Accumulated data stealing detection method and device for network traffic, computer equipment and readable storage medium

Abstract

The invention relates to an accumulated data stealing detection method and device for network traffic, computer equipment and a readable storage medium. The method comprises the following steps: acquiring access data of a detection object in a current time period; performing feature extraction on the access data according to a preset time granularity to obtain feature values of a plurality of access behavior features of the detection object; determining a current abnormal score of the detection object according to the feature values of the plurality of access behavior features; according to the current abnormal score and the historical abnormal score of the detection object, obtaining an accumulated data stealing abnormal index; and according to the accumulated data stealing abnormal index, determining an accumulated data stealing behavior detection result of the detection object. By adopting the method, possible suspected accumulated data stealing behaviors in the network flow data can be effectively monitored.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a method, device, computer equipment, computer-readable storage medium and computer program product for detecting cumulative data theft of network traffic. Background Art

[0002] With the development of information technology, many business systems store a large amount of valuable data, and data theft is also a problem that must be faced on the modern Internet. Currently, the more commonly used defense and detection methods include: monitoring and tracking the flow of sensitive and important data in the network to identify possible data leakage behaviors; collecting access information and historical access information, and obtaining access risk assessment values ​​through analysis, and analyzing real-time browsing information based on access risk assessment values ​​and historical browsing information to determine whether it is abnormal; based on the traffic data in the time window, calculate the silent period difference factor, construct abnormal time series, detect data transmission behavior, identify abnormal transmission deviations, and calculate the protocol switching rate based on the traffic data set to capture the typical low-frequency and intermittent communication mode in APT (Advanced Persistent Threat) attacks.

[0003] However, the current common means of data theft detection are often limited to limited scenarios such as highly sensitive data protection monitoring, short-term high-frequency access, download volume detection, crawler detection, etc., which easily ignore the time accumulation effect of network data theft, and the features used for detection are relatively simple. There is a lack of effective detection methods for long-term cumulative data theft scenarios that exist in the network. Summary of the invention

[0004] Based on this, it is necessary to provide a cumulative theft detection method, device, computer equipment, computer-readable storage medium and computer program product for network traffic to address the technical problem that the above method cannot effectively detect the long-term cumulative theft behavior in the network.

[0005] In a first aspect, the present application provides a method for detecting cumulative data theft of network traffic. The method comprises:

[0006] Obtain access data of the detection object in the current time period;

[0007] Extracting features from the access data according to a preset time granularity to obtain feature values ​​of multiple access behavior features of the detection object;

[0008] Determining a current anomaly score of the detection object according to the feature values ​​of the multiple access behavior features;

[0009] Obtaining a cumulative data theft anomaly index according to the current anomaly score and the historical anomaly score of the detection object;

[0010] The cumulative number theft behavior detection result of the detection object is determined according to the cumulative number theft abnormality index.

[0011] In one embodiment, there are multiple detection objects, and determining the current anomaly score of the detection object according to the feature values ​​of the multiple access behavior features includes:

[0012] Obtaining target weights of each of the access behavior features in the current time period;

[0013] For each detection object, according to the target weight, weighted aggregation processing is performed on the feature values ​​of each access behavior feature of the detection object to obtain a current anomaly score of the detection object.

[0014] In one embodiment, obtaining the target weight of each of the access behavior features in the current time period includes:

[0015] Obtaining initial weights of each of the access behavior features;

[0016] For each access behavior feature, the initial weight of the access behavior feature is updated according to the distribution information of the feature values ​​of each detection object on the access behavior feature in the current time period to obtain the target weight.

[0017] In one embodiment, the updating of the initial weight of the access behavior feature according to the distribution information of the feature value of each detection object on the access behavior feature in the current time period to obtain the target weight includes:

[0018] When it is determined according to the distribution information that the distribution difference of the access behavior characteristics of the respective detection objects is greater than a first threshold, increasing the initial weight of the access behavior characteristics to obtain the target weight;

[0019] When it is determined according to the distribution information that the distribution difference of each detection object in the access behavior feature is less than a second threshold, the initial weight of the access behavior feature is reduced to obtain the target weight.

[0020] In one embodiment, performing weighted aggregation processing on the feature values ​​of each access behavior feature of the detection object according to the target weight to obtain the current anomaly score of the detection object includes:

[0021] Determine a first type of feature and a second type of feature in each of the access behavior features; the first type of feature is a feature where the magnitude difference of feature values ​​of different detection objects under this type of feature is greater than a difference threshold, and the second type of feature is a feature where the magnitude difference of feature values ​​of different detection objects under this type of feature is less than the difference threshold;

[0022] Performing feature conversion processing on the feature values ​​of the first type of features and the feature values ​​of the second type of features respectively to obtain first converted feature values ​​and second converted feature values;

[0023] Based on the first conversion feature value and the second conversion feature value, obtaining a processed feature value of each access behavior feature;

[0024] According to the target weight, weighted aggregation processing is performed on the processed feature values ​​of the various access behavior features to obtain a current anomaly score of the detection object.

[0025] In one embodiment, performing feature conversion processing on the feature value of the first type of feature to obtain a first converted feature value includes:

[0026] Determine the maximum eigenvalue of each detected object under the first type of features, and perform feature conversion processing on the eigenvalue of each detected object under the first type of features based on the maximum eigenvalue to obtain a first converted eigenvalue of each detected object under the first type of features;

[0027] Performing feature conversion processing on the feature values ​​of the second type of features to obtain second converted feature values ​​includes:

[0028] Determine the average feature value of each detection object under the second type of features, and perform feature conversion processing on the feature value of each detection object under the second type of features based on the average feature value to obtain a second converted feature value of each detection object under the second type of features.

[0029] In one embodiment, the historical anomaly score includes anomaly scores of multiple historical time periods; the cumulative data theft anomaly index is obtained according to the current anomaly score and the historical anomaly score of the detection object, including:

[0030] Obtaining a first weight of the current time period and a second weight of each of the historical time periods; wherein the first weight is greater than the second weight, and the weight of the historical time period is negatively correlated with the time distance of the historical time period relative to the current time period;

[0031] According to the first weight and the second weight, weighted aggregation processing is performed on the current anomaly score and the historical anomaly scores of each of the historical time periods to obtain the cumulative data theft anomaly index.

[0032] In a second aspect, the present application also provides a device for detecting cumulative data theft of network traffic. The device comprises:

[0033] A data acquisition module is used to acquire access data of the detection object in the current time period;

[0034] A feature extraction module, used to extract features from the access data according to a preset time granularity to obtain feature values ​​of multiple access behavior features of the detection object;

[0035] a score determination module, configured to determine a current abnormal score of the detection object according to the feature values ​​of the plurality of access behavior features;

[0036] A score fusion module, used for obtaining a cumulative data theft anomaly index according to the current anomaly score and the historical anomaly score of the detection object;

[0037] The anomaly detection module is used to determine the cumulative number theft behavior detection result of the detection object according to the cumulative number theft anomaly index.

[0038] In a third aspect, the present application further provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0039] Obtain access data of the detection object in the current time period;

[0040] Extracting features from the access data according to a preset time granularity to obtain feature values ​​of multiple access behavior features of the detection object;

[0041] Determining a current anomaly score of the detection object according to the feature values ​​of the multiple access behavior features;

[0042] Obtaining a cumulative data theft anomaly index according to the current anomaly score and the historical anomaly score of the detection object;

[0043] The cumulative number theft behavior detection result of the detection object is determined according to the cumulative number theft abnormality index.

[0044] In a fourth aspect, the present application further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0045] Obtain access data of the detection object in the current time period;

[0046] Extracting features from the access data according to a preset time granularity to obtain feature values ​​of multiple access behavior features of the detection object;

[0047] Determining a current anomaly score of the detection object according to the feature values ​​of the multiple access behavior features;

[0048] Obtaining a cumulative data theft anomaly index according to the current anomaly score and the historical anomaly score of the detection object;

[0049] The cumulative number theft behavior detection result of the detection object is determined according to the cumulative number theft abnormality index.

[0050] In a fifth aspect, the present application further provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0051] Obtain access data of the detection object in the current time period;

[0052] Extracting features from the access data according to a preset time granularity to obtain feature values ​​of multiple access behavior features of the detection object;

[0053] Determining a current anomaly score of the detection object according to the feature values ​​of the multiple access behavior features;

[0054] Obtaining a cumulative data theft anomaly index according to the current anomaly score and the historical anomaly score of the detection object;

[0055] The cumulative number theft behavior detection result of the detection object is determined according to the cumulative number theft abnormality index.

[0056] The above-mentioned cumulative data theft detection method, device, computer equipment, storage medium and computer program product of network traffic extract features of access data of the detection object in the current time period according to a preset time granularity to obtain feature values ​​of the detection object under multiple access behavior features; determine the current anomaly score of the detection object according to the feature values ​​under the multiple access behavior features; obtain a cumulative data theft anomaly index according to the current anomaly score and historical anomaly scores of the detection object; and determine the cumulative data theft behavior detection result of the detection object according to the cumulative data theft anomaly index. This method starts with analyzing the network access behavior of the detection object, and detects potential cumulative data theft behaviors through feature extraction and multi-feature anomaly detection methods, which can realize effective detection of suspected cumulative data theft behaviors that may exist in network traffic data, and solves the technical problems that most current traffic detection methods only focus on highly sensitive data, have a short detection time period, a single detection behavior feature, and lack effective detection methods for suspected cumulative data theft behaviors that may exist in network traffic data; and, by combining access behavior features with time granularity to generate multiple detection feature selection methods that are closely related to cumulative data theft, the cumulative effect of time and the diversity of data theft behaviors are taken into account, and the access behavior of the detection object is evaluated from a more comprehensive perspective, which can improve the accuracy of identifying the data theft behaviors of the detection object. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 A schematic diagram of a flow chart of a method for detecting cumulative data theft of network traffic in one embodiment;

[0058] Figure 2 A schematic diagram of a flow chart of a step of determining an abnormality score of a detection object in one embodiment;

[0059] Figure 3 A schematic flow chart of a step of determining a cumulative theft anomaly index in one embodiment;

[0060] Figure 4 is a flow chart of a method for detecting cumulative data theft of network traffic in another embodiment;

[0061] Figure 5 It is a structural block diagram of a device for detecting cumulative data theft of network traffic in one embodiment;

[0062] Figure 6 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0063] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0064] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein.

[0065] Accumulation of data voyeur refers to the behavior of risk subjects to pull system data through multiple channels, long-term, and large-volume networks, which may lead to data security risks such as information leakage. For business systems of enterprises in different fields, intruders will not only steal very confidential business information through network attacks, but sometimes pull some data that is not very important individually, but can be analyzed to obtain key information of the business system after the data volume accumulates to a certain extent. Therefore, it is very necessary to prevent the accumulation of data voyeur attacks by intruders. However, most of the current data security defense methods and technologies focus on protecting the data security of key data and sensitive data, and often ignore the huge cumulative effect of relatively non-critical data.

[0066] Based on this, the present application proposes a multi-feature anomaly detection algorithm combined with time granularity. Starting from the network access behavior of the detection object, a large number of features of the access behavior of the detection object over a long period of time are extracted and processed, and the risk score of the detection object within the time period is obtained by using the anomaly detection algorithm. An appropriate threshold is set to determine whether there is a suspected cumulative theft risk, and the performance and evidence of the network access behavior of the object detected with the risk are extracted and displayed. In addition, an anomaly monitoring device based on this algorithm model is designed, which can effectively detect possible cumulative theft behavior in the network traffic monitoring system.

[0067] In one embodiment, Figure 1 As shown, a method for detecting cumulative theft of network traffic is provided. This embodiment uses the method applied to a server as an example. It can be understood that the method can also be applied to a terminal, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. Among them, the terminal can be but is not limited to various personal computers, laptops, smart phones, and tablet computers. The server can be implemented as an independent server or a server cluster composed of multiple servers. In this embodiment, the method includes the following steps:

[0068] Step S110, obtaining access data of the detection object in the current time period.

[0069] Among them, the detection object refers to the subject of access behavior of network traffic data, such as the source IP and account number in the traffic storage log.

[0070] Specifically, the log record audit table of the network traffic data of the detection object in the current time period can be collected as the original access data. The original access data is further preprocessed to obtain access data to ensure the integrity and consistency of the data and improve the data quality. The preprocessing may include at least one of data cleaning, attribute alignment, and filling in missing data.

[0071] For example, set the time period to one week, determine the start time and end time of this period (for example, from 00:00 every Monday to 00:00 next Monday). Collect and obtain the log record audit table of network traffic data as the original access data, perform data cleaning, store access record attributes in the specified format, fill in missing values ​​and blank values ​​to keep the data format consistent for subsequent analysis.

[0072] In some embodiments, the detection object can be determined in the following manner: obtaining access data of multiple candidate detection objects within the current time period; counting the number of access records of each candidate detection object based on the access data of each candidate detection object; and screening out the candidate detection objects whose number of access records is greater than a threshold from the multiple candidate detection objects as the detection objects.

[0073] Specifically, the number of access records of multiple candidate detection objects in the current time period can be counted, and the threshold can be set to filter out the detection objects with low access volume in the current time period, and other detection objects with access records greater than the threshold can be screened for subsequent inspection. For example, set the threshold N=1000, count the number of access records of all source IPs in the audit log in the current time period, filter the source IPs with less than 1000 access records, and record the remaining source IPs for subsequent analysis.

[0074] Step S120 , extracting features from the access data according to a preset time granularity to obtain feature values ​​of multiple access behavior features of the detection object.

[0075] The preset time granularity may be full time, working time, night time, weekdays, and rest days, etc.

[0076] Among them, the access behavior characteristics can be the number of access records, the amount of data pulled, the number of APIs accessed, the number of IP addresses accessed, the number of cities where the source IP addresses (i.e., the detection objects) are located, the number of data labels returned, etc.

[0077] In a specific implementation, feature extraction is performed on access data at each time granularity to obtain feature values ​​of multiple access behavior features of the detection object at different time granularities.

[0078] In this step, multiple access behavior features of the detection object are combined with the time granularity to more comprehensively analyze the access behavior of the detection object.

[0079] Step S130, determining a current abnormality score of the detection object according to the feature values ​​of the plurality of access behavior features.

[0080] In a specific implementation, each access behavior feature can be weighted, and the feature values ​​of each access behavior feature can be weighted according to the target weight of each access behavior feature to obtain multiple weighted access behavior features. Multiple weighted access behavior features can be used to perform multi-feature anomaly detection to determine the current anomaly score of the detection object in the current time period.

[0081] Specifically, the anomaly detection model can be used to perform multi-feature anomaly detection on each weighted access behavior feature. For example, the anomaly detection model can be built based on methods such as Linear Regression (LR), Isolation Forest (IForest), Principal Component Analysis (PCA), and One-Class Support Vector Machine (OCSVM).

[0082] Furthermore, in some embodiments, after obtaining the current anomaly score, the anomaly score may be converted into a numerical value between 0 and 100 through transformation to enhance the readability and comparability of the anomaly score.

[0083] Step S140, obtaining a cumulative data theft anomaly index according to the current anomaly score and the historical anomaly score of the detected object.

[0084] In a specific implementation, the current anomaly score and the historical anomaly score of the detected object can be aggregated by a weighted method to obtain a cumulative theft anomaly index. Specifically, a first weight can be assigned to the current time period, and a second weight can be assigned to each historical time period; according to the first weight and the second weight, the current anomaly score and the historical anomaly score of each historical time period are weighted and aggregated to obtain a cumulative theft anomaly index. Among them, the first weight is greater than the second weight, and the weight of the historical time period is negatively correlated with the time distance of the historical time period relative to the current time period.

[0085] In this step, by comparing the historical anomaly scores of historical event cycles, the abnormal behavior trend of the detection object can be identified and evaluated, and the accuracy of the cumulative theft anomaly index can be enhanced.

[0086] Step S150, determining the cumulative number theft behavior detection result of the detection object according to the cumulative number theft abnormality index.

[0087] In a specific implementation, a suitable index threshold can be set to determine whether the detected object has suspected cumulative theft behavior. For example, the index threshold is set to 80. If the cumulative theft abnormality index is greater than the index threshold 80, it is determined that the detected object has suspected cumulative theft behavior. Otherwise, it is determined that there is no cumulative theft behavior.

[0088] Further, in some embodiments, after determining that the detected object has suspected cumulative theft behavior according to the cumulative theft anomaly index, the access behavior of the detected object can be traced and forensics can be obtained to display the changing trend of the anomaly index of the detected object in multiple time periods. For example, a line graph can be used to display the time series of the abnormal index changes of the detected object in multiple time periods. Extract several significant access behavior features that contribute most to the abnormal index of the detected object. For example, the ten significant features that contribute most to the abnormal index of the detected object can be found by calculating the product of the feature weight and the feature value. Compare and evaluate these significant features with the corresponding features of other detected objects and display them in a histogram. The original attributes of these significant features (such as access API, access destination IP, location, etc.) are traced and forensics are obtained by querying the traffic log audit table, and the access behavior data of the detected object is recorded. This embodiment performs risk forensics and data tracing on the detected object that is suspected of cumulative theft behavior. On the one hand, it intuitively displays the abnormal access behavior of the risk object, and on the other hand, it provides a reference for further in-depth analysis of whether the risk object has abnormal behavior.

[0089] In the above-mentioned cumulative theft detection method of network traffic, according to the preset time granularity, the access data of the detection object in the current time period is feature extracted to obtain the feature value of the detection object under multiple access behavior features; according to the feature values ​​under multiple access behavior features, the current anomaly score of the detection object is determined; according to the current anomaly score and historical anomaly score of the detection object, the cumulative theft anomaly index is obtained; according to the cumulative theft anomaly index, the cumulative theft behavior detection result of the detection object is determined. Starting from the analysis of the network access behavior of the detection object, the method detects the potential cumulative theft behavior through feature extraction and multi-feature anomaly detection methods, which can realize the effective monitoring of the suspected cumulative theft behavior that may exist in the network traffic data, and solves the technical problems that most current traffic detection methods only focus on highly sensitive data, have a short detection time period, a single detection behavior feature, and lack an effective detection method for the suspected cumulative theft behavior that may exist in the network traffic data; and, by combining the access behavior feature with the time granularity to generate multiple detection feature selection methods that are closely related to the cumulative theft, the cumulative effect of time and the diversity of theft behavior are considered, and the access behavior of the detection object is evaluated from a more comprehensive perspective, which can improve the accuracy of identifying the theft behavior of the detection object.

[0090] In an exemplary embodiment, there are multiple detection objects, and the above step S130 determines the current abnormality score of the detection object according to the feature values ​​of multiple access behavior features, including:

[0091] Step S131, obtaining the target weight of each access behavior feature in the current time period;

[0092] Step S132 , for each detection object, weighted aggregation processing is performed on the feature values ​​of each access behavior feature of the detection object according to the target weight to obtain the current anomaly score of the detection object.

[0093] In the specific implementation, the larger the characteristic value of the access behavior feature, the higher the degree of abnormality. The linear regression model can be used to determine the current abnormality score of each detection object in the current time period. In other words, by assigning weights to each access behavior feature, for each detection object, the target weight of each access behavior feature in the current time period is used to perform weighted aggregation processing on the characteristic values ​​of each access behavior feature of the detection object to obtain the current abnormality score of the detection object, which can be expressed as:

[0094]

[0095] in, represents the current anomaly score of any detected object, Indicates access behavior characteristics The target weight, Indicates access behavior characteristics The characteristic value of Indicates the total number of access behavior features, is the index, Set to 1.

[0096] Furthermore, in some embodiments, in order to intuitively reflect the abnormality degree of the detected object, the current abnormality score may be transformed to a numerical value SC between 0 and 100. The transformation process may be expressed by the following formula:

[0097] .

[0098] In this embodiment, by assigning different weights to each access behavior feature, weighted aggregation processing is performed on the feature values ​​of each access behavior feature of the detection object according to the target weight to obtain the current anomaly score of the detection object, so that the obtained anomaly score can more accurately reflect the actual abnormal situation, thereby improving the accuracy and effectiveness of detection.

[0099] In an exemplary embodiment, the above step S131 obtains the target weight of each access behavior feature in the current time period, including: obtaining the initial weight of each access behavior feature; for each access behavior feature, according to the distribution information of the characteristic values ​​of each detection object on the access behavior feature in the current time period, updating the initial weight of the access behavior feature to obtain the target weight.

[0100] In the specific implementation, the target weight assigned to each access behavior feature can be obtained by iteration based on the initial weight. First, the importance of each access behavior feature in the cumulative theft behavior is analyzed based on experience and historical data, so as to assign an initial weight to each access behavior feature. , and make the sum of weights equal to 1, that is Then, for each access behavior feature, the weight of the access behavior feature is updated according to the distribution information of the feature values ​​of each detection object on the access behavior feature in the current time period, and finally the updated weight is multiplied by the same coefficient to keep the sum of the weights unchanged.

[0101] Further, in an exemplary embodiment, based on the distribution information of the characteristic values ​​of the access behavior characteristics of each detection object in the current time period, the initial weight of the access behavior characteristics is updated to obtain the target weight, including: when it is determined according to the distribution information that the distribution difference of the access behavior characteristics of each detection object is greater than a first threshold, the initial weight of the access behavior characteristics is increased to obtain the target weight; when it is determined according to the distribution information that the distribution difference of the access behavior characteristics of each detection object is less than a second threshold, the initial weight of the access behavior characteristics is reduced to obtain the target weight.

[0102] In a specific implementation, according to the distribution information of the characteristic values ​​of the access behavior characteristics of each detection object in the current time period, the principle of updating the initial weight of the access behavior characteristics is: increase the weight of the access behavior characteristics with large distribution differences, and reduce the weight corresponding to the access behavior characteristics with small distribution differences. That is, when it is determined according to the distribution information that the distribution difference of the access behavior characteristics of each detection object is greater than the first threshold, the initial weight of the access behavior characteristics is increased; when it is determined according to the distribution information that the distribution difference of the access behavior characteristics of each detection object is less than the second threshold, the initial weight of the access behavior characteristics is reduced.

[0103] Specifically, the weight update process of each access behavior feature can be expressed as:

[0104]

[0105]

[0106] in, Indicates Among the access behavior characteristics Large eigenvalues, Indicates The initial weight of the access behavior feature, Indicates the target weight of each access behavior feature.

[0107] In the above embodiment, the initial weight of each access behavior feature is updated based on the distribution information of the feature values ​​of each detection object on each access behavior feature in the current time period in a manner of increasing the weight of access behavior features with large distribution differences and decreasing the weight of access behavior features with small distribution differences. This processing method of iteratively updating the weights of access behavior features using attenuation factors can improve the accuracy of subsequent anomaly detection results.

[0108] In an exemplary embodiment, if Figure 2As shown, in the above step S132, according to the target weight, the feature values ​​of each access behavior feature of the detection object are weighted and aggregated to obtain the current anomaly score of the detection object, including:

[0109] Step S210, determining the first type of features and the second type of features in each access behavior feature; the first type of features are features where the magnitude difference of the feature values ​​of different detection objects under this type of features is greater than a difference threshold, and the second type of features are features where the magnitude difference of the feature values ​​of different detection objects under this type of features is less than the difference threshold;

[0110] Step S220, performing feature conversion processing on the feature values ​​of the first type of features and the feature values ​​of the second type of features respectively to obtain first converted feature values ​​and second converted feature values;

[0111] Step S230, obtaining processed feature values ​​of each access behavior feature based on the first conversion feature value and the second conversion feature value;

[0112] Step S240 , performing weighted aggregation processing on the processed feature values ​​of each access behavior feature according to the target weight, to obtain the current anomaly score of the detection object.

[0113] In the specific implementation, considering the differences between different detection objects in the same access behavior feature, feature processing is required before weighted aggregation of the feature values ​​of each access behavior feature of the detection object. Specifically, first determine from each access behavior feature the features whose magnitude difference of the feature values ​​of different detection objects under this type of feature is greater than the difference threshold, as the first type of feature, and determine the features whose magnitude difference of the feature values ​​of different detection objects under this type of feature is less than the difference threshold, as the second type of feature. For the first type of feature and the second type of feature, different feature conversion methods are used to perform feature conversion processing, respectively, to obtain the first conversion feature value and the second conversion feature value, and the first conversion feature value and the second conversion feature value are used as the processed feature values ​​of each access behavior feature. Finally, all the processed feature values ​​are normalized and scaled to the interval [0, 1] for subsequent analysis. According to the target weight, each normalized feature value is weighted and aggregated to obtain the current anomaly score of the detection object.

[0114] Further, in an exemplary embodiment, feature conversion processing is performed on the feature values ​​of the first category of features to obtain first converted feature values, including: determining the maximum feature value of each detection object under the first category of features, and performing feature conversion processing on the feature values ​​of each detection object under the first category of features based on the maximum feature value to obtain the first converted feature value of each detection object under the first category of features.

[0115] In the specific implementation, considering that different detection objects have order of magnitude differences in the feature values ​​of the first type of features, feature processing is required to compress the feature differences. Specifically, the first type of features may include multiple access behavior features. For any access behavior feature in the first type of features, the maximum feature value of each detection object under the access behavior feature can be determined. Based on all feature values ​​of each detection object under the access behavior feature and the maximum feature value, the first conversion feature value of each detection object under the access behavior feature is determined. The specific conversion process can be expressed by the formula:

[0116]

[0117] in, and Respectively represent any access behavior feature of any detection object in the first category of features (for example ) and the eigenvalues ​​before transformation, Indicates the access behavior characteristics of each detection object The maximum eigenvalue under .

[0118] In some embodiments, feature conversion processing is performed on the feature values ​​of the second category of features to obtain second converted feature values, including: determining the average feature value of each detection object under the second category of features, and performing feature conversion processing on the feature values ​​of each detection object under the second category of features based on the average feature value to obtain the second converted feature value of each detection object under the second category of features.

[0119] In a specific implementation, the second type of features may also include multiple access behavior features. For any access behavior feature in the second type of features, , for each detection object in the access behavior characteristics The feature values ​​under the condition are averaged to obtain the average feature value. For any detection object c, use the detection object c in the access behavior feature The eigenvalue under the condition is subtracted from the average eigenvalue, and the absolute value of the difference is used as the access behavior feature of the detection object c. The second conversion eigenvalue under . It can be expressed by the formula: ,in, is the mean eigenvalue.

[0120] It can be understood that in some embodiments, in addition to being divided into first-category features and second-category features, each access behavior feature can also be divided into other features, and another feature conversion method (such as regularization processing) can be used for feature conversion, which is not specifically limited in this application.

[0121] In the above embodiment, feature engineering is performed on the obtained access features, the access behavior features are normalized, the differences in behavior features among the behavior subjects are highlighted, and the behavior features can better reflect the abnormality of the access behavior; and through feature engineering of the access behavior features, the first type of features are processed by compressing the feature order of magnitude, and the second type of features are processed by subtracting the average feature value, so that the obtained model detection results are more interpretable.

[0122] In an exemplary embodiment, the historical anomaly score includes anomaly scores for multiple historical time periods; Figure 3 As shown, the above step S140 obtains the cumulative data theft anomaly index according to the current anomaly score and the historical anomaly score of the detected object, including:

[0123] Step S310, obtaining the first weight of the current time period and the second weight of each historical time period;

[0124] Step S320: Perform weighted aggregation processing on the current anomaly score and the historical anomaly scores of each historical time period according to the first weight and the second weight to obtain a cumulative data theft anomaly index.

[0125] In the specific implementation, the first weight is greater than the second weight, and the weight of the historical time period is negatively correlated with the distance of the historical time period from the current time period. In other words, the closer to the current time, the greater the weight, and the farther from the current time, the smaller the weight. For example, if the current time period is , the previous 5 time periods were , then the weight of each time period can be set as: According to the first weight of the current time period and the second weight of each historical time period, the current anomaly score and the historical anomaly scores of each historical time period are weighted and aggregated to obtain the cumulative theft anomaly index, which can be expressed as:

[0126]

[0127] in, It is object detection forward The anomaly score for each time period, Indicates the anomaly score of the current time period. If the detection object is not within the detection range of the model within a certain time period, the anomaly score is 0.

[0128] In this embodiment, when determining the cumulative number theft anomaly index of the current time period, in addition to using the anomaly score of the current time period, the anomaly scores of previous periods are also combined for calculation. This method of combining the anomaly scores of the current time period and the historical time period to calculate the cumulative number theft anomaly index of the detection object in the current time period is equivalent to increasing the time range of detection and taking into account the attenuation effect of time. The weight is determined according to the principle that the closer the distance to the current time is, the greater the weight, and the farther the distance to the current time is, the smaller the weight. This can further improve the accuracy of the determined cumulative number theft anomaly index and improve the reliability of subsequent detection results.

[0129] The method proposed in this application can be applied in a flow data risk monitoring system to detect suspected cumulative data theft behavior of source IP in network traffic data. Data flow detection refers to the process of real-time monitoring and analysis of data flows in the network and collecting information about how data flows in the network. Its purpose is to obtain the propagation path and trend of data at all levels in the process and detect possible abnormal behaviors such as data leakage and data forgery.

[0130] In one embodiment, in order to facilitate those skilled in the art to understand the embodiments of the present application, the following will be combined with the attached Figure 4 , further illustrating the present application. This embodiment includes the following steps:

[0131] Step S401, obtaining access data of multiple candidate detection objects in the current time period;

[0132] Step S402, counting the number of access records of each candidate detection object according to the access data of each candidate detection object;

[0133] Step S403, screening out multiple detection objects whose number of access records is greater than a threshold from multiple candidate detection objects;

[0134] Step S404, for each detection object, extracting features from the access data according to a preset time granularity to obtain feature values ​​of multiple access behavior features of the detection object;

[0135] Step S405, for each access behavior feature, according to the distribution information of the feature values ​​of each detection object on the access behavior feature in the current time period, the initial weight of the access behavior feature is updated to obtain the target weight;

[0136] Step S406, determining the first type of features and the second type of features in each access behavior feature; the first type of features are features where the magnitude difference of the feature values ​​of different detection objects under this type of features is greater than the difference threshold, and the second type of features are features where the magnitude difference of the feature values ​​of different detection objects under this type of features is less than the difference threshold;

[0137] Step S407, performing feature conversion processing on the feature values ​​of the first type of features and the feature values ​​of the second type of features respectively to obtain first converted feature values ​​and second converted feature values;

[0138] Step S408, obtaining processed feature values ​​of each access behavior feature based on the first conversion feature value and the second conversion feature value;

[0139] Step S409, performing weighted aggregation processing on the processed feature values ​​of each access behavior feature according to the target weight, to obtain the current anomaly score of the detection object;

[0140] Step S410, based on the first weight of the current time period and the second weight of each historical time period, the current anomaly score and the historical anomaly scores of each historical time period are weighted and aggregated to obtain a cumulative data theft anomaly index; the first weight is greater than the second weight, and the weight of the historical time period is negatively correlated with the time distance of the historical time period relative to the current time period;

[0141] Step S411, tracing the access behavior of the detection object and collecting evidence, showing the change trend of the abnormal index of the detection object in multiple time periods.

[0142] The method proposed in this application solves the problem that most current traffic detection methods only focus on highly sensitive data, have a short detection time period, have a single detection behavior feature, and lack an effective detection method for suspected cumulative theft behaviors that may exist in network traffic data. Starting from analyzing the network access behavior of the subject of the behavior, the potential cumulative theft behavior is detected through feature engineering and multi-feature anomaly detection methods, taking into account the cumulative effect of time and the diversity of theft behaviors, evaluating the access behavior of the subject of the behavior from a more comprehensive perspective, and improving the accuracy of the model in identifying the theft behavior of the subject of the behavior. Risk forensics and data traceability are carried out on risk objects that are suspected of cumulative theft behaviors identified by the model. On the one hand, the abnormal access behavior of the risk object is intuitively displayed, and on the other hand, a reference is provided for further in-depth analysis of whether the risk object has abnormal behavior.

[0143] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0144] Based on the same inventive concept, the embodiment of the present application also provides a network traffic cumulative theft detection device for implementing the above-mentioned network traffic cumulative theft detection method. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above-mentioned method, so the specific limitations in the embodiments of one or more network traffic cumulative theft detection devices provided below can refer to the limitations of the network traffic cumulative theft detection method above, and will not be repeated here.

[0145] In one embodiment, Figure 5 As shown, a cumulative theft detection device for network traffic is provided, comprising:

[0146] The data acquisition module 510 is used to acquire the access data of the detection object in the current time period;

[0147] The feature extraction module 520 is used to extract features from the access data according to a preset time granularity to obtain feature values ​​of multiple access behavior features of the detection object;

[0148] A score determination module 530, for determining a current abnormal score of a detection object according to feature values ​​of a plurality of access behavior features;

[0149] The score fusion module 540 is used to obtain a cumulative data theft anomaly index based on the current anomaly score and the historical anomaly score of the detected object;

[0150] The anomaly detection module 550 is used to determine the cumulative theft behavior detection result of the detection object according to the cumulative theft anomaly index.

[0151] In one of the embodiments, there are multiple detection objects, and the score determination module 530 is also used to obtain the target weight of each access behavior feature in the current time period; for each detection object, according to the target weight, the feature values ​​of each access behavior feature of the detection object are weighted and aggregated to obtain the current anomaly score of the detection object.

[0152] In one of the embodiments, the score determination module 530 is also used to obtain the initial weight of each access behavior feature; for each access behavior feature, the initial weight of the access behavior feature is updated according to the distribution information of the feature values ​​of each detection object on the access behavior feature in the current time period to obtain the target weight.

[0153] In one of the embodiments, the score determination module 530 is also used to increase the initial weight of the access behavior feature to obtain the target weight when it is determined based on the distribution information that the distribution difference of the access behavior feature of each detection object is greater than a first threshold value; and to reduce the initial weight of the access behavior feature to obtain the target weight when it is determined based on the distribution information that the distribution difference of the access behavior feature of each detection object is less than a second threshold value.

[0154] In one embodiment, the score determination module 530 is also used to determine the first type of features and the second type of features in each access behavior feature; the first type of features are features in which the order of magnitude difference of the feature values ​​of different detection objects under this type of features is greater than the difference threshold, and the second type of features are features in which the order of magnitude difference of the feature values ​​of different detection objects under this type of features is less than the difference threshold; feature conversion processing is performed on the feature values ​​of the first type of features and the feature values ​​of the second type of features respectively to obtain first conversion feature values ​​and second conversion feature values; based on the first conversion feature values ​​and the second conversion feature values, the processed feature values ​​of each access behavior feature are obtained; according to the target weight, the processed feature values ​​of each access behavior feature are weighted and aggregated to obtain the current abnormality score of the detection object.

[0155] In one embodiment, the score determination module 530 is also used to determine the maximum eigenvalue of each detection object under the first category of features, and perform feature conversion processing on the eigenvalue of each detection object under the first category of features based on the maximum eigenvalue to obtain the first converted eigenvalue of each detection object under the first category of features; determine the average eigenvalue of each detection object under the second category of features, and perform feature conversion processing on the eigenvalue of each detection object under the second category of features based on the average eigenvalue to obtain the second converted eigenvalue of each detection object under the second category of features.

[0156] In one of the embodiments, the historical anomaly score includes anomaly scores of multiple historical time periods; the score fusion module 540 is further used to obtain a first weight of the current time period and a second weight of each historical time period; the first weight is greater than the second weight, and the weight of the historical time period is negatively correlated with the time distance of the historical time period relative to the current time period; according to the first weight and the second weight, the current anomaly score and the historical anomaly scores of each historical time period are weighted and aggregated to obtain a cumulative theft anomaly index.

[0157] Each module in the above-mentioned network traffic cumulative theft detection device can be implemented in whole or in part by software, hardware and their combination. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the corresponding operations of each of the above modules.

[0158] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 6 As shown. The computer device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data in the cumulative theft detection process of network traffic. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a cumulative theft detection method of network traffic is implemented.

[0159] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0160] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0161] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0162] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0163] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0164] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0165] The technical features of the above embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0166] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for detecting cumulative data theft of network traffic, characterized in that: The method comprises: Obtain access data of the detection object in the current time period; Extracting features from the access data according to a preset time granularity to obtain feature values ​​of multiple access behavior features of the detection object; Determining a current anomaly score of the detection object according to the feature values ​​of the multiple access behavior features; Obtaining a cumulative data theft anomaly index according to the current anomaly score and the historical anomaly score of the detection object; The cumulative number theft behavior detection result of the detection object is determined according to the cumulative number theft abnormality index.

2. The method according to claim 1, characterized in that There are multiple detection objects, and determining the current anomaly score of the detection object according to the feature values ​​of the multiple access behavior features includes: Obtaining target weights of each of the access behavior features in the current time period; For each detection object, according to the target weight, weighted aggregation processing is performed on the feature values ​​of each access behavior feature of the detection object to obtain a current anomaly score of the detection object.

3. The method according to claim 2, characterized in that The obtaining of the target weight of each of the access behavior features in the current time period includes: Obtaining initial weights of each of the access behavior features; For each access behavior feature, the initial weight of the access behavior feature is updated according to the distribution information of the feature values ​​of each detection object on the access behavior feature in the current time period to obtain the target weight.

4. The method according to claim 3, characterized in that The updating of the initial weight of the access behavior feature according to the distribution information of the feature value of each detection object on the access behavior feature in the current time period to obtain the target weight includes: When it is determined according to the distribution information that the distribution difference of the access behavior characteristics of the respective detection objects is greater than a first threshold, increasing the initial weight of the access behavior characteristics to obtain the target weight; When it is determined according to the distribution information that the distribution difference of each detection object in the access behavior feature is less than a second threshold, the initial weight of the access behavior feature is reduced to obtain the target weight.

5. The method according to claim 2, characterized in that: The step of performing weighted aggregation processing on the feature values ​​of each access behavior feature of the detection object according to the target weight to obtain the current anomaly score of the detection object includes: Determine a first type of feature and a second type of feature in each of the access behavior features; the first type of feature is a feature where the magnitude difference of feature values ​​of different detection objects under this type of feature is greater than a difference threshold, and the second type of feature is a feature where the magnitude difference of feature values ​​of different detection objects under this type of feature is less than the difference threshold; Performing feature conversion processing on the feature values ​​of the first type of features and the feature values ​​of the second type of features respectively to obtain first converted feature values ​​and second converted feature values; Based on the first conversion feature value and the second conversion feature value, obtaining a processed feature value of each access behavior feature; According to the target weight, weighted aggregation processing is performed on the processed feature values ​​of the various access behavior features to obtain a current anomaly score of the detection object.

6. The method according to claim 5, characterized in that Performing feature conversion processing on the feature values ​​of the first type of features to obtain first converted feature values ​​includes: Determine the maximum eigenvalue of each detected object under the first type of features, and perform feature conversion processing on the eigenvalue of each detected object under the first type of features based on the maximum eigenvalue to obtain a first converted eigenvalue of each detected object under the first type of features; Performing feature conversion processing on the feature values ​​of the second type of features to obtain second converted feature values ​​includes: Determine the average feature value of each detection object under the second type of features, and perform feature conversion processing on the feature value of each detection object under the second type of features based on the average feature value to obtain a second converted feature value of each detection object under the second type of features.

7. The method according to claim 1, characterized in that The historical anomaly score includes anomaly scores of multiple historical time periods; the cumulative data theft anomaly index is obtained according to the current anomaly score and the historical anomaly score of the detection object, including: Obtaining a first weight of the current time period and a second weight of each of the historical time periods; wherein the first weight is greater than the second weight, and the weight of the historical time period is negatively correlated with the time distance of the historical time period relative to the current time period; According to the first weight and the second weight, weighted aggregation processing is performed on the current anomaly score and the historical anomaly scores of each of the historical time periods to obtain the cumulative data theft anomaly index.

8. A device for detecting cumulative data theft of network traffic, characterized in that: The device comprises: A data acquisition module is used to acquire access data of the detection object in the current time period; A feature extraction module, used to extract features from the access data according to a preset time granularity to obtain feature values ​​of multiple access behavior features of the detection object; a score determination module, configured to determine a current abnormal score of the detection object according to the feature values ​​of the plurality of access behavior features; A score fusion module, used for obtaining a cumulative data theft anomaly index according to the current anomaly score and the historical anomaly score of the detection object; The anomaly detection module is used to determine the cumulative number theft behavior detection result of the detection object according to the cumulative number theft anomaly index.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the cumulative theft detection method for network traffic according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the cumulative theft detection method for network traffic according to any one of claims 1 to 7 are implemented.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the cumulative data theft detection method for network traffic according to any one of claims 1 to 7 are implemented.

Images