Trap-based BOT flow detection method and related device
By deploying trap links in the target page and monitoring the access path of network BOT, the problem of difficulty in efficient detection of malicious BOT in the prior art is solved, and accurate detection and efficient defense are achieved.
Patent Information
- Application Number
- CN202411808487.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-10
- Publication Date
- 2025-02-25
AI Technical Summary
The existing technology is difficult to efficiently detect malicious BOT traffic, and the maintenance of BOT lists consumes a lot of manpower, so it is impossible to effectively deal with the emergence of new BOTs.
By deploying trap links in the target page, capture the network BOT that accesses the trap links, and determine the malicious BOT by monitoring its access path.
It realizes accurate detection of malicious BOT in BOT traffic, improves the detection efficiency and accuracy of malicious BOT, reduces false alarms, and builds a more targeted defense mechanism.
Smart Images
Figure CN119520157A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of network security technology, and in particular to a trap-based BOT traffic detection method and related devices. Background Art
[0002] BOT traffic refers to automated program access traffic initiated by non-manual operations (such as tool scripts, plug-in crawlers, etc.) to service entities such as websites, servers or applications. Malicious BOTs in BOT traffic may perform malicious attacks such as crawling sensitive data, brushing business interfaces, plug-in cheating, etc., which will cause network fraud and security threats.
[0003] Currently, malicious BOTs in BOT traffic are often identified by maintaining BOT lists. This requires that the IP addresses of known malicious BOTs be updated in the BOT lists at any time. However, with the continuous emergence of new BOTs, the maintenance of the BOT lists will consume a lot of manpower, which will make it impossible to efficiently detect malicious BOTs. Summary of the invention
[0004] In view of the above problems, this application provides a trap-based BOT traffic detection method and related devices to achieve the purpose of accurately detecting malicious BOTs in BOT traffic. The specific solution is as follows:
[0005] The first aspect of the present application provides a trap-based BOT flow detection method, the trap-based BOT flow detection method comprising:
[0006] Deploy trap links in the target page;
[0007] Capturing the network BOT accessing the trap link in the BOT traffic of the target page;
[0008] By monitoring the access path of the network BOT under the target page, a malicious BOT in the network BOT is determined.
[0009] In a possible implementation, a first picture is set under the trap link, and the first picture is in a hidden state and is prohibited from being accessed by users;
[0010] The method of determining a malicious BOT in the network BOT by monitoring the access path of the network BOT under the target page includes:
[0011] The BOT in the network BOT that accesses the first image is regarded as the malicious BOT.
[0012] In a possible implementation, a second picture is provided under the trap link, the second picture is in a visible state and is associated with a network link, and the network link is prohibited from being accessed by users;
[0013] The method of determining a malicious BOT in the network BOT by monitoring the access path of the network BOT under the target page includes:
[0014] The BOT in the network BOT that accesses the second image index to the network link is regarded as the malicious BOT.
[0015] In a possible implementation, the display area of the trap link in the target page is shielded from user editing;
[0016] The method of determining a malicious BOT in the network BOT by monitoring the access path of the network BOT under the target page includes:
[0017] The BOT that edits the display area in the network BOT is regarded as the malicious BOT.
[0018] In a possible implementation, the determining of a malicious BOT in the network BOT by monitoring the access path of the network BOT under the target page includes:
[0019] Monitor the touch events of the network BOT in the target page;
[0020] The BOT in the network that has not detected the touch event within a preset time period is regarded as the malicious BOT.
[0021] In a possible implementation, the trap-based BOT traffic detection method further includes:
[0022] The access information of the malicious BOT is extracted and stored in a database.
[0023] The second aspect of the present application provides a trap-based BOT flow detection device, the trap-based BOT flow detection device comprising:
[0024] Trap deployment module, used to deploy trap links in the target page;
[0025] A BOT capture module, used for capturing the network BOT accessing the trap link in the BOT traffic of the target page;
[0026] The malicious BOT monitoring module is used to determine the malicious BOT in the network BOT by monitoring the access path of the network BOT under the target page.
[0027] The third aspect of the present application provides a computer program product, including computer-readable instructions. When the computer-readable instructions are executed on an electronic device, the electronic device implements the trap-based BOT traffic detection method of the above-mentioned first aspect or any implementation of the first aspect.
[0028] A fourth aspect of the present application provides an electronic device, comprising at least one processor and a memory connected to the processor, wherein:
[0029] The memory is used to store computer programs;
[0030] The processor is used to execute the computer program so that the electronic device can implement the trap-based BOT traffic detection method of the above-mentioned first aspect or any implementation of the first aspect.
[0031] The fifth aspect of the present application provides a computer storage medium, which carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can implement the trap-based BOT traffic detection method of the above-mentioned first aspect or any implementation method of the first aspect.
[0032] By means of the above technical solution, the present application provides a trap-based BOT traffic detection method and related devices, which deploy trap links in the target page; capture network BOTs that access trap links in the BOT traffic of the target page; and determine malicious BOTs in the network BOTs by monitoring the access path of the network BOTs under the target page. The present application accurately captures BOT features by deploying trap links, thereby achieving accurate detection of malicious BOTs, improving the detection efficiency and accuracy of malicious BOTs, and providing a basis for building a more targeted defense mechanism. BRIEF DESCRIPTION OF THE DRAWINGS
[0033] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale.
[0034] Figure 1 A flowchart of a BOT flow detection method based on a trap provided in an embodiment of the present application;
[0035] Figure 2 Another flowchart of a trap-based BOT flow detection method provided in an embodiment of the present application;
[0036] Figure 3 Another flowchart of a trap-based BOT flow detection method provided in an embodiment of the present application;
[0037] Figure 4 Another flowchart of a trap-based BOT flow detection method provided in an embodiment of the present application;
[0038] Figure 5 Another flowchart of a trap-based BOT flow detection method provided in an embodiment of the present application;
[0039] Figure 6 Another flowchart of a trap-based BOT flow detection method provided in an embodiment of the present application;
[0040] Figure 7 A schematic diagram of the structure of a trap-based BOT flow detection device provided in an embodiment of the present application;
[0041] Figure 8 Another structural schematic diagram of a trap-based BOT flow detection device provided in an embodiment of the present application;
[0042] Fig. 9 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0043] The following describes the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. The terms used in the implementation method section of the present application are only used to explain the specific embodiments of the present application, and are not intended to limit the present application.
[0044] The embodiments of the present application are described below in conjunction with the accompanying drawings. Those skilled in the art will appreciate that, with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.
[0045] The terms "first", "second" etc. in the specification of the application and the above-mentioned drawings are used to distinguish similar objects, and need not be used to describe a specific order or sequential order. It should be understood that the terms used in this way can be interchangeable in appropriate circumstances, and this is only to describe the distinction mode adopted by the objects of the same attributes when describing in the embodiments of the application. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, so that the process, method, system, product or equipment comprising a series of units need not be limited to those units, but may include other units that are not clearly listed or inherent to these processes, methods, products or equipment.
[0046] The BOT traffic detection method and device based on traps provided in the embodiment of the present application, firstly, can more accurately capture the characteristics of BOT based on the implementation of trap technology, reduce false alarms, and build a more targeted defense mechanism; secondly, the present application has stronger adaptability and scalability, and the website administrator can continuously adjust and optimize the settings of trap links according to the actual situation to cope with the new trends of BOT attacks; furthermore, the present application can be combined with other BOT detection methods to form a more three-dimensional defense system, and the implementation cost is relatively low. The following first introduces a BOT traffic detection method based on traps provided in the embodiment of the present application in detail in conjunction with the accompanying drawings.
[0047] See also Figure 1 , Figure 1 The following is a flow chart of a BOT flow detection method based on a trap provided in an embodiment of the present application. Figure 1 As shown, a trap-based BOT traffic detection method provided in an embodiment of the present application may include steps S10 to S30, and these steps are described in detail below.
[0048] S10, deploying a trap link in the target page.
[0049] The embodiment of the present application adopts a BOT detection mechanism based on trap technology, and uses the characteristics of the HTTP protocol to set a hidden trap link (ie, Trap Link) in the website page to be detected (ie, the target page) to capture the access behavior of the BOT.
[0050] Specifically, the trap link is invisible to human users, and only malicious BOTs will be attracted to visit it. In this regard, the embodiment of the present application can configure a BOT statement in the target page, and the BOT statement contains network links in the target page that are prohibited from access. These network links can be used as trap links.
[0051] In actual applications, in order to capture malicious BOTs, you first need to set a BOT declaration (which can be / robots.txt). The BOT declaration is a description of its website to the network BOT. For example, for a network link "http: / / www.example.com / welcome.html" on the target web page, the network BOT needs to check its BOT declaration "http: / / www.example.com / robots.txt" before accessing it. The network BOT can find the "User-agent" and "Disallow" fields. The "User-agent" field indicates the applicable BOT type, and the "Disallow" field indicates the network link that cannot be accessed. Since the "Disallow" field of the BOT declaration has clearly indicated that the network BOT cannot access the network link, any network BOT that clicks on the network link does not obey the BOT declaration. Therefore, the website link contained in the "Disallow" field of the BOT declaration can be used as a trap link, and all network BOTs that access the trap link may be malicious BOTs.
[0052] S20, capturing the network BOT that accesses the trap link in the BOT traffic of the target page.
[0053] In an embodiment of the present application, at least one trap link can be deployed in the target page through the "Disallow" field declared by the BOT. Therefore, for the BOT traffic accessing the target page, the network BOT accessing any trap link can be captured. Since these network BOTs may be malicious BOTs, their source IP, access time, access page, request header, request body and other key information can be recorded, and this key information can be cleaned and formatted.
[0054] S30, determining malicious BOTs in the network BOTs by monitoring the access paths of the network BOTs under the target page.
[0055] In the embodiment of the present application, for the captured network BOT accessing the trap link, by monitoring its access path under the target page, it can be determined whether it meets the specific conditions. Once it meets the conditions, it is regarded as a malicious BOT. The IP address of the malicious BOT is captured, so as to establish a malicious BOT address library.
[0056] Of course, in actual applications, you can also set up a BOT whitelist to filter out detected malicious BOTs to exclude known search engines.
[0057] In a possible implementation, the specific condition may be to hide the image under the trap link so that human users cannot find it, and only the BOT can access the hidden image. Figure 2 , Figure 2 Another flowchart of a BOT flow detection method based on a trap provided in an embodiment of the present application is shown below. Figure 2 As shown, a first picture is set under the trap link, the first picture is in a hidden state, and users are prohibited from accessing it. Accordingly, step S30 "determine the malicious BOT in the network BOT by monitoring the access path of the network BOT under the target page" can adopt the following steps:
[0058] S301: The BOT accessing the first image in the network BOT is regarded as a malicious BOT.
[0059] Specifically, in the embodiment of the present application, the size of the first image under the trap link is set to 0 to make it invisible, so that human users cannot find the first image, and the first image is prohibited from being accessed by users, so that human users cannot perform click operations on the first image, while the network BOT can access the first image through HTML code. In actual applications, in order to enable the network BOT to access the first image, it is necessary to add alt attributes and meta tags in HTML.
[0060] Based on this, for the captured network BOTs, the BOT that accesses the first picture can be regarded as a malicious BOT.
[0061] In a possible implementation, the specific condition may be to set the image under the trap link to be visible, and to set a hidden network link behind the image so that human users cannot find it, and only the BOT can access the hidden network link. Figure 3 , Figure 3 Another flowchart of a BOT flow detection method based on a trap provided in an embodiment of the present application is shown below. Figure 3 As shown, a second picture is set under the trap link, the second picture is in a visible state, and is associated with a network link, and the network link is prohibited from being accessed by users. Accordingly, step S30 "determine the malicious BOT in the network BOT by monitoring the access path of the network BOT under the target page" can adopt the following steps:
[0062] S302: The BOT in the network BOT that accesses the second image index to the network link is regarded as a malicious BOT.
[0063] Specifically, in the present application trial, the second image under the trap link is set to be visible (the specific size can be adjusted as needed), and a network link that is prohibited from user access is associated with the second image. In this way, the second image is visible, and the network link behind it is hidden and cannot be clicked by human users. In this way, human users cannot perform click operations on the network, but the network BOT can still access and index the network link through HTML code.
[0064] Based on this, for the captured network BOT, the BOT that accesses the second picture and indexes the network link behind it can be regarded as a malicious BOT.
[0065] In one possible implementation, the specific condition can be to shield the link area from mouse selection, so that the trap link is visible but cannot be edited by human users, only BOTs can edit it. Figure 4 , Figure 4 Another flowchart of a BOT flow detection method based on a trap provided in an embodiment of the present application is shown below. Figure 4 As shown, the display area of the trap link in the target page is blocked from user editing. Accordingly, step S30 "determine the malicious BOT in the network BOT by monitoring the access path of the network BOT under the target page" can adopt the following steps:
[0066] S303, treating the BOT in the editing display area in the network BOT as a malicious BOT.
[0067] Specifically, in the embodiment of the present application, the display area of the trap link in the target page can be set to the background color, and the display area is shielded from user editing, that is, human users cannot click on the display area, or select link text, etc. Therefore, even if human users see the trap link, they cannot edit it, and the network bot can still edit the display area of the trap link through HTML code.
[0068] Based on this, for the captured network BOT, the BOT in the display area where the trap link is edited can be regarded as a malicious BOT.
[0069] In a possible implementation, the specific condition may be the absence of a detected touch event. Figure 5 , Figure 5 Another flowchart of a BOT flow detection method based on a trap provided in an embodiment of the present application is shown below. Figure 5 As shown, a trap-based BOT traffic detection method provided by an embodiment of the present application, wherein step S30 "determines malicious BOTs in the network BOTs by monitoring the access path of the network BOTs under the target page", can adopt the following steps:
[0070] S304, monitoring the touch events of the network BOT in the target page.
[0071] Specifically, in the embodiment of the present application, the touch events (such as mouse events, keyboard events, etc.) of the network BOT in the target page can be monitored to exclude human users from accessing the target page.
[0072] S305: The BOT in the network that has not detected any touch event within a preset time period is regarded as a malicious BOT.
[0073] Specifically, in the embodiment of the present application, if the network BOT does not detect any touch event within a preset time (such as 20 seconds), it is considered that the visitor is not a human user, but a malicious BOT. Therefore, for the captured network BOT, the BOT that does not detect a touch event within the preset time can be regarded as a malicious BOT. In practical applications, it can be implemented through JS (JavaScript) code.
[0074] It can be seen that the embodiments of the present application can make full use of the differences in human-computer interaction and efficiently identify malicious BOT behaviors.
[0075] In a possible implementation, the access information of malicious BOTs can also be stored in the database to establish a complete BOT access information database. Website administrators can use the BOT access information database to perform data analysis and formulate more targeted BOT defense strategies. Figure 6 , Figure 6 Another flowchart of a BOT flow detection method based on a trap provided in an embodiment of the present application is shown below. Figure 6 As shown, a trap-based BOT traffic detection method provided in an embodiment of the present application also includes the following steps:
[0076] S40, extracting the access information of the malicious BOT and storing the access information in a database.
[0077] Specifically, in the embodiment of the present application, after being cleaned and formatted, key information such as the source IP, access time, access page, request header, request body, etc. of the malicious BOT can be further analyzed and extracted, and the key features contained therein can be stored in a database to construct a BOT access information library.
[0078] Through the above description, the embodiment of the present application provides a trap-based BOT traffic detection method, which accurately captures BOT characteristics by deploying trap links, thereby achieving accurate detection of malicious BOTs, improving the detection efficiency and accuracy of malicious BOTs, and providing a basis for building a more targeted defense mechanism.
[0079] See also Figure 7 , Figure 7 The schematic diagram of the structure of a BOT flow detection device based on a trap provided in the embodiment of the present application. Figure 7 As shown, a BOT flow detection device based on a trap provided in an embodiment of the present application includes:
[0080] The trap deployment module 10 is used to deploy the trap link in the target page;
[0081] A BOT capture module 20, used to capture the network BOT accessing the trap link in the BOT traffic of the target page;
[0082] The malicious BOT monitoring module 30 is used to determine malicious BOTs in the network BOTs by monitoring the access paths of the network BOTs under the target page.
[0083] In a possible implementation, a first picture is set under the trap link, and the first picture is in a hidden state and is prohibited from being accessed by users;
[0084] Malicious BOT monitoring module 30 is specifically used for:
[0085] The BOT that accesses the first image among the network BOTs is regarded as a malicious BOT.
[0086] In a possible implementation, a second picture is provided under the trap link, the second picture is in a visible state, and is associated with a network link, and the network link is prohibited from being accessed by users;
[0087] Malicious BOT monitoring module 30 is specifically used for:
[0088] The BOT in the network BOT that accesses the second image index to the network link is regarded as a malicious BOT.
[0089] In a possible implementation, the display area of the trap link in the target page is blocked from user editing;
[0090] Malicious BOT monitoring module 30 is specifically used for:
[0091] The BOT that edits the display area in the network BOT is regarded as a malicious BOT.
[0092] In a possible implementation, the malicious BOT monitoring module 30 is specifically used to:
[0093] Monitor the touch events of the network BOT in the target page; and regard the BOT in the network BOT that has not detected any touch events within a preset time as a malicious BOT.
[0094] See also Figure 8 , Figure 8 Another structural diagram of a trap-based BOT flow detection device provided in an embodiment of the present application. Figure 8 As shown, in a possible implementation, the trap-based BOT flow detection device further includes:
[0095] The information storage module 40 is used to extract the access information of the malicious BOT and store the access information in the database.
[0096] It should be noted that the detailed functions of each module in the embodiment of the present application can be found in the corresponding public part of the above-mentioned trap-based BOT traffic detection method embodiment, which will not be repeated here.
[0097] The present application also provides an electronic device in an embodiment. Fig. 9 , Fig. 9 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. The electronic device in the embodiment of the present application may include but is not limited to fixed terminals such as mobile phones, laptops, PDAs (personal digital assistants), PADs (tablet computers), desktop computers, etc. Fig. 9 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.
[0098] like Fig. 9 As shown, the electronic device may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage device 908 to a random access memory (RAM) 903. When the electronic device is powered on, various programs and data required for the operation of the electronic device are also stored in the RAM 903. The processing device 901, the ROM 902, and the RAM 903 are connected to each other via a bus 904. An input / output (I / O) interface 905 is also connected to the bus 904.
[0099] Typically, the following devices may be connected to the I / O interface 905: an input device 906 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 907 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 908 including, for example, a memory card, a hard disk, etc.; and a communication device 909. The communication device 909 may allow the electronic device to communicate with other devices wirelessly or by wire to exchange data. Although Fig. 9 An electronic device having various devices is shown, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.
[0100] An embodiment of the present application also provides a computer program product including computer-readable instructions. When the computer-readable instructions are executed on an electronic device, the electronic device implements any of the trap-based BOT traffic detection methods provided in the embodiments of the present application.
[0101] A computer-readable storage medium is also provided in an embodiment of the present application. The storage medium carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can implement any trap-based BOT traffic detection method provided in the embodiment of the present application.
[0102] It should also be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed over multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the drawings of the device embodiments provided by the present application, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines.
[0103] Through the description of the above implementation mode, the technicians in the field can clearly understand that the present application can be implemented by means of software plus necessary general hardware, and of course, it can also be implemented by special hardware including special integrated circuits, special CPUs, special memories, special components, etc. In general, all functions completed by computer programs can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be various, such as analog circuits, digital circuits or special circuits. However, for the present application, software program implementation is a better implementation mode in more cases. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a readable storage medium, such as a computer floppy disk, a U disk, a mobile hard disk, a ROM, a RAM, a disk or an optical disk, etc., including a number of instructions to enable a computer device (which can be a personal computer, a training device, or a network device, etc.) to execute the methods described in each embodiment of the present application.
[0104] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments may be implemented in the form of a computer program product.
[0105] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, a computer, a training device, or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, training device, or data center. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a training device, a data center, etc. that includes one or more available media integrations. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)), etc.
Claims
1. A BOT flow detection method based on traps, characterized in that: The BOT flow detection method based on traps includes: Deploy trap links in the target page; Capturing the network BOT accessing the trap link in the BOT traffic of the target page; By monitoring the access path of the network BOT under the target page, a malicious BOT in the network BOT is determined.
2. The BOT flow detection method based on trap according to claim 1 is characterized in that: A first picture is set under the trap link, and the first picture is in a hidden state and is prohibited from being accessed by users; The method of determining a malicious BOT in the network BOT by monitoring the access path of the network BOT under the target page includes: The BOT in the network BOT that accesses the first image is regarded as the malicious BOT.
3. The BOT flow detection method based on trap according to claim 1 is characterized in that: A second picture is provided under the trap link, the second picture is in a visible state and is associated with a network link, and the network link is prohibited from being accessed by users; The method of determining a malicious BOT in the network BOT by monitoring the access path of the network BOT under the target page includes: The BOT in the network BOT that accesses the second image index to the network link is regarded as the malicious BOT.
4. The BOT flow detection method based on trap according to claim 1 is characterized in that: The display area of the trap link in the target page is shielded from user editing; The method of determining a malicious BOT in the network BOT by monitoring the access path of the network BOT under the target page includes: The BOT that edits the display area in the network BOT is regarded as the malicious BOT.
5. The BOT flow detection method based on trap according to claim 1 is characterized in that: The method of determining a malicious BOT in the network BOT by monitoring the access path of the network BOT under the target page includes: Monitor the touch events of the network BOT in the target page; The BOT in the network that has not detected the touch event within a preset time period is regarded as the malicious BOT.
6. The trap-based BOT flow detection method according to claim 1, characterized in that: The trap-based BOT flow detection method also includes: The access information of the malicious BOT is extracted and stored in a database.
7. A BOT flow detection device based on a trap, characterized in that: The BOT flow detection device based on the trap comprises: Trap deployment module, used to deploy trap links in the target page; A BOT capture module, used for capturing the network BOT accessing the trap link in the BOT traffic of the target page; The malicious BOT monitoring module is used to determine the malicious BOT in the network BOT by monitoring the access path of the network BOT under the target page.
8. A computer program product, characterized in that It comprises computer-readable instructions, and when the computer-readable instructions are executed on an electronic device, the electronic device implements the trap-based BOT traffic detection method as claimed in any one of claims 1 to 6.
9. An electronic device, characterized in that: The method comprises at least one processor and a memory connected to the processor, wherein: The memory is used to store computer programs; The processor is used to execute the computer program so that the electronic device can implement the trap-based BOT flow detection method as described in any one of claims 1 to 6.
10. A computer storage medium, characterized in that: The storage medium carries one or more computer programs, and when the one or more computer programs are executed by an electronic device, the electronic device can implement the trap-based BOT traffic detection method as described in any one of claims 1 to 6.