Behavior detection method and device

Abstract

Embodiments of the invention provide a behavior detection method and apparatus. The behavior detection method comprises the steps of obtaining to-be-detected traffic data corresponding to a target service; determining a user identifier and access data associated with the user identifier in the to-be-detected traffic data; performing Hash operation on the access data to obtain an access Hash value corresponding to the user identifier; determining access behavior information of the user identifier based on a behavior detection strategy of the target service and the access hash value; wherein the behavior detection strategy is associated with a level unauthorized behavior detection dimension.

Description

Technical Field

[0001] The embodiments of the present specification relate to the field of computer technology, and in particular to a behavior detection method and device. Background Art

[0002] With the development of Internet technology, more and more businesses are going online to provide users with more convenient services through online businesses. With the development of online businesses, horizontal unauthorized access vulnerabilities have become a common problem for Internet sites, which not only prevents online businesses from being carried out normally, but also causes large-scale leakage of user sensitive data, which greatly affects the normal operation of online businesses. In the existing technology, in order to solve the problem of horizontal unauthorized access vulnerabilities, most of them adopt maintenance measures after the unauthorized behavior occurs, that is, after the horizontal unauthorized behavior occurs, the preset repair measures in the site will be used to deal with it to avoid causing more data leakage; however, this processing method has a certain lag and cannot stop the loss in time, so there is an urgent need for an effective solution to solve the above problems. Summary of the invention

[0003] In view of this, an embodiment of this specification provides a behavior detection method. One or more embodiments of this specification also relate to a behavior detection device, a computing device, a computer-readable storage medium and a computer program to solve the technical defects existing in the prior art.

[0004] According to a first aspect of an embodiment of this specification, a behavior detection method is provided, including: Obtain the traffic data to be detected corresponding to the target business; Determining a user identifier and access data associated with the user identifier in the traffic data to be detected; Performing a hash operation on the access data to obtain an access hash value corresponding to the user identifier; Based on the behavior detection strategy of the target business and the access hash value, the access behavior information of the user identifier is determined; wherein the behavior detection strategy is associated with a horizontal unauthorized behavior detection dimension.

[0005] According to a second aspect of an embodiment of this specification, a behavior detection device is provided, including: A data acquisition module is configured to acquire the to-be-detected traffic data corresponding to the target service; an identification determination module, configured to determine a user identification and access data associated with the user identification in the traffic data to be detected; A hash operation module, configured to perform a hash operation on the access data to obtain an access hash value corresponding to the user identifier; The information determination module is configured to determine the access behavior information of the user identifier based on the behavior detection strategy of the target business and the access hash value; wherein the behavior detection strategy is associated with a horizontal unauthorized behavior detection dimension.

[0006] According to a third aspect of an embodiment of this specification, a computing device is provided, including: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to implement any step of the above-mentioned behavior detection method when executing the computer-executable instructions.

[0007] According to a fourth aspect of the embodiments of this specification, a computer-readable storage medium is provided, which stores computer-executable instructions, and when the instructions are executed by a processor, the steps of the above-mentioned behavior detection method are implemented.

[0008] According to a fifth aspect of the embodiments of this specification, a computer program is provided, wherein when the computer program is executed in a computer, the computer is caused to execute the steps of the above-mentioned behavior detection method.

[0009] The behavior detection method provided in this specification can, in order to be able to perceive unauthorized behavior in advance and take protective measures, determine the user ID and the access data associated with the user ID in the traffic data to be detected after obtaining the traffic data to be detected corresponding to the target business, and then perform a hash operation on the access data to obtain the access hash value corresponding to the user ID. At this time, a unique corresponding hash value is generated for each access data to facilitate subsequent access behavior detection. After that, by combining the behavior detection strategy and access hash value of the target business, the access behavior information of the user ID is determined before the private resources are fed back for the access data, which can achieve the effect of perceiving unauthorized behavior in advance and taking protective measures to avoid losses caused by data leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1 It is a structural diagram of a behavior detection method provided by an embodiment of this specification; Figure 2 is a flow chart of a behavior detection method provided by an embodiment of this specification; Figure 3 is a flow chart of another behavior detection method provided by an embodiment of this specification; Figure 4 is a structural diagram of a behavior detection device provided by an embodiment of this specification; Figure 5 It is a structural block diagram of a computing device provided by an embodiment of this specification. DETAILED DESCRIPTION

[0011] Many specific details are described in the following description to facilitate a full understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the connotation of this specification, so this specification is not limited to the specific implementation disclosed below.

[0012] The terms used in one or more embodiments of this specification are only for the purpose of describing specific embodiments, and are not intended to limit one or more embodiments of this specification. The singular forms of "a", "said" and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0013] It should be understood that although the terms first, second, etc. may be used to describe various information in one or more embodiments of this specification, this information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, the first may also be referred to as the second, and similarly, the second may also be referred to as the first. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0014] First, the terms involved in one or more embodiments of this specification are explained.

[0015] Hash is a method of transforming an input of any length (also called pre-image) into an output of fixed length through a hash algorithm. The output is the hash value. This conversion is a compression mapping, that is, the space of hash values ​​is usually much smaller than the space of inputs. Different inputs may hash to the same output, so it is impossible to determine the unique input value from the hash value. Simply put, it is a function that compresses a message of any length into a message digest of a fixed length.

[0016] Horizontal privilege escaping: refers to the privilege escaping between users of the same level, which means that the attacker attempts to access the user resources with the same privilege as him. For example, user A and user B belong to the same level of roles and have the same level of privileges. They can obtain their own private data (data A and data B), but if the system only verifies the role that can access the data, and does not segment or verify the data, resulting in user A being able to access user B's data (data B), then user A's access to data B is called horizontal privilege escaping.

[0017] In this specification, a behavior detection method is provided. This specification also relates to a behavior detection device, a computing device, a computer-readable storage medium and a computer program, which are described in detail one by one in the following embodiments.

[0018] See also Figure 1 As shown in the schematic diagram, the behavior detection method provided in this specification can, in order to be able to perceive unauthorized behavior in advance and take protective measures, determine the user ID and the access data associated with the user ID in the traffic data to be detected after obtaining the traffic data to be detected corresponding to the target business, and then perform a hash operation on the access data to obtain the access hash value corresponding to the user ID. At this time, a unique corresponding hash value is generated for each access data to facilitate subsequent access behavior detection. After that, by combining the behavior detection strategy and access hash value of the target business, the access behavior information of the user ID is determined before the private resources are fed back for the access data, which can achieve the effect of perceiving unauthorized behavior and taking protective measures in advance to avoid losses caused by data leakage.

[0019] Figure 2 A flow chart of a behavior detection method provided according to an embodiment of the present specification is shown, which specifically includes the following steps.

[0020] Step S202: Obtain the to-be-detected traffic data corresponding to the target service.

[0021] The behavior detection method provided in this specification is applied to the behavior detection process of the website. The method is applied to the server to which the website belongs. The server performs horizontal unauthorized behavior detection based on the traffic data collected in real time, and can promptly blow the fuse after the detection is completed, or ban the account of the user with abnormal behavior, etc. This embodiment does not make any limitation here.

[0022] Specifically, the target business refers to a business that can access, read and / or download resources by using a website, and the resources involved in the access, read and / or download operations include at least the private resources corresponding to each user. That is, the target business will involve operations such as access, read and / or download of each user's private resources, and horizontal unauthorized behavior between users may occur in this process. Correspondingly, the traffic data to be detected specifically refers to the real-time traffic corresponding to the target business at the current moment, which is used to determine whether there is horizontal unauthorized behavior between users by analyzing the real-time traffic in the future.

[0023] It should be noted that the behavior detection method provided in this specification is executed in real-time on the server side, which is used to detect and analyze the traffic data to be detected at any time, so as to realize timely perception and protection of unauthorized behavior to avoid leakage of data and resources on the server side.

[0024] Furthermore, considering that the traffic data involved in the target business covers many dimensions, and not every dimension involves sensitive data, if the global traffic of the target business is detected, more computing resources and time will be consumed. Therefore, in order to efficiently and accurately detect abnormal behavior, the dimension of associated sensitive data can be determined in combination with the historical traffic data of the target business, and the traffic data is filtered before each detection based on the dimension. In this embodiment, the specific implementation method is as follows: Acquire historical traffic data of the target business; determine resource access data of associated user resources in the historical traffic data, and generate benchmark access information based on the resource access data; acquire initial traffic data corresponding to the target business; and filter out traffic data associated with the benchmark access information in the initial traffic data as the traffic data to be detected.

[0025] Specifically, historical traffic data refers to the traffic data corresponding to any time interval of the target business before the current detection, which is used to analyze the access data of the associated user's private resources; accordingly, user resources are the private resources of the corresponding user, and the resource content includes but is not limited to images, text, audio, transaction information, etc.; accordingly, resource access data refers to the access data of the associated user's resources in the historical traffic data, and the resource access data consists of url, parameters and parameter values. The user's private resources can be accessed through the resource access data. Accordingly, the benchmark access information refers to the marking information generated for the resource access data, which is used to mark the descriptive information of the associated user's private resources in the traffic. The access data of the associated user's private resources can be determined in the traffic data through the benchmark access information, so as to facilitate the subsequent detection and confirmation of unauthorized behavior in combination with this part of the access data. Accordingly, the initial traffic data refers to the full real-time traffic corresponding to the target business at the current moment.

[0026] Based on this, in order to screen out the benchmark access information that causes data leakage due to horizontal unauthorized behavior from a large amount of traffic data, we can first obtain the historical traffic data of the target business, and then determine the resource access data associated with the user resources in the historical traffic data. In other words, the traffic data involving the user's private resources is screened out from the historical traffic data as resource access data; thereafter, the benchmark access information can be generated in combination with the resource access data to clarify which access data in the traffic data is associated with the user's private resources.

[0027] After determining the benchmark access information, if the initial traffic data of the associated target business, that is, the real-time traffic, is obtained, the initial traffic data can be filtered according to the benchmark access information to obtain the traffic data associated with the benchmark access information, and it can be used as the traffic data to be detected to detect the horizontal unauthorized behavior.

[0028] In specific implementation, the http traffic within a certain period of time can be collected. Through the session identifier in the cookie of the http request, the ID corresponding to each user can be obtained. The URL, all parameter names and parameter values ​​in the request are concatenated and hashed to obtain the unique hash value corresponding to each user ID. Based on this feature, it can be clearly seen that if each hash value corresponds to only one user ID, it means that the URL, all parameter names and parameter values ​​before the hash operation are the access data of the user to which the ID belongs to access the private resources. In other words, if each hash value in all historical traffic of a certain URL uniquely corresponds to a user ID, it is determined that the resource requested by the URL is the private resource corresponding to the user himself.

[0029] On this basis, when marking the URL associated with the user's private resources in the historical http traffic, you can select the access data associated with the user ID or private resources, and determine the URL associated with the private resource in combination with this access data. When real-time traffic is obtained, the traffic accessing the user's private resources can be determined in the real-time traffic based on the marked URL, so as to facilitate the subsequent analysis of horizontal unauthorized behavior.

[0030] It should be noted that the determination of the benchmark access information may be completed at any time before the initial traffic data is obtained, and this embodiment does not impose any limitation thereto.

[0031] In summary, by combining historical traffic data to compile benchmark access information, and using the benchmark access information as the basis in the subsequent unauthorized behavior detection process, the access data of the associated user's private resources can be accurately screened out in the real-time traffic, and based on this, horizontal unauthorized behavior detection can be performed, which can effectively reduce the amount of data processed, thereby completing unauthorized behavior detection in a shorter time to avoid omissions.

[0032] Step S204: determining a user identifier and access data associated with the user identifier in the traffic data to be detected.

[0033] Specifically, after obtaining the traffic data to be detected associated with the target business as mentioned above, further, considering that the traffic data to be detected contains a large number of access requests and feedback content, in order to be able to complete the detection of whether each user has horizontal unauthorized behavior, the user ID of each user and the access data associated with each user ID can be determined in the traffic to be detected, so as to facilitate the subsequent combination of the access data and the access ID to complete the detection of whether each user has horizontal unauthorized behavior.

[0034] Among them, the user identifier specifically refers to the unique identifier of the user participating in the target business, which is used to characterize the user identity; correspondingly, the access data specifically refers to the URL data, parameter name data and parameter value data corresponding to each user identifier, and the association between the user identifier and the user data refers to all access data associated with each user identifier; under normal circumstances, each user identifier corresponds to one access data; if a user has horizontal unauthorized behavior, the user will use the identifiers of other users to access private resources. At this time, multiple user identifiers will correspond to one access data, which can be used to determine the occurrence of unauthorized behavior.

[0035] Furthermore, when determining the user ID and its associated access data, considering that the content is the basis for determining whether the user has horizontal unauthorized behavior, it is necessary to ensure the accurate correlation between the user ID and the access data. Therefore, it can be implemented in combination with session identification and parsing. In this embodiment, the specific implementation method is such as steps S2042 to S2044.

[0036] Step S2042: extracting a session identifier from the user information file corresponding to the traffic data to be detected, and determining the user identifier corresponding to the session identifier.

[0037] Step S2044: parse the traffic data to be detected, and generate the access data associated with the user identifier according to the parsing result.

[0038] Specifically, the user information file specifically refers to the file corresponding to the real-time traffic data request cookie in the traffic data to be detected, which is used to store the user ID of the user; correspondingly, the session ID specifically refers to the ID stored in the cookie file, and the session ID and the user ID have a one-to-one correspondence.

[0039] Based on this, after obtaining the traffic data to be detected, the user information file corresponding to the traffic data to be detected can be determined first, and then the session identifier can be determined in the user information file to determine the user identifier corresponding to each user among all the users involved in the traffic data to be detected according to the session identifier; at the same time, in order to be able to detect horizontal unauthorized behavior for the user corresponding to each user identifier, the traffic data to be detected can be analyzed, so as to determine the access data associated with each user identifier according to the analysis result, so as to facilitate subsequent use.

[0040] It should be noted that the user ID obtained at this time is associated with the access data, indicating that a certain user uses the current user ID to read the private resources corresponding to the user ID through the relevant parameters corresponding to the access data. This behavior may be completed by the user to which the user ID belongs, or it may be completed by other users using the user ID of the user. Therefore, it is necessary to perform relevant detection and processing operations after obtaining the access data associated with the user ID.

[0041] In summary, by combining the traffic data to be detected to obtain the user identification and access data, it is possible to associate the user identification and access data in the data analysis stage, thereby facilitating the subsequent detection of horizontal unauthorized behavior according to the correlation between the two to ensure detection accuracy.

[0042] Furthermore, when parsing the traffic data to be detected to determine the access data, it is actually combined with data components of different dimensions in the access data. In this embodiment, the specific implementation method is as follows: The traffic data to be detected is parsed to obtain the access address, access parameter information and access parameter value associated with the user identifier; and the access data associated with the user identifier is obtained by splicing the access address, the access parameter information and the access parameter value.

[0043] Specifically, the access address refers to the address used to access private resources in real-time traffic, that is, the URL; correspondingly, the access parameter information refers to the name of the relevant parameters in the request in the real-time traffic; the access parameter value is the value of each relevant parameter; accordingly, the access address, access parameter information and access parameter value are spliced ​​together, which specifically refers to splicing the relevant information of the three together. The splicing form can be head-to-tail splicing, etc., and this embodiment does not make any limitation here.

[0044] Based on this, after obtaining the user ID, considering that when accessing the user's private resources, it is necessary to combine the user ID and the corresponding access data to read the private data corresponding to each user ID, so the traffic data to be detected is parsed to obtain the access address, access parameter information and access parameter value associated with the user ID. This part of information is the basis for accessing private resources. At this time, the access address, access parameter information and access parameter value can be spliced ​​to obtain the access data associated with the user ID according to the splicing result, and then used in the future.

[0045] Continuing with the above example, based on the collected real-time traffic, after determining the content of the associated tagged url, we can get that the ID corresponding to user A is ID_A, and urlA is used to access user A's private resources, where ID_A is required to use urlA to access user A's private resources; the ID corresponding to user B is ID_B, and urlB is used to access user B's private resources, where ID_B is required to use urlB to access user B's private resources; the ID corresponding to user C is ID_C, and urlA is used to access user A's private resources, where ID_A is required to use urlA to access user A's private resources; after obtaining this part of the data, it can be used to subsequently detect unauthorized behavior for each user.

[0046] In summary, by combining multi-dimensional data to form access data, higher accuracy can be ensured when detecting horizontal unauthorized behavior, so that a quick and accurate response can be made to avoid data leakage and further reduce losses.

[0047] Step S206: performing a hash operation on the access data to obtain an access hash value corresponding to the user identifier.

[0048] Specifically, after obtaining the access data associated with the user ID as mentioned above, in order to improve the detection speed and accuracy of horizontal unauthorized behavior, a hash operation can be performed on the access data associated with the user ID to obtain the access hash value corresponding to each user ID. Subsequently, the access behavior information of each user ID can be determined by combining the behavior detection strategy and access hash value preset by the target business, and then management and control can be carried out when necessary to avoid data leakage.

[0049] Step S208, based on the behavior detection strategy of the target business and the access hash value, determine the access behavior information of the user identifier; wherein the behavior detection strategy is associated with a horizontal unauthorized behavior detection dimension.

[0050] Specifically, after obtaining the access hash value corresponding to the user identifier as described above, further, considering that different business scenarios require different methods to detect horizontal unauthorized behaviors, the behavior detection strategy associated with the target business can be determined first, and then the access hash value can be integrated to achieve the determination of the access behavior information of the user identifier, so that all user identifiers involved in the detected traffic are detected, and it can be determined whether there is horizontal unauthorized behavior at the current moment, so as to take timely countermeasures for the corresponding problems. Such as blocking addresses, blocking accounts, or closing private resource access, etc., this embodiment does not make any restrictions here. Among them, the behavior detection strategy specifically refers to the strategy set for different business scenarios, which is controlled by the computing resources and storage resources of the service provider, that is, the adequacy of the storage resources and computing resources of the service provider controls the behavior detection strategy. Accordingly, the access behavior information specifically refers to the descriptive information for determining whether the user associated with the user identifier has horizontal unauthorized behavior; accordingly, the horizontal unauthorized behavior detection dimension specifically refers to the dimension of horizontal unauthorized behavior detection for users.

[0051] Furthermore, when the business party to which the target business belongs meets the resource call conditions, it means that the business party to which the target business belongs has sufficient computing resources and storage resources. At this time, in order to quickly complete the detection of horizontal unauthorized behavior, an access information table can be established in advance, and the mapping relationship between the historical access hash value and the historical user identifier can be recorded in the access information table. After obtaining the real-time traffic, the access information table can be read to determine whether the mapping relationship is correct. In this embodiment, the specific implementation method is as follows: Determine an access information table based on the behavior detection strategy of the target business; query the access information table according to the access hash value, and determine the access behavior information of the user identifier according to the query result; wherein the access information table records the mapping relationship between historical access hash values ​​and historical user identifiers.

[0052] Specifically, the resource call condition refers to the condition that is called when horizontal unauthorized behavior is detected. Through the resource call condition, it can be determined whether the resources that can be called in the current business scenario can support the detection of horizontal unauthorized behavior. Correspondingly, the access information table specifically refers to the information table that records the user identification and access hash value associated with the users participating in the target business. Since each user's user identification is unique, and the access data when accessing private data is unique, the corresponding access hash value is also unique. Therefore, the mapping relationship between the user identification and the access hash value can be sorted out based on the historical traffic data, and stored in the access information table. It is used to query the table when in use, and it can be determined whether the relationship between the current access hash value and the user identification is the relationship stored in the access information table, and then determine the horizontal unauthorized behavior. Correspondingly, the historical access hash value specifically refers to the hash value obtained after the hash operation based on the historical access data.

[0053] Based on this, when the business party to which the target business belongs meets the resource call conditions, it means that the business party has sufficient storage and computing resources. Therefore, the storage and computing resources can be used to pre-establish an access information table and record the mapping relationship between historical user identifiers and historical access hash values. When the target business performs behavior detection, the access information table can be determined based on the behavior detection strategy of the target business. Since the access hash value corresponds to the user identifier, and the mapping relationship between the historical access hash value and the historical user identifier is recorded in the access information table, and the content recorded in the access information table is accurate; therefore, the access information table can be queried based on the access hash value, and the access behavior information corresponding to the user identifier can be determined based on the query results. That is, the historical user identifier stored in the access information table can be determined based on the query results, and the behavior information of the user identifier can be determined by comparing the user identifier corresponding to the historical user identifier access hash value.

[0054] It should be noted that the access information table needs to be established in advance, and the mapping relationships stored in the access information table are accurate mapping relationships, which is the basis for ensuring the accuracy of horizontal unauthorized behavior detection at any time in the future. In addition, considering that the users participating in the target business may be updated at any time, the access information table can also be updated as the users are updated, so as to ensure that all users participating in the target business can be covered in each detection.

[0055] In summary, when the business party has sufficient resources, in order to ensure detection accuracy and efficiency, the access behavior information can be determined in combination with the access information table, so that a large number of user identifiers can be detected in a shorter period of time to ensure that the business party corresponding to the target business can make a quick resolution decision for horizontal unauthorized behavior.

[0056] Furthermore, when determining the access behavior information, it is actually based on comparing the user identifier stored in the access information table with the user identifier corresponding to the access hash value. In this embodiment, the specific implementation method is as follows: Determine the associated user identifier according to the query result, and if the associated user identifier is the same as the user identifier, determine the normal access information as the access behavior information of the user identifier; or Determine the associated user identifier according to the query result, and if the associated user identifier is different from the user identifier, determine the access abnormality information as the access behavior information of the user identifier; or When it is determined according to the query result that there is no associated user identifier in the access information table, a target mapping relationship is generated based on the user identifier and the access hash value, and the target mapping relationship is recorded in the access information table.

[0057] On the first aspect, when the associated user identifier is determined by querying the access information table, and the associated user identifier is the same as the user identifier, it means that the user identifier corresponding to the access data at this time is the identifier corresponding to the user accessing private resources, which further indicates that there is no unauthorized behavior of the user identifier. Therefore, the normal access information can be used as the access behavior information corresponding to the user identifier.

[0058] Secondly, when the access information table is queried to determine the associated user ID, and the associated user ID is different from the user ID, it means that the user ID corresponding to the access data at this time is not the ID corresponding to the user accessing the private resources. It further indicates that other users have used the ID of the user corresponding to the private resources to access them. This means that the user using the user ID has horizontal unauthorized behavior. Therefore, the access exception information can be determined as the access behavior information, which is convenient for subsequent blocking and other processing of the user ID, and avoids the use of the user ID to continue to read private resources and other operations.

[0059] On the third aspect, when the access information table is queried to determine that there is no associated user ID, it means that the user to which the current access data and its corresponding user ID belong is participating in the target business for the first time. In this case, it is impossible for the user corresponding to the user ID to engage in horizontal unauthorized behavior. Therefore, a target mapping relationship can be created based on the access hash value and the user ID, and the target mapping relationship can be written into the access information table to store the new user's information in the access information table for subsequent use.

[0060] Using the above example, by using the sha256 algorithm to hash urlA as url: example.com / test?a=123&b=abc, we can get the hash string A corresponding to urlA. Similarly, we can perform a hash operation on urlB to get the hash string B corresponding to urlB. At this time, we can determine that in the real-time traffic, hash string A corresponds to ID_A, and hash string B corresponds to ID_B.

[0061] Furthermore, based on the hash strings A and B, the pre-established access information table is queried, and the user ID corresponding to the hash string A in the historical traffic is determined to be ID_A according to the query results, and the user ID corresponding to the hash string B in the historical traffic is determined to be ID_B according to the query results. By comparing the queried user ID with the user ID corresponding to the access data in the real-time traffic, it is determined that both user A and user B have normal private resource access according to the comparison results. However, the ID_C corresponding to user C is inconsistent with the ID queried based on the hash value corresponding to urlA, and it is determined that user C has horizontal unauthorized behavior.

[0062] In addition, when the user ID is not obtained by querying the table based on the hash string, it means that there is no relevant mapping relationship for this user in the current table. Therefore, a new mapping relationship can be formed based on the hash string and the user ID corresponding to the access data, and written into the table for convenience in subsequent processing stages.

[0063] In actual applications, after determining the user ID that has committed horizontal unauthorized behavior, considering that the detection behavior occurs before the private resource is fed back based on the request, the user ID that has committed the unauthorized behavior can be banned, or the target business can be temporarily shut down to avoid data leakage caused by successful access to private resources.

[0064] The behavior detection method provided in this specification can, in order to be able to perceive unauthorized behavior in advance and take protective measures, determine the user ID and the access data associated with the user ID in the traffic data to be detected after obtaining the traffic data to be detected corresponding to the target business, and then perform a hash operation on the access data to obtain the access hash value corresponding to the user ID. At this time, a unique corresponding hash value is generated for each access data to facilitate subsequent access behavior detection. After that, by combining the behavior detection strategy and access hash value of the target business, the access behavior information of the user ID is determined before the private resources are fed back for the access data, which can achieve the effect of perceiving unauthorized behavior in advance and taking protective measures to avoid losses caused by data leakage.

[0065] Corresponding to the above embodiment, this specification also provides another behavior detection method: Figure 3 A flow chart of another behavior detection method provided according to an embodiment of the present specification is shown, which specifically includes the following steps.

[0066] Step S302: Obtain the to-be-detected traffic data corresponding to the target service.

[0067] The behavior detection method provided in this specification is applied to the behavior detection process of the website. The method is applied to the server to which the website belongs. The server performs horizontal unauthorized behavior detection based on the traffic data collected in real time, and can promptly blow the fuse after the detection is completed, or ban the account of the user with abnormal behavior, etc. This embodiment does not make any limitation here.

[0068] Specifically, the target business refers to a business that can access, read and / or download resources by using a website, and the resources involved in the access, read and / or download operations include at least the private resources corresponding to each user. That is, the target business will involve operations such as access, read and / or download of each user's private resources, and horizontal unauthorized behavior between users may occur in this process. Correspondingly, the traffic data to be detected specifically refers to the real-time traffic corresponding to the target business at the current moment, which is used to determine whether there is horizontal unauthorized behavior between users by analyzing the real-time traffic in the future.

[0069] It should be noted that the behavior detection method provided in this specification is executed in real-time on the server side, which is used to detect and analyze the traffic data to be detected at any time, so as to realize timely perception and protection of unauthorized behavior to avoid leakage of data and resources on the server side.

[0070] Step S304: determining a user identifier and access data associated with the user identifier in the traffic data to be detected.

[0071] Specifically, after obtaining the traffic data to be detected associated with the target business as mentioned above, further, considering that the traffic data to be detected contains a large number of access requests and feedback content, in order to be able to complete the detection of whether each user has horizontal unauthorized behavior, the user ID of each user and the access data associated with each user ID can be determined in the traffic to be detected, so as to facilitate the subsequent combination of the access data and the access ID to complete the detection of whether each user has horizontal unauthorized behavior.

[0072] Among them, the user identifier specifically refers to the unique identifier of the user participating in the target business, which is used to characterize the user identity; correspondingly, the access data specifically refers to the URL data, parameter name data and parameter value data corresponding to each user identifier, and the association between the user identifier and the user data refers to all access data associated with each user identifier; under normal circumstances, each user identifier corresponds to one access data; if a user has horizontal unauthorized behavior, the user will use the identifiers of other users to access private resources. At this time, multiple user identifiers will correspond to one access data, which can be used to determine the occurrence of unauthorized behavior.

[0073] Step S306: Perform a hash operation on the access data to obtain an access hash value corresponding to the user identifier.

[0074] Specifically, after obtaining the access data associated with the user ID as mentioned above, in order to improve the detection speed and accuracy of horizontal unauthorized behavior, a hash operation can be performed on the access data associated with the user ID to obtain the access hash value corresponding to each user ID. Subsequently, the access behavior information of each user ID can be determined by combining the behavior detection strategy and access hash value preset by the target business, and then management and control can be carried out when necessary to avoid data leakage.

[0075] It should be noted that the other behavior detection method provided in this embodiment corresponds to the behavior detection method provided in the above embodiment, wherein the description contents of step S302 to step S306 may refer to the same or corresponding description contents in the above embodiment, and will not be described in detail here. In addition, the contents provided in this embodiment that are the same as those described in the above embodiment may also refer to the above embodiment, and this embodiment is not limited in any way here.

[0076] Step S308, when the business party to which the target business belongs does not meet the resource calling condition, determine the number of user identifiers corresponding to the access hash value within a preset time interval according to the traffic data to be detected.

[0077] Specifically, after obtaining the access hash value corresponding to the user ID, further, considering that different business scenarios require different methods to detect horizontal unauthorized behaviors, the behavior detection strategy associated with the target business can be determined first, and then the access hash value can be integrated to achieve the access behavior information of the user ID. In this way, all user IDs involved in the detected traffic are detected to determine whether there is horizontal unauthorized behavior at the current moment, so as to take timely countermeasures for the corresponding problems. Such as blocking addresses, blocking accounts, or closing private resource access, etc., this embodiment does not make any restrictions here.

[0078] Based on this, when it is determined that the resource call conditions are not met, the number of user identifiers corresponding to the access hash value within the preset time interval can be determined based on the traffic data to be detected, and then the access behavior information can be determined based on the number of user identifiers. Among them, the preset time interval specifically refers to the time of the number of user identifiers, and the length of the time interval can be set according to the actual application scenario, such as 5 minutes, 10 minutes, etc., and this embodiment does not make any limitation here.

[0079] That is to say, when the business party to which the target business belongs does not meet the resource call conditions, it means that the computing resources and storage resources of the business party to which the target business belongs are insufficient. At this time, if some storage resources and computing resources are called for the detection of horizontal unauthorized behavior, it may cause resource call pressure on the business party. Therefore, for the situation where the conditions are not met, after obtaining the access hash value corresponding to the user ID, the detection can be achieved by using the statistical access hash value and the corresponding relationship between the number of user IDs. That is, when there is horizontal unauthorized behavior, the same access data may correspond to at least two user IDs, which are used to access the private resources of different users. At this time, it means that a user is operating maliciously, so this mechanism can be used to detect unauthorized behavior.

[0080] Furthermore, in the process of determining the number of user identifiers, considering that the user identifier is associated with the access data, and the access data is subjected to a hash operation to obtain an access hash value, the number of user identifiers can be counted based on the access data. In this embodiment, the specific implementation method is as follows: Determine the access user identification corresponding to the access data within a preset time interval according to the traffic data to be detected; and count the number of identifications corresponding to the access user identification as the number of user identifications corresponding to the access hash value.

[0081] Based on this, the traffic data to be detected contains all the traffic within the preset time period, so the access user identification corresponding to the access data within the preset time interval can be determined by analyzing the traffic of the data to be detected; usually, each access data should correspond to an access user identification, because each user will only access private resources through his or her own user identification, if it exceeds, there may be unauthorized behavior. Therefore, the number of identifications corresponding to the access user identification can be counted, and since the access data is hashed to obtain the access hash value, the number of user identifications corresponding to the access hash value can be determined based on the identification data, so as to facilitate subsequent quantity comparison, thereby determining whether there is unauthorized behavior.

[0082] For example, the ID corresponding to user A is ID_A, and urlA is used to access user A's private resources, where ID_A is required to use urlA to access user A's private resources; the ID corresponding to user B is ID_B, and urlB is used to access user B's private resources, where ID_B is required to use urlB to access user B's private resources; the ID corresponding to user C is ID_C, and urlA is used to access user A's private resources, where ID_A is required to use urlA to access user A's private resources.

[0083] By using the sha256 algorithm to perform a hash operation on urlA, which is url: example.com / test?a=123&b=abc, we can obtain the hash string A corresponding to urlA. Similarly, we can perform a hash operation on urlB to obtain the hash string B corresponding to urlB. At this time, we can determine that in the real-time traffic, hash string A corresponds to ID_A and ID_C, and hash string B corresponds to ID_B.

[0084] Furthermore, by counting the access user IDs corresponding to each access data within 10 minutes, it is determined that urlA corresponds to ID_A and ID_C, urlB corresponds to ID_B, and then the number of user IDs corresponding to hash string A is determined to be 2, and the number of user IDs corresponding to hash string B is determined to be 1, so as to facilitate the subsequent detection of horizontal unauthorized behavior in combination with the number of user IDs.

[0085] In summary, by counting the user identification data of the access data, the number of user identifications corresponding to the access hash value is determined, so that the horizontal unauthorized behavior analysis can be completed later by analyzing the number of user identifications within a preset time period, thereby ensuring the accuracy of the unauthorized behavior analysis.

[0086] Step S310: Detect the number of user identifiers based on the behavior detection strategy, and determine access behavior information of the user identifiers according to the detection result.

[0087] Specifically, after obtaining the number of user identifiers as described above, the number of user identifiers can be further detected based on the behavior detection strategy to analyze whether the number has reached the upper limit, so as to determine the access behavior information of the user identifier according to the detection result. The access behavior information specifically refers to the description information to determine whether the user associated with the user identifier has horizontal unauthorized behavior; Further, when analyzing whether a user has horizontal unauthorized behavior based on the number of user identifications, it can be implemented in combination with a preset number threshold and completed by comparing the number threshold. In this embodiment, the specific implementation method is as follows: When it is determined based on the behavior detection strategy that the number of user identifiers is greater than a preset number threshold, access abnormality information is determined as the access behavior information of the user identifier; or, when it is determined based on the behavior detection strategy that the number of user identifiers is less than or equal to a preset number threshold, normal access information is determined as the access behavior information of the user identifier.

[0088] During specific implementation, the preset quantity threshold may be set according to the actual application scenario, such as 1, 2, etc., and this embodiment does not impose any limitation thereto.

[0089] First, when the behavior detection strategy determines that the number of user identifications is greater than the preset threshold, it indicates that horizontal unauthorized behavior exists. To avoid losses, the access anomaly information can be used as the access behavior information of the user identification.

[0090] Secondly, when the behavior detection strategy determines that the number of user identifications is less than or equal to the preset number threshold, it means that there is no horizontal unauthorized behavior at this time, so the normal access information can be used as the access behavior information corresponding to the user identification.

[0091] Continuing with the above example, according to the statistical results, the number of user identifiers corresponding to hash string A is determined to be 2, and the number of user identifiers corresponding to hash string B is determined to be 1, while the preset number threshold is 1. Through comparison, it is determined that the number of user identifiers corresponding to hash string A is 2, which is greater than 1, and thus it is determined that horizontal unauthorized behavior exists.

[0092] In summary, by using the quantity threshold comparison method to determine the access behavior information, it can be ensured that the detection of horizontal unauthorized behavior is completed in a shorter time, thereby improving the detection accuracy and reducing the consumption of computing resources.

[0093] In addition, considering that there may be a risk of low detection accuracy through one detection, and the business side also needs to determine whether horizontal unauthorized behavior occurs to reduce losses, after the access behavior information is determined, it is possible to detect whether the unauthorized behavior is successful. In this embodiment, the specific implementation method is as follows: Obtain the access feedback result of each access user identification corresponding to the access data; perform hash operations on the access feedback results of each access user identification respectively to obtain the feedback hash value corresponding to each access user identification; compare the feedback hash values ​​corresponding to each access user identification, and determine the abnormal behavior result of the user identification according to the comparison result.

[0094] Specifically, the access feedback result specifically refers to the content fed back to the access user ID for the access data, including but not limited to private resources and information associated with the access user ID. Correspondingly, the feedback hash value specifically refers to the hash value obtained after performing a hash operation on the feedback result, and the hash operation can be performed in the same manner as the hash operation of the access data, and this embodiment does not make any limitation here. Correspondingly, the abnormal behavior result specifically refers to the result of determining whether the unauthorized behavior has been successful.

[0095] Based on this, in order to avoid causing too much loss, we can first determine whether there is horizontal unauthorized behavior, and then obtain the access feedback result corresponding to each access user ID of the access data. Then, we perform a hash operation on the access feedback result to obtain the feedback hash value corresponding to each access user ID. By comparing the feedback hash values ​​between the various access user IDs, we can determine the abnormal behavior result corresponding to the user ID. The result includes success or failure. It is used to indicate whether the horizontal unauthorized behavior is successful.

[0096] Continuing with the above example, after determining that hash string A corresponds to ID_A and ID_C, a hash operation can be performed on the private resources based on the feedback from ID_A to obtain hash string A1, and a hash operation can be performed on the private resources based on the feedback from ID_C to obtain hash string C1. If hash string A1 and hash string C1 are equal, it indicates that the horizontal overreaching behavior is successful, otherwise it indicates failure.

[0097] By comparing the feedback hash values ​​to detect the success and failure of horizontal unauthorized behavior, it is possible to further determine whether private resource leakage has occurred, so that a timely response can be made to avoid excessive losses.

[0098] In summary, in order to be able to perceive unauthorized behavior in advance and take protective measures, after obtaining the traffic data to be detected corresponding to the target business, the user ID and the access data associated with the user ID can be determined in the traffic data to be detected, and then the access data can be hashed to obtain the access hash value corresponding to the user ID. At this time, a unique corresponding hash value is generated for each access data to facilitate subsequent access behavior detection. After that, by combining the behavior detection strategy and access hash value of the target business, the access behavior information of the user ID can be determined before the private resources are fed back for the access data, which can achieve the effect of perceiving unauthorized behavior and taking protective measures in advance to avoid losses caused by data leakage.

[0099] Corresponding to the above method embodiment, this specification also provides a behavior detection device embodiment, Figure 4 FIG. 1 shows a schematic diagram of a behavior detection device provided by an embodiment of the present specification. Figure 4 As shown, the device comprises: The data acquisition module 402 is configured to acquire the to-be-detected traffic data corresponding to the target service; The identification determination module 404 is configured to determine a user identification and access data associated with the user identification in the traffic data to be detected; A hash operation module 406 is configured to perform a hash operation on the access data to obtain an access hash value corresponding to the user identifier; The information determination module 408 is configured to determine the access behavior information of the user identifier based on the behavior detection strategy of the target business and the access hash value; wherein the behavior detection strategy is associated with a horizontal unauthorized behavior detection dimension.

[0100] In an optional embodiment, the device further includes: An information generation module is configured to obtain historical traffic data of the target service; determine resource access data of associated user resources in the historical traffic data, and generate reference access information based on the resource access data; Accordingly, the data acquisition module 402 is further configured to: Acquire initial traffic data corresponding to the target service; and filter out traffic data associated with the reference access information from the initial traffic data as the traffic data to be detected.

[0101] In an optional embodiment, the identification module 404 is further configured to: Extracting a session identifier from a user information file corresponding to the flow data to be detected, and determining the user identifier corresponding to the session identifier; parsing the flow data to be detected, and generating the access data associated with the user identifier according to the parsing result.

[0102] In an optional embodiment, the identification module 404 is further configured to: The traffic data to be detected is parsed to obtain the access address, access parameter information and access parameter value associated with the user identifier; and the access data associated with the user identifier is obtained by splicing the access address, the access parameter information and the access parameter value.

[0103] In an optional embodiment, when the business party to which the target business belongs meets the resource calling condition, the information determination module 408 is further configured to: Determine an access information table based on the behavior detection strategy of the target business; query the access information table according to the access hash value, and determine the access behavior information of the user identifier according to the query result; wherein the access information table records the mapping relationship between historical access hash values ​​and historical user identifiers.

[0104] In an optional embodiment, the information determination module 408 is further configured to: Determine the associated user identifier based on the query result, and when the associated user identifier is the same as the user identifier, determine normal access information as the access behavior information of the user identifier; or determine the associated user identifier based on the query result, and when the associated user identifier is different from the user identifier, determine abnormal access information as the access behavior information of the user identifier; or, when it is determined based on the query result that the associated user identifier does not exist in the access information table, generate a target mapping relationship based on the user identifier and the access hash value, and record the target mapping relationship in the access information table.

[0105] In an optional embodiment, when the business party to which the target business belongs does not meet the resource calling condition, the information determination module 408 is further configured to: According to the traffic data to be detected, the number of user identifiers corresponding to the access hash value within a preset time interval is determined; the number of user identifiers is detected based on the behavior detection strategy, and the access behavior information of the user identifier is determined according to the detection result.

[0106] In an optional embodiment, the information determination module 408 is further configured to: Determine the access user identification corresponding to the access data within a preset time interval according to the traffic data to be detected; and count the number of identifications corresponding to the access user identification as the number of user identifications corresponding to the access hash value.

[0107] In an optional embodiment, the information determination module 408 is further configured to: When it is determined based on the behavior detection strategy that the number of user identifiers is greater than a preset number threshold, access abnormality information is determined as the access behavior information of the user identifier; or, when it is determined based on the behavior detection strategy that the number of user identifiers is less than or equal to a preset number threshold, normal access information is determined as the access behavior information of the user identifier.

[0108] In an optional embodiment, the device further includes: The abnormal behavior detection module is configured to obtain the access feedback result of each access user identifier corresponding to the access data; perform hash operations on the access feedback results of each access user identifier to obtain the feedback hash value corresponding to each access user identifier; compare the feedback hash values ​​corresponding to each access user identifier, and determine the abnormal behavior result of the user identifier based on the comparison result.

[0109] The behavior detection device provided in this specification can, in order to be able to perceive unauthorized behavior in advance and take protective measures, determine the user ID and the access data associated with the user ID in the traffic data to be detected after obtaining the traffic data to be detected corresponding to the target business, and then perform a hash operation on the access data to obtain the access hash value corresponding to the user ID. At this time, a hash value with a unique corresponding relationship is generated for each access data to facilitate subsequent access behavior detection. After that, by combining the behavior detection strategy and access hash value of the target business, the access behavior information of the user ID is determined before the private resources are fed back for the access data, which can achieve the effect of perceiving unauthorized behavior and taking protective measures in advance to avoid losses caused by data leakage.

[0110] The above is a schematic scheme of a behavior detection device of this embodiment. It should be noted that the technical scheme of the behavior detection device and the technical scheme of the above behavior detection method belong to the same concept, and the details not described in detail in the technical scheme of the behavior detection device can be referred to the description of the technical scheme of the above behavior detection method.

[0111] Figure 5 The structure block diagram of a computing device 500 provided according to an embodiment of the present specification is shown. The components of the computing device 500 include but are not limited to a memory 510 and a processor 520. The processor 520 is connected to the memory 510 via a bus 530, and the database 550 is used to store data.

[0112] The computing device 500 also includes an access device 540 that enables the computing device 500 to communicate via one or more networks 560. Examples of these networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of communication networks such as the Internet. The access device 540 may include one or more of any type of network interface (e.g., a network interface card (NIC)) that is wired or wireless, such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a World Wide Interoperability for Microwave Access (Wi-MAX) interface, an Ethernet interface, a universal serial bus (USB) interface, a cellular network interface, a Bluetooth interface, a near field communication (NFC) interface, and the like.

[0113] In one embodiment of the present specification, the above components of the computing device 500 and Figure 5 Other components not shown in the figure may also be connected to each other, for example, via a bus. It should be understood that Figure 5 The computing device structure block diagram shown is only for the purpose of illustration, and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0114] Computing device 500 may be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, a personal digital assistant, a laptop computer, a notebook computer, a netbook, etc.), a mobile phone (e.g., a smart phone), a wearable computing device (e.g., a smart watch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or PC. Computing device 500 may also be a mobile or stationary server.

[0115] The processor 520 is used to execute the following computer executable instructions, which implement the steps of the above-mentioned behavior detection method when executed by the processor.

[0116] The above is a schematic scheme of a computing device of this embodiment. It should be noted that the technical scheme of the computing device and the technical scheme of the above behavior detection method belong to the same concept, and the details not described in detail in the technical scheme of the computing device can be referred to the description of the technical scheme of the above behavior detection method.

[0117] An embodiment of the present specification further provides a computer-readable storage medium storing computer-executable instructions, which can implement the steps of the above-mentioned behavior detection method when executed by a processor.

[0118] The above is a schematic scheme of a computer-readable storage medium of this embodiment. It should be noted that the technical scheme of the storage medium and the technical scheme of the above-mentioned behavior detection method belong to the same concept, and the details not described in detail in the technical scheme of the storage medium can be referred to the description of the technical scheme of the above-mentioned behavior detection method.

[0119] An embodiment of the present specification further provides a computer program, wherein when the computer program is executed in a computer, the computer is caused to execute the steps of the above-mentioned behavior detection method.

[0120] The above is an illustrative solution of a computer program of this embodiment. It should be noted that the technical solution of the computer program and the technical solution of the above behavior detection method belong to the same concept, and the details of the technical solution of the computer program that are not described in detail can be found in the description of the technical solution of the above behavior detection method.

[0121] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0122] The computer instructions include computer program codes, which may be in source code form, object code form, executable files or some intermediate forms, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0123] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of this specification are not limited by the order of the actions described, because according to the embodiments of this specification, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the embodiments of this specification.

[0124] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0125] The preferred embodiments of this specification disclosed above are only used to help explain this specification. The optional embodiments do not describe all the details in detail, nor do they limit the invention to only the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of the embodiments of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the embodiments of this specification, so that technicians in the relevant technical field can well understand and use this specification. This specification is only limited by the claims and their full scope and equivalents.

Claims

1. A behavior detection method, comprising: Obtain the traffic data to be detected corresponding to the target business; Determining a user identifier and access data associated with the user identifier in the traffic data to be detected; Performing a hash operation on the access data to obtain an access hash value corresponding to the user identifier; Determine an access information table based on the behavior detection strategy of the target business; The access information table is queried according to the access hash value, and the access behavior information of the user identifier is determined according to the query result; wherein the behavior detection strategy is associated with a horizontal unauthorized behavior detection dimension, and the access information table records the mapping relationship between historical access hash values ​​and historical user identifiers.

2. The method according to claim 1, before the step of obtaining the to-be-detected traffic data corresponding to the target service is performed, further comprising: Obtaining historical traffic data of the target service; Determining resource access data associated with user resources in the historical traffic data, and generating benchmark access information based on the resource access data; Accordingly, the step of obtaining the to-be-detected traffic data corresponding to the target service includes: Obtaining initial traffic data corresponding to the target service; The flow data associated with the reference access information is screened out from the initial flow data as the flow data to be detected.

3. The method according to claim 1, wherein determining a user identifier and access data associated with the user identifier in the traffic data to be detected comprises: Extracting a session identifier from a user information file corresponding to the traffic data to be detected, and determining the user identifier corresponding to the session identifier; The traffic data to be detected is parsed, and the access data associated with the user identifier is generated according to the parsing result.

4. The method according to claim 3, wherein the step of parsing the traffic data to be detected and generating the access data associated with the user identifier according to the parsing result comprises: Parsing the traffic data to be detected to obtain the access address, access parameter information and access parameter value associated with the user identifier; The access data associated with the user identifier is obtained by concatenating the access address, the access parameter information and the access parameter value.

5. The method according to claim 1, wherein determining the access behavior information of the user identifier according to the query result comprises: Determine the associated user identifier according to the query result, and if the associated user identifier is the same as the user identifier, determine the normal access information as the access behavior information of the user identifier; or, Determine an associated user identifier according to the query result, and if the associated user identifier is different from the user identifier, determine access exception information as access behavior information of the user identifier; or, When it is determined according to the query result that there is no associated user identifier in the access information table, a target mapping relationship is generated based on the user identifier and the access hash value, and the target mapping relationship is recorded in the access information table.

6. According to the method of claim 1, when the business party to which the target business belongs does not meet the resource call condition, the determining the access behavior information of the user identifier based on the behavior detection strategy of the target business and the access hash value comprises: Determine the number of user identifiers corresponding to the access hash value within a preset time interval according to the traffic data to be detected; The number of user identifiers is detected based on the behavior detection strategy, and access behavior information of the user identifiers is determined according to the detection result.

7. The method according to claim 6, wherein determining the number of user identifiers corresponding to the access hash value within a preset time interval according to the traffic data to be detected comprises: Determine, according to the traffic data to be detected, an access user identifier corresponding to the access data within a preset time interval; The number of identifiers corresponding to the access user identifiers is counted as the number of user identifiers corresponding to the access hash value.

8. The method according to claim 7, wherein the detecting the number of user identifiers based on the behavior detection strategy and determining the access behavior information of the user identifiers according to the detection result comprises: When it is determined based on the behavior detection strategy that the number of user identifiers is greater than a preset number threshold, determining access abnormality information as access behavior information of the user identifier; or, When it is determined based on the behavior detection strategy that the number of user identifiers is less than or equal to a preset number threshold, normal access information is determined as the access behavior information of the user identifier.

9. The method according to claim 8, after the step of determining the access abnormality information as the access behavior information of the user identification is performed, further comprising: Obtaining access feedback results corresponding to each access user identifier of the access data; Perform hash operations on the access feedback results of each access user ID to obtain the feedback hash value corresponding to each access user ID; The feedback hash values ​​corresponding to each access user identification are compared, and the abnormal behavior result of the user identification is determined according to the comparison result.

10. A behavior detection device, comprising: A data acquisition module is configured to acquire the to-be-detected traffic data corresponding to the target service; an identification determination module, configured to determine a user identification and access data associated with the user identification in the traffic data to be detected; A hash operation module, configured to perform a hash operation on the access data to obtain an access hash value corresponding to the user identifier; An information determination module configured to determine an access information table based on a behavior detection strategy of the target service; The access information table is queried according to the access hash value, and the access behavior information of the user identifier is determined according to the query result; wherein the behavior detection strategy is associated with a horizontal unauthorized behavior detection dimension, and the access information table records the mapping relationship between historical access hash values ​​and historical user identifiers.

11. A computing device comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the method described in any one of claims 1 to 9 are implemented.

12. A computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions, when executed by a processor, implement the steps of the method according to any one of claims 1 to 9.

Images