Tracing method and system for malicious access of terminal

Abstract

The invention discloses a method and a system for tracing malicious access of a terminal. The method comprises the following steps: triggering positioning detection of the terminal according to a positioning signal; acquiring an access process of the terminal based on positioning detection of the terminal; forming a plurality of sub-access processes based on the division of the access process; defining abnormal access according to screening of the plurality of sub-access processes; defining malicious access based on the identification of the abnormal access, and triggering the tracing of the malicious access according to the position of the malicious access; in the source tracing of the malicious access, an attack means corresponding to the malicious access is defined according to website information and access time corresponding to the malicious access, and autonomous optimization of the terminal is carried out based on the attack means, so that targeted source tracing is carried out for the malicious access, and the attack means is defined in the targeted source tracing. Therefore, the attack means can be further optimized, autonomous optimization of the terminal is further realized, and monitoring, tracing and chain management and control of autonomous optimization of the terminal on malicious access are realized.

Description

Technical Field

[0001] The present invention relates to the technical field of terminals, and in particular to a method and system for tracing the source of malicious access to a terminal. Background Art

[0002] With the development of science and technology, the network has gradually improved. Terminals are accessed through the network and are subject to malicious access during the working process. In the existing technology, malicious access to terminals is generally checked manually, and a single dimension is controlled during the investigation process. There is no control of multi-dimensional attack methods, which affects the targeted tracing of terminals. Summary of the invention

[0003] The purpose of the present invention is to overcome the shortcomings of the prior art. The present invention provides a method and system for tracing the source of malicious access of a terminal, which collects the positioning signal of the terminal and triggers the positioning detection of the terminal according to the positioning signal; collects the access process of the terminal based on the positioning detection of the terminal; forms multiple sub-access processes based on the division of the access process; defines abnormal access according to the screening of multiple sub-access processes; defines malicious access based on the identification of abnormal access, and triggers the tracing of the malicious access according to the location of the malicious access; in the tracing of the malicious access, the attack means corresponding to the malicious access is defined according to the website information and access time corresponding to the malicious access, and the terminal is autonomously optimized based on the attack means, so as to perform targeted tracing for the malicious access, and define the attack means in the targeted tracing, so as to facilitate further optimization of the attack means, thereby realizing autonomous optimization of the terminal, and realizing chain-type control of the terminal's monitoring, tracing and autonomous optimization of malicious access.

[0004] The embodiment of the present invention provides a method for tracing the source of malicious access of a terminal, which is applied to the scenario of tracing the source of malicious access of a terminal;

[0005] The method for tracing the source of malicious access of the terminal includes:

[0006] Collect the terminal's positioning signal and trigger the terminal's positioning detection according to the positioning signal;

[0007] Collecting the access process of the terminal based on the location detection of the terminal;

[0008] Based on the division of the access process, a plurality of sub-access processes are formed;

[0009] Defining abnormal access based on screening of multiple sub-access processes;

[0010] Define malicious access based on the identification of abnormal access, and trigger the tracing of malicious access based on the location of the malicious access;

[0011] In tracing the source of malicious access, the attack means corresponding to the malicious access are defined according to the URL information and access time corresponding to the malicious access, and the terminal is autonomously optimized based on the attack means.

[0012] Optionally, collecting the positioning signal of the terminal and triggering the positioning detection of the terminal according to the positioning signal includes:

[0013] Collect the positioning signal of the terminal;

[0014] Defining the terminal's positioning information based on the analysis of the terminal's positioning signal;

[0015] Positioning the terminal according to the positioning information of the terminal;

[0016] When the terminal is in a positioning state, the control space of the terminal is collected based on the response of the terminal;

[0017] The terminal's positioning detection is triggered according to the terminal's control space, positioning signal and detection signal.

[0018] Optionally, the collecting the access process of the terminal based on the location detection of the terminal includes:

[0019] Real-time monitoring terminal positioning detection;

[0020] In the terminal positioning detection, the real-time interaction data of the terminal is collected;

[0021] Define corresponding access data based on the real-time interactive data of the terminal and access rights;

[0022] Associating access data with corresponding interactive devices;

[0023] An access signal of a terminal is defined according to the access data, the corresponding interactive device and the terminal;

[0024] The access process of the terminal is defined based on the analysis of the access signal of the terminal.

[0025] Optionally, the forming of multiple sub-access processes based on the division of the access process includes:

[0026] Freeze the access process of the terminal;

[0027] Define the partitioning mode based on the load corresponding to the terminal's access process and the corresponding access mechanism;

[0028] Divide the access process according to the division mode;

[0029] A plurality of access nodes are formed according to the division of the access process;

[0030] Associating the locations of multiple access nodes, the space formed by two adjacent access nodes, and the corresponding access data volume;

[0031] A plurality of sub-access processes are formed based on the locations of the plurality of access nodes, the space formed by two adjacent access nodes, and the corresponding access data volumes.

[0032] Optionally, defining abnormal access based on screening of multiple sub-access processes includes:

[0033] Collect multiple sub-access processes;

[0034] forming a sub-access process set based on the plurality of sub-access processes;

[0035] Define the filtering mode according to the set of sub-access processes, the number of access nodes, and the corresponding access data volume;

[0036] The screening of multiple sub-access processes is triggered based on the screening mode, and abnormal access is defined during the screening process.

[0037] Optionally, the step of defining malicious access based on the identification of abnormal access and triggering tracing of the malicious access according to the location of the malicious access includes:

[0038] Collect abnormal access;

[0039] Define corresponding exception types based on exception access and exception identification mechanisms;

[0040] Define malicious access based on the screening of each anomaly type;

[0041] Flag malicious access and define where the malicious access is located.

[0042] Optionally, the method of defining malicious access based on the identification of abnormal access and triggering tracing of the malicious access according to the location of the malicious access further includes:

[0043] Match the associated URL information based on the location of the malicious access;

[0044] A plurality of malicious access points are defined according to the associated website information, and tracing of malicious access is triggered based on the plurality of malicious access points.

[0045] Optionally, in the tracing of the malicious access, the attack means corresponding to the malicious access is defined according to the website information and access time corresponding to the malicious access, and the terminal is autonomously optimized based on the attack means, including:

[0046] Real-time monitoring of malicious access sources;

[0047] In tracing the source of malicious access, the URL information, access time and access level corresponding to the malicious access are collected.

[0048] Optionally, in the tracing of the malicious access, defining the attack means corresponding to the malicious access according to the website information and access time corresponding to the malicious access, and performing autonomous optimization of the terminal based on the attack means, further includes:

[0049] Associate the URL information, access time and access level corresponding to the malicious access;

[0050] Define a set of traceability coefficients based on the URL information, access time, and access level corresponding to the malicious access;

[0051] Define the corresponding attack methods according to the traceability coefficient set and malicious access level;

[0052] Based on this attack method, the terminal is autonomously optimized.

[0053] In addition, an embodiment of the present invention further provides a system for tracing the source of malicious access to a terminal, and the system for tracing the source of malicious access to a terminal includes:

[0054] The acquisition module is used to collect the terminal's positioning signal and trigger the terminal's positioning detection according to the positioning signal;

[0055] An access process module, used to collect the access process of the terminal based on the location detection of the terminal;

[0056] A partitioning module, used to form a plurality of sub-access processes based on the partitioning of the access process;

[0057] An abnormal access module, used to define abnormal access based on the screening of multiple sub-access processes;

[0058] The tracing module is used to define malicious access based on the identification of abnormal access and trigger the tracing of malicious access based on the location of the malicious access;

[0059] The autonomous optimization module is used to define the attack means corresponding to the malicious access according to the website information and access time corresponding to the malicious access in the tracing of the malicious access, and to perform autonomous optimization of the terminal based on the attack means.

[0060] In an embodiment of the present invention, through the method in the embodiment of the present invention, the positioning signal of the terminal is collected, and the positioning detection of the terminal is triggered according to the positioning signal; the access process of the terminal is collected based on the positioning detection of the terminal; multiple sub-access processes are formed based on the division of the access process; abnormal access is defined according to the screening of multiple sub-access processes; malicious access is defined based on the identification of abnormal access, and the tracing of the malicious access is triggered according to the location of the malicious access; in the tracing of the malicious access, the attack means corresponding to the malicious access is defined according to the website information and access time corresponding to the malicious access, and the terminal is autonomously optimized based on the attack means, so as to carry out targeted tracing of the malicious access, and define the attack means in the targeted tracing, so as to facilitate further optimization of the attack means, thereby realizing autonomous optimization of the terminal, and realizing chain-type control of the terminal's monitoring, tracing and autonomous optimization of malicious access. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0062] Figure 1 It is a flowchart of a method for tracing the source of malicious access of a terminal in an embodiment of the present invention;

[0063] Figure 2 It is a flowchart of S11 in the method for tracing the source of malicious access of a terminal in an embodiment of the present invention;

[0064] Figure 3 It is a flowchart of S12 in the method for tracing the source of malicious access of a terminal in an embodiment of the present invention;

[0065] Figure 4 It is a flowchart of S13 in the method for tracing the source of malicious access of a terminal in an embodiment of the present invention;

[0066] Figure 5 It is a flowchart of S14 in the method for tracing the source of malicious access of a terminal in an embodiment of the present invention;

[0067] Figure 6 It is a flowchart of S15 in the method for tracing the source of malicious access of a terminal in an embodiment of the present invention;

[0068] Figure 7 It is a flowchart of S16 in the method for tracing the source of malicious access of a terminal in an embodiment of the present invention;

[0069] Figure 8 It is a schematic diagram of the structure of a system for tracing malicious access of a terminal in an embodiment of the present invention;

[0070] Fig. 9 The figure is a hardware diagram of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0071] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0072] See also Figures 1 to 9 A method for tracing the source of malicious access of a terminal is applied to a tracing scenario of malicious access of a terminal. The method for tracing the source of malicious access of a terminal includes:

[0073] Step S11: collecting the positioning signal of the terminal, and triggering the positioning detection of the terminal according to the positioning signal;

[0074] Step S12: collecting the access process of the terminal based on the positioning detection of the terminal;

[0075] Step S13: forming a plurality of sub-access processes based on the division of the access process;

[0076] Step S14: defining abnormal access according to the screening of multiple sub-access processes;

[0077] Step S15: defining malicious access based on the identification of abnormal access, and triggering tracing of the malicious access according to the location of the malicious access;

[0078] Step S16: In tracing the source of malicious access, the attack means corresponding to the malicious access is defined according to the website information and access time corresponding to the malicious access, and the terminal is autonomously optimized based on the attack means.

[0079] In an embodiment of the present invention, through the method in the embodiment of the present invention, the positioning signal of the terminal is collected, and the positioning detection of the terminal is triggered according to the positioning signal; the access process of the terminal is collected based on the positioning detection of the terminal; multiple sub-access processes are formed based on the division of the access process; abnormal access is defined according to the screening of multiple sub-access processes; malicious access is defined based on the identification of abnormal access, and the tracing of the malicious access is triggered according to the location of the malicious access; in the tracing of the malicious access, the attack means corresponding to the malicious access is defined according to the website information and access time corresponding to the malicious access, and the terminal is autonomously optimized based on the attack means, so as to carry out targeted tracing of the malicious access, and define the attack means in the targeted tracing, so as to facilitate further optimization of the attack means, thereby realizing autonomous optimization of the terminal, and realizing chain-type control of the terminal's monitoring, tracing and autonomous optimization of malicious access.

[0080] refer to Figure 2 , in step S11, the positioning signal of the terminal is collected, and the positioning detection of the terminal is triggered according to the positioning signal;

[0081] In the specific implementation process of the present invention, the specific steps may be:

[0082] S111: collecting terminal positioning signals;

[0083] S112: defining the terminal's positioning information based on the analysis of the terminal's positioning signal;

[0084] S113: Positioning the terminal according to the positioning information of the terminal;

[0085] S114: When the terminal is in a positioning state, collecting a control space of the terminal based on a response of the terminal;

[0086] S115: Triggering positioning detection of the terminal according to the control space, positioning signal and detection signal of the terminal.

[0087] In an embodiment of the present application, the positioning signal of the terminal is collected, and the positioning signal of the terminal is further processed to facilitate the signal parsing of the positioning signal of the terminal, so as to define the positioning information of the terminal based on the parsing of the positioning signal of the terminal, thereby introducing the positioning information of the terminal. Optionally, the positioning signal of the terminal is a signal corresponding to the terminal at the positioning position, and is presented in the form of a signal. Signal parsing refers to further parsing the positioning signal and exposing the content behind the positioning signal. The positioning information of the terminal refers to the information with the location obtained by the terminal in the positioning detection.

[0088] At this time, the terminal is positioned according to the positioning information of the terminal, so as to realize the positioning of the terminal. Further, when the terminal is in the positioning state, the control space of the terminal is collected based on the response of the terminal, thereby introducing the control space of the terminal, and further controlling the control space of the terminal, thereby triggering the positioning detection of the terminal according to the control space, positioning signal and detection signal of the terminal, and being compatible with the overall consideration of the control space, positioning signal and detection signal of the terminal, realizing the multi-dimensional control of the control space, positioning signal and detection signal of the terminal, and ensuring the detection accuracy of the positioning detection of the terminal. Optionally, the control space of the terminal refers to the space in the terminal that controls the overall system.

[0089] refer to Figure 3 , in step S12, the access process of the terminal is collected based on the positioning detection of the terminal;

[0090] In the specific implementation process of the present invention, the specific steps may be:

[0091] S121: real-time monitoring of terminal location detection;

[0092] S122: during the positioning detection of the terminal, collecting real-time interaction data of the terminal;

[0093] S123: defining corresponding access data according to the real-time interaction data of the terminal and the access authority;

[0094] S124: Associating access data with corresponding interactive devices;

[0095] S125: defining an access signal of the terminal according to the access data, the corresponding interactive device and the terminal;

[0096] S126: Define the access process of the terminal based on the analysis of the access signal of the terminal.

[0097] In an embodiment of the present application, the positioning detection of the terminal is monitored in real time to facilitate real-time management and control of the positioning detection of the terminal. At this time, during the positioning detection of the terminal, real-time interaction data of the terminal is collected.

[0098] Furthermore, the real-time interactive data of the terminal is introduced, and the real-time interactive data of the terminal is further controlled, so that the corresponding access data is defined according to the real-time interactive data of the terminal and the access rights, which is compatible with the overall consideration of the real-time interactive data of the terminal and the access rights, and realizes the multi-dimensional control of the access data, ensuring the integrity and accuracy of the access data. Optionally, the real-time interactive data of the terminal refers to the interactive data when the terminal dynamically interacts with the external device, and the access rights refer to the rights for accessing the terminal, and the access content is partially restricted.

[0099] Therefore, the access data and the corresponding interactive device are associated; the access signal of the terminal is defined according to the access data, the corresponding interactive device and the terminal, the access signal of the terminal is introduced, and the access data, the corresponding interactive device and the terminal are controlled in multiple dimensions, so as to define the access process of the terminal based on the analysis of the access signal of the terminal, and then control the access process of the terminal, thereby realizing further control of the access process of the terminal. Optionally, the interactive device refers to a device that interacts with the terminal.

[0100] refer to Figure 4 , in step S13, a plurality of sub-access processes are formed based on the division of the access process;

[0101] In the specific implementation process of the present invention, the specific steps may be:

[0102] S131: freeze the access process of the terminal;

[0103] S132: defining a partitioning mode based on a load corresponding to an access process of a terminal and a corresponding access mechanism;

[0104] S133: Divide the access process according to the division mode;

[0105] S134: forming a plurality of access nodes according to the division of the access process;

[0106] S135: Associating the locations of multiple access nodes, the space formed by two adjacent access nodes, and the corresponding access data volumes;

[0107] S136: forming a plurality of sub-access processes based on the locations of the plurality of access nodes, the space formed by two adjacent access nodes, and the corresponding access data volumes.

[0108] In an embodiment of the present application, the access process of the terminal is frozen, and the access process of the terminal is further controlled, so that the division mode is defined based on the load corresponding to the access process of the terminal and the corresponding access mechanism, and the load corresponding to the access process of the terminal and the corresponding access mechanism are introduced. The load corresponding to the access process of the terminal and the corresponding access mechanism are controlled in an integrated manner, so as to control the load corresponding to the access process of the terminal and the corresponding access mechanism in multiple dimensions, thereby ensuring the adaptability and accuracy of the division mode. Optionally, the division mode includes overall division, local division and other modes. The access process of the terminal refers to the overall process of the terminal in the entire access stage.

[0109] Further, the access process is divided according to the division mode, and multiple access nodes are formed according to the division of the access process, so as to introduce multiple access nodes, and the access process is reasonably divided, ensuring the division effect of the access process, and then further processing is performed on multiple access nodes, which is convenient for subsequent processing of multiple access nodes. Optionally, the access node refers to the node marked in the access process for control.

[0110] Therefore, in order to further control multiple access nodes, the locations of multiple access nodes, the space formed by two adjacent access nodes and the corresponding access data volume are introduced, so as to associate the locations of multiple access nodes, the space formed by two adjacent access nodes and the corresponding access data volume, thereby realizing multi-dimensional control of the locations of multiple access nodes, the space formed by two adjacent access nodes and the corresponding access data volume, thereby forming multiple sub-access processes based on the locations of multiple access nodes, the space formed by two adjacent access nodes and the corresponding access data volume, thereby ensuring the rationality of multiple sub-access processes.

[0111] refer to Figure 5 ,S14: defining abnormal access according to the screening of multiple sub-access processes;

[0112] In the specific implementation process of the present invention, the specific steps may be:

[0113] S141: Collect multiple sub-access processes;

[0114] S142: forming a sub-access process set based on the multiple sub-access processes;

[0115] S143: defining a screening mode according to the sub-access process set, the number of access nodes, and the corresponding access data volume;

[0116] S144: triggering the screening of multiple sub-access processes based on the screening mode, and defining abnormal access during the screening process.

[0117] In an embodiment of the present application, multiple sub-access processes are collected and further processed, thereby forming a sub-access process set based on the multiple sub-access processes, introducing the sub-access process set, and realizing the overall processing of the sub-access process set.

[0118] Therefore, the screening mode is defined according to the sub-access process set, the number of access nodes and the corresponding access data volume, and the sub-access process set, the number of access nodes and the corresponding access data volume are introduced. The sub-access process set, the number of access nodes and the corresponding access data volume are controlled in multiple dimensions, thereby ensuring the accuracy of the screening mode. At the same time, based on the screening mode, the screening of multiple sub-access processes is triggered, and abnormal access is defined in the screening process, and abnormal access is controlled to ensure the accuracy of abnormal access. Optionally, the number of access nodes refers to the number of access nodes that exist, and the access data volume refers to the overall data volume of the access data.

[0119] refer to Figure 6 ,S15: define malicious access based on the identification of abnormal access, and trigger the tracing of malicious access according to the location of the malicious access;

[0120] In the specific implementation process of the present invention, the specific steps may be:

[0121] S151: Collect abnormal access;

[0122] S152: defining corresponding exception types based on abnormal access and abnormal identification mechanisms;

[0123] S153: Defining malicious access based on screening of each abnormal type;

[0124] S154: Mark malicious access and define the location of the malicious access;

[0125] S155: Matching the associated website information according to the location of the malicious access;

[0126] S156: Define multiple malicious access points according to the associated website information, and trigger tracing of malicious access based on the multiple malicious access points.

[0127] In the embodiment of the present application, abnormal access is collected, and abnormal access and abnormal identification mechanism are associated, so as to define corresponding abnormal types based on abnormal access and abnormal identification mechanism, and further control is performed on the abnormal types. Optionally, abnormal access is access to an abnormal state.

[0128] Furthermore, in the tracing of malicious access, the attack means corresponding to the malicious access are defined according to the URL information and access time corresponding to the malicious access, and the terminal is autonomously optimized based on the attack means, so as to conduct targeted tracing of the malicious access, and define the attack means in the targeted tracing, so as to facilitate further optimization of the attack means, thereby realizing autonomous optimization of the terminal and realizing chain-type control of terminal monitoring, tracing and autonomous optimization of malicious access.

[0129] At this time, malicious access is defined according to the screening of each exception type, so as to facilitate the screening of each exception type, and further screening is performed based on the name of each exception type, thereby introducing the corresponding malicious access type and implementing the screening of each exception type.

[0130] Therefore, malicious access is marked, and the location of the malicious access is defined; the associated URL information is matched according to the location of the malicious access; multiple malicious access points are defined according to the associated URL information, and the malicious access source tracing is triggered based on the multiple malicious access points, so as to carry out targeted source tracing for the malicious access and realize the source tracing control of the malicious access. Optionally, malicious access refers to access in a malicious state and affects the terminal.

[0131] In addition, in the process of tracing the source of malicious access, synchronous evidence collection is carried out to record the means of malicious access, and as a subsequent processing, optimize the existing terminal abnormality tracing and evidence collection process, shorten the abnormality investigation and evidence analysis time, solve the problems of missed detection and misdetection that may be caused by network security personnel, and effectively improve the efficiency of terminal abnormality handling and the credibility of evidence.

[0132] Furthermore, the tool is used for automatic monitoring and analysis, which enables quick one-click search for abnormal programs or plug-ins, greatly shortening the emergency response time limit; the tool is a stand-alone software, does not require server configuration, is maintenance-free, and does not require upgrades. It is highly portable and secure, and can be directly promoted and used in various power supply bureaus.

[0133] refer to Figure 7 , S16: In tracing the source of malicious access, the attack means corresponding to the malicious access is defined according to the website information and access time corresponding to the malicious access, and the terminal is autonomously optimized based on the attack means;

[0134] In the specific implementation process of the present invention, the specific steps may be:

[0135] S161: Real-time monitoring of malicious access tracing;

[0136] S162: In tracing the source of malicious access, collecting website information, access time, and access level corresponding to the malicious access;

[0137] S163: Associating the website information, access time and access level corresponding to the malicious access;

[0138] S164: defining a set of traceability coefficients according to the website information, access time, and access level corresponding to the malicious access;

[0139] S165: Define the corresponding attack means according to the traceability coefficient set and malicious access level;

[0140] S166: Perform autonomous optimization of the terminal based on the attack method.

[0141] In the specific implementation process of the present invention, the positioning signal of the terminal is collected, and the positioning detection of the terminal is triggered according to the positioning signal; the access process of the terminal is collected based on the positioning detection of the terminal; multiple sub-access processes are formed based on the division of the access process; abnormal access is defined according to the screening of multiple sub-access processes; malicious access is defined based on the identification of abnormal access, and the tracing of the malicious access is triggered according to the location of the malicious access; in the tracing of the malicious access, the attack means corresponding to the malicious access is defined according to the website information and access time corresponding to the malicious access, and the terminal is autonomously optimized based on the attack means, so as to carry out targeted tracing of the malicious access, and define the attack means in the targeted tracing, so as to facilitate further optimization of the attack means, thereby realizing autonomous optimization of the terminal, and realizing chain-type control of the terminal's monitoring, tracing and autonomous optimization of malicious access.

[0142] At this time, the malicious access is traced in real time. In the trace of malicious access, the URL information, access time and access level corresponding to the malicious access are collected, and the URL information, access time and access level corresponding to the malicious access are introduced to control the URL information, access time and access level corresponding to the malicious access as a whole. Optionally, the URL information refers to the corresponding IP address, and the access level refers to the corresponding access content level.

[0143] Therefore, associating the URL information, access time and access level corresponding to malicious access, and controlling the URL information, access time and access level corresponding to malicious access in multiple dimensions is compatible with the consideration of the URL information, access time and access level corresponding to malicious access, so as to define a traceability coefficient set according to the URL information, access time and access level corresponding to malicious access, thereby ensuring the integrity of the traceability coefficient set, and at the same time, defining corresponding attack means according to the traceability coefficient set and the malicious access level; autonomous optimization of the terminal is performed based on the attack means, so as to match the corresponding optimization mechanism for the attack means, thereby realizing autonomous optimization of the terminal, thereby conducting targeted tracing for malicious access, and defining the attack means in the targeted tracing, so as to further optimize the attack means, thereby realizing autonomous optimization of the terminal, and realizing chain-type control of terminal monitoring, tracing and autonomous optimization of malicious access.

[0144] In an embodiment of the present invention, through the method in the embodiment of the present invention, the positioning signal of the terminal is collected, and the positioning detection of the terminal is triggered according to the positioning signal; the access process of the terminal is collected based on the positioning detection of the terminal; multiple sub-access processes are formed based on the division of the access process; abnormal access is defined according to the screening of multiple sub-access processes; malicious access is defined based on the identification of abnormal access, and the tracing of the malicious access is triggered according to the location of the malicious access; in the tracing of the malicious access, the attack means corresponding to the malicious access is defined according to the website information and access time corresponding to the malicious access, and the terminal is autonomously optimized based on the attack means, so as to carry out targeted tracing of the malicious access, and define the attack means in the targeted tracing, so as to facilitate further optimization of the attack means, thereby realizing autonomous optimization of the terminal, and realizing chain-type control of the terminal's monitoring, tracing and autonomous optimization of malicious access.

[0145] See also Figure 8 , Figure 8 It is a schematic diagram of the structure of a system for tracing malicious access of a terminal in an embodiment of the present invention.

[0146] like Figure 8 As shown, a system for tracing the source of malicious access of a terminal, the system for tracing the source of malicious access of a terminal includes:

[0147] The acquisition module 21 is used to acquire the positioning signal of the terminal and trigger the positioning detection of the terminal according to the positioning signal;

[0148] An access process module 22, used to collect the access process of the terminal based on the location detection of the terminal;

[0149] A division module 23, used to form a plurality of sub-access processes based on the division of the access process;

[0150] An abnormal access module 24, used to define abnormal access according to the screening of multiple sub-access processes;

[0151] A tracing module 25, used to define malicious access based on the identification of abnormal access, and trigger tracing of malicious access according to the location of the malicious access;

[0152] The autonomous optimization module 26 is used to define the attack means corresponding to the malicious access according to the website information and access time corresponding to the malicious access in the tracing of the malicious access, and perform autonomous optimization of the terminal based on the attack means.

[0153] See also Fig. 9 , refer to the following Fig. 9 The electronic device 40 according to this embodiment of the present invention will be described. Fig. 9 The electronic device 40 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0154] like Fig. 9 As shown, the electronic device 40 is in the form of a general computing device. The components of the electronic device 40 may include but are not limited to: at least one processing unit 41, at least one storage unit 42, and a bus 43 connecting different system components (including the storage unit 42 and the processing unit 41).

[0155] The storage unit stores program codes, which can be executed by the processing unit 41, so that the processing unit 41 executes the steps according to various exemplary embodiments of the present invention described in the above “Embodiment Method” section of this specification.

[0156] The storage unit 42 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 421 and / or a cache memory unit 422 , and may further include a read-only memory unit (ROM) 423 .

[0157] The storage unit 42 may also include a program / utility 424 having a set (at least one) of program modules 425, such program modules 425 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0158] Bus 43 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0159] The electronic device 40 may also communicate with one or more external devices (e.g., keyboards, pointing devices, Bluetooth devices, etc.), one or more devices that enable a user to interact with the electronic device 40, and / or any device that enables the electronic device 40 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 44. Furthermore, the electronic device 40 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 45. Fig. 9 As shown, the network adapter 45 communicates with other modules of the electronic device 40 via the bus 43. It should be understood that although Fig. 9 Not shown, other hardware and / or software modules may be used in conjunction with the electronic device 40, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup planning systems.

[0160] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0161] Those skilled in the art can understand that all or some of the steps in the various methods of the above embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, and the storage medium can include: a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, etc. In addition, it stores computer program instructions, and when the computer program instructions are executed by a computer, the computer executes the above method.

[0162] In addition, the above method and system for tracing the source of malicious access to the terminal provided in the embodiment of the present invention are introduced in detail. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A method for tracing the source of malicious access to a terminal, characterized in that: Applicable to the tracing scenario of malicious access to terminals; The method for tracing the source of malicious access of the terminal includes: Collect the terminal's positioning signal and trigger the terminal's positioning detection according to the positioning signal; Collecting the access process of the terminal based on the location detection of the terminal; Based on the division of the access process, a plurality of sub-access processes are formed; Defining abnormal access based on screening of multiple sub-access processes; Define malicious access based on the identification of abnormal access, and trigger the tracing of malicious access based on the location of the malicious access; In tracing the source of malicious access, the attack means corresponding to the malicious access are defined according to the URL information and access time corresponding to the malicious access, and the terminal is autonomously optimized based on the attack means.

2. The method for tracing the source of malicious access of a terminal according to claim 1, characterized in that: The collecting of the positioning signal of the terminal and triggering the positioning detection of the terminal according to the positioning signal include: Collect the positioning signal of the terminal; Defining the terminal's positioning information based on the analysis of the terminal's positioning signal; Positioning the terminal according to the positioning information of the terminal; When the terminal is in a positioning state, the control space of the terminal is collected based on the response of the terminal; The terminal's positioning detection is triggered according to the terminal's control space, positioning signal and detection signal.

3. The method for tracing the source of malicious access of a terminal according to claim 2, characterized in that: The collecting of the terminal access process based on the terminal positioning detection includes: Real-time monitoring terminal positioning detection; In the terminal positioning detection, the real-time interaction data of the terminal is collected; Define corresponding access data based on the real-time interactive data of the terminal and access rights; Associating access data with corresponding interactive devices; An access signal of a terminal is defined according to the access data, the corresponding interactive device and the terminal; The access process of the terminal is defined based on the analysis of the access signal of the terminal.

4. The method for tracing the source of malicious access of a terminal according to claim 3, characterized in that: The forming of a plurality of sub-access processes based on the division of the access process includes: Freeze the access process of the terminal; Define the partitioning mode based on the load corresponding to the terminal's access process and the corresponding access mechanism; Divide the access process according to the division mode; A plurality of access nodes are formed according to the division of the access process; Associating the locations of multiple access nodes, the space formed by two adjacent access nodes, and the corresponding access data volume; A plurality of sub-access processes are formed based on the locations of the plurality of access nodes, the space formed by two adjacent access nodes, and the corresponding access data volumes.

5. The method for tracing the source of malicious access of a terminal according to claim 4, characterized in that: The step of defining abnormal access based on screening of multiple sub-access processes includes: Collect multiple sub-access processes; forming a sub-access process set based on the plurality of sub-access processes; Define the filtering mode according to the set of sub-access processes, the number of access nodes, and the corresponding access data volume; The screening of multiple sub-access processes is triggered based on the screening mode, and abnormal access is defined during the screening process.

6. The method for tracing the source of malicious access of a terminal according to claim 5, characterized in that: The process of defining malicious access based on the identification of abnormal access and triggering the tracing of the malicious access according to the location of the malicious access includes: Collect abnormal access; Define corresponding exception types based on exception access and exception identification mechanisms; Define malicious access based on the screening of each anomaly type; Flag malicious access and define where the malicious access is located.

7. The method for tracing the source of malicious access of a terminal according to claim 6, characterized in that: The method of defining malicious access based on the identification of abnormal access and triggering the tracing of the malicious access according to the location of the malicious access also includes: Match the associated URL information based on the location of the malicious access; Multiple malicious access points are defined according to the associated website information, and malicious access tracing is triggered based on the multiple malicious access points.

8. The method for tracing the source of malicious access of a terminal according to claim 7, characterized in that: In the tracing of the malicious access, the attack means corresponding to the malicious access is defined according to the website information and access time corresponding to the malicious access, and the terminal is autonomously optimized based on the attack means, including: Real-time monitoring of malicious access sources; In tracing the source of malicious access, the URL information, access time and access level corresponding to the malicious access are collected.

9. The method for tracing the source of malicious access of a terminal according to claim 8, characterized in that: In the tracing of the malicious access, the attack means corresponding to the malicious access is defined according to the website information and access time corresponding to the malicious access, and the terminal is autonomously optimized based on the attack means, and further includes: Associate the URL information, access time and access level corresponding to the malicious access; Define a set of traceability coefficients based on the URL information, access time, and access level corresponding to the malicious access; Define the corresponding attack methods according to the traceability coefficient set and malicious access level; Based on this attack method, the terminal is autonomously optimized.

10. A system for tracing malicious access to a terminal, characterized in that: The terminal malicious access tracing system is applied to the terminal malicious access tracing method as claimed in any one of claims 1 to 9, and the terminal malicious access tracing system includes: The acquisition module is used to acquire the terminal's positioning signal and trigger the terminal's positioning detection according to the positioning signal; An access process module, used to collect the access process of the terminal based on the location detection of the terminal; A partitioning module, used to form a plurality of sub-access processes based on the partitioning of the access process; An abnormal access module, used to define abnormal access based on the screening of multiple sub-access processes; The tracing module is used to define malicious access based on the identification of abnormal access and trigger the tracing of malicious access based on the location of the malicious access; The autonomous optimization module is used to define the attack means corresponding to the malicious access according to the website information and access time corresponding to the malicious access in the tracing of the malicious access, and to perform autonomous optimization of the terminal based on the attack means.

Images