Attack behavior detection method and device, product, equipment and medium

Abstract

The invention discloses an attack behavior detection method and device, a product, equipment and a medium. The method comprises the following steps: collecting user interaction behavior data of a service platform; clustering user interaction behavior data of a target service in the business platform in a preset time window based on a preset dimension to obtain clustering data corresponding to different dimension values of the target service under the preset dimension; determining the number of user interaction behaviors of the different dimension values in the preset time window based on the clustering data; based on the number of the user interaction behaviors, whether the user interaction behaviors corresponding to the target dimension value are attack behaviors or not is judged, and the target dimension value is the dimension value under the preset dimension. Therefore, attack judgment is carried out based on the number of the user interaction behaviors, the abnormal dimension value of the user interaction behaviors in the preset time window can be detected in time, the attack behaviors can be detected in time, the safety of a service platform is improved, and normal operation of the service platform is guaranteed.

Description

Technical Field

[0001] The present application relates to the technical field of attack behavior detection, and in particular to an attack behavior detection method, device, product, equipment and medium. Background Art

[0002] With the development of computer technology, all industries have built their own business platforms to achieve business management and operation. However, the business platform is at risk of being maliciously attacked to collect information, which seriously threatens the normal operation of the business platform. Therefore, how to detect attack behaviors in time from numerous user behaviors and ensure the normal operation of the business platform is a problem that needs to be solved at present. Summary of the invention

[0003] In view of this, the purpose of this application is to provide an attack behavior detection method, device, product, equipment and medium, which can detect attack behaviors in a timely manner, improve the security of the business platform, and ensure the normal operation of the business platform. The specific plan is as follows:

[0004] In a first aspect, the present application discloses an attack behavior detection method, comprising:

[0005] Collect user interaction behavior data on the business platform;

[0006] Clustering the user interaction behavior data of the target service in the business platform within a preset time window based on a preset dimension to obtain clustering data corresponding to different dimension values ​​of the target service under the preset dimension;

[0007] Determine the number of user interaction behaviors of the different dimension values ​​in the preset time window based on the clustering data;

[0008] Based on the number of user interaction behaviors, it is determined whether the user interaction behavior corresponding to the target dimension value is an attack behavior, wherein the target dimension value is a dimension value under the preset dimension.

[0009] Optionally, the preset dimension includes one or more dimensions consisting of IP, device and user agent.

[0010] Optionally, before judging whether the user interaction behavior corresponding to the target dimension value is an attack behavior based on the number of user interaction behaviors, the method further includes:

[0011] Sorting the number of user interaction behaviors of different dimension values ​​in the preset time window to obtain a sorting result;

[0012] Based on the sorting results, the dimension value with the highest number of user interaction behaviors is selected according to a preset ratio or a preset number as the target dimension value.

[0013] Optionally, judging whether the user interaction behavior corresponding to the target dimension value is an attack behavior based on the number of user interaction behaviors includes:

[0014] Comparing the number of user interaction behaviors with a preset number threshold;

[0015] If the number of user interaction behaviors is greater than the preset threshold, the corresponding warning information will be sent to the security personnel terminal so that the security personnel can confirm whether the user interaction behavior corresponding to the target dimension value is an attack behavior.

[0016] Optionally, also include:

[0017] When the triggering times of the warning information reaches a preset threshold, the user interaction behavior corresponding to the target dimension value is determined to be an attack behavior.

[0018] Optionally, the business platform is a charging business platform, and the target service includes one or more of a power station search service, a power station list service, a power station price query service, and a power station detail maintenance service.

[0019] In a second aspect, the present application discloses an attack behavior detection device, comprising:

[0020] Data collection module, used to collect user interaction behavior data of the business platform;

[0021] A data clustering module, used to cluster the user interaction behavior data of the target service in the business platform within a preset time window based on a preset dimension, and obtain clustering data corresponding to different dimension values ​​of the target service under the preset dimension;

[0022] A quantity determination module, used to determine the quantity of user interaction behaviors of the different dimension values ​​in the preset time window based on the clustering data;

[0023] An attack judgment module is used to judge whether the user interaction behavior corresponding to the target dimension value is an attack behavior based on the number of user interaction behaviors, wherein the target dimension value is the dimension value under the preset dimension.

[0024] In a third aspect, the present application discloses a computer program product, which implements the aforementioned attack behavior detection method when executed.

[0025] In a fourth aspect, the present application discloses an electronic device, including a memory and a processor, wherein:

[0026] The memory is used to store the computer program;

[0027] The processor is used to execute the computer program to implement the aforementioned attack behavior detection method.

[0028] In a fifth aspect, the present application discloses a computer-readable storage medium for storing a computer program, wherein the computer program implements the aforementioned attack behavior detection method when executed by a processor.

[0029] It can be seen from the above scheme that the present application provides an attack behavior detection method, including: collecting user interaction behavior data of a business platform; clustering the user interaction behavior data of a target service in the business platform within a preset time window based on a preset dimension, and obtaining clustering data corresponding to different dimensional values ​​of the target service under the preset dimension; determining the number of user interaction behaviors of the different dimensional values ​​under the preset time window based on the clustering data; judging whether the user interaction behavior corresponding to the target dimension value is an attack behavior based on the number of user interaction behaviors, wherein the target dimension value is the dimension value under the preset dimension.

[0030] It can be seen that the beneficial effects of this application are: determining the number of user interaction behaviors corresponding to different dimension values ​​of the target service in the business platform within the preset time window and the preset dimension, making attack judgments based on the number of user interaction behaviors, and being able to timely detect the dimension values ​​of abnormal user interaction behaviors within the preset time window, thereby realizing attack behavior judgment. In this way, attack behaviors can be detected in a timely manner, the security of the business platform can be improved, and the normal operation of the business platform can be guaranteed.

[0031] Correspondingly, an attack behavior detection device, product, equipment and readable storage medium provided by the present application also have the above-mentioned technical effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0033] Figure 1 A flow chart of an attack behavior detection method provided in an embodiment of the present application;

[0034] Figure 2 An attack behavior detection architecture diagram provided for an embodiment of the present application;

[0035] Figure 3 A schematic diagram of early warning information provided in an embodiment of the present application;

[0036] Figure 4 A schematic diagram of a blocking rule provided in an embodiment of the present application;

[0037] Figure 5 A schematic diagram of the structure of an attack behavior detection device provided in an embodiment of the present application;

[0038] Figure 6 A structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0039] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0040] See also Figure 1 As shown, the embodiment of the present application discloses an attack behavior detection method, including:

[0041] Step S11: Collect user interaction behavior data of the business platform.

[0042] Among them, the business platform can be understood as a system or platform that supports enterprises or organizations to carry out various business activities. The business platform is a comprehensive system that integrates multiple business functions and services and can support the daily operations of enterprises or organizations. User interaction behavior data can be understood as user access data to the business platform, which can include access data to various services in the business platform. Services are functional units in the business platform, and various services collaborate to realize the functions of the business platform.

[0043] In an optional implementation, the user interaction behavior data of the business platform may be collected based on the logs of each service of the business platform.

[0044] In an optional implementation, the business platform can adopt a microservice architecture, where microservices are services in the business platform, and the API (Application Programming Interface) gateway is the entry point for user requests. User interaction behavior data of the business platform can be collected through the API gateway. In other words, the collection of user interaction behavior data can be implemented at the API gateway layer.

[0045] Furthermore, after collecting the user interaction behavior data, the embodiment of the present application can place the user interaction behavior data in a message queue, and other processes consume the data in the queue, thereby executing subsequent steps S12 to S14.

[0046] Step S12: clustering the user interaction behavior data of the target service in the business platform within a preset time window based on a preset dimension, and obtaining clustering data corresponding to different dimension values ​​of the target service under the preset dimension.

[0047] The preset dimension includes one or more dimensions of IP (Internet Protocol), device and user agent. That is, the preset dimension can be one of IP, device and user agent, or a combination of multiple thereof, such as a combination of IP, device and user agent.

[0048] The target service is a service in the business platform that needs to be detected for attack behaviors. For example, the business platform is a charging business platform, and the target service includes one or more of a power station search service, a power station list service, a power station price query service, and a power station detail maintenance service. Among them, the power station search service is a service that responds to the user's power station search, and the power station list service is a service that pushes a power station list to the user, such as a list of nearby power stations. The power station price query service is a service that responds to the user's electricity price query request, and the power station detail maintenance service is a service that maintains the power station details. The power station details can be understood as power station situation description information, including but not limited to the power station location, power station equipment information, power station name, etc.

[0049] The preset time window can be set based on the business, for example, 1 minute. The embodiment of the present application can cluster the data of different dimension values ​​within the preset time window based on the preset dimension. For example, the preset dimension is IP, and different dimension values ​​are different IP values; the preset dimension is device, and different dimension values ​​can be different device identifiers; the preset dimension is user agent, and different dimension values ​​can be different user agent information; the preset dimension value is a combination of IP, device and user agent, and different dimension values ​​can be different combinations of IP, device identifier and user agent. Clustered data can be understood as user interaction behavior data under any dimension value, that is, the user interaction behavior data under the dimension value in the preset time window is clustered into one category.

[0050] In this embodiment, the target service may be determined based on the URL (Uniform Resource Locator) in the request, and then cluster analysis may be performed from dimensions such as IP, device, and user agent.

[0051] Step S13: determining the number of user interaction behaviors of the different dimensional values ​​in the preset time window based on the clustering data.

[0052] The embodiment of the present application can count the number of user interaction behavior data in the cluster data to obtain the number of user interaction behaviors in the preset time window under the corresponding dimension value. For example, under a certain target service, the number of user interaction behaviors of a certain IP value within a certain 1 minute. In this way, the number of user interaction behaviors of different dimension values ​​in the preset time window for each target service is obtained.

[0053] Furthermore, the number of user interaction behaviors of different dimension values ​​in the preset time window can be sorted to obtain a sorting result; based on the sorting result, the dimension value with the highest number of user interaction behaviors can be selected as the target dimension value according to a preset ratio or a preset number.

[0054] It should be noted that an abnormal increase in the number of user interaction behaviors is usually an attack behavior. In the embodiment of the present application, the dimension value with the highest number of user interaction behaviors can be selected according to a preset ratio or a preset number as the target dimension value to reduce the amount of attack behavior judgment data. For example, the top 10 IPs are used as the target dimension value.

[0055] In addition, if the dimension value in the preset dimension is a dimension value that can determine the user identity, the dimension value can be eliminated from the target dimension value. For example, the device ID (identification), the device ID is the device ID registered by a normal user. The embodiment of the present application can exclude this dimension value to avoid judging the user behavior of a normal user as an attack behavior.

[0056] Step S14: Based on the number of user interaction behaviors, determine whether the user interaction behavior corresponding to the target dimension value is an attack behavior, wherein the target dimension value is the dimension value under the preset dimension.

[0057] In an embodiment of the present application, the number of user interaction behaviors can be compared with a preset number threshold; if the number of user interaction behaviors is greater than the preset number threshold, the corresponding warning information will be sent to the security personnel terminal so that the security personnel can confirm whether the user interaction behavior corresponding to the target dimension value is an attack behavior.

[0058] Among them, the preset quantity threshold may be a threshold determined based on historical data analysis. If it is higher than the threshold, an abnormality exists and an early warning is issued.

[0059] Furthermore, when the triggering times of the warning information reaches a preset threshold, the user interaction behavior corresponding to the target dimension value is determined to be an attack behavior.

[0060] It should be noted that if the triggering times of the warning information reaches the preset times threshold, the triggering times are the consecutive triggering times or the triggering times within the recent preset time, such as 10 times in a row or 10 times in the last 12 minutes, the user interaction behavior corresponding to the target dimension value can be determined as an attack behavior.

[0061] In addition, the embodiment of the present application can configure blocking rules after detecting attack behaviors to block attack behaviors of corresponding target dimension values. For example, the corresponding IP or device can be restricted from continuing to access the service platform.

[0062] It can be seen that the embodiment of the present application collects user interaction behavior data of the business platform; clusters the user interaction behavior data of the target service in the business platform within the preset time window based on the preset dimension, and obtains the clustering data corresponding to the different dimension values ​​of the target service under the preset dimension; determines the number of user interaction behaviors of the different dimension values ​​under the preset time window based on the clustering data; judges whether the user interaction behavior corresponding to the target dimension value is an attack behavior based on the number of user interaction behaviors, wherein the target dimension value is the dimension value under the preset dimension. That is, the embodiment of the present application determines the number of user interaction behaviors corresponding to different dimension values ​​of the target service in the business platform within the preset time window and under the preset dimension, and makes attack judgments based on the number of user interaction behaviors, so as to timely detect the dimension values ​​of abnormal user interaction behaviors within the preset time window, thereby realizing attack behavior judgment. In this way, it is possible to detect attack behaviors in a timely manner, improve the security of the business platform, and ensure the normal operation of the business platform.

[0063] The following uses the charging service platform as an example to further illustrate the attack behavior detection solution provided by the present application. The present application embodiment can implement multiple software function modules to implement attack behavior detection. Figure 2 As shown, Figure 2 An attack behavior detection architecture diagram provided for an embodiment of the present application.

[0064] User behavior data collection module: Automatically collect all user interaction data on the charging service platform at the microservice framework level, including but not limited to charging station search records, charging price inquiries, charging behavior patterns, etc., to form a comprehensive user behavior log, and send these logs to a message queue in real time for caching, such as Kafka. Among them, the charging behavior pattern may include the type of device used for charging and the type of client. The client type may include applets, browsers, APPs (Applications), etc.

[0065] Real-time clustering analysis module for vulnerable services: This module consumes data from the aforementioned charging user behavior data message queue through real-time stream computing technology, such as Flink. When consuming data, only the data of vulnerable services (i.e., target services) are retained, such as data of power station search, power station list, power station details, power station price and other services. Then, the data of these services are statistically analyzed from the perspective of quantity according to the URL from dimensions such as IP, device, UserAgent (user agent), and one window of 1 minute. After the analysis is completed, the Top 10 (i.e., the 10 dimension values ​​with the highest number) data are taken for each dimension. For example, the IP values ​​with the most user interaction behaviors are taken. Different services correspond to different URLs. The embodiments of the present application can distinguish different target services based on URLs. Through this single-dimensional statistical analysis, massive user behavior data can be quickly converged into a data set that can calculate the results in real time, and each data set takes the Top 10 data, which greatly reduces the subsequent data storage.

[0066] Vulnerable service security situation awareness: This module is used to display the output results of the above-mentioned vulnerable service real-time clustering analysis module in real time. The clustering analysis results can be viewed in real time from dimensions such as IP, device, UserAgent, and user. The clustering analysis results of the preset time period can be displayed in the form of a line chart, a pie chart, and a detailed information list. The horizontal axis of the line chart can be time, and the vertical axis can be the number of user interaction behaviors corresponding to the target dimension value of the target service within the preset time window. The detailed information can include the target service identifier, the target dimension value, the maximum value of the number of user interaction behaviors of the target dimension value within the preset time window, and the total number of user interaction behaviors in the preset time period. The preset time period includes multiple preset time windows. The pie chart can show the proportion of the number of user interaction behaviors corresponding to the target dimension value of the target service within the preset time period to the total number of user interaction behaviors in the preset time period. And the line chart, pie chart, and detailed information list corresponding to the user in the preset time period can be displayed. The user can be represented by name, mobile phone number, and user ID (identification). The horizontal axis of the line chart can be time, and the vertical axis can be the number of user interaction behaviors corresponding to each user corresponding to the target service within the preset time window. Detailed information may include service identification, user representation, the maximum number of user interaction behaviors of the user within a preset time window, and the total number of user interaction behaviors in a preset time period. The preset time period includes multiple preset time windows. The pie chart may show the proportion of the number of user interaction behaviors of the user for a certain service within a preset time period to the total number of user interaction behaviors in the preset time period.

[0067] Attack behavior determination and warning module: This module determines attack behavior from the dimensions of IP, device, and UserAgent based on the user behavior data of the aforementioned cluster analysis. By setting a certain threshold, for example, if the number of calls exceeds 100, that is, the number of visits to a certain service exceeds 100 times, an early warning will be triggered. If the continuous warning exceeds 10 minutes, it is considered to be a clear attack behavior. Figure 3 As shown, Figure 3 A schematic diagram of early warning information provided by an embodiment of the present application can be used to show security personnel specific dimension values, occurrence time, and occurrence location, i.e., the occurrence data center, etc., for user analysis.

[0068] Attack behavior determination and early warning module: Once suspected malicious attack behavior is identified, the system will trigger the risk assessment process, and security personnel will further confirm it based on multi-source information (such as IP address, device fingerprint, historical behavior records, etc.). After confirmation, the system will automatically take blocking measures, such as restricting the IP or device from continuing to access. You can configure blocking rules to block attack behaviors corresponding to the corresponding target dimension values, see Figure 4 As shown, Figure 4 A blocking rule diagram provided for an embodiment of the present application. The target field in the Header can be matched to perform blocking. It can be understood that the target field is used to record the corresponding target dimension value, such as the device identifier.

[0069] With the popularity of electric vehicles, charging services have become a key link between users and energy supply. This application implements a solution for real-time detection of user attack behaviors for charging service platforms. Through real-time data analysis of user behaviors, accurate identification and anomaly detection of massive user behaviors in the charging service network can be achieved, malicious attacks can be effectively identified and blocked, and a solid security line of defense can be built for charging service providers. It can effectively curb the intrusion of malicious users into the charging service network, such as malicious users using technical means to frequently query charging station information and prices, and then collect, process and sell these sensitive data, protect the commercial secrets and user privacy of charging service providers, and significantly improve the overall security and reliability of the charging service network, enhance users' trust in charging services, and provide strong guarantees for the healthy development of the electric vehicle industry. At the same time, by blocking malicious attacks in real time and reducing economic losses caused by data leakage or improper use, the operating efficiency and economic benefits of charging service providers are further improved.

[0070] See also Figure 5 As shown, the present application discloses an attack behavior detection device, comprising:

[0071] A data collection module 11 is used to collect user interaction behavior data of the business platform;

[0072] A data clustering module 12 is used to cluster the user interaction behavior data of the target service in the business platform within a preset time window based on a preset dimension, and obtain clustering data corresponding to different dimension values ​​of the target service under the preset dimension;

[0073] A quantity determination module 13, configured to determine the quantity of user interaction behaviors of the different dimension values ​​in the preset time window based on the clustering data;

[0074] The attack judgment module 14 is used to judge whether the user interaction behavior corresponding to the target dimension value is an attack behavior based on the number of the user interaction behaviors, wherein the target dimension value is the dimension value under the preset dimension.

[0075] In a specific implementation, the preset dimension includes one or more dimensions consisting of IP, device, and user agent.

[0076] Furthermore, the device also includes: a target dimension value determination module, which is used to sort the number of user interaction behaviors with different dimension values ​​in the preset time window before judging whether the user interaction behavior corresponding to the target dimension value is an attack behavior based on the number of user interaction behaviors to obtain a sorting result; based on the sorting result, and according to a preset ratio or a preset number, the dimension value with the highest number of user interaction behaviors is selected as the target dimension value.

[0077] In an optional implementation, the attack judgment module 14 is specifically used to compare the number of user interaction behaviors with a preset number threshold; if the number of user interaction behaviors is greater than the preset number threshold, a corresponding warning message is sent to the security personnel terminal so that the security personnel can confirm whether the user interaction behavior corresponding to the target dimension value is an attack behavior.

[0078] In an optional implementation, the attack judgment module 14 is further configured to determine that the user interaction behavior corresponding to the target dimension value is an attack behavior when the triggering times of the warning information reaches a preset threshold.

[0079] In an optional implementation, the business platform is a charging business platform, and the target service includes one or more of a power station search service, a power station list service, a power station price query service, and a power station detail maintenance service.

[0080] It can be seen that the embodiment of the present application collects user interaction behavior data of the business platform; clusters the user interaction behavior data of the target service in the business platform within the preset time window based on the preset dimension, and obtains the clustering data corresponding to the different dimension values ​​of the target service under the preset dimension; determines the number of user interaction behaviors of the different dimension values ​​under the preset time window based on the clustering data; judges whether the user interaction behavior corresponding to the target dimension value is an attack behavior based on the number of user interaction behaviors, wherein the target dimension value is the dimension value under the preset dimension. That is, the embodiment of the present application determines the number of user interaction behaviors corresponding to different dimension values ​​of the target service in the business platform within the preset time window and under the preset dimension, and makes attack judgments based on the number of user interaction behaviors, so as to timely detect the dimension values ​​of abnormal user interaction behaviors within the preset time window, thereby realizing attack behavior judgment. In this way, it is possible to detect attack behaviors in a timely manner, improve the security of the business platform, and ensure the normal operation of the business platform.

[0081] It should be pointed out that the user behavior data acquisition module disclosed in the above embodiment is equivalent to the data collection module 11, the real-time clustering analysis module for vulnerable services may include a data clustering module 12 and a quantity determination module 13, and the attack behavior determination and early warning module is equivalent to the attack judgment module 14.

[0082] Furthermore, an embodiment of the present application discloses a computer program product, which, when executed, implements the attack behavior detection method disclosed in the aforementioned embodiment.

[0083] For the specific process of the above-mentioned attack behavior detection method, reference may be made to the corresponding contents disclosed in the above-mentioned embodiments, which will not be described in detail here.

[0084] See also Figure 6 As shown, an embodiment of the present application discloses an electronic device 20, including a processor 21 and a memory 22; wherein the memory 22 is used to store a computer program; and the processor 21 is used to execute the computer program to implement the attack behavior detection method disclosed in the above embodiment.

[0085] For the specific process of the above-mentioned attack behavior detection method, reference may be made to the corresponding contents disclosed in the above-mentioned embodiments, which will not be described in detail here.

[0086] Furthermore, the memory 22 as a carrier for storing resources may be a read-only memory, a random access memory, a magnetic disk or an optical disk, etc., and the storage method may be temporary storage or permanent storage.

[0087] In addition, the electronic device 20 also includes a power supply 23, a communication interface 24, an input / output interface 25 and a communication bus 26; wherein the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and an external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input / output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0088] Furthermore, an embodiment of the present application also discloses a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the attack behavior detection method disclosed in the aforementioned embodiment.

[0089] For the specific process of the above-mentioned attack behavior detection method, reference may be made to the corresponding contents disclosed in the above-mentioned embodiments, which will not be described in detail here.

[0090] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0091] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0092] The above is a detailed introduction to an attack behavior detection method, device, product, equipment and medium provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for detecting attack behavior, characterized in that: include: Collect user interaction behavior data on the business platform; Clustering the user interaction behavior data of the target service in the business platform within a preset time window based on a preset dimension to obtain clustering data corresponding to different dimension values ​​of the target service under the preset dimension; Determine the number of user interaction behaviors of the different dimension values ​​in the preset time window based on the clustering data; Based on the number of user interaction behaviors, it is determined whether the user interaction behavior corresponding to the target dimension value is an attack behavior, wherein the target dimension value is a dimension value under the preset dimension.

2. The attack behavior detection method according to claim 1, characterized in that: The preset dimensions include dimensions consisting of one or more of IP, device, and user agent.

3. The attack behavior detection method according to claim 1, characterized in that: Before judging whether the user interaction behavior corresponding to the target dimension value is an attack behavior based on the number of user interaction behaviors, the method further includes: Sorting the number of user interaction behaviors of different dimension values ​​in the preset time window to obtain a sorting result; Based on the sorting results, the dimension value with the highest number of user interaction behaviors is selected according to a preset ratio or a preset number as the target dimension value.

4. The attack behavior detection method according to claim 1, characterized in that: The determining, based on the number of user interaction behaviors, whether the user interaction behavior corresponding to the target dimension value is an attack behavior includes: Comparing the number of user interaction behaviors with a preset number threshold; If the number of user interaction behaviors is greater than the preset threshold, the corresponding warning information will be sent to the security personnel terminal so that the security personnel can confirm whether the user interaction behavior corresponding to the target dimension value is an attack behavior.

5. The attack behavior detection method according to claim 4, characterized in that: Also includes: When the triggering times of the warning information reaches a preset threshold, the user interaction behavior corresponding to the target dimension value is determined to be an attack behavior.

6. The attack behavior detection method according to any one of claims 1 to 5, characterized in that: The business platform is a charging business platform, and the target service includes one or more of a power station search service, a power station list service, a power station price query service, and a power station detail maintenance service.

7. An attack behavior detection device, characterized in that: include: Data collection module, used to collect user interaction behavior data of the business platform; A data clustering module, used to cluster the user interaction behavior data of the target service in the business platform within a preset time window based on a preset dimension, and obtain clustering data corresponding to different dimension values ​​of the target service under the preset dimension; A quantity determination module, used to determine the quantity of user interaction behaviors of the different dimension values ​​in the preset time window based on the clustering data; An attack judgment module is used to judge whether the user interaction behavior corresponding to the target dimension value is an attack behavior based on the number of user interaction behaviors, wherein the target dimension value is the dimension value under the preset dimension.

8. A computer program product, characterized in that When the computer program product is executed, the attack behavior detection method according to any one of claims 1 to 6 is implemented.

9. An electronic device, characterized in that: comprising a memory and a processor, wherein: The memory is used to store the computer program; The processor is used to execute the computer program to implement the attack behavior detection method according to any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that: Used to store a computer program, wherein when the computer program is executed by a processor, the attack behavior detection method according to any one of claims 1 to 6 is implemented.

Images