Risk processing method and device, storage medium and electronic equipment

Abstract

The invention discloses a risk processing method and device, a storage medium and electronic equipment, and the method comprises the steps: obtaining a corresponding reference user access log through a reference network application program, and learning a reference network verification rule corresponding to the reference user access log through the reference user access log, according to the method, the reference network verification rule is learned, the rule verification set is updated according to the reference network verification rule, and when the target user access log in the target application program is detected, the reference network verification rule corresponding to the target user access log can be determined according to the learned reference network verification rule; according to the method and the device, various reference network verification rules in the network application program can be self-learned and updated in time, so that the efficiency of risk processing in the network application program can be improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a risk management method, device, storage medium and electronic device. Background Art

[0002] With the rapid development of Internet technology, web applications have become an indispensable part of the daily operations, communication, shopping, and entertainment of modern enterprises and individuals. However, this high degree of dependence and popularity has also made it a major target for hackers and malicious attackers. Web applications face increasingly complex and diverse security threats, including but not limited to data leakage, data tampering, denial of service attacks (DDoS), cross-site scripting attacks (XSS), SQL injection, cross-site request forgery (CSRF), etc. Once these security vulnerabilities are exploited, they will not only lead to the leakage of user personal information, but may also cause financial losses, reputation damage and even legal disputes, causing significant impacts on enterprises and individuals.

[0003] Traditional security defense methods, such as firewalls and intrusion detection systems, can resist external attacks to a certain extent, but their limitations are becoming increasingly prominent in the face of evolving attack techniques and methods. These systems often rely on preset rules and feature libraries to identify and block attacks, while attackers bypass these defense mechanisms by constantly changing attack methods and exploiting new vulnerabilities.

[0004] Therefore, in order to more effectively address the security challenges of network applications, a more efficient risk handling solution is needed. Summary of the invention

[0005] The embodiments of the present application provide a risk management method, device, storage medium, and electronic device, which can improve the efficiency of risk management in network applications.

[0006] In a first aspect, an embodiment of the present application provides a risk management method, including:

[0007] Obtain a reference user access log corresponding to a reference network application;

[0008] Based on the reference user access log, a verification rule learning engine is used to generate verification rules based on the reference user behavior pattern to obtain reference network verification rules;

[0009] Update the rule verification set based on the above reference network verification rules;

[0010] The target user access log in the target network application is monitored, and based on the target user access log, the rule verification engine is used to call the above rule verification set to perform risk processing on the above target user.

[0011] In a possible implementation, based on the reference user access log, a verification rule learning engine is used to generate verification rules based on the reference user behavior pattern to obtain reference network verification rules, including:

[0012] Using a verification rule learning engine to determine a reference user behavior pattern for the reference user access log;

[0013] A verification rule generation process is performed based on the above reference user behavior pattern to obtain a reference network verification rule.

[0014] In a possible implementation, the verification rule learning engine is used to determine the reference user behavior pattern for the reference user access log, including:

[0015] Using a verification rule learning engine to obtain a reference user behavior pattern label corresponding to the reference user access log, and determining a reference user behavior pattern based on the reference user behavior pattern label; and / or,

[0016] Using a verification rule learning engine to perform behavior pattern recognition on the reference user access log to obtain a reference user behavior pattern;

[0017] Among them, the above-mentioned reference user behavior patterns include normal network behavior patterns and abnormal network behavior patterns.

[0018] In a possible implementation, the verification rule learning engine is used to perform behavior pattern recognition on the reference user access log to obtain the reference user behavior pattern, including:

[0019] Using a verification rule learning engine to determine multiple metadata behavior verification dimensions for the reference user access log, based on evaluation dimension deviation parameters of the reference user access log in each of the metadata behavior verification dimensions;

[0020] Draw a reference user access behavior radar chart based on the evaluation dimension deviation parameter of each of the metadata behavior verification dimensions;

[0021] The comprehensive behavior deviation degree is determined based on the reference user access behavior radar chart, and the reference user behavior pattern corresponding to the reference user access log is determined based on the comprehensive behavior deviation degree.

[0022] In a possible implementation, the updating of the rule verification set based on the reference network verification rule includes:

[0023] Determine the URL corresponding to the above reference network verification rule;

[0024] The reference network verification rule is written into the rule verification set, and the URL is used as the rule verification identifier of the reference network verification rule.

[0025] In a possible implementation, the rule verification engine based on the target user access log calls the rule verification set to perform risk processing on the target user, including:

[0026] Input the target user access log into the rule verification engine, perform verification rule matching processing on the target user access log through the rule verification set, and obtain a rule verification result;

[0027] Based on the above rule verification results, the above target users are protected from risky behavior.

[0028] In a possible implementation, the target user access log is subjected to verification rule matching processing by the rule verification set to obtain a rule verification result, including:

[0029] Determine the target URL corresponding to the target web application;

[0030] Using the target URL as a rule verification index, querying at least one target network verification rule corresponding to the rule verification index from the rule verification set;

[0031] The target network verification rule is used to perform verification rule matching processing on the target user access log to obtain a rule verification result.

[0032] In a possible implementation, the risk behavior protection processing for the target user based on the rule verification result includes:

[0033] Determine the user behavior pattern type corresponding to the above rule verification result;

[0034] If the user behavior pattern type is an abnormal behavior pattern type, determining an abnormal network verification rule corresponding to the rule verification result;

[0035] Obtain the abnormal protection action corresponding to the abnormal network verification rule, and execute the abnormal protection action on the target user.

[0036] In one possible implementation, the method further includes:

[0037] The target user access log is used as the reference user access log, and the step of generating and processing the reference network verification rules based on the reference user access log by using the verification rule learning engine and the reference user behavior pattern is performed.

[0038] In a second aspect, an embodiment of the present application further provides a risk management device, including:

[0039] An acquisition module, used to acquire a reference user access log corresponding to a reference network application;

[0040] A generation module is used to generate verification rules based on the reference user access log and the reference user behavior pattern using a verification rule learning engine to obtain reference network verification rules;

[0041] An updating module, used to update a rule verification set based on the reference network verification rules;

[0042] The processing module is used to monitor the target user access log in the target network application, and based on the target user access log, use the rule verification engine to call the above rule verification set to perform risk processing on the above target user.

[0043] In a third aspect, an embodiment of the present application further provides a computer-readable storage medium on which a computer program is stored. When the above-mentioned computer program runs on a computer, the above-mentioned computer executes the risk management method provided in any embodiment of the present application.

[0044] In a fourth aspect, an embodiment of the present application further provides an electronic device, comprising a processor and a memory, wherein the memory has a computer program, and the processor is used to execute a risk management method provided in any embodiment of the present application by calling the computer program.

[0045] The technical solution provided by the embodiment of the present application is to obtain the reference user access log corresponding to the reference network application, and based on the reference user access log, use the verification rule learning engine to generate verification rules based on the reference user behavior pattern to obtain the reference network verification rules, update the rule verification set based on the reference network verification rules, monitor the target user access log in the target network application, and use the rule verification engine to call the rule verification set based on the target user access log to perform risk processing on the target user. In the present application, the corresponding reference user access log is obtained by referring to the network application, and the reference network verification rules corresponding to the reference user access log are learned through the reference user access log, and the reference network verification rules are updated to the rule verification set. When monitoring the target user access log in the target application, the reference network verification rules corresponding to the target user access log can be determined according to the learned reference network verification rules, so as to perform risk processing on the target user according to the reference network verification rules. In the present application, various reference network verification rules in the network application can be self-learned and updated in time, so as to improve the efficiency of risk processing in the network application. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0047] Figure 1 A first flow chart of the risk management method provided in the embodiment of the present application.

[0048] Figure 2 A second flow chart of the risk management method provided in an embodiment of the present application.

[0049] Figure 3 A schematic diagram of the structure of a risk management device provided in an embodiment of the present application.

[0050] Figure 4 A first structural schematic diagram of an electronic device provided in an embodiment of the present application.

[0051] Figure 5 A second structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0052] The technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0053] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0054] The network application mentioned in this application refers to a web application.

[0055] Among them, a web application is a software program that can be accessed through a web browser. It usually runs on a web server. Users can use a browser to send requests to the server through the Internet or an intranet. After receiving the requests, the server will process them and return the corresponding results, which are usually web pages or other types of documents.

[0056] Web applications can be of various types, such as:

[0057] E-commerce websites: such as online shopping websites, where users can browse products, place orders, make payments, etc.

[0058] Social media platforms: such as Weibo, WeChat, Facebook, etc., where users can post information, communicate and interact.

[0059] Online office software: such as Google Docs, Office 365, etc., users can edit documents, spreadsheets, slides, etc. online.

[0060] Content Management System (CMS): Such as WordPress, Joomla, etc., used to build and manage website content.

[0061] Enterprise Resource Planning (ERP) system: used for internal enterprise management, such as supply chain management, financial management, human resource management, etc.

[0062] Customer Relationship Management (CRM) system: used to manage customer information, sales processes, customer service, etc.

[0063] Among them, web applications usually consist of front-end and back-end:

[0064] Front-end: It is the user interface part, including the layout, style and interaction logic of the web page. Users can interact with the web application through the front-end.

[0065] Backend: It is the logical processing part of the server, responsible for processing user requests, accessing databases, performing calculations, and returning processing results to the frontend.

[0066] Web applications have the advantages of cross-platform, easy access and update, good scalability, etc., so they have been widely used. In modern society, Web applications have become an indispensable part of people's daily life and work.

[0067] With the rapid development of Internet technology, web applications have become an indispensable part of the daily operations, communication, shopping, and entertainment of modern enterprises and individuals. However, this high degree of dependence and popularity has also made it a major target for hackers and malicious attackers. Web applications face increasingly complex and diverse security threats, including but not limited to data leakage, data tampering, denial of service attacks (DDoS), cross-site scripting attacks (XSS), SQL injection, cross-site request forgery (CSRF), etc. Once these security vulnerabilities are exploited, they will not only lead to the leakage of user personal information, but may also cause financial losses, reputation damage and even legal disputes, causing significant impacts on enterprises and individuals.

[0068] Traditional security defense methods, such as firewalls and intrusion detection systems, can resist external attacks to a certain extent, but their limitations are becoming increasingly prominent in the face of evolving attack techniques and methods. These systems often rely on preset rules and feature libraries to identify and block attacks, while attackers bypass these defense mechanisms by constantly changing attack methods and exploiting new vulnerabilities.

[0069] Therefore, in order to more effectively address the security challenges of network applications, a more efficient risk handling solution is needed.

[0070] In order to solve the above problems, the embodiment of the present application provides a risk handling method, and the execution subject of the risk handling method can be the risk handling device provided in the embodiment of the present application, or an electronic device integrated with the risk handling device, wherein the risk handling device can be implemented in hardware or software. Among them, the electronic device can be a smart phone, tablet computer, PDA, laptop computer, desktop computer or other devices.

[0071] See also Figure 1 , Figure 1 This is a schematic diagram of the first process of the risk handling method provided in the embodiment of the present application. The specific process of the risk handling method provided in the embodiment of the present application can be as follows:

[0072] S110: Obtain a reference user access log corresponding to a reference network application.

[0073] Among them, user access log refers to HTTP request log. Common fields in request log are as follows:

[0074] Time: The time when the request is recorded, usually based on the server time.

[0075] Client IP (c-ip): The IP address of the client that initiates the request, which is an important basis for identifying unique users and judging the authenticity of the crawler.

[0076] Request method (cs-method): For example, GET, POST, etc., describes the operation that the client wants the server to perform.

[0077] Request resource path (cs-uri-stem): The specific resource path requested by the client, that is, the absolute path under the root directory of the website.

[0078] Request parameter (cs-uri-query): The parameter part after the "?" in the URL is used to pass data to the server.

[0079] Server IP (s-ip): The IP address of the server that processes the request.

[0080] Port number (s-port): The port on which the server receives requests, usually 80 for HTTP and 443 for HTTPS.

[0081] User Agent (cs(User-Agent)): describes the client information that initiates the request, including browser type, version, and operating system.

[0082] Status code (sc-status): The status code of the server response, such as 200 for success and 404 for resource not found.

[0083] Request source page (cs(Referer)): Indicates which page the request came from, often used to analyze user behavior and sources.

[0084] Other fields in the request header: such as Accept (content type acceptable to the client), Accept-Language (acceptable language type), Accept-Encoding (acceptable content encoding method), etc.

[0085] The reference network application refers to a Web application used as a sample, which can be various types of Web applications. The reference user access log is the user access log corresponding to the reference network application.

[0086] In one possible implementation, a proxy server can be deployed between the client and the Web server. The proxy server can intercept and parse the HTTP request sent by the client and the HTTP response returned by the Web server. Through the proxy server, a user behavior log collection module can be added to the HTTP response. The module acts as the data collection end of the user behavior log on the client, while the proxy server acts as the data processing end. This method can realize the automatic acquisition of user behavior logs and has good scalability and flexibility.

[0087] In addition, the user access log corresponding to the network application can also be obtained from server log files, log analysis tools, and log data recorded by the current system.

[0088] S120 , based on the reference user access log, a verification rule learning engine is used to generate verification rules based on the reference user behavior pattern to obtain reference network verification rules.

[0089] The network verification rule refers to the verification rule for the behavior generated by the user accessing the network application. For example, the user's behavior can be determined based on the user access log generated by the user accessing the network application, and the behavior pattern corresponding to the behavior can be verified to be a normal network behavior pattern or an abnormal network behavior pattern.

[0090] It should be noted that normal network behavior patterns are normal user access behaviors, such as normal login, web browsing, and regular operations in business systems. Abnormal network behavior patterns are abnormal user access behaviors, such as hacker attacks on websites, such as brute force cracking, vulnerability scanning, SQL injection, XSS attacks, and other types of unconventional access behaviors.

[0091] Among them, the verification rule learning engine is configured to determine the corresponding user behavior pattern through the user access log of the network application, and generate verification rules according to the user behavior pattern to obtain a model of reference network verification rules. In this application, normal network behavior patterns and abnormal network behavior patterns are learned by referring to user access logs, so as to generate network verification rules according to the learned normal network behavior patterns and abnormal network behavior patterns. That is, for example, when encountering behaviors that are significantly different from these patterns, they can be quickly identified as potential threats.

[0092] It should be noted that the present application summarizes the regularity of access behaviors, such as the regularity of behavioral characteristics in access behaviors such as the number of visits, frequency, access content, and access paths, through statistical analysis, thereby creating the verification learning rule engine.

[0093] It can be understood that the reference user behavior pattern can be determined by access behavior features recorded in the reference user access log.

[0094] In the embodiment of the present application, the verification rule generation process is performed based on the reference user behavior pattern to obtain the reference network verification rule, which involves multiple steps such as in-depth analysis of user behavior data, feature extraction, pattern recognition, and rule generation. For example, this series of steps can be the following steps:

[0095] 1. Data collection and preprocessing

[0096] Collect data: First, collect a large amount of user behavior data from various sources (such as network logs, user behavior logs, system monitoring, etc.), which is implemented in step S110.

[0097] Data cleaning: Clean the collected data to remove invalid, redundant or erroneous data records.

[0098] Data normalization: Convert data into a unified format and standard to facilitate subsequent analysis and processing.

[0099] 2. Feature extraction and behavior pattern recognition

[0100] Feature extraction: Extract key features from user behavior data, which can reflect the user's behavior patterns and habits. Features may include access frequency, access duration, access path, user interaction behavior, etc.

[0101] Behavior pattern recognition: Use machine learning or statistical methods to perform pattern recognition on user behavior data to discover potential user behavior patterns. This can be achieved through cluster analysis, association rule mining, sequence pattern mining and other technologies.

[0102] 3. Verification rule generation

[0103] Rule definition: Based on the identified user behavior patterns, define a series of verification rules. These rules are designed to identify abnormal behaviors or behavior patterns that do not conform to expectations.

[0104] Rule refinement: Refine and optimize the initially defined validation rules to ensure their accuracy and practicality. This may involve adjusting the parameters of the rules, improving the logic of the rules, etc.

[0105] Rule verification: Verify the effectiveness and accuracy of the verification rules by comparing them with actual user behavior data. This can be achieved through methods such as cross-validation and simulation testing.

[0106] In one possible implementation, the training process of the verification rule learning engine may be as follows:

[0107] (1) obtaining a machine learning model, and creating an initial verification rule learning engine for generating network verification rule processing scenarios for user access logs based on the machine learning model;

[0108] (2) Obtain sample user access logs and annotate the sample user access logs with user behavior pattern labels and network verification rule labels;

[0109] (3) performing at least one round of model training on the initial verification rule learning engine based on the sample user access logs;

[0110] (4) During the model forward propagation training process, the initial verification rule learning engine is controlled to extract the predicted user behavior pattern from the sample user access log, and verification rule generation processing is performed based on the predicted user behavior pattern to obtain the predicted network verification rule;

[0111] (5) During the model back-propagation training process, the behavior extraction loss is determined based on the predicted user behavior pattern and the user behavior pattern label, the rule generation loss is determined based on the predicted network verification rule and the network verification rule label, and the model comprehensive loss is obtained based on the behavior extraction loss and the rule generation loss. The model comprehensive loss is used to adjust the model parameters of the initial verification rule learning engine until the initial verification rule learning engine completes the model training and obtains the verification rule learning engine.

[0112] Specifically, the first model loss calculation formula is used to calculate the behavior extraction loss based on the predicted user behavior pattern and user behavior pattern label, the second model loss calculation formula is used to calculate the rule generation loss based on the predicted network verification rule and network verification rule label, and the third model loss calculation formula is used to calculate the model comprehensive loss based on the behavior extraction loss and the rule generation loss.

[0113] Among them, the model loss calculation formulas such as the first model loss calculation formula, the second model loss calculation formula and the third model loss calculation formula can be fitted by one or more of the contrast loss calculation formula, the cross entropy loss calculation formula, the hinge loss calculation formula and the like in the related technology.

[0114] Optionally, the model training termination conditions of the initial verification rule learning engine may include, for example, the value of the loss function is less than or equal to a preset loss function threshold, the number of iterations reaches a preset number threshold, etc. The specific model training termination conditions can be determined based on actual conditions and are not specifically limited here.

[0115] S130: Update the rule verification set based on the reference network verification rule.

[0116] The rule verification set may include rules in the rule engine, that is, the network verification rule and the reference network verification rule generated by the verification rule learning engine by referring to the user access log.

[0117] In the present application, the reference network verification rules generated by the verification rule learning engine are written into the rule verification set, thereby updating the rule verification set.

[0118] S140, monitoring the target user access log in the target network application, and using a rule verification engine to call a rule verification set to perform risk processing on the target user based on the target user access log.

[0119] The rule verification engine is configured to call the rule verification set to perform rule verification on the target user access log, and match the model corresponding to the reference network verification rule in the rule verification set.

[0120] In an embodiment of the present application, when monitoring the access log of a target user in a target application, the reference network verification rule corresponding to the access log of the target user can be determined based on the learned reference network verification rule, so that the target user can be risk-handled based on the reference network verification rule.

[0121] In one possible implementation, the training process of the rule verification engine may be as follows:

[0122] (1) Obtaining a classification model, and creating an initial rule verification engine for a network verification rule classification scenario based on the classification model;

[0123] Among them, the classification model builds a model that can accurately classify new data into predefined categories by learning training data of known categories. Its principle usually involves steps such as feature extraction, model training, and classification decision. During the training process, the model will continuously adjust its internal parameters to minimize the classification error. Classification models can include linear discriminant analysis (LDA), quadratic discriminant analysis (QDA), Fisher linear classifier, semi-parametric models, ensemble learning methods (such as AdaBoost, Bagging), transfer learning models, and hybrid models.

[0124] (2) Obtaining sample network verification rules and labeling the sample network verification rules with rule category labels;

[0125] (3) performing at least one round of model training on the initial rule verification engine based on the sample network verification rules;

[0126] (4) During the model forward propagation training process, the control initial rule verification engine determines the prediction rule verification result based on the sample network verification rule;

[0127] (5) During the model back-propagation training process, the rule classification loss is determined based on the predicted rule verification results and the rule category labels, and the rule classification loss is used to adjust the model parameters of the initial rule verification engine until the initial rule verification engine completes the model training and obtains the rule verification engine.

[0128] Specifically, the fourth model loss calculation formula is used to calculate the rule classification loss based on the prediction rule verification result and the rule category label. The fourth model loss calculation formula can be fitted by one or more of the contrast loss calculation formula, cross entropy loss calculation formula, hinge loss calculation formula, etc. in the related art.

[0129] Optionally, the model training termination conditions of the initial rule verification engine may include, for example, the value of the loss function is less than or equal to a preset loss function threshold, the number of iterations reaches a preset number threshold, etc. The specific model training termination conditions may be determined based on actual conditions and are not specifically limited here.

[0130] In specific implementation, the present application is not limited by the execution order of the various steps described. If no conflict occurs, some steps can be performed in other orders or simultaneously.

[0131] As can be seen from the above, the risk handling method provided by the embodiment of the present application obtains the reference user access log corresponding to the reference network application, and based on the reference user access log, uses the verification rule learning engine to generate and process the verification rules based on the reference user behavior pattern to obtain the reference network verification rules, updates the rule verification set based on the reference network verification rules, monitors the target user access log in the target network application, and uses the rule verification engine to call the rule verification set based on the target user access log to perform risk handling on the target user. In the present application, the corresponding reference user access log is obtained by referring to the network application, and the reference network verification rules corresponding to the reference user access log are learned through the reference user access log, and the reference network verification rules are updated to the rule verification set. When detecting the target user access log in the target application, the reference network verification rules corresponding to the target user access log can be determined according to the learned reference network verification rules, so as to perform risk handling on the target user according to the reference network verification rules. In the present application, various reference network verification rules in the network application can be self-learned and updated in time, so as to improve the efficiency of risk handling in the network application.

[0132] The method described in the above embodiments is further described in detail below with examples.

[0133] See also Figure 2 , Figure 2 A second flow chart of the risk management method provided in the embodiment of the present application. The method comprises:

[0134] S210: Obtain a reference user access log corresponding to a reference network application.

[0135] Among them, the user access log corresponding to the network application can be obtained from multiple channels such as server log files, proxy servers, log analysis tools, and log data recorded by the current system.

[0136] It should be noted that the reference user access logs obtained in the present application may include user access logs corresponding to normal user access behaviors, and user access logs corresponding to abnormal user access behaviors.

[0137] S220: Using a verification rule learning engine to determine a reference user behavior pattern for a reference user access log.

[0138] Among them, the reference user behavior patterns include normal network behavior patterns and abnormal network behavior patterns.

[0139] In one possible implementation, when using a verification rule learning engine to determine a reference user behavior pattern for a reference user access log, the verification rule learning engine can be used to obtain a reference user behavior pattern label corresponding to the reference user access log, and determine the reference user behavior pattern based on the reference user behavior pattern label.

[0140] The reference user behavior pattern label refers to the normal network behavior pattern and the abnormal network behavior pattern are labeled with corresponding labels, in order to distinguish between normal and abnormal. The verification rule learning engine can learn the corresponding behavior features of the normal network behavior pattern and the abnormal network behavior pattern according to the labeled reference user behavior pattern.

[0141] In a possible implementation, when the verification rule learning engine is used to determine the reference user behavior pattern for the reference user access log, the verification rule learning engine may also be used to perform behavior pattern recognition on the reference user access log to obtain the reference user behavior pattern.

[0142] Specifically, when using a verification rule learning engine to perform behavioral pattern recognition on a reference user access log to obtain a reference user behavior pattern, the verification rule learning engine can be used to determine multiple metadata behavior verification dimensions for the reference user access log, based on the evaluation dimension deviation parameters of the reference user access log in each metadata behavior verification dimension, a reference user access behavior radar chart is drawn based on the evaluation dimension deviation parameters of each metadata behavior verification dimension, the comprehensive behavior deviation degree is determined based on the reference user access behavior radar chart, and the reference user behavior pattern corresponding to the reference user access log is determined based on the comprehensive behavior deviation degree.

[0143] Among them, the metadata behavior verification dimension is to use the corresponding metadata in the user access log as the verification condition, and verify from multiple data dimensions of the metadata. For example, the metadata dimensions may include: protocol version, request method, resource type, request header length, request body length, response body length, character encoding standard, number of nested layers of request body data, permitted range of parameter items, special character content of parameter items, parameter item length, number of parameter items, parameter value length, number of parameter values, permitted range of parameter values ​​and other dimensions.

[0144] For each metadata behavior verification dimension, the degree of deviation of the performance of the reference user access log on that dimension from the expected or average level is calculated, that is, the evaluation dimension deviation parameter. This can be achieved through statistical methods (such as mean, standard deviation, percentile, etc.). The deviation parameter can be a positive value (indicating higher than the average level) or a negative value (indicating lower than the average level), or it can be in the form of an absolute value, indicating the absolute value of the deviation.

[0145] In an embodiment of the present application, a reference user access behavior radar chart is drawn based on the above-mentioned multiple metadata behavior verification dimensions. The radar chart can visualize each dimension and the deviation range of each dimension. The larger the deviation, the more serious it is, indicating that the behavior is more abnormal.

[0146] The radar chart provided in the embodiment of the present application can intuitively display the performance of the reference user in different metadata behavior verification dimensions. By observing the shape and size of the polygon, it can be determined in which dimensions the user performs better (the polygon protrudes outward in the area) and in which dimensions the user performs worse (the polygon is sunken inward in the area). In addition, the radar charts of different users or different time periods can be compared to analyze the changing trends or differences in user behavior.

[0147] S230: Perform verification rule generation processing based on the reference user behavior pattern to obtain reference network verification rules.

[0148] In the embodiment of the present application, a series of verification rules, namely the reference network verification rules, can be defined according to the reference user behavior pattern, and these rules are intended to identify abnormal behavior or behavior patterns that do not conform to expectations. S240: Determine the URL corresponding to the reference network verification rule.

[0149] In the embodiment of the present application, the reference network verification rule can be uniquely identified by a URL, that is, each network verification rule corresponds to a URL.

[0150] S250: Write the reference network verification rule into the rule verification set, and use the URL as the rule verification identifier of the reference network verification rule.

[0151] In an embodiment of the present application, the reference network verification rule generated by the verification rule learning engine is written into the rule verification set to update the rule verification set, and the URL corresponding to the reference network verification rule is used as the unique identifier of the reference network verification rule, that is, the rule verification identifier.

[0152] S260. Monitor the target user access log in the target network application.

[0153] In the embodiment of the present application, the target user access log in the target application can be monitored. Specifically, the user access log that needs to be monitored in the target network application can be used as the target user access log.

[0154] S270: Input the target user access log into the rule verification engine, perform verification rule matching processing on the target user access log through the rule verification set, and obtain the rule verification result.

[0155] In one possible implementation, when the target user access log is processed by verification rule matching through a rule verification set to obtain a rule verification result, the target URL corresponding to the target network application can be determined, and the target URL can be used as a rule verification index. At least one target network verification rule corresponding to the rule verification index is queried from the rule verification set, and the target network verification rule is used to perform verification rule matching on the target user access log to obtain a rule verification result.

[0156] S280: Perform risk behavior protection processing on the target user based on the rule verification result.

[0157] In one possible implementation, when risk behavior protection processing is performed on the target user based on the rule verification result, the user behavior pattern type corresponding to the rule verification result can be determined. If the user behavior pattern type is an abnormal behavior pattern type, the abnormal network verification rule corresponding to the rule verification result is determined, and the abnormal protection action corresponding to the abnormal network verification rule is obtained, and the abnormal protection action is performed on the target user.

[0158] Among them, the user behavior pattern type is an abnormal behavior pattern type, that is, the access behavior corresponding to the user is an abnormal network behavior pattern.

[0159] In an embodiment of the present application, the target user access log is input into a rule verification engine. After the target user access log is processed by verification rule matching through a rule verification set, a reference network verification rule in the rule verification set corresponding to the target user access log can be obtained, that is, the target network verification rule. The target verification rule corresponds to a corresponding protection rule, and the target user is protected through the protection rule.

[0160] In addition, in one possible implementation, the method further includes:

[0161] The target user access log is used as a reference user access log, and the reference user access log is used to generate and process the verification rules based on the reference user behavior pattern using a verification rule learning engine to obtain a reference network verification rule.

[0162] That is, the rules corresponding to the monitored users are used as a reference to update the rules of the verification rule learning engine.

[0163] As can be seen from the above, the risk handling method proposed in the embodiment of the present application obtains the reference user access log corresponding to the reference network application, uses the verification rule learning engine to determine the reference user behavior pattern for the reference user access log, performs verification rule generation processing based on the reference user behavior pattern to obtain the reference network verification rule, determines the URL corresponding to the reference network verification rule, writes the reference network verification rule into the rule verification set, uses the URL as the rule verification identifier of the reference network verification rule, monitors the target user access log in the target network application, inputs the target user access log into the rule verification engine, performs verification rule matching processing on the target user access log through the rule verification set, obtains the rule verification result, and performs risk behavior protection processing on the target user based on the rule verification result. In this way, the present application learns the reference user behavior pattern corresponding to the reference user access log through the verification rule learning engine, generates the reference network verification rule according to the reference user behavior pattern, and writes the rule verification set, so that when the target user access log is subjected to risk processing, the reference network verification rule matching the user access log can be directly obtained from the rule verification set, and the target user is subjected to risk processing based on the matched reference network verification rule, thereby improving the efficiency of risk processing in the network application.

[0164] In one embodiment, a risk management device is also provided. Figure 3 , Figure 3 The schematic diagram of the structure of the risk processing device 300 provided in the embodiment of the present application. The risk processing device 300 is applied to an electronic device, and the risk processing device 300 includes an acquisition module 301, a generation module 302, an update module 303 and a processing module 304, as follows:

[0165] An acquisition module 301 is used to acquire a reference user access log corresponding to a reference network application;

[0166] A generation module 302 is used to generate a verification rule based on the reference user access log and the reference user behavior pattern using a verification rule learning engine to obtain a reference network verification rule;

[0167] An updating module 303 is used to update a rule verification set based on the reference network verification rule;

[0168] The processing module 304 is used to monitor the target user access log in the target network application, and based on the target user access log, use the rule verification engine to call the above rule verification set to perform risk processing on the above target user.

[0169] In a possible implementation, the generating module 302 may be used to:

[0170] Using a verification rule learning engine to determine a reference user behavior pattern for the reference user access log;

[0171] A verification rule generation process is performed based on the above reference user behavior pattern to obtain a reference network verification rule.

[0172] In a possible implementation, the generating module 302 may be used to:

[0173] Using a verification rule learning engine to obtain a reference user behavior pattern label corresponding to the reference user access log, and determining a reference user behavior pattern based on the reference user behavior pattern label; and / or,

[0174] Using a verification rule learning engine to perform behavior pattern recognition on the reference user access log to obtain a reference user behavior pattern;

[0175] Among them, the above-mentioned reference user behavior patterns include normal network behavior patterns and abnormal network behavior patterns.

[0176] In a possible implementation, the generating module 302 may be used to:

[0177] Using a verification rule learning engine to determine multiple metadata behavior verification dimensions for the reference user access log, based on evaluation dimension deviation parameters of the reference user access log in each of the metadata behavior verification dimensions;

[0178] Draw a reference user access behavior radar chart based on the evaluation dimension deviation parameter of each of the metadata behavior verification dimensions;

[0179] The comprehensive behavior deviation degree is determined based on the reference user access behavior radar chart, and the reference user behavior pattern corresponding to the reference user access log is determined based on the comprehensive behavior deviation degree.

[0180] In a possible implementation, the updating module 303 may be used to:

[0181] Determine the URL corresponding to the above reference network verification rule;

[0182] The reference network verification rule is written into the rule verification set, and the URL is used as the rule verification identifier of the reference network verification rule.

[0183] In a possible implementation, the processing module 304 may be used to:

[0184] Input the target user access log into the rule verification engine, perform verification rule matching processing on the target user access log through the rule verification set, and obtain a rule verification result;

[0185] Based on the above rule verification results, the above target users are protected from risky behavior.

[0186] In a possible implementation, the processing module 304 may be used to:

[0187] Determine the target URL corresponding to the target web application;

[0188] Using the target URL as a rule verification index, querying at least one target network verification rule corresponding to the rule verification index from the rule verification set;

[0189] The target network verification rule is used to perform verification rule matching processing on the target user access log to obtain a rule verification result.

[0190] In a possible implementation, the processing module 304 may be used to:

[0191] Determine the user behavior pattern type corresponding to the above rule verification result;

[0192] If the user behavior pattern type is an abnormal behavior pattern type, determining an abnormal network verification rule corresponding to the rule verification result;

[0193] Obtain the abnormal protection action corresponding to the abnormal network verification rule, and execute the abnormal protection action on the target user.

[0194] In a possible implementation, the processing module 304 may also be used to:

[0195] The target user access log is used as the reference user access log, and the step of generating and processing the reference network verification rules based on the reference user access log by using the verification rule learning engine and the reference user behavior pattern is performed.

[0196] It should be noted that the risk management device provided in the embodiment of the present application belongs to the same concept as the risk management method in the above embodiment. Any method provided in the risk management method embodiment can be implemented through the risk management device. The specific implementation process is detailed in the risk management method embodiment, which will not be repeated here.

[0197] In addition, in order to better implement the risk management method in the embodiment of the present application, on the basis of the risk management method, the present application also provides an electronic device, which can be a smart phone, tablet computer, PDA, laptop computer, or desktop computer. Figure 4 , Figure 4The first structural diagram of the electronic device provided in the embodiment of the present application is as follows: The electronic device 400 includes a processor 401 and a memory 402. The processor 401 is electrically connected to the memory 402.

[0198] The processor 401 is the control center of the electronic device 400. It uses various interfaces and lines to connect various parts of the entire electronic device. By running or calling the computer program stored in the memory 402, and calling the data stored in the memory 402, it executes various functions of the electronic device and processes data, thereby monitoring the electronic device as a whole. Among them, the processor 401 can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc.

[0199] The memory 402 can be used to store computer programs and data. The computer program stored in the memory 402 contains instructions that can be executed in the processor. The computer program can form various functional modules. The processor 401 executes various functional applications and data processing by calling the computer program stored in the memory 402. Among them, the memory 402 can mainly include a program storage area and a data storage area. The program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the electronic device 400 (such as audio data, video data, etc.), etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart MediaCard, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0200] In this embodiment, the processor 401 in the electronic device 400 loads instructions corresponding to the processes of one or more computer programs into the memory 402 according to the following steps, and the processor 401 runs the computer programs stored in the memory 402 to implement various functions:

[0201] Obtain a reference user access log corresponding to a reference network application;

[0202] Based on the reference user access log, a verification rule learning engine is used to generate verification rules based on the reference user behavior pattern to obtain reference network verification rules;

[0203] Update the rule verification set based on the above reference network verification rules;

[0204] The target user access log in the target network application is monitored, and based on the target user access log, the rule verification engine is used to call the above rule verification set to perform risk processing on the above target user.

[0205] In one possible implementation, see Figure 5 , Figure 5 A second structural diagram of an electronic device provided in an embodiment of the present application. The electronic device 400 further includes: a radio frequency circuit 403, a display screen 404, a control circuit 405, an input unit 406, an audio circuit 407, a sensor 408, and a power supply 409. The processor 401 is electrically connected to the radio frequency circuit 403, the display screen 404, the control circuit 405, the input unit 406, the audio circuit 407, the sensor 408, and the power supply 409, respectively.

[0206] The radio frequency circuit 403 is used to send and receive radio frequency signals to communicate with network devices or other electronic devices through wireless communication.

[0207] The display screen 404 may be used to display information input by a user or information provided to a user and various graphical user interfaces of the electronic device. These graphical user interfaces may be composed of images, texts, icons, videos and any combination thereof.

[0208] The control circuit 405 is electrically connected to the display screen 404 and is used to control the display screen 404 to display information.

[0209] The input unit 406 can be used to receive input numbers, character information or user feature information (such as fingerprints), and generate keyboard, mouse, joystick, optical or trackball signal input related to user settings and function control. The input unit 406 can include a fingerprint recognition module.

[0210] The audio circuit 407 can provide an audio interface between the user and the electronic device through a speaker and a microphone. The audio circuit 407 includes a microphone. The microphone is electrically connected to the processor 401. The microphone is used to receive voice information input by the user.

[0211] The sensor 408 is used to collect external environment information. The sensor 408 may include one or more sensors such as an environment brightness sensor, an acceleration sensor, and a gyroscope.

[0212] The power supply 409 is used to supply power to various components of the electronic device 400. In a possible implementation, the power supply 409 may be logically connected to the processor 401 through a power management system, so that the power management system can manage charging, discharging, power consumption and other functions.

[0213] Although not shown in the figure, the electronic device 400 may also include a camera, a Bluetooth module, etc., which will not be described in detail here.

[0214] In this embodiment, the processor 401 in the electronic device 400 loads instructions corresponding to the processes of one or more computer programs into the memory 402 according to the following steps, and the processor 401 runs the computer programs stored in the memory 402 to implement various functions:

[0215] Obtain a reference user access log corresponding to a reference network application;

[0216] Based on the reference user access log, a verification rule learning engine is used to generate verification rules based on the reference user behavior pattern to obtain reference network verification rules;

[0217] Update the rule verification set based on the above reference network verification rules;

[0218] The target user access log in the target network application is monitored, and based on the target user access log, the rule verification engine is used to call the above rule verification set to perform risk processing on the above target user.

[0219] In a possible implementation, when the processor 401 generates verification rules based on the reference user access log and the reference user behavior pattern using the verification rule learning engine to obtain the reference network verification rules, it may execute:

[0220] Using a verification rule learning engine to determine a reference user behavior pattern for the reference user access log;

[0221] A verification rule generation process is performed based on the above reference user behavior pattern to obtain a reference network verification rule.

[0222] In a possible implementation, when the processor 401 uses the verification rule learning engine to determine the reference user behavior pattern for the reference user access log, the processor 401 may execute:

[0223] Using a verification rule learning engine to obtain a reference user behavior pattern label corresponding to the reference user access log, and determining a reference user behavior pattern based on the reference user behavior pattern label; and / or,

[0224] Using a verification rule learning engine to perform behavior pattern recognition on the reference user access log to obtain a reference user behavior pattern;

[0225] Among them, the above-mentioned reference user behavior patterns include normal network behavior patterns and abnormal network behavior patterns.

[0226] In a possible implementation, when the processor 401 uses the verification rule learning engine to perform behavior pattern recognition on the reference user access log to obtain the reference user behavior pattern, it can execute:

[0227] Using a verification rule learning engine to determine multiple metadata behavior verification dimensions for the reference user access log, based on evaluation dimension deviation parameters of the reference user access log in each of the metadata behavior verification dimensions;

[0228] Draw a reference user access behavior radar chart based on the evaluation dimension deviation parameter of each of the metadata behavior verification dimensions;

[0229] The comprehensive behavior deviation degree is determined based on the reference user access behavior radar chart, and the reference user behavior pattern corresponding to the reference user access log is determined based on the comprehensive behavior deviation degree.

[0230] In a possible implementation manner, when executing the updating of the rule verification set based on the reference network verification rule, the processor 401 may execute:

[0231] Determine the URL corresponding to the above reference network verification rule;

[0232] The reference network verification rule is written into the rule verification set, and the URL is used as the rule verification identifier of the reference network verification rule.

[0233] In a possible implementation, when the processor 401 uses a rule verification engine to call the rule verification set to perform risk processing on the target user based on the target user access log, the processor 401 may execute:

[0234] Input the target user access log into the rule verification engine, perform verification rule matching processing on the target user access log through the rule verification set, and obtain a rule verification result;

[0235] Based on the above rule verification results, the above target users are protected from risky behavior.

[0236] In a possible implementation, when the processor 401 performs verification rule matching processing on the target user access log through the rule verification set and obtains the rule verification result, it can execute:

[0237] Determine the target URL corresponding to the target web application;

[0238] Using the target URL as a rule verification index, querying at least one target network verification rule corresponding to the rule verification index from the rule verification set;

[0239] The target network verification rule is used to perform verification rule matching processing on the target user access log to obtain a rule verification result.

[0240] In a possible implementation, when the processor 401 performs risk behavior protection processing on the target user based on the rule verification result, the processor 401 may execute:

[0241] Determine the user behavior pattern type corresponding to the above rule verification result;

[0242] If the user behavior pattern type is an abnormal behavior pattern type, determining an abnormal network verification rule corresponding to the rule verification result;

[0243] Obtain the abnormal protection action corresponding to the abnormal network verification rule, and execute the abnormal protection action on the target user.

[0244] In a possible implementation, the processor 401 may further execute:

[0245] The target user access log is used as the reference user access log, and the step of generating and processing the reference network verification rules based on the reference user access log by using the verification rule learning engine and the reference user behavior pattern is performed.

[0246] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored. When the computer program runs on a computer, the computer executes the risk management method of any of the above embodiments.

[0247] It should be noted that, those skilled in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing related hardware through a computer program, and the above computer program can be stored in a computer-readable storage medium, and the above storage medium can include but is not limited to: read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0248] In addition, the terms "first", "second", and "third" in this application are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or device that includes a series of steps or modules is not limited to the listed steps or modules, but some embodiments also include steps or modules that are not listed, or some embodiments also include other steps or modules inherent to these processes, methods, products, or devices.

[0249] The above is a detailed introduction to the risk management method, device, storage medium and electronic device provided in the embodiments of the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method and core idea of ​​the present application; at the same time, for those skilled in the art, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A risk management method, characterized in that: include: Obtain a reference user access log corresponding to a reference network application; Based on the reference user access log, a verification rule learning engine is used to generate verification rules based on the reference user behavior pattern to obtain reference network verification rules; Updating a rule verification set based on the reference network verification rule; The target user access log in the target network application is monitored, and based on the target user access log, the rule verification engine is used to call the rule verification set to perform risk processing on the target user.

2. The method according to claim 1, characterized in that Based on the reference user access log, a verification rule learning engine is used to generate verification rules based on the reference user behavior pattern to obtain reference network verification rules, including: Determine a reference user behavior pattern for the reference user access log using a verification rule learning engine; A verification rule generation process is performed based on the reference user behavior pattern to obtain a reference network verification rule.

3. The method according to claim 2, characterized in that The adopting the verification rule learning engine to determine the reference user behavior pattern for the reference user access log includes: Using a verification rule learning engine to obtain a reference user behavior pattern label corresponding to the reference user access log, and determining a reference user behavior pattern based on the reference user behavior pattern label; and / or, Using a verification rule learning engine to perform behavior pattern recognition on the reference user access log to obtain a reference user behavior pattern; The reference user behavior patterns include normal network behavior patterns and abnormal network behavior patterns.

4. The method according to claim 3, characterized in that The adopting the verification rule learning engine to perform behavior pattern recognition on the reference user access log to obtain the reference user behavior pattern includes: A verification rule learning engine is used to determine a plurality of metadata behavior verification dimensions for the reference user access log, based on evaluation dimension deviation parameters of the reference user access log in each metadata behavior verification dimension; Draw a reference user access behavior radar chart based on the evaluation dimension deviation parameter of each metadata behavior verification dimension; The comprehensive behavior deviation degree is determined based on the reference user access behavior radar chart, and the reference user behavior pattern corresponding to the reference user access log is determined based on the comprehensive behavior deviation degree.

5. The method according to claim 1, characterized in that The method of using a rule verification engine to call the rule verification set based on the target user access log to perform risk processing on the target user includes: Inputting the target user access log into the rule verification engine, performing verification rule matching processing on the target user access log through the rule verification set, and obtaining a rule verification result; Based on the rule verification result, risk behavior protection processing is performed on the target user.

6. The method according to claim 5, characterized in that The step of performing verification rule matching processing on the target user access log through the rule verification set to obtain a rule verification result includes: Determine the target URL corresponding to the target web application; Taking the target URL as a rule verification index, querying at least one target network verification rule corresponding to the rule verification index from the rule verification set; The target network verification rule is used to perform verification rule matching processing on the target user access log to obtain a rule verification result.

7. The method according to claim 5, characterized in that The performing risk behavior protection processing on the target user based on the rule verification result includes: Determine the user behavior pattern type corresponding to the rule verification result; If the user behavior pattern type is an abnormal behavior pattern type, determining an abnormal network verification rule corresponding to the rule verification result; Obtain an abnormal protection action corresponding to the abnormal network verification rule, and execute the abnormal protection action on the target user.

8. A risk management device, characterized in that: include: An acquisition module, used to acquire a reference user access log corresponding to a reference network application; A generation module, configured to generate a verification rule based on the reference user access log and a verification rule learning engine based on a reference user behavior pattern to obtain a reference network verification rule; An updating module, configured to update a rule verification set based on the reference network verification rule; The processing module is used to monitor the target user access log in the target network application, and based on the target user access log, use the rule verification engine to call the rule verification set to perform risk processing on the target user.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed on a computer, the computer is enabled to execute the risk handling method according to any one of claims 1 to 7.

10. An electronic device comprising a processor and a memory, wherein the memory stores a computer program, wherein: The processor is used to execute the risk management method as claimed in any one of claims 1 to 7 by calling the computer program.

Images