Abnormal behavior processing method, device, computer equipment and storage medium

Abstract

The present application relates to a method, apparatus, computer equipment, storage medium and computer program product for abnormal behavior processing. The method comprises: obtaining behavior detection data generated when abnormal detection of the behavior to be evaluated is performed, the behavior detection data includes the behavior timestamp of the behavior to be evaluated triggering the abnormal detection; performing feature statistics on the behavior detection data whose behavior timestamp is within the time window to be processed, and obtaining the behavior characteristics of the time window to be processed, the behavior characteristics include statistical characteristics under at least one statistical dimension; determining the self-protection dimension of the time window to be processed through the behavior characteristics, the self-protection dimension is used to characterize: the statistical dimension of the maximum impact of abnormal behavior in the time window to be processed; obtaining security data matching the self-protection dimension of the time window to be processed, and performing abnormal behavior processing through the security data. The use of this method can improve the accuracy of abnormal behavior processing.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to a method, apparatus, computer equipment and storage medium for handling abnormal behavior. Background Art

[0002] With the improvement and development of Internet technology, more and more users need to use various Internet application software in their daily lives due to its good convenience and flexibility. In order to protect the account security of users in Internet application software, a security verification service can be performed on the device number of the terminal device used by the user. In this way, when the security verification service returns that the security verification fails, the user needs to enter the corresponding verification code to log in, or directly intercept certain types of operation behaviors to avoid abnormal behaviors against the application software.

[0003] At present, the security verification system can actively perceive data query anomalies. When abnormal behavior is detected, the system automatically triggers protection measures to return corresponding downgraded disaster recovery data to protect the stability of the system. However, when abnormal behavior occurs, the system itself needs to implement the data statistics function of the distributed system. When large-scale abnormal behavior or other emergencies occur, the security verification system may have large-scale misinterceptions, thereby reducing the accuracy of abnormal behavior processing. Therefore, how to improve the accuracy of abnormal behavior processing is an urgent problem to be solved. Summary of the invention

[0004] Based on this, it is necessary to provide a method, apparatus, computer device and storage medium for abnormal behavior processing that can improve the accuracy of abnormal behavior processing in response to the above technical problems.

[0005] In a first aspect, the present application provides a method for handling abnormal behavior. The method comprises:

[0006] Obtaining behavior detection data generated when performing anomaly detection on the behavior to be evaluated, the behavior detection data including a behavior timestamp when the behavior to be evaluated triggers the anomaly detection;

[0007] Performing feature statistics on the behavior detection data whose behavior timestamps are within the time window to be processed to obtain the behavior features of the time window to be processed, where the behavior features include statistical features under at least one statistical dimension;

[0008] Determine the self-protection dimension of the time window to be processed through the behavior characteristics. The self-protection dimension is used to characterize: the statistical dimension of the maximum impact that causes abnormal behavior in the time window to be processed;

[0009] Obtain security data that matches the self-protection dimension of the time window to be processed, and perform abnormal behavior processing based on the security data.

[0010] In a second aspect, the present application also provides an abnormal behavior processing device. The device comprises:

[0011] A data acquisition module, used to acquire behavior detection data generated when anomaly detection is performed on the behavior to be evaluated, the behavior detection data including a behavior timestamp when the behavior to be evaluated triggers anomaly detection;

[0012] A feature statistics module is used to perform feature statistics on the behavior detection data whose behavior timestamp is within the time window to be processed, so as to obtain the behavior features of the time window to be processed, wherein the behavior features include statistical features under at least one statistical dimension;

[0013] A self-protection dimension determination module is used to determine the self-protection dimension of the time window to be processed through behavior characteristics, and the self-protection dimension is used to characterize: a statistical dimension of the maximum impact that causes abnormal behavior to occur within the time window to be processed;

[0014] The abnormal behavior processing module is used to obtain security data matching the self-protection dimension of the time window to be processed, and perform abnormal behavior processing through the security data.

[0015] In a third aspect, the present application further provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0016] Obtaining behavior detection data generated when performing anomaly detection on the behavior to be evaluated, the behavior detection data including a behavior timestamp when the behavior to be evaluated triggers the anomaly detection;

[0017] Performing feature statistics on the behavior detection data whose behavior timestamps are within the time window to be processed to obtain the behavior features of the time window to be processed, where the behavior features include statistical features under at least one statistical dimension;

[0018] Determine the self-protection dimension of the time window to be processed through the behavior characteristics. The self-protection dimension is used to characterize: the statistical dimension of the maximum impact that causes abnormal behavior in the time window to be processed;

[0019] Obtain security data that matches the self-protection dimension of the time window to be processed, and perform abnormal behavior processing based on the security data.

[0020] In a fourth aspect, the present application further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0021] Obtaining behavior detection data generated when performing anomaly detection on the behavior to be evaluated, the behavior detection data including a behavior timestamp when the behavior to be evaluated triggers the anomaly detection;

[0022] Performing feature statistics on the behavior detection data whose behavior timestamps are within the time window to be processed to obtain the behavior features of the time window to be processed, where the behavior features include statistical features under at least one statistical dimension;

[0023] Determine the self-protection dimension of the time window to be processed through the behavior characteristics. The self-protection dimension is used to characterize: the statistical dimension of the maximum impact that causes abnormal behavior in the time window to be processed;

[0024] Obtain security data that matches the self-protection dimension of the time window to be processed, and perform abnormal behavior processing based on the security data.

[0025] In a fifth aspect, the present application further provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0026] Obtaining behavior detection data generated when performing anomaly detection on the behavior to be evaluated, the behavior detection data including a behavior timestamp when the behavior to be evaluated triggers the anomaly detection;

[0027] Performing feature statistics on the behavior detection data whose behavior timestamps are within the time window to be processed to obtain the behavior features of the time window to be processed, where the behavior features include statistical features under at least one statistical dimension;

[0028] Determine the self-protection dimension of the time window to be processed through the behavior characteristics. The self-protection dimension is used to characterize: the statistical dimension of the maximum impact that causes abnormal behavior in the time window to be processed;

[0029] Obtain security data that matches the self-protection dimension of the time window to be processed, and perform abnormal behavior processing based on the security data.

[0030] The above-mentioned abnormal behavior processing method, device, computer equipment, storage medium and computer program product perform feature statistics on the behavior detection data within the time window to obtain statistical features under different statistical dimensions, thereby determining the statistical dimension with the greatest impact that causes abnormal behavior within the time window through the statistical features under different statistical dimensions, and then performing corresponding self-protection processing through the determined statistical dimension with the greatest impact, that is, performing abnormal behavior processing through the matched security data, and even if large-scale abnormal behavior occurs, it can be analyzed in a more fine-grained manner through the behavior detection data split into time windows, and a more comprehensive abnormal impact assessment can be performed through different statistical dimensions, thereby ensuring that the abnormal behavior processing performed is more accurate, that is, the accuracy of abnormal behavior processing can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1An application environment diagram of a method for handling abnormal behavior in an embodiment;

[0032] Figure 2 A schematic diagram of the system architecture of an abnormal behavior processing system in one embodiment;

[0033] Figure 3 A flowchart of a method for handling abnormal behavior in one embodiment;

[0034] Figure 4 A schematic diagram of a time window of a rolling time window in one embodiment;

[0035] Figure 5 A schematic diagram of a time window of a sliding time window in an embodiment;

[0036] Figure 6 A schematic diagram of a process for determining a self-protection dimension in one embodiment;

[0037] Figure 7 A schematic diagram of a process for determining a self-protection dimension of a time window to be processed based on a statistical normalization value in an embodiment;

[0038] Figure 8 It is a schematic diagram of a process of determining the self-protection dimension of a time window to be processed based on a statistical normalization value in another embodiment;

[0039] Fig. 9 A schematic diagram of a portion of a flow chart for obtaining the behavior characteristics of a time window to be processed in one embodiment;

[0040] Fig.10 A schematic diagram of a process for obtaining magnitude statistical features in one embodiment;

[0041] Fig.11 A schematic diagram of a process for obtaining a proportional statistical feature in one embodiment;

[0042] Fig.12 A schematic diagram of a process for obtaining month-on-month statistical features in one embodiment;

[0043] Fig.13 A schematic diagram of a process for obtaining magnitude fluctuation statistical characteristics in one embodiment;

[0044] Fig.14 A schematic diagram of a process for handling abnormal behavior through security data in one embodiment;

[0045] Fig.15 A complete flowchart of a method for handling abnormal behavior in one embodiment;

[0046] Fig.16 is a structural block diagram of an abnormal behavior processing device in an embodiment;

[0047] Fig.17 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0049] With the improvement and development of Internet technology, due to its good convenience and flexibility, more and more users need to use various Internet application software in their daily lives. In order to ensure the security of users' accounts in Internet application software, a security verification service can be performed on the device number of the terminal device used by the user. For example, the application software account used by the user can be bound to the device information of the terminal device used by the user. Once the terminal device is changed to log in to the application software account, it can identify the terminal device that does not meet the user's historical behavior rules or terminal devices, such as: the user has used the terminal device to log in to a game after a certain date, and the number of days the user has used the terminal device to log in to a certain game is greater than 5 days, or the user has used the terminal device to log in to a certain game for more than 3 hours, etc., then when the user changes the device to log in to the application software account, the result of security verification failure will be returned. Based on this, when the security verification service returns that the security verification fails, the user needs to enter the corresponding verification code to log in, or directly intercept certain types of operation behaviors to avoid abnormal behavior against the application software.

[0050] At present, the security verification system can actively perceive data query anomalies. When abnormal behavior is detected, the system automatically triggers protection measures and returns corresponding downgraded disaster recovery data to protect the stability of the system. Abnormal behavior can be caused by query anomalies caused by the network environment, or abnormal data results statistics exceed the threshold. However, when abnormal behavior occurs, the system itself needs to implement the data statistics function of the distributed system. When large-scale abnormal behavior or other emergencies occur, such as users updating the device system on a large scale, large-scale malicious tampering of the user's device number, etc., the security verification system may have large-scale misinterpretations, which will reduce the accuracy of abnormal behavior processing. Therefore, how to improve the accuracy of abnormal behavior processing is an urgent problem to be solved.

[0051] The embodiment of the present application provides a method for abnormal behavior processing that can improve the accuracy of abnormal behavior processing. The method for abnormal behavior processing provided by the embodiment of the present application can be applied to Figure 1In the application environment shown, the terminal 102 communicates with the server 104 through a network. The data storage system can store data that the server 104 needs to process. The data storage system can be integrated on the server 104, or placed on the cloud or other servers.

[0052] Specifically, taking the application to server 104 as an example, server 104 first obtains the behavior detection data generated when performing abnormal detection on the behavior to be evaluated, and the behavior detection data includes the behavior timestamp of the behavior to be evaluated triggering the abnormal detection, and then performs feature statistics on the behavior detection data whose behavior timestamp is within the time window to be processed, and obtains the behavior characteristics of the time window to be processed, and the behavior characteristics include statistical characteristics under at least one statistical dimension, and the self-protection dimension of the time window to be processed is determined through the behavior characteristics, and the self-protection dimension is used to characterize: the statistical dimension of the maximum impact of abnormal behavior in the time window to be processed. Finally, obtain security data matching the self-protection dimension of the time window to be processed, and perform abnormal behavior processing through security data. Through the above method, when large-scale abnormal behavior occurs, it is also possible to perform a more fine-grained analysis by splitting the behavior detection data into time windows, and perform a more comprehensive abnormal impact assessment through different statistical dimensions, so as to ensure that the abnormal behavior processing performed is more accurate, that is, the accuracy of abnormal behavior processing can be improved.

[0053] Among them, the terminal 102 can be, but is not limited to, various desktop computers, laptops, smart phones, tablet computers, Internet of Things devices, portable wearable devices, vehicle-mounted terminals, aircraft, etc., and the Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart vehicle-mounted devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The server 104 can be implemented with an independent server or a server cluster composed of multiple servers. And the method for abnormal behavior processing provided in the application embodiment can be applied to various scenarios, including but not limited to cloud technology, and artificial intelligence, etc.

[0054] Furthermore, the abnormal behavior processing system provided in this embodiment is as follows: Figure 2As shown, at least the following processes are included: behavior detection data acquisition 201, behavior feature generation 202, self-protection scheme triggering 203, and historical data analysis 204. Among them, behavior detection data acquisition 201 specifically includes: acquiring behavior detection data generated when abnormal detection of the behavior to be evaluated is performed, that is, when the user performs certain operation behaviors (such as game login), it will trigger abnormal detection of the operation behavior, and the operation behavior is the behavior to be evaluated, thereby generating behavior detection data corresponding to the behavior to be evaluated. At this time, real-time message events can be directly pushed to push the behavior detection data generated by real-time abnormal detection, and when acquiring behavior detection data, it can also be the behavior detection data generated by abnormal detection in the historical time period, and then the behavior detection data in the historical time period is stored as historical data in the database, so that the behavior detection data is obtained from the database when abnormal behavior processing is required.

[0055] Based on this, the behavior feature generation 202 can be combined with each pending time window of the specified window length by the developer using Flink SQL, and the behavior features of each pending time window can be aggregated under different statistical dimensions. At this time, the statistical dimension can include but is not limited to the magnitude statistical dimension, the ratio statistical dimension, the month-on-month statistical dimension, and the magnitude fluctuation statistical dimension. Further, the self-protection scheme trigger 203 needs to determine whether there are statistical features in the abnormal feature range through the behavior features of each pending time window, and then determine the self-protection dimension of the pending time window through the statistical features in the abnormal feature range. After determining the self-protection dimension, a corresponding alarm can be generated to remind the relevant personnel of the system that there is an abnormal risk. At this time, security data matching the self-protection dimension can also be obtained, and abnormal behavior processing is performed through the security data. Further, in the historical data analysis 204, the results of abnormal behavior processing for each pending time window will be recorded, specifically including the determined self-protection dimension and the aforementioned statistical calculation results, so as to adjust the calculation parameters or statistical dimensions that may have problems. For example: the abnormal behavior processing through security data is greatly increased or greatly reduced, that is, the adjustment of the set threshold needs to be considered. Alternatively, if a certain statistical dimension has never been identified as a self-protection dimension, whether statistical processing is still required for this statistical dimension can also be adjusted based on actual conditions.

[0056] Based on the above introduction, the following embodiments are described in detail: In one embodiment, Figure 3 As shown, a method for abnormal behavior processing is provided, and the method is applied to Figure 1The server 104 in the example is used for explanation. It is understandable that the method can also be applied to the terminal 102, and can also be applied to a system including the terminal 102 and the server 104, and is implemented through the interaction between the terminal 102 and the server 104. In this embodiment, the method includes the following steps:

[0057] Step 302 : acquiring behavior detection data generated when performing anomaly detection on the behavior to be evaluated, wherein the behavior detection data includes a behavior timestamp when the behavior to be evaluated triggers anomaly detection.

[0058] Among them, the behavior detection data includes the behavior timestamp of the behavior to be evaluated that triggers the anomaly detection, and the behavior timestamp represents the timestamp of the behavior to be evaluated that triggers the anomaly detection. For example, the behavior A1 to be evaluated triggers the anomaly detection at XXXX year XXX month XX day, X hours X minutes X seconds. At this time, it can be determined that the behavior detection data includes the behavior timestamp of the behavior A1 to be evaluated "XXXX year XXX month XX day, X hours X minutes X seconds". Secondly, anomaly detection is used to detect whether the behavior to be evaluated is an abnormal behavior, so the behavior detection data can also include the anomaly detection result of the behavior to be evaluated, that is, the anomaly detection result represents that the behavior to be evaluated is an abnormal behavior, or the behavior to be evaluated is not an abnormal behavior. Based on this, the behavior to be evaluated can be the operation behavior performed by the user in real time, such as: the login behavior of the user logging into the application software in real time, the payment behavior of the user making real-time payment for virtual products, etc. The behavior to be evaluated can also be the historical operation behavior performed by the user in the historical time period. The behavior to be evaluated that triggers the anomaly detection can be the operation behavior of the target type in the target scenario, such as game login, virtual payment, etc.

[0059] Specifically, the server obtains the behavior detection data generated when performing anomaly detection on the behavior to be evaluated. It can be seen from the above introduction that the behavior to be evaluated can be the operation behavior performed by the user in real time. Therefore, when the user performs real-time operation behavior and triggers anomaly detection, the operation behavior is the behavior to be evaluated, thereby generating behavior detection data corresponding to the behavior to be evaluated, that is, the server can obtain the behavior detection data in real time. Secondly, since the behavior to be evaluated can also be the historical operation behavior performed by the user in the historical time period, it can also be the operation behavior performed by the user in the historical time period, and the operation behavior triggers anomaly detection to generate behavior detection data, and then the behavior detection data in the historical time period is stored as historical data in the database. Therefore, the server can obtain the behavior detection data from the database when abnormal behavior processing is required. That is, the behavior detection data can include real-time behavior detection data and historical behavior detection data.

[0060] It is understandable that the behavior detection data may include the behavior timestamp of the behavior to be evaluated that triggers the anomaly detection and the anomaly detection result of the behavior to be evaluated, and may also include the user identifier of the behavior to be evaluated, which may be a user account, etc. And it may also include the scene type that triggers the anomaly detection, such as a game scene, an audio and video viewing scene, an online shopping scene, etc. And it may also include the device information of the device used by the user who performs the behavior to be evaluated, such as the device type and device version, etc. In this embodiment, the data information included in the behavior detection data and the method for obtaining the behavior detection data are not specifically limited.

[0061] Step 304 , performing feature statistics on the behavior detection data whose behavior timestamps are within the time window to be processed, to obtain the behavior features of the time window to be processed, wherein the behavior features include statistical features under at least one statistical dimension.

[0062] Among them, the behavior characteristics include statistical characteristics under at least one statistical dimension, and the aforementioned statistical dimensions include at least: magnitude statistical dimension, proportion statistical dimension, month-on-month statistical dimension and magnitude fluctuation statistical dimension. Based on this, the statistical characteristics can be: magnitude statistical characteristics under magnitude statistical dimension, proportion statistical characteristics under proportion statistical dimension, month-on-month statistical characteristics under month-on-month statistical dimension, and magnitude fluctuation statistical characteristics under magnitude fluctuation statistical dimension. Secondly, the time window to be processed is a time window of a preset window length, and the time window to be processed can be a rolling time window or a sliding time window, or the time window to be processed can also be a time window of a preset window length determined by real-time triggering.

[0063] Specifically, the server first determines the time window to be processed based on the needs of the target scenario. Since the time window to be processed can be a rolling time window or a sliding time window, the differences between the rolling time window and the sliding time window are introduced below. Figure 4 The illustrated rolling time windows include time window 401 , time window 402 , and time window 403 , and the window durations of time window 401 , time window 402 , and time window 403 are consistent, and each behavior to be evaluated exists only in one time window.

[0064] Secondly, if Figure 5The sliding time window shown needs to slide on the time axis with a certain step length, and there are time window 501, time window 502 and time window 503. Time window 502 is obtained by sliding backward with a step length of 504 on the basis of time window 501, and time window 503 is obtained by sliding backward with a step length of 504 on the basis of time window 501, and the window lengths of time window 501, time window 502 and time window 503 are consistent. And any behavior to be evaluated may exist in different time windows.

[0065] For example, taking the time window to be processed as a rolling time window, the time window to be processed may be (1-10), and the next time window adjacent to the time window to be processed may be (11-20), that is, when the time window to be processed is a rolling time window, there is no overlapping time period between the time windows, so each behavior to be evaluated only exists in one time window. Secondly, taking the time window to be processed as a sliding time window and the step size of 5 as an example, the time window to be processed may be (1-10), and the next time window adjacent to the time window to be processed may be (5-15), that is, when the time window to be processed is an interactive time window, there may be overlapping time periods between the time windows, so the behaviors to be evaluated may all exist in different time windows.

[0066] Furthermore, since the behavior detection data includes the behavior timestamp when the behavior to be evaluated triggers the anomaly detection, the timestamp when the behavior to be evaluated triggers the anomaly detection can be determined through the behavior timestamp. Then, the server selects the behavior detection data whose behavior timestamp is within the time window to be processed, and performs feature statistics on the aforementioned behavior detection data from at least one statistical dimension, thereby obtaining the behavior features under the time window to be processed. Through the aforementioned introduction, the aforementioned statistical dimensions at least include: magnitude statistical dimension, proportion statistical dimension, month-on-month statistical dimension and magnitude fluctuation statistical dimension. Therefore, the magnitude statistical features under the magnitude statistical dimension may at least include: the number of abnormal behaviors under the time window to be processed, and the total number of behaviors to be evaluated for abnormal detection under the time window to be processed. Secondly, the proportion statistical features under the proportion statistical dimension may at least include: the proportion of the number of abnormal behaviors under the time window to be processed to the behaviors to be evaluated for abnormal detection. The month-on-month statistical features under the month-on-month statistical dimension may at least include: the number of abnormal behaviors under the time window to be processed, and the month-on-month comparison between the number of abnormal behaviors in the previous time window adjacent to the time window to be processed. And the magnitude fluctuation statistical features under the magnitude fluctuation statistical dimension may at least include: the number of abnormal behaviors in the time window to be processed, and the fluctuation difference of the number of abnormal behaviors in the previous time window adjacent to the time window to be processed.

[0067] Since different statistical dimensions can describe abnormal behaviors from different directions, the statistical dimensions and the combination of statistical dimensions to be used need to be determined based on the needs of the target scenario. For example, if the target scenario needs to determine whether a large number of abnormal behaviors are generated in a certain time window, the magnitude statistical features under the magnitude statistical dimension can characterize the number of abnormal behaviors in the time window to be processed. At this time, it can be determined whether a large number of abnormal behaviors are generated by determining whether the number of abnormal behaviors in the time window to be processed reaches the quantity risk value. Secondly, if the target scenario needs to determine whether the proportion of abnormal behaviors generated in a certain time window reaches the proportional risk value, the demand can be met by the proportional statistical features under the proportional statistical dimension. Further, if the target scenario needs to determine the changing trend of abnormal risks generated between adjacent time windows, the demand can be met by the month-on-month statistical features under the month-on-month statistical dimension. And, if the target scenario needs to determine whether the fluctuation size of the number of abnormal behaviors between adjacent time windows exceeds the risk value, the demand can be met by the magnitude fluctuation statistical features under the magnitude fluctuation statistical dimension. It should be understood that the above examples are only used to understand this solution and should not be understood as specific limitations on the statistical dimensions and application scenarios in this solution.

[0068] Step 306: determine the self-protection dimension of the time window to be processed through the behavior characteristics, where the self-protection dimension is used to characterize: the statistical dimension of the maximum impact that causes abnormal behavior to occur within the time window to be processed.

[0069] Among them, the self-protection dimension is used to characterize: the statistical dimension with the greatest impact on the abnormal behavior in the time window to be processed, that is, the self-protection dimension is determined from the statistical dimension. For example, if the statistical dimension includes: magnitude statistical dimension, proportion statistical dimension, month-on-month statistical dimension and magnitude fluctuation statistical dimension, if it is determined through behavioral characteristics that the statistical dimension with the greatest impact on the abnormal behavior in the time window to be processed is the proportion statistical dimension, then the proportion statistical dimension is determined as the self-protection dimension. Specifically, the server determines the self-protection dimension of the time window to be processed through behavioral characteristics, and before determining the self-protection dimension, the server needs to determine whether there is at least one statistical feature in the behavioral characteristics that is within the abnormal feature range under the statistical dimension. If not, it means that the abnormal behavior does not constitute a risk. At this time, the self-protection dimension will not be determined, but similar steps will be performed for the next time window. If it exists, the server will determine the self-protection dimension through the statistical features within the abnormal feature range under the statistical dimension.

[0070] Step 308, obtaining security data matching the self-protection dimension of the time window to be processed, and performing abnormal behavior processing through the security data.

[0071] Among them, each statistical dimension has pre-matched security data, such as: the magnitude statistical dimension matches security data B1, the proportion statistical dimension matches security data B2, the month-on-month statistical dimension matches security data B3, and the magnitude fluctuation statistical dimension matches security data B4. And the security data needs to be flexibly configured and accessed according to the access party and the target scenario, which is not specifically limited here.

[0072] Specifically, the server obtains security data that matches the self-protection dimension of the time window to be processed, that is, since each statistical dimension has pre-matched security data, then the security data that pre-matches the statistical dimension is used as the security data that matches the self-protection dimension, for example, if the self-protection dimension is specifically a proportional statistical dimension, then the security data that matches the self-protection dimension is the proportional statistical dimension matching security data B2. Further, the server processes abnormal behavior through security data, that is, the server maintains a self-protection state for abnormal behavior to ensure that the self-protection solution effectively monitors and processes abnormal behavior.

[0073] It can be understood that all examples in this embodiment are only used to understand the present solution and should not be understood as specific limitations of the present solution.

[0074] In the above-mentioned method for handling abnormal behavior, feature statistics are performed on the behavior detection data within the time window to obtain statistical features under different statistical dimensions, and then the statistical dimension with the greatest impact that causes abnormal behavior within the time window is determined through the statistical features under different statistical dimensions, and then corresponding self-protection processing is performed through the determined statistical dimension with the greatest impact, that is, abnormal behavior processing is performed through the matched security data, and even if large-scale abnormal behavior occurs, a more fine-grained analysis can be performed by splitting the behavior detection data into time windows, and a more comprehensive abnormal impact assessment can be performed through different statistical dimensions, thereby ensuring that the abnormal behavior processing performed is more accurate, that is, the accuracy of abnormal behavior processing can be improved.

[0075] It can be seen from the above embodiments that in the process of determining the self-protection dimension, it is necessary to determine whether there is at least one statistical feature in the behavior feature that is within the abnormal feature range under the statistical dimension. If so, the self-protection dimension is determined. The following will be described in detail based on this: In one embodiment, if Figure 6 As shown in FIG. 1 , the self-protection dimension of the time window to be processed is determined by the behavioral characteristics, including:

[0076] Step 602, if there is at least one statistical feature in the behavior feature that is within the abnormal feature range under the statistical dimension, the maximum value of the abnormal feature range, the minimum value of the abnormal feature range, and the statistical feature are normalized to obtain a statistical normalized value under the statistical dimension.

[0077] The abnormal feature range specifically consists of a range from a minimum value to a maximum value, and each statistical dimension has a corresponding abnormal feature range. For example, the abnormal feature range under the magnitude statistical dimension is (50, 80), that is, the minimum value of the range under the magnitude statistical dimension is 50, and the maximum value of the range under the magnitude statistical dimension is 80. Alternatively, the abnormal feature range under the ratio statistical dimension is (0.6, 0.95), that is, the minimum value of the range under the ratio statistical dimension is 0.6, and the maximum value of the range under the ratio statistical dimension is 0.95.

[0078] Specifically, when there is at least one statistical feature in the behavior feature that is within the abnormal feature range under the statistical dimension, the server performs normalization processing with the statistical feature under the statistical dimension by using the maximum value of the abnormal feature range under the statistical dimension, the minimum value of the abnormal feature range under the statistical dimension, and the statistical feature under the statistical dimension to obtain the statistical normalization value under the statistical dimension. For ease of understanding, the abnormal feature range (50, 80) under the magnitude statistical dimension and the abnormal feature range (0.6, 0.95) under the proportion statistical dimension are used as examples for explanation. If the magnitude statistical feature under the magnitude statistical dimension is 60 and the proportion statistical feature under the statistical dimension is 0.3, that is, the magnitude statistical feature is within the abnormal feature range under the magnitude statistical dimension, and the proportion statistical feature is not within the abnormal feature range under the proportion statistical dimension, then the server will perform normalization processing with the magnitude statistical feature under the magnitude statistical dimension by using the maximum value of the abnormal feature range under the magnitude statistical dimension, the minimum value of the abnormal feature range under the magnitude statistical dimension, and the magnitude statistical feature under the magnitude statistical dimension to obtain the statistical normalization value under the magnitude statistical dimension. At this time, the statistical dimension that is not within the abnormal feature range will not be calculated for the statistical normalization value.

[0079] Furthermore, the specific method of normalization is: to find the difference between the statistical feature under the statistical dimension and the minimum value of the range under the statistical dimension, and to find the difference between the maximum value of the range of the abnormal feature under the statistical dimension and the minimum value of the range of the abnormal feature under the statistical dimension, and then to calculate the difference ratio of the above two differences to obtain the statistical normalization value under the statistical dimension. For ease of understanding, the statistical normalization value method of normalization processing is as shown in formula (1):

[0080]

[0081] Among them, N i Characterizes the statistical normalized value of statistical dimension i, x i Characterize the statistical characteristics under statistical dimension i, min(x i ) represents the minimum value of the range under the statistical dimension i, max(x i ) represents the maximum value of the range under the statistical dimension i.

[0082] Step 604: determine the self-protection dimension of the time window to be processed based on the statistical normalization value.

[0083] Specifically, the server determines the self-protection dimension of the time window to be processed based on the statistical normalization value. In the process of determining the self-protection dimension, the server also needs to calculate the evaluation value of the time window to be processed based on the statistical normalization value. The evaluation value is used to characterize the abnormal risk degree of the time window to be processed. When the evaluation value is within the abnormal evaluation value range, the server determines the self-protection dimension of the time window to be processed. It can be understood that all examples in this embodiment are only used to understand this solution and should not be understood as a specific limitation of this solution.

[0084] In this embodiment, the self-protection dimension is determined in the presence of statistical features within the abnormal feature range, which can ensure that the abnormal behavior has abnormal risks. Then, the statistical features are normalized so that the statistical normalization values ​​under different statistical dimensions can more accurately describe the specific data information represented by the abnormal behavior in the time window to be processed under the statistical dimension. Based on the statistical normalization values ​​under different statistical dimensions, the statistical dimension with the greatest impact on the abnormal behavior in the time window to be processed is determined to improve the accuracy of the determined self-protection dimension, thereby improving the accuracy of abnormal behavior processing.

[0085] Since the abnormal feature range under the statistical dimension can be one or more, the following first introduces a method for determining the self-protection dimension when there is only one abnormal feature range: In one embodiment, if Figure 7 As shown, the self-protection dimension of the time window to be processed is determined based on the statistical normalized value, including:

[0086] Step 702: If there is only one statistical feature in the abnormal feature range under the statistical dimension, obtain the dimension weight of the statistical dimension of the statistical feature, and perform weighted processing on the statistical normalization value and the dimension weight to obtain an evaluation value.

[0087] Each statistical dimension has a corresponding dimension weight, such as: the magnitude statistical dimension corresponds to the dimension weight C1, the proportion statistical dimension corresponds to the dimension weight C2, the month-on-month statistical dimension corresponds to the dimension weight C3, and the magnitude fluctuation statistical dimension corresponds to the dimension weight C4. Secondly, the evaluation value is used to characterize the abnormal risk level of the time window to be processed.

[0088] Specifically, when there is only one statistical feature in the abnormal feature range under the statistical dimension, the server first obtains the dimension weight of the statistical dimension of the statistical feature in the abnormal feature range, and then performs weighted processing on the statistical normalized value and the dimension weight to obtain the evaluation value, that is, the dimension weight corresponding to the statistical dimension is weighted with the statistical normalized value of the statistical dimension, and the result of the weighted processing is the evaluation value. For ease of understanding, one way to calculate the evaluation value is as shown in formula (2):

[0089] score=N i *w i ; (2)

[0090] Among them, score represents the evaluation value, N i Characterizes the statistical normalized value of statistical dimension i, w i Characterizes the dimension weight of statistical dimension i.

[0091] To facilitate understanding, the above example is used for further introduction. If the magnitude statistical feature is within the range of abnormal features under the magnitude statistical dimension, the statistical normalized value under the magnitude statistical dimension can be obtained at this time, and then the above calculation is performed based on the statistical normalized value under the magnitude statistical dimension and the dimension weight under the magnitude statistical dimension to obtain the evaluation value.

[0092] Step 704: If the evaluation value is within the abnormal evaluation value range, the statistical dimension of the statistical feature is determined as the self-protection dimension of the time window to be processed.

[0093] Among them, since the evaluation value is used to characterize the abnormal risk degree of the time window to be processed, the abnormal evaluation value range is used to characterize the abnormal risk degree range where abnormal risks exist. The abnormal evaluation value range can be (60, 100). The specific value needs to be determined based on the actual application scenario and is not limited here.

[0094] Specifically, when the evaluation value is within the abnormal evaluation value range, that is, there is an abnormal risk in the time window to be processed, it is necessary to determine the statistical dimension with the greatest impact on the abnormal behavior. Since there is only one statistical feature within the abnormal feature range under the statistical dimension, that is, other statistical features are not within the abnormal feature range, that is, the statistical features that are not within the abnormal feature range have a greater impact on the risk, at this time, the statistical dimension with the statistical feature within the abnormal feature range is directly determined as the self-protection dimension of the time window to be processed. On the contrary, if the evaluation value is not within the abnormal evaluation value range, it means that the abnormal behavior does not constitute a risk within the time window to be processed. At this time, the self-protection dimension will not be determined, but the aforementioned similar steps will be performed on the next time window adjacent to the time window to be processed.

[0095] For ease of understanding, the above example is further introduced again. After the above calculation is performed based on the statistical normalization value under the magnitude statistical dimension and the dimension weight under the magnitude statistical dimension to obtain the evaluation value, if the evaluation value is within the abnormal evaluation value range, the magnitude statistical dimension can be determined as the self-protection dimension of the time window to be processed. It can be understood that all examples in this embodiment are only used to understand this solution and should not be understood as a specific limitation of this solution.

[0096] In this embodiment, when there is only one statistical feature within the abnormal feature range under the statistical dimension, the evaluation value is calculated through a single statistical dimension, and then the abnormal risk level of the time window to be processed is evaluated based on the evaluation value to ensure that the self-protection dimension is determined when there is a risk, and further ensure the accuracy and reliability of the self-protection dimension, thereby improving the accuracy of abnormal behavior processing.

[0097] The following describes a method for determining the self-protection dimension when there are multiple self-protection dimensions: In one embodiment, if Figure 8 As shown, the self-protection dimension of the time window to be processed is determined based on the statistical normalized value, including:

[0098] Step 802: If there are multiple statistical features within the abnormal feature range under the statistical dimension, the statistical normalized value of each statistical feature and the dimension weight of the statistical dimension of each statistical feature are weighted to obtain an evaluation value.

[0099] Specifically, when there are multiple statistical features in the abnormal feature range under the statistical dimension, the server also needs to first obtain the dimension weight of the statistical dimension of the statistical features in the abnormal feature range, and then perform weighted summation processing on the statistical normalized value of each statistical feature and the dimension weight of the statistical dimension of each statistical feature, and then determine the result of the weighted summation processing as the evaluation value. For ease of understanding, taking the statistical dimensions including magnitude statistical dimension, proportion statistical dimension, month-on-month statistical dimension and magnitude fluctuation statistical dimension as examples, a calculation method of the evaluation value is as shown in formula (3):

[0100] score=N A *w A +N B *w B +N C *w C +N D *w D ; (3)

[0101] Among them, score represents the evaluation value, N A The statistical normalization value representing the magnitude statistical dimension, w A The dimension weight that represents the magnitude statistics dimension, NB The statistical normalization value representing the proportional statistical dimension, w B The dimension weight representing the proportional statistical dimension, N C The statistical normalization value representing the month-on-month statistical dimension, w C The dimension weight that represents the month-on-month statistical dimension, N D The statistical normalized value representing the statistical dimension of magnitude fluctuation, w D The dimension weight that represents the statistical dimension of magnitude fluctuation.

[0102] Step 804: If the evaluation value is within the abnormal evaluation value range, a difference calculation is performed between the statistical normalized value of each statistical feature and the dimension normalized threshold of the statistical dimension of each statistical feature.

[0103] Among them, each statistical dimension has a pre-configured dimension normalization threshold, such as: the dimension normalization threshold D1 for the magnitude statistical dimension, the dimension normalization threshold D2 for the ratio statistical dimension, the dimension normalization threshold D3 for the month-on-month statistical dimension, and the dimension normalization threshold D4 for the magnitude fluctuation statistical dimension. Secondly, the difference calculation result obtained by performing the difference calculation on each statistical dimension is used to characterize: the degree of fluctuation of the statistical characteristics of the statistical dimension within the abnormal characteristic range within the time window to be processed.

[0104] Specifically, when the evaluation value is within the abnormal evaluation value range, that is, there is an abnormal risk in the time window to be processed, it is necessary to determine the statistical dimension that has the greatest impact on the abnormal behavior. Since there are multiple statistical features within the abnormal feature range under the statistical dimension, it is necessary to select the statistical dimension with the greatest impact on the risk from multiple statistical dimensions. At this time, it is necessary to further determine the degree of fluctuation within the abnormal feature range under the time window to be processed. The greater the degree of fluctuation, the greater the difference, which also indicates that the impact of the statistical dimension is the most obvious. Based on this, the server calculates the difference between the statistical normalized value of the statistical feature and the dimension normalization threshold for each statistical dimension, thereby obtaining the difference calculation result for each statistical dimension. For ease of understanding, the difference calculation result is calculated as shown in formula (4):

[0105] D i =N i -N i_risk ; (4)

[0106] Among them, D i Characterizes the difference calculation result of statistical dimension i, N i Characterizes the statistical normalized value of statistical dimension i, N i_risl Characterizes the dimension normalization threshold of statistical dimension i.

[0107] Step 806: determine the statistical dimension with the largest value in the difference calculation result as the self-protection dimension of the time window to be processed.

[0108] Specifically, since the difference calculation result is used to characterize: the fluctuation degree of the statistical characteristics of the statistical dimension within the time window to be processed within the range of abnormal characteristics, the greater the fluctuation degree, that is, the greater the difference, which also means that the influence of the statistical dimension is the most obvious. Therefore, the server determines the statistical dimension with the largest value in the difference calculation result as the self-protection dimension of the time window to be processed.

[0109] For ease of understanding, taking the statistical dimensions including magnitude statistical dimension, proportion statistical dimension, month-on-month statistical dimension and magnitude fluctuation statistical dimension as examples, the self-protection dimension is determined as shown in formula (5):

[0110] D=max(N A ,N B ,N C ,N D ); (5)

[0111] Among them, D represents the self-protection dimension, N A The difference calculation result representing the magnitude statistical dimension, N B The difference calculation result representing the proportional statistical dimension, N C The difference calculation result representing the month-on-month statistical dimension, N D The difference calculation result that characterizes the statistical dimension of magnitude fluctuations.

[0112] To facilitate understanding, the above example is used for further introduction. If the difference calculation result of the magnitude statistical dimension is 5, the difference calculation result of the ratio statistical dimension is 6, the difference calculation result of the month-on-month statistical dimension is 2, and the difference calculation result of the magnitude fluctuation statistical dimension is 8, then it can be determined that 8 is the difference calculation result with the largest value. Therefore, the magnitude fluctuation statistical dimension corresponding to the difference calculation result "8" can be determined as the self-protection dimension of the time window to be processed.

[0113] It can be understood that all examples in this embodiment are only used to understand the present solution and should not be understood as specific limitations of the present solution.

[0114] In this embodiment, when there are multiple statistical features in the abnormal feature range under the statistical dimension, the evaluation value is calculated by weighted summation between multiple statistical dimensions, so the obtained evaluation value can consider multiple dimensions to more accurately and comprehensively evaluate the abnormal risk level of the time window to be processed, so as to ensure the determination of the self-protection dimension in the presence of risk. Secondly, by calculating the difference between the statistical normalization value and the dimensional normalization threshold, the degree of fluctuation of the statistical features of different statistical dimensions in the abnormal feature range under the time window to be processed is determined, and the degree of fluctuation is used to more accurately describe the degree of influence that leads to abnormal behavior, so as to further ensure the accuracy and reliability of the self-protection dimension, thereby improving the accuracy of abnormal behavior processing.

[0115] In one embodiment, Fig. 9 As shown, the behavior detection data also includes an abnormal detection result of the behavior to be evaluated. It can be seen from the above embodiments that the abnormal detection result indicates that the behavior to be evaluated is an abnormal behavior, or that the behavior to be evaluated is not an abnormal behavior.

[0116] Based on this, feature statistics are performed on the behavior detection data whose behavior timestamps are within the time window to be processed to obtain the behavior features of the time window to be processed, including:

[0117] Step 902 , counting the number of first abnormal behaviors in the time window to be processed through the abnormal behaviors represented by the abnormal detection results in the behavior detection data in the time window to be processed.

[0118] Among them, the first number of abnormal behaviors is used to describe the number of abnormal behaviors within the time window to be processed. Specifically, since the abnormal detection result characterizes that the behavior to be evaluated is an abnormal behavior, or that the behavior to be evaluated is not an abnormal behavior, that is, the server needs to specifically count the abnormal behaviors characterized by the abnormal detection results in the behavior detection data in the time window to be processed to count the number of first abnormal behaviors in the time window to be processed. For example, the behavior detection data of the time window to be processed specifically includes the abnormal detection results of the behavior A1 to be evaluated to the abnormal detection results of the behavior A200 to be evaluated, and the abnormal detection results of the behavior A1 to be evaluated to the abnormal detection results of the behavior A30 to be evaluated are all characterized as abnormal behaviors, that is, the behaviors A1 to be evaluated to the behaviors A30 to be evaluated are all abnormal behaviors, and it can be counted that the number of first abnormal behaviors in the time window to be processed is 30. It can be understood that all examples in this embodiment are only used to understand the present solution and should not be understood as specific limitations of the present solution.

[0119] Step 904: Perform feature statistics based on the number of first abnormal behaviors to obtain behavior features of the time window to be processed.

[0120] Specifically, the server performs feature statistics of multiple statistical dimensions based on the first abnormal behavior quantity to obtain the behavior features of the time window to be processed.

[0121] In this embodiment, the number of abnormal behaviors determined by screening the anomaly detection results is obtained. Since risks are usually caused by abnormal behaviors, statistics on the number of abnormal behaviors can reduce the amount of data in feature statistics and ensure the targeted nature of behavior feature statistics, thereby improving the efficiency and accuracy of behavior feature statistics determination.

[0122] It can be seen from the above introduction that the statistical dimensions at least include: magnitude statistical dimension, ratio statistical dimension, month-on-month statistical dimension and magnitude fluctuation statistical dimension. The following will introduce the methods of performing feature statistics under different statistical dimensions respectively: In one embodiment, Fig.10 As shown, the behavior characteristics include magnitude statistical characteristics under the magnitude statistical dimension, and the magnitude statistical characteristics include total behavior statistical characteristics and abnormal behavior statistical characteristics.

[0123] The total number of behaviors statistical feature is used to characterize the total number of behaviors to be evaluated within the time window to be processed, and the abnormal behavior statistical feature is used to characterize the total number of abnormal behaviors within the time window to be processed.

[0124] Based on this, feature statistics are performed based on the number of first abnormal behaviors to obtain the behavior features of the time window to be processed, including:

[0125] Step 1002 , counting the total number of behaviors in the time window to be processed through the behavior detection data in the time window to be processed, and determining the statistical features of the total number of behaviors based on the total number of behaviors.

[0126] Specifically, the server counts the total number of behaviors in the time window to be processed through the behavior detection data in the time window to be processed, that is, the total number of behaviors to be evaluated that trigger anomaly detection included in the behavior detection data, which is the total number of behaviors in the time window to be processed. Exemplarily, the example in the aforementioned embodiment is further introduced, such as the behavior detection data in the time window to be processed specifically includes the anomaly detection results of the behavior A1 to the behavior A200 to be evaluated, that is, there are relevant data in the behavior detection data that trigger anomaly detection of the behaviors A1 to A200 to be evaluated, that is, there are 200 behaviors to be evaluated that trigger anomaly detection in the time window to be processed, so it can be determined that the total number of behaviors in the time window to be processed is 200.

[0127] Furthermore, the server determines the statistical feature of the total number of behaviors based on the total number of behaviors, that is, determines that the statistical feature of the total number of behaviors is used to characterize the total number of behaviors in the time window to be processed. From the above example, it can be seen that the total number of behaviors in the time window to be processed is determined to be 200, then the obtained statistical feature of the total number of behaviors is used to characterize that the total number of behaviors in the time window to be processed is 200.

[0128] Step 1004: Determine abnormal behavior statistical features based on the first abnormal behavior quantity.

[0129] Specifically, the server determines the abnormal behavior statistical feature based on the first abnormal behavior number, that is, determines the abnormal behavior statistical feature to characterize the first abnormal behavior number in the time window to be processed. From the above example, it can be seen that the total number of behaviors in the time window to be processed is determined to be 200, and the number of first abnormal behaviors is 30. At this time, the abnormal behavior statistical feature obtained is used to characterize the first abnormal behavior number in the time window to be processed as 30. It can be seen that since the behavior feature includes the magnitude statistical feature under the magnitude statistical dimension, and the magnitude statistical feature includes the total number of behaviors statistical feature and the abnormal behavior statistical feature, that is, at this time, the magnitude statistical feature can characterize: the total number of abnormal behaviors occurring in the time window to be processed is 30, and the total number of behaviors triggering abnormal detection in the time window to be processed is 200.

[0130] It can be understood that all examples in this embodiment are only used to understand the present solution and should not be understood as specific limitations of the present solution.

[0131] In this embodiment, the total number of behaviors that trigger anomaly detection within the time window to be processed and the determined number of first abnormal behaviors are counted to determine the statistical characteristics of the total number of behaviors and the statistical characteristics of abnormal behaviors, so that the magnitude statistical characteristics can be measured in magnitude from two directions: the total number of abnormal behaviors and the total number of behaviors that trigger anomaly detection in the magnitude statistical dimension to ensure the accuracy and completeness of the magnitude statistical characteristics.

[0132] In one embodiment, Fig.11 As shown, the behavior feature includes a proportional statistical feature under a proportional statistical dimension. The proportional statistical feature is used to characterize the ratio of the total number of abnormal behaviors to the total number of behaviors to be evaluated that trigger anomaly detection within the time window to be processed.

[0133] Based on this, feature statistics are performed based on the number of first abnormal behaviors to obtain the behavior features of the time window to be processed, including:

[0134] Step 1102, counting the total number of behaviors in the time window to be processed by using the behavior detection data in the time window to be processed.

[0135] Specifically, the server counts the total number of behaviors in the time window to be processed through the behavior detection data in the time window to be processed, that is, the total number of behaviors to be evaluated that trigger anomaly detection included in the behavior detection data, that is, the total number of behaviors in the time window to be processed. The details are similar to the above embodiment and will not be repeated here.

[0136] Step 1104 , performing proportional feature statistical processing on the number of first abnormal behaviors and the total number of behaviors to obtain proportional statistical features.

[0137] Specifically, the server performs proportional feature statistical processing on the number of first abnormal behaviors and the total number of behaviors to obtain proportional statistical features, that is, the server uses the number of first abnormal behaviors in the time window to be processed as the numerator and the total number of behaviors in the time window to be processed as the denominator to perform proportional feature statistical processing, thereby obtaining the proportional statistical features in the time window to be processed. For ease of understanding, the proportional feature statistical processing method is as shown in formula (5):

[0138]

[0139] Among them, r represents the statistical characteristics of the proportion of the time window to be processed, m represents the total number of behaviors in the time window to be processed, and sum this_window Indicates the number of first abnormal behaviors within the time window to be processed.

[0140] For example, from the above example, it can be seen that the total number of behaviors in the time window to be processed is determined to be 200, and the number of first abnormal behaviors is 30. At this time, the obtained proportional statistical feature is Specifically, the total number of abnormal behaviors in the time window to be processed accounts for 15% of the total number of behaviors to be evaluated that trigger abnormal detection. It is understood that all examples in this embodiment are only used to understand this solution and should not be understood as specific limitations of this solution.

[0141] In this embodiment, the ratio of the total number of abnormal behaviors to the total number of behaviors to be evaluated that trigger anomaly detection within the time window to be processed is statistically calculated to determine the proportion of abnormal behaviors occurring within the time window to be processed, thereby finding out whether the abnormal behavior is common. This ensures the accuracy of the proportional statistical features, thereby providing statistical features with more statistical dimensions and higher accuracy for subsequent calculations, thereby improving the accuracy of abnormal behavior processing.

[0142] In one embodiment, Fig.12 As shown in FIG. 1 , the behavior feature includes the month-on-month statistical feature under the month-on-month statistical dimension. The month-on-month statistical feature is used to characterize the change ratio of the number of abnormal behaviors in two consecutive adjacent time windows.

[0143] Based on this, feature statistics are performed based on the number of first abnormal behaviors to obtain the behavior features of the time window to be processed, including:

[0144] Step 1202, obtaining the previous adjacent time window to the time window to be processed, and obtaining the behavior detection data whose behavior timestamp is within the adjacent time window, wherein the adjacent time window is adjacent to the time window to be processed and has the same window duration.

[0145] The adjacent time window is the previous time window adjacent to the time window to be processed, and the window length of the adjacent time window is consistent with the window length of the time window to be processed. Figure 4 , if the time window to be processed is Figure 4 The time window 402 shown in FIG. 4 is the adjacent time window. Figure 4 Next, taking the sliding time window as an example, please refer to Figure 5 ,If the time window to be processed is the time window 503 shown in FIG. ,5, then the adjacent time window is Figure 5 The time window 502 is shown in FIG.

[0146] Specifically, the server first obtains an adjacent time window that is continuous and adjacent to the time window to be processed and has the same window duration based on the time window to be processed, and then obtains the behavior detection data in the adjacent time window in a manner similar to the above-mentioned embodiment. Since the adjacent time window is already a historical time window, it can be that the user performs an operation behavior in the adjacent time window, and the operation behavior triggers an abnormality detection to generate behavior detection data, and then the behavior detection data in the adjacent time window is stored in the database as historical data. Therefore, the server can obtain the behavior detection data in the adjacent time window from the database when it is necessary to statistically determine the behavior characteristics, that is, the behavior detection data in the adjacent time window can only include the historical behavior detection data in the adjacent time window.

[0147] Among them, similar to the aforementioned embodiment, the behavior detection data within adjacent time windows includes at least: the behavior timestamp of the behavior to be evaluated in the adjacent time window triggering the anomaly detection, the anomaly detection result of the behavior to be evaluated in the adjacent time window, the user identification of the behavior to be evaluated, the scenario type triggering the anomaly detection, and the device information of the device used by the user performing the behavior to be evaluated.

[0148] Step 1204: Count the number of second abnormal behaviors in the adjacent time windows through the abnormal detection results in the behavior detection data in the adjacent time windows.

[0149] Among them, the second number of abnormal behaviors is similar to the first number of abnormal behaviors, both of which are used to describe the number of abnormal behaviors in a time window. The first number of abnormal behaviors is used to describe the number of abnormal behaviors in a time window to be processed, and the second number of abnormal behaviors is used to describe the number of abnormal behaviors in an adjacent time window. Specifically, since the abnormal detection result characterizes that the behavior to be evaluated is an abnormal behavior, or that the behavior to be evaluated is not an abnormal behavior, the server needs to specifically count the abnormal behavior represented by the abnormal detection result in the behavior detection data in the adjacent time window to count the second number of abnormal behaviors in the adjacent time window. The specific statistical method is similar to the aforementioned embodiment and will not be repeated here.

[0150] Step 1206: Perform month-on-month statistical processing on the first abnormal behavior quantity and the second abnormal behavior quantity to obtain month-on-month statistical features.

[0151] Specifically, the server performs month-on-month statistical processing on the number of first abnormal behaviors and the number of second abnormal behaviors to obtain month-on-month statistical features. That is, the server calculates the number of first abnormal behaviors in the time window to be processed, and calculates the difference with the number of second abnormal behaviors in the adjacent time window, and then uses the obtained difference as the numerator and the number of second abnormal behaviors in the adjacent time window as the denominator to perform proportional feature statistical processing, thereby obtaining the month-on-month statistical features in the time window to be processed. For ease of understanding, the month-on-month statistical processing method is as shown in formula (6):

[0152]

[0153] Among them, h represents the month-on-month statistical characteristics of the time window to be processed, and m this_window Indicates the number of first abnormal behaviors within the time window to be processed, m pre_window Characterizes the number of second abnormal behaviors in adjacent time windows.

[0154] For example, further describing the above example, if the number of first abnormal behaviors in the time window to be processed is 30, and the number of second abnormal behaviors in the adjacent time window is 50, the obtained month-on-month statistical feature is: The month-on-month statistical feature is specifically used to characterize that the total number of abnormal behaviors in the time window to be processed has a 40% change ratio compared to that in the adjacent time window. It is understood that all examples in this embodiment are only used to understand this solution and should not be understood as specific limitations of this solution.

[0155] In this embodiment, the month-on-month statistical characteristics are used to characterize the change ratio of the number of abnormal behaviors in two consecutive adjacent time windows. That is, the change ratio of abnormal behaviors between the current time window and the previous time window can be determined, and the degree of risk abnormality can be determined by the change ratio of abnormal behaviors. That is, statistical features with more statistical dimensions and higher accuracy are provided for subsequent calculations, thereby further improving the accuracy of abnormal behavior processing.

[0156] In one embodiment, Fig.13 As shown, the behavior feature includes the magnitude fluctuation statistical feature under the magnitude fluctuation statistical dimension. The magnitude fluctuation statistical feature is used to characterize the fluctuation degree of the number of abnormal behaviors in two consecutive adjacent time windows.

[0157] Based on this, feature statistics are performed based on the number of first abnormal behaviors to obtain the behavior features of the time window to be processed, including:

[0158] Step 1302, obtaining the previous adjacent time window to the time window to be processed, and obtaining the behavior detection data whose behavior timestamp is within the adjacent time window, wherein the adjacent time window is adjacent to the time window to be processed and has the same window duration.

[0159] Among them, the adjacent time window is the previous time window adjacent to the time window to be processed, and the window duration of the adjacent time window is consistent with the window duration of the time window to be processed. Specifically, the server first obtains the adjacent time window that is continuously adjacent to the time window to be processed and has the same window duration based on the time window to be processed, and then obtains the behavior detection data in the adjacent time window in a similar manner to the aforementioned embodiment. Since the adjacent time window is already a historical time window, it can be that the user performs an operation behavior in the adjacent time window, and the operation behavior triggers an abnormality detection to generate behavior detection data, and then the behavior detection data in the adjacent time window is stored as historical data in the database. Therefore, the server can obtain the behavior detection data in the adjacent time window from the database when it is necessary to statistically determine the behavior characteristics, that is, the behavior detection data in the adjacent time window can only include the historical behavior detection data in the adjacent time window.

[0160] Wherein, similar to the above-mentioned embodiment, the behavior detection data in the adjacent time windows at least includes: the behavior timestamp of the behavior to be evaluated in the adjacent time window triggering the anomaly detection, and the anomaly detection result of the behavior to be evaluated in the adjacent time window.

[0161] Step 1304: Count the number of second abnormal behaviors in the adjacent time windows through the abnormal detection results in the behavior detection data in the adjacent time windows.

[0162] Among them, the second number of abnormal behaviors is similar to the first number of abnormal behaviors, both of which are used to describe the number of abnormal behaviors in a time window. The first number of abnormal behaviors is used to describe the number of abnormal behaviors in a time window to be processed, and the second number of abnormal behaviors is used to describe the number of abnormal behaviors in an adjacent time window. Specifically, since the abnormal detection result characterizes that the behavior to be evaluated is an abnormal behavior, or that the behavior to be evaluated is not an abnormal behavior, the server needs to specifically count the abnormal behavior represented by the abnormal detection result in the behavior detection data in the adjacent time window to count the second number of abnormal behaviors in the adjacent time window. The specific statistical method is similar to the aforementioned embodiment and will not be repeated here.

[0163] Step 1306: Perform magnitude fluctuation statistical processing on the first abnormal behavior quantity and the second abnormal behavior quantity to obtain magnitude fluctuation statistical characteristics.

[0164] Specifically, the server performs magnitude fluctuation statistics processing on the number of first abnormal behaviors and the number of second abnormal behaviors to obtain magnitude fluctuation statistical features. That is, the server calculates the number of first abnormal behaviors in the time window to be processed, and performs difference calculation with the number of second abnormal behaviors in the adjacent time window, and then determines the magnitude fluctuation statistical features in the time window to be processed based on the obtained difference. For ease of understanding, the magnitude fluctuation statistical features are calculated as shown in formula (7):

[0165] w=|m this_window -m pre_window |; (7)

[0166] Among them, w represents the magnitude fluctuation statistical characteristics of the time window to be processed, m this_window Indicates the number of first abnormal behaviors within the time window to be processed, m pre_window Characterizes the number of second abnormal behaviors in adjacent time windows.

[0167] For example, further introducing the above example, if it is determined that the number of first abnormal behaviors in the time window to be processed is 30, and the number of second abnormal behaviors in the adjacent time window is 50, the magnitude fluctuation statistical feature obtained at this time is 20 (|30-50|), and the month-on-month statistical feature is specifically used to characterize that the total number of abnormal behaviors in the time window to be processed compared with that in the adjacent time window has a change of 20. It can be understood that all examples in this embodiment are only used to understand this solution and should not be understood as a specific limitation of this solution.

[0168] In this embodiment, the magnitude fluctuation change value of the number of abnormal behaviors in two consecutive adjacent time windows is characterized by the magnitude fluctuation statistical characteristics, that is, the change amplitude of the abnormal number of abnormal behaviors between the current time window and the previous time window can be determined, and the degree of fluctuation of the risk anomaly is analyzed by the change amplitude of the abnormal number, that is, statistical features with more statistical dimensions and higher accuracy are provided for subsequent calculations, thereby further improving the accuracy of abnormal behavior processing.

[0169] In one embodiment, Fig.14 As shown, abnormal behavior processing is performed through security data, including:

[0170] Step 1402: Maintain a self-protection state against abnormal behavior within the data validity period of the security data.

[0171] Among them, the valid duration of the data needs to be determined according to the self-protection dimension matched by the security data. For example, when the self-protection dimension is the magnitude statistical dimension, the valid duration of the data is configured to 30 minutes. When the self-protection dimension is the ratio statistical dimension, the valid duration of the data is configured to 20 minutes. When the self-protection dimension is the month-on-month statistical dimension, the valid duration of the data is configured to 10 minutes. When the self-protection dimension is the magnitude fluctuation statistical dimension, the valid duration of the data is configured to 10 minutes. It can be understood that the aforementioned examples are only used to understand this solution and should not be understood as specific limitations on this solution.

[0172] Specifically, the server processes abnormal behavior through security data, that is, the server maintains a self-protection state for abnormal behavior. Since the self-protection scheme can flexibly support the access and offline configuration of self-protection scenarios, after determining the self-protection dimension, the security data matching the self-protection dimension of the time window to be processed can be obtained, and then the data validity period is configured for the security data. Based on this, the server enters the self-protection state for abnormal behavior after obtaining the security data, and starts timing at the data acquisition timestamp of the security data. In this way, the self-protection state for abnormal behavior is maintained within the data validity period of the security data to ensure that the self-protection scheme remains effective.

[0173] Step 1404, after the data validity period of the security data is reached, the self-protection state is released and the initial state is restored.

[0174] Specifically, considering that the self-protection state should not exist for a long time in actual application scenarios, which will affect the normal operation of the system, the server starts timing when obtaining the data acquisition timestamp of the security data, and when the timing reaches the data validity period of the security data, the self-protection state is released and restored to the initial state, that is, the system is restored to its normal operating state, avoiding system operation problems caused by being in the self-protection state for a long time.

[0175] In this embodiment, the data validity period of the security data is used to ensure that the self-protection state against abnormal behavior is maintained during the data validity period to ensure that the self-protection scheme continues to be effective. After the data validity period of the security data is reached, the self-protection state is released and restored to the initial state to avoid system operation problems caused by being in the self-protection state for a long time, thereby improving the practicality of abnormal behavior processing and ensuring system stability for abnormal behavior processing.

[0176] Based on the detailed description of the above embodiments, the complete process of the method for handling abnormal behavior in the embodiments of the present application will be described below. In one embodiment, Fig.15 As shown, a method for abnormal behavior processing is provided, and the method is applied to Figure 1 The server 104 in the example is used for explanation. It is understandable that the method can also be applied to the terminal 102, and can also be applied to a system including the terminal 102 and the server 104, and is implemented through the interaction between the terminal 102 and the server 104. In this embodiment, the method includes the following steps:

[0177] Step 1501, obtaining behavior detection data generated when performing abnormal detection on the behavior to be evaluated.

[0178] Among them, the behavior detection data includes the behavior timestamp of the behavior to be evaluated triggering the anomaly detection, and the behavior timestamp represents the timestamp of the behavior to be evaluated triggering the anomaly detection. Secondly, anomaly detection is used to detect whether the behavior to be evaluated is an abnormal behavior, so the behavior detection data can also include the anomaly detection result of the behavior to be evaluated, that is, the anomaly detection result represents that the behavior to be evaluated is an abnormal behavior, or that the behavior to be evaluated is not an abnormal behavior.

[0179] Based on this, the behavior to be evaluated can be the operation behavior performed by the user in real time, such as: the login behavior of the user logging into the application software in real time, the payment behavior of the user making real-time payments for virtual products, etc. The behavior to be evaluated can also be the historical operation behavior performed by the user in the historical time period. The behavior to be evaluated that triggers anomaly detection can be the operation behavior of the target type in the target scenario, such as game login, virtual payment, etc.

[0180] Specifically, the server obtains the behavior detection data generated when performing anomaly detection on the behavior to be evaluated. It can be seen from the above introduction that the behavior to be evaluated can be the operation behavior performed by the user in real time. Therefore, when the user performs real-time operation behavior and triggers anomaly detection, the operation behavior is the behavior to be evaluated, thereby generating behavior detection data corresponding to the behavior to be evaluated, that is, the server can obtain the behavior detection data in real time. Secondly, since the behavior to be evaluated can also be the historical operation behavior performed by the user in the historical time period, it can also be the operation behavior performed by the user in the historical time period, and the operation behavior triggers anomaly detection to generate behavior detection data, and then the behavior detection data in the historical time period is stored as historical data in the database. Therefore, the server can obtain the behavior detection data from the database when abnormal behavior processing is required. That is, the behavior detection data can include real-time behavior detection data and historical behavior detection data.

[0181] It is understandable that the behavior detection data may include the behavior timestamp of the behavior to be evaluated that triggers the anomaly detection and the anomaly detection result of the behavior to be evaluated, and may also include the user identifier of the behavior to be evaluated, which may be a user account, etc. And it may also include the scene type that triggers the anomaly detection, such as a game scene, an audio and video viewing scene, an online shopping scene, etc. And it may also include the device information of the device used by the user who performs the behavior to be evaluated, such as the device type and device version, etc. In this embodiment, the data information included in the behavior detection data and the method for obtaining the behavior detection data are not specifically limited.

[0182] Step 1502 , counting the number of first abnormal behaviors in the time window to be processed through the abnormal behaviors represented by the abnormal detection results in the behavior detection data in the time window to be processed.

[0183] The first number of abnormal behaviors is used to describe the number of abnormal behaviors within the time window to be processed. Specifically, since the abnormal detection result indicates that the behavior to be evaluated is an abnormal behavior, or that the behavior to be evaluated is not an abnormal behavior, the server needs to specifically count the number of first abnormal behaviors within the time window to be processed by using the abnormal behaviors represented by the abnormal detection results in the behavior detection data within the time window to be processed.

[0184] Step 1503, counting the total number of behaviors in the time window to be processed through the behavior detection data in the time window to be processed.

[0185] Specifically, the server uses the behavior detection data in the time window to be processed to count the total number of behaviors in the time window to be processed, that is, the total number of behaviors to be evaluated that trigger anomaly detection included in the behavior detection data, which is the total number of behaviors in the time window to be processed.

[0186] Step 1504: determining a statistical feature of the total number of behaviors based on the total number of behaviors, and determining a statistical feature of the abnormal behaviors based on the first abnormal behavior quantity.

[0187] Specifically, the server determines the total number of behaviors based on the total number of behaviors, that is, determines the total number of behaviors to characterize the total number of behaviors in the time window to be processed. Secondly, the server determines the abnormal behavior statistical feature based on the first abnormal behavior number, that is, determines the abnormal behavior statistical feature to characterize the first abnormal behavior number in the time window to be processed.

[0188] Step 1505: Perform proportional feature statistical processing on the number of first abnormal behaviors and the total number of behaviors to obtain proportional statistical features.

[0189] Specifically, the server performs proportional feature statistical processing on the number of first abnormal behaviors and the total number of behaviors to obtain proportional statistical features, that is, the server uses the number of first abnormal behaviors within the time window to be processed as the numerator and the total number of behaviors within the time window to be processed as the denominator to perform proportional feature statistical processing, thereby obtaining the proportional statistical features within the time window to be processed.

[0190] Step 1506, obtaining the previous adjacent time window to the time window to be processed, and obtaining the behavior detection data whose behavior timestamp is within the adjacent time window.

[0191] Among them, the adjacent time window is the previous time window adjacent to the time window to be processed, and the window duration of the adjacent time window is consistent with the window duration of the time window to be processed. Specifically, the server first obtains the adjacent time window that is continuously adjacent to the time window to be processed and has the same window duration based on the time window to be processed, and then obtains the behavior detection data in the adjacent time window in a similar manner to the aforementioned embodiment. Since the adjacent time window is already a historical time window, it can be that the user performs an operation behavior in the adjacent time window, and the operation behavior triggers an abnormality detection to generate behavior detection data, and then the behavior detection data in the adjacent time window is stored as historical data in the database. Therefore, the server can obtain the behavior detection data in the adjacent time window from the database when it is necessary to statistically determine the behavior characteristics, that is, the behavior detection data in the adjacent time window can only include the historical behavior detection data in the adjacent time window.

[0192] Among them, similar to the aforementioned embodiment, the behavior detection data within adjacent time windows includes at least: the behavior timestamp of the behavior to be evaluated in the adjacent time window triggering the anomaly detection, the anomaly detection result of the behavior to be evaluated in the adjacent time window, the user identification of the behavior to be evaluated, the scenario type triggering the anomaly detection, and the device information of the device used by the user performing the behavior to be evaluated.

[0193] Step 1507: Count the number of second abnormal behaviors in the adjacent time windows through the abnormal detection results in the behavior detection data in the adjacent time windows.

[0194] Among them, the second number of abnormal behaviors is similar to the first number of abnormal behaviors, both of which are used to describe the number of abnormal behaviors in a time window. The first number of abnormal behaviors is used to describe the number of abnormal behaviors in a time window to be processed, and the second number of abnormal behaviors is used to describe the number of abnormal behaviors in an adjacent time window. Specifically, since the abnormal detection result characterizes that the behavior to be evaluated is an abnormal behavior, or that the behavior to be evaluated is not an abnormal behavior, the server needs to specifically count the abnormal behavior represented by the abnormal detection result in the behavior detection data in the adjacent time window to count the second number of abnormal behaviors in the adjacent time window. The specific statistical method is similar to the aforementioned embodiment and will not be repeated here.

[0195] Step 1508: Perform month-on-month statistical processing on the first abnormal behavior quantity and the second abnormal behavior quantity to obtain month-on-month statistical features.

[0196] Specifically, the server performs month-on-month statistical processing on the number of first abnormal behaviors and the number of second abnormal behaviors to obtain month-on-month statistical features. That is, the server calculates the number of first abnormal behaviors in the time window to be processed, and performs difference calculation with the number of second abnormal behaviors in the adjacent time window, and then uses the obtained difference as the numerator and the number of second abnormal behaviors in the adjacent time window as the denominator to perform proportional feature statistical processing, thereby obtaining the month-on-month statistical features in the time window to be processed.

[0197] Step 1509: Perform magnitude fluctuation statistical processing on the first abnormal behavior quantity and the second abnormal behavior quantity to obtain magnitude fluctuation statistical characteristics.

[0198] Specifically, the server performs magnitude fluctuation statistics processing on the number of first abnormal behaviors and the number of second abnormal behaviors to obtain magnitude fluctuation statistical features. That is, the server calculates the number of first abnormal behaviors in the time window to be processed, and performs difference calculation with the number of second abnormal behaviors in the adjacent time window, and then determines the magnitude fluctuation statistical features in the time window to be processed based on the obtained difference.

[0199] Step 1510, if there is at least one statistical feature in the behavior feature that is within the abnormal feature range under the statistical dimension, the maximum value of the abnormal feature range, the minimum value of the abnormal feature range, and the statistical feature are normalized to obtain a statistical normalized value under the statistical dimension.

[0200] The abnormal feature range specifically consists of a minimum range value to a maximum range value, and each statistical dimension has a corresponding abnormal feature range. Specifically, when there is at least one statistical feature in the behavior feature that is within the abnormal feature range under the statistical dimension, the server normalizes the abnormal feature range under the statistical dimension by using the maximum range value of the abnormal feature range under the statistical dimension, the minimum range value of the abnormal feature range under the statistical dimension, and the statistical feature under the statistical dimension to obtain a statistical normalized value under the statistical dimension.

[0201] Step 1511, if there is only one statistical feature in the abnormal feature range under the statistical dimension, obtain the dimension weight of the statistical dimension of the statistical feature, and perform weighted processing on the statistical normalized value and the dimension weight to obtain an evaluation value.

[0202] Among them, each statistical dimension has a corresponding dimension weight. Secondly, the evaluation value is used to characterize the abnormal risk level of the time window to be processed. Specifically, when there is only one statistical feature in the abnormal feature range under the statistical dimension, the server first obtains the dimension weight of the statistical dimension of the statistical feature in the abnormal feature range, and then weights the statistical normalization value and the dimension weight to obtain the evaluation value, that is, the dimension weight corresponding to the statistical dimension is weighted with the statistical normalization value of the statistical dimension, and then the result of the weighted processing is the evaluation value.

[0203] Step 1512: If the evaluation value is within the abnormal evaluation value range, the statistical dimension of the statistical feature is determined as the self-protection dimension of the time window to be processed.

[0204] Among them, since the evaluation value is used to characterize the abnormal risk degree of the time window to be processed, the abnormal evaluation value range is used to characterize the abnormal risk degree range where abnormal risks exist. The abnormal evaluation value range can be (60, 100). The specific value needs to be determined based on the actual application scenario and is not limited here.

[0205] Specifically, when the evaluation value is within the abnormal evaluation value range, that is, there is an abnormal risk in the time window to be processed, it is necessary to determine the statistical dimension with the greatest impact on the abnormal behavior. Since there is only one statistical feature within the abnormal feature range under the statistical dimension, that is, other statistical features are not within the abnormal feature range, that is, the statistical features that are not within the abnormal feature range have a greater impact on the risk, at this time, the statistical dimension with the statistical feature within the abnormal feature range is directly determined as the self-protection dimension of the time window to be processed. On the contrary, if the evaluation value is not within the abnormal evaluation value range, it means that the abnormal behavior does not constitute a risk within the time window to be processed. At this time, the self-protection dimension will not be determined, but the aforementioned similar steps will be performed on the next time window adjacent to the time window to be processed.

[0206] Step 1513, if there are multiple statistical features within the abnormal feature range under the statistical dimension, the statistical normalized value of each statistical feature and the dimension weight of the statistical dimension of each statistical feature are weighted to obtain an evaluation value.

[0207] Specifically, when there are multiple statistical features that are within the abnormal feature range under the statistical dimension, the server also needs to first obtain the dimension weights of the statistical dimensions of the statistical features that are within the abnormal feature range, and then perform weighted sum processing on the statistical normalized value of each statistical feature and the dimension weights of the statistical dimension of each statistical feature, and then determine the result of the weighted summation processing as the evaluation value.

[0208] Step 1514: If the evaluation value is within the abnormal evaluation value range, a difference calculation is performed between the statistical normalized value of each statistical feature and the dimension normalized threshold of the statistical dimension of each statistical feature.

[0209] Each statistical dimension has a pre-configured dimension normalization threshold. Secondly, the difference calculation result obtained by performing difference calculation on each statistical dimension is used to characterize: the degree of fluctuation of the statistical feature of the statistical dimension within the abnormal feature range within the time window to be processed.

[0210] Specifically, when the evaluation value is within the abnormal evaluation value range, that is, there is an abnormal risk in the time window to be processed, it is necessary to determine the statistical dimension with the greatest impact on the abnormal behavior. Since there are multiple statistical features within the abnormal feature range under the statistical dimension, it is necessary to select the statistical dimension with the greatest impact on the risk from multiple statistical dimensions. At this time, it is necessary to further determine the degree of fluctuation within the abnormal feature range under the time window to be processed. The greater the degree of fluctuation, the greater the difference, which also indicates that the impact of the statistical dimension is the most obvious. Based on this, the server calculates the difference between the statistical normalized value of the statistical feature and the dimension normalization threshold for each statistical dimension, thereby obtaining the difference calculation result of each statistical dimension.

[0211] Step 1515: determine the statistical dimension with the largest value in the difference calculation result as the self-protection dimension of the time window to be processed.

[0212] Specifically, since the difference calculation result is used to characterize: the fluctuation degree of the statistical characteristics of the statistical dimension within the time window to be processed within the range of abnormal characteristics, the greater the fluctuation degree, that is, the greater the difference, which also means that the influence of the statistical dimension is the most obvious. Therefore, the server determines the statistical dimension with the largest value in the difference calculation result as the self-protection dimension of the time window to be processed.

[0213] Step 1516, obtain security data that matches the self-protection dimension of the time window to be processed, and maintain the self-protection state against abnormal behavior within the data validity period of the security data; after the data validity period of the security data is reached, release the self-protection state and restore the initial state.

[0214] Among them, each statistical dimension has pre-matched security data. And the effective duration of the data needs to be determined according to the self-protection dimension matched by the security data. Specifically, the server obtains the security data matching the self-protection dimension of the time window to be processed, that is, since each statistical dimension has pre-matched security data, then the security data pre-matched by the statistical dimension is used as the security data matching the self-protection dimension, depending on the specific statistical dimension of the self-protection dimension.

[0215] Furthermore, the server processes abnormal behavior through security data, that is, the server maintains a self-protection state for abnormal behavior. Since the self-protection scheme can flexibly support the access and offline configuration of self-protection scenarios, after determining the self-protection dimension, the security data matching the self-protection dimension of the time window to be processed can be obtained, and then the data validity period is configured for the security data. Based on this, the server enters the self-protection state for abnormal behavior after obtaining the security data, and starts timing at the data acquisition timestamp of the security data. Therefore, the self-protection state for abnormal behavior is maintained within the data validity period of the security data to ensure that the self-protection scheme remains effective.

[0216] Secondly, considering that the self-protection state should not exist for a long time in actual application scenarios, which will affect the normal operation of the system, the server starts timing when obtaining the data acquisition timestamp of the security data, and when the timing reaches the data validity period of the security data, the self-protection state is released and restored to the initial state, that is, the normal operation of the system is restored to avoid system operation problems caused by being in the self-protection state for a long time.

[0217] It should be understood that the specific implementation of steps 1501 to 1516 are similar to the above-mentioned embodiments and will not be repeated here.

[0218] It should be understood that, although the steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0219] Based on the same inventive concept, the embodiment of the present application also provides an abnormal behavior processing device for implementing the abnormal behavior processing method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more abnormal behavior processing device embodiments provided below can refer to the limitations of the abnormal behavior processing method above, and will not be repeated here.

[0220] In one embodiment, Fig.16 As shown, an abnormal behavior processing device is provided, including: a data acquisition module 1602, a feature statistics module 1604, a self-protection dimension determination module 1606 and an abnormal behavior processing module 1608, wherein:

[0221] The data acquisition module 1602 is used to acquire behavior detection data generated when abnormal detection of the behavior to be evaluated is performed, and the behavior detection data includes a behavior timestamp when the behavior to be evaluated triggers the abnormal detection;

[0222] A feature statistics module 1604 is used to perform feature statistics on the behavior detection data whose behavior timestamp is within the time window to be processed, and obtain the behavior feature of the time window to be processed, where the behavior feature includes a statistical feature under at least one statistical dimension;

[0223] A self-protection dimension determination module 1606 is used to determine the self-protection dimension of the time window to be processed through the behavior characteristics, where the self-protection dimension is used to characterize: a statistical dimension of the maximum impact on the abnormal behavior in the time window to be processed;

[0224] The abnormal behavior processing module 1608 is used to obtain security data matching the self-protection dimension of the time window to be processed, and perform abnormal behavior processing through the security data.

[0225] In one embodiment, the self-protection dimension determination module 1606 is specifically used to obtain a statistical normalization value under the statistical dimension by normalizing the maximum value of the abnormal feature range, the minimum value of the abnormal feature range, and the statistical feature if there is at least one statistical feature in the behavioral feature that is within the abnormal feature range under the statistical dimension; and determine the self-protection dimension of the time window to be processed based on the statistical normalization value.

[0226] In one embodiment, the self-protection dimension determination module 1606 is specifically used to obtain the dimension weight of the statistical dimension of the statistical feature if there is only one statistical feature in the abnormal feature range under the statistical dimension, and to weightedly process the statistical normalized value and the dimension weight to obtain an evaluation value; if the evaluation value is in the abnormal evaluation value range, the statistical dimension of the statistical feature is determined as the self-protection dimension of the time window to be processed.

[0227] In one embodiment, the self-protection dimension determination module 1606 is specifically used to perform weighted processing on the statistical normalized value of each statistical feature and the dimension weight of the statistical dimension of each statistical feature to obtain an evaluation value if there are multiple statistical features within the abnormal feature range under the statistical dimension; if the evaluation value is within the abnormal evaluation value range, perform difference calculation on the statistical normalized value of each statistical feature and the dimension normalization threshold of the statistical dimension of each statistical feature; and determine the statistical dimension with the largest value in the difference calculation result as the self-protection dimension of the time window to be processed.

[0228] In one embodiment, the behavior detection data also includes abnormal detection results of the behavior to be evaluated;

[0229] The feature statistics module 1604 is specifically used to count the number of first abnormal behaviors in the time window to be processed through the abnormal behaviors represented by the abnormal detection results in the behavior detection data in the time window to be processed; and perform feature statistics based on the number of first abnormal behaviors to obtain the behavior characteristics of the time window to be processed.

[0230] In one embodiment, the behavior detection data also includes abnormal detection results of the behavior to be evaluated;

[0231] The feature statistics module 1604 is specifically used to count the total number of behaviors in the time window to be processed through the behavior detection data in the time window to be processed, and determine the total number of behaviors statistical features based on the total number of behaviors; determine the abnormal behavior statistical features based on the first abnormal behavior number.

[0232] In one embodiment, the behavior feature includes a magnitude statistical feature under a magnitude statistical dimension, and the magnitude statistical feature includes a total number of behaviors statistical feature and an abnormal behavior statistical feature;

[0233] The feature statistics module 1604 is specifically used to count the total number of behaviors in the time window to be processed through the behavior detection data in the time window to be processed, and determine the total number of behaviors statistical features based on the total number of behaviors; determine the abnormal behavior statistical features based on the first abnormal behavior number.

[0234] In one embodiment, the behavior feature includes a proportional statistical feature under a proportional statistical dimension;

[0235] The feature statistics module 1604 is specifically used to count the total number of behaviors in the time window to be processed through the behavior detection data in the time window to be processed; and perform proportional feature statistics processing on the number of first abnormal behaviors and the total number of behaviors to obtain proportional statistical features.

[0236] In one embodiment, the behavior feature includes a month-on-month statistical feature under a month-on-month statistical dimension;

[0237] The feature statistics module 1604 is specifically used to obtain the previous adjacent time window of the time window to be processed, and obtain the behavior detection data whose behavior timestamp is in the adjacent time window, the adjacent time window is adjacent to the time window to be processed, and the window length is consistent; through the anomaly detection results in the behavior detection data in the adjacent time window, the number of second abnormal behaviors in the adjacent time window is counted; the number of first abnormal behaviors and the number of second abnormal behaviors are subjected to month-on-month statistical processing to obtain month-on-month statistical features.

[0238] In one embodiment, the behavior feature includes a magnitude fluctuation statistical feature under a magnitude fluctuation statistical dimension;

[0239] The feature statistics module 1604 is specifically used to obtain the previous adjacent time window of the time window to be processed, and obtain the behavior detection data whose behavior timestamp is in the adjacent time window, the adjacent time window is adjacent to the time window to be processed, and the window length is consistent; through the anomaly detection results in the behavior detection data in the adjacent time window, the number of second abnormal behaviors in the adjacent time window is counted; the magnitude fluctuation statistics are processed by the number of first abnormal behaviors and the number of second abnormal behaviors to obtain the magnitude fluctuation statistical characteristics.

[0240] In one embodiment, the abnormal behavior processing module 1608 is specifically used to maintain a self-protection state against abnormal behavior within the data validity period of the security data; after the data validity period of the security data is reached, the self-protection state is released and the initial state is restored.

[0241] Each module in the abnormal behavior processing device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0242] In one embodiment, a computer device is provided. The computer device may be a server or a terminal. In this embodiment, the computer device is described as a server as an example. The internal structure diagram thereof may be as follows: Fig.17 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store behavior detection data and other data related to the embodiment of the present application. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for abnormal behavior processing is implemented.

[0243] Those skilled in the art will understand that Fig.17 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0244] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0245] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0246] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0247] It should be noted that the object information (including but not limited to object device information, object personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the object or fully authorized by all parties, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0248] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0249] The technical feature information of the above embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical feature information in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical feature information, they should be considered to be within the scope of this specification.

[0250] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be construed as limiting the scope of the present application. It should be noted that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present application, and these are all within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be subject to the attached claims.

Claims

1. A method for handling abnormal behavior, characterized in that: include: Acquire behavior detection data generated when performing anomaly detection on the behavior to be evaluated, the behavior detection data including a behavior timestamp when the behavior to be evaluated triggers anomaly detection; Performing feature statistics on the behavior detection data whose behavior timestamp is within the time window to be processed to obtain the behavior feature of the time window to be processed, wherein the behavior feature includes a statistical feature under at least one statistical dimension; Determine the self-protection dimension of the time window to be processed by the behavior feature, where the self-protection dimension is used to characterize: the statistical dimension of the maximum influence that causes abnormal behavior to occur within the time window to be processed; Acquire security data that matches the self-protection dimension of the time window to be processed, and perform abnormal behavior processing based on the security data.

2. The method according to claim 1, characterized in that The determining the self-protection dimension of the to-be-processed time window by using the behavior characteristics includes: If there is at least one statistical feature in the behavior feature that is within the abnormal feature range under the statistical dimension, a normalization process is performed with the statistical feature by using the maximum value of the abnormal feature range, the minimum value of the abnormal feature range, and the statistical feature to obtain a statistical normalization value under the statistical dimension; A self-protection dimension of the time window to be processed is determined based on the statistical normalized value.

3. The method according to claim 2, characterized in that The determining the self-protection dimension of the to-be-processed time window based on the statistical normalized value includes: If there is only one statistical feature that is within the abnormal feature range under the statistical dimension, obtain the dimension weight of the statistical dimension of the statistical feature, and perform weighted processing on the statistical normalized value and the dimension weight to obtain an evaluation value; If the evaluation value is within the abnormal evaluation value range, the statistical dimension of the statistical feature is determined as the self-protection dimension of the time window to be processed.

4. The method according to claim 2, characterized in that: The determining the self-protection dimension of the to-be-processed time window based on the statistical normalized value includes: If there are multiple statistical features that are within the abnormal feature range under the statistical dimension, weighting is performed on the statistical normalization value of each statistical feature and the dimension weight of the statistical dimension of each statistical feature to obtain an evaluation value; If the evaluation value is within the abnormal evaluation value range, performing difference calculation on the statistical normalized value of each of the statistical features and the dimension normalized threshold of the statistical dimension of each of the statistical features; The statistical dimension with the largest value in the difference calculation result is determined as the self-protection dimension of the time window to be processed.

5. The method according to claim 1, characterized in that The behavior detection data also includes abnormal detection results of the behavior to be evaluated; The performing feature statistics on the behavior detection data whose behavior timestamp is within the time window to be processed to obtain the behavior features of the time window to be processed includes: By using the abnormal behaviors represented by the abnormal detection results in the behavior detection data in the time window to be processed, counting the number of first abnormal behaviors in the time window to be processed; Feature statistics are performed based on the first abnormal behavior quantity to obtain the behavior features of the time window to be processed.

6. The method according to claim 5, characterized in that The behavior characteristics include magnitude statistical characteristics under the magnitude statistical dimension, and the magnitude statistical characteristics include total behavior statistical characteristics and abnormal behavior statistical characteristics; The performing feature statistics based on the first abnormal behavior quantity to obtain the behavior feature of the to-be-processed time window includes: By using the behavior detection data in the time window to be processed, counting the total number of behaviors in the time window to be processed, and determining the statistical feature of the total number of behaviors based on the total number of behaviors; The abnormal behavior statistical feature is determined based on the first abnormal behavior quantity.

7. The method according to claim 5, characterized in that The behavior characteristics include proportional statistical characteristics under the proportional statistical dimension; The performing feature statistics based on the first abnormal behavior quantity to obtain the behavior feature of the to-be-processed time window includes: By using the behavior detection data in the time window to be processed, the total number of behaviors in the time window to be processed is counted; Performing proportional feature statistical processing on the number of the first abnormal behaviors and the total number of behaviors to obtain the proportional statistical feature.

8. The method according to claim 5, characterized in that The behavior characteristics include month-on-month statistical characteristics under the month-on-month statistical dimension; The performing feature statistics based on the first abnormal behavior quantity to obtain the behavior feature of the to-be-processed time window includes: Obtaining a previous adjacent time window to the time window to be processed, and obtaining the behavior detection data whose behavior timestamp is within the adjacent time window, wherein the adjacent time window is adjacent to the time window to be processed and has the same window duration; Counting the number of second abnormal behaviors in the adjacent time window through the abnormal detection results in the behavior detection data in the adjacent time window; The month-on-month statistical feature is obtained by performing month-on-month statistical processing on the number of the first abnormal behaviors and the number of the second abnormal behaviors.

9. The method according to claim 5, characterized in that The behavior characteristics include magnitude fluctuation statistical characteristics under the magnitude fluctuation statistical dimension; The performing feature statistics based on the first abnormal behavior quantity to obtain the behavior feature of the to-be-processed time window includes: Obtaining a previous adjacent time window to the time window to be processed, and obtaining the behavior detection data whose behavior timestamp is within the adjacent time window, wherein the adjacent time window is adjacent to the time window to be processed and has the same window duration; Counting the number of second abnormal behaviors in the adjacent time window through the abnormal detection results in the behavior detection data in the adjacent time window; The magnitude fluctuation statistical feature is obtained by performing magnitude fluctuation statistical processing on the first abnormal behavior quantity and the second abnormal behavior quantity.

10. The method according to claim 1, characterized in that The abnormal behavior processing using the security data includes: Maintaining a self-protection state against abnormal behavior within the validity period of the security data; After the data validity period of the security data is reached, the self-protection state is released and the initial state is restored.

11. An abnormal behavior processing device, characterized in that: The device comprises: A data acquisition module, used to acquire behavior detection data generated when performing anomaly detection on the behavior to be evaluated, wherein the behavior detection data includes a behavior timestamp when the behavior to be evaluated triggers the anomaly detection; A feature statistics module, used for performing feature statistics on the behavior detection data whose behavior timestamp is within the time window to be processed, to obtain the behavior feature of the time window to be processed, wherein the behavior feature includes a statistical feature under at least one statistical dimension; A self-protection dimension determination module, used to determine the self-protection dimension of the time window to be processed according to the behavior characteristics, wherein the self-protection dimension is used to characterize: a statistical dimension of the maximum influence that causes abnormal behavior to occur within the time window to be processed; The abnormal behavior processing module is used to obtain security data matching the self-protection dimension of the time window to be processed, and perform abnormal behavior processing through the security data.

12. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 10 are implemented.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

14. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

Images