extraction model to obtain multiple account information in the communication log.
[0074] In some embodiments of the present application, the account information acquisition module 320 also includes: a user login log acquisition sub-module, which is used to obtain the user login log from the user access management system according to the target time period if all account information is not extracted from the communication log. The user access management system is a system for managing user network access, and the user login log includes at least one user login source address; a second account information acquisition sub-module, which is used to extract the multiple account information from the communication log according to the user login source address.
[0075] In some embodiments of the present application, the account information acquisition module 320 also includes: an extraction result acquisition submodule, which is used to use preset account rules to extract multiple account information that conform to the preset account rules from the communication log to obtain extraction results; the account information extraction model input submodule includes: an account information extraction model input unit, which is used to input the communication log into the account information extraction model if the extraction result indicates that the account information is not extracted according to the preset account rules.
[0076] In some embodiments of the present application, the network behavior management and control device 300 includes: a local database configuration module, which is used to pre-configure entity information sets of multiple users into the local database.
[0077] In some embodiments of the present application, the network behavior control device 300 is used for security control, and the security control is at least one of user network access permission control, user network behavior auditing, and user network access risk warning.
[0078] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described devices and modules can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here.
[0079] In several embodiments provided in the present application, the coupling between modules may be electrical, mechanical or other forms of coupling.
[0080] In addition, each functional module in each embodiment of the present application can be integrated into a processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The above integrated modules can be implemented in the form of hardware or software functional modules.
[0081] A structural block diagram of an electronic device provided in an embodiment of the present application. Please refer to Figure 6 , which shows a structural block diagram of an electronic device provided in an embodiment of the present application. The electronic device 100 can be an electronic device such as a computer, a server, etc. that can run an application. The electronic device 100 in the present application may include one or more of the following components: a processor 101, a memory 102, and one or more applications, wherein the one or more applications may be stored in the memory 102 and configured to be executed by one or more processors 101, and the one or more programs are configured to execute the method described in the aforementioned method embodiment.
[0082] The processor 101 may include one or more processing cores. The processor 101 uses various interfaces and lines to connect various parts of the entire electronic device 100, and executes various functions and processes data of the electronic device 100 by running or executing instructions, programs, code sets or instruction sets stored in the memory 102, and calling data stored in the memory 102. Optionally, the processor 101 can be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). The processor 101 can integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing display content; and the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 101, but may be implemented separately through a communication chip.
[0083] The memory 102 may include a random access memory (RAM) or a read-only memory (ROM). The memory 102 may be used to store instructions, programs, codes, code sets or instruction sets. The memory 102 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the following various method embodiments, etc. The data storage area may also store data (such as a phone book, audio and video data, chat record data) created by the electronic device 100 during use.
[0084] Please refer to Figure 7 , which shows a structural block diagram of a computer-readable storage medium provided in an embodiment of the present application. The computer-readable storage medium 200 stores program codes, which can be called by a processor to execute the method described in the above method embodiment.
[0085] The computer-readable storage medium 200 may be an electronic memory such as a flash memory, an EEPROM (electrically erasable programmable read-only memory), an EPROM, a hard disk, or a ROM. Optionally, the computer-readable storage medium 200 includes a non-transitory computer-readable storage medium. The computer-readable storage medium 200 has storage space for program code 210 that performs any method steps in the above method. These program codes can be read from or written to one or more computer program products. The program code 210 can be compressed, for example, in an appropriate form.
[0086] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application.
Claims
1. A method for controlling network behavior, characterized in that: The method comprises: Acquire multiple communication messages corresponding to multiple users within a target time period; Obtaining multiple account information according to the multiple communication messages; Matching the multiple account information through a local database to obtain entity information sets corresponding to each user; the entity information set of each user includes the user's application system account, user personal information, and user position information; Based on each user's entity information set, security management and control is performed on each user's network behavior.
2. The method according to claim 1, characterized in that: The obtaining of multiple account information according to the multiple communication messages includes: Determining, according to the plurality of communication messages, communication logs corresponding to the plurality of communication messages; The multiple account information is extracted from the communication log.
3. The method according to claim 2, characterized in that The extracting the plurality of account information from the communication log includes: Inputting the communication log into an account information extraction model, wherein the account information extraction model is obtained by training with a plurality of different log sample sets, wherein the different log sample sets include a plurality of types of sample logs and a method for extracting account information from each type of log; The account information extraction model is used to obtain multiple account information in the communication log.
4. The method according to claim 3, characterized in that After inputting the communication log into the account information extraction model, the method further includes: If all account information is not extracted from the communication log, obtaining a user login log from a user access management system according to the target time period, the user access management system being a system for managing user network access, the user login log including at least one user login source address; The plurality of account information is extracted from the communication log according to the user login source address.
5. The method according to claim 3, characterized in that: Before inputting the communication log into the account information extraction model, the method further includes: Using a preset account rule, extracting multiple account information that meets the preset account rule from the communication log to obtain an extraction result; The step of inputting the communication log into an account information extraction model comprises: If the extraction result indicates that the account information is not extracted according to the preset account rule, the communication log is input into the account information extraction model.
6. The method according to any one of claims 1 to 5, characterized in that: Before matching the multiple account information through the local database to obtain entity information sets corresponding to each user, the method further includes: Preconfigure entity information sets of multiple users into the local database.
7. The method according to any one of claims 1 to 5, characterized in that: The security management and control is at least one of user network access permission control, user network behavior audit and user network access risk warning.
8. A network behavior control device, characterized in that: The device comprises: A communication message acquisition module, used to acquire multiple communication messages corresponding to multiple users within a target time period; An account information obtaining module, used to obtain multiple account information according to the multiple communication messages; An entity information set acquisition module is used to match the multiple account information through a local database to obtain entity information sets corresponding to each user, where each user's entity information set includes the user's application system account, user personal information, and user position information; The security control module is used to perform security control on the network behavior of each user based on the entity information set of each user.
9. An electronic device, characterized in that: The electronic device comprises: one or more processors; Memory; One or more application programs, wherein the one or more application programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs are configured to execute the method according to any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores program codes, which can be called by a processor to execute the method according to any one of claims 1 to 7.