Plug-in program behavior identification method and device based on log analysis

Abstract

The embodiment of the invention discloses a plug-in program behavior identification method and device based on log analysis. The method comprises the steps that an operation log of an application system is obtained, the operation log comprises a plurality of operation behavior records, and each operation behavior record comprises an operation account, operation time and an operation service type; determining operation behavior feature information corresponding to each operation behavior record based on the operation account, the operation time and the operation service type; clustering all the operation behavior records based on the operation behavior feature information to obtain a plurality of class clusters; determining an abnormal probability corresponding to each operation behavior record in each class cluster based on the operation behavior feature information corresponding to each operation behavior record in each class cluster; and determining an abnormal operation behavior record based on the abnormal probability, and determining an operation behavior corresponding to the abnormal operation behavior record as a plug-in program behavior. Through the technical scheme of the embodiment of the invention, the accuracy and robustness of behavior identification of the plug-in program are improved.

Description

Technical Field

[0001] The embodiments of the present invention relate to computer technology, and in particular to a method and device for identifying plug-in program behavior based on log analysis. Background Art

[0002] Cheat behavior refers to the business operation behavior of cheating by using cheat programs in the application system. Cheat behavior has great harm to daily production. It is unpredictable, difficult to find and uncontrollable, so it is necessary to identify the cheat behavior in the application system.

[0003] The existing plug-in behavior recognition method is usually to build a model of normal operation behavior and use the model to detect any abnormal behavior that deviates from normal operation. For example, a sudden increase in login attempts or a sharp increase in the frequency of access to a specific file may be abnormal behavior. However, in the process of implementing the present invention, the inventor found that there are at least the following problems in the prior art:

[0004] The above method relies on the modeling of normal operation behavior, but in actual applications, the normal operation behavior of users may vary greatly, resulting in a high false alarm rate in the above method. For example, the occasional abnormal behavior of users may be misjudged as plug-in behavior, reducing the recognition accuracy. Summary of the invention

[0005] The embodiment of the present invention provides a plug-in program behavior identification method and device based on log analysis to improve the accuracy and robustness of plug-in program behavior identification.

[0006] In a first aspect, an embodiment of the present invention provides a method for identifying plug-in behavior based on log analysis, comprising:

[0007] Obtaining an operation log of the application system, wherein the operation log includes multiple operation behavior records, each operation behavior record includes an operation account, operation time, and operation business type;

[0008] Determine the operation behavior characteristic information corresponding to each operation behavior record based on the operation account, the operation time, and the operation business type;

[0009] Based on the operation behavior feature information corresponding to each operation behavior record, all operation behavior records are clustered to obtain multiple clusters;

[0010] Determine the abnormal probability corresponding to each operation behavior record in each cluster based on the operation behavior feature information corresponding to each operation behavior record in each cluster;

[0011] An abnormal operation behavior record is determined based on the abnormal probability, and the operation behavior corresponding to the abnormal operation behavior record is determined as a plug-in program behavior.

[0012] In a second aspect, an embodiment of the present invention further provides a plug-in behavior identification device based on log analysis, comprising:

[0013] An operation log acquisition module is used to acquire the operation log of the application system, wherein the operation log includes multiple operation behavior records, each of which includes the operation account, operation time and operation business type;

[0014] An operation behavior characteristic information determination module, used to determine the operation behavior characteristic information corresponding to each operation behavior record based on the operation account, the operation time and the operation business type;

[0015] An operation behavior record clustering module is used to cluster all operation behavior records based on the operation behavior feature information corresponding to each operation behavior record to obtain multiple clusters;

[0016] An abnormality probability determination module, used to determine the abnormality probability corresponding to each operation behavior record in each cluster based on the operation behavior feature information corresponding to each operation behavior record in each cluster;

[0017] The plug-in program behavior determination module is used to determine the abnormal operation behavior record based on the abnormal probability, and determine the operation behavior corresponding to the abnormal operation behavior record as the plug-in program behavior.

[0018] In a third aspect, an embodiment of the present invention further provides an electronic device, the electronic device comprising:

[0019] one or more processors;

[0020] A memory for storing one or more programs;

[0021] When the one or more programs are executed by the one or more processors, the one or more processors implement the plug-in program behavior identification method based on log analysis as provided in any embodiment of the present invention.

[0022] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a plug-in behavior identification method based on log analysis as provided in any embodiment of the present invention.

[0023] One embodiment of the above invention has the following advantages or beneficial effects:

[0024] By obtaining the operation log of the application system, the operation log includes multiple operation behavior records, each operation behavior record includes the operation account, operation time and operation business type; based on the operation account, operation time and operation business type, the operation behavior feature information corresponding to each operation behavior record is determined, and based on the operation behavior feature information corresponding to each operation behavior record, all operation behavior records are clustered to obtain multiple clusters, and all operation behavior records in each cluster are records with similar behaviors. Based on the operation behavior feature information corresponding to each operation behavior record in each cluster, the abnormal probability corresponding to each operation behavior record in each cluster is determined, and the abnormal operation behavior record is determined based on the abnormal probability, and the operation behavior corresponding to the abnormal operation behavior record is determined as the plug-in program behavior, so that the plug-in program behavior can be accurately identified by clustering and parsing the operation behavior records in the operation log, reducing the false alarm rate and the false negative rate, and improving the accuracy and robustness of plug-in program behavior recognition. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0026] Figure 1 It is a flow chart of a method for identifying plug-in program behavior based on log analysis provided by an embodiment of the present invention;

[0027] Figure 2 It is a flowchart of another plug-in program behavior identification method based on log analysis provided by an embodiment of the present invention;

[0028] Figure 3 It is a flowchart of another plug-in program behavior identification method based on log analysis provided by an embodiment of the present invention;

[0029] Figure 4 It is a structural schematic diagram of a plug-in program behavior identification device based on log analysis provided by an embodiment of the present invention;

[0030] Figure 5 It is a structural schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0031] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only parts related to the present invention, rather than all structures, are shown in the accompanying drawings.

[0032] Figure 1 This is a flowchart of a method for identifying plug-in behavior based on log analysis provided by an embodiment of the present invention. This embodiment is applicable to the situation of identifying plug-in behavior in an application system, especially to the identification of plug-in behavior in a business processing scenario. This method can be executed by a plug-in behavior identification device based on log analysis, which can be implemented by software and / or hardware and integrated in an electronic device. Figure 1 As shown, the method specifically comprises the following steps:

[0033] S110 , obtaining an operation log of the application system, where the operation log includes a plurality of operation behavior records, each of which includes an operation account, operation time, and operation business type.

[0034] The application system may refer to any application system of business software, so as to identify the plug-in behavior existing in the application system. The plug-in behavior is manifested in the application system as high-frequency, similar, large-scale and rhythmic business operation behavior. These business operations are difficult to achieve manually and are implemented through plug-ins and scripts. Based on the characteristics of plug-in behavior, the plug-in behavior in the application system can be accurately and quickly identified by identifying the high-frequency, similar, large-scale and rhythmic operation behavior records in the operation log.

[0035] Among them, the operation log is the historical operation log generated by the application system within a preset time period. The preset time period can be set in advance based on the identification requirements. For example, the preset time period can refer to a recent period of time, such as the last week or the last half month, so as to identify the plug-in behavior that exists in the application system in the recent period of time. The operation behavior record is used to record the operation data of each business operation behavior in the application system. Each operation behavior record contains information such as the operation account, operation time, and operation business type. The operation account can refer to the login account during the business operation. The operation time refers to the execution time of the business operation behavior. The operation business type refers to the business type operated by the business operation behavior. There are multiple business types in the application system. Different business types are used to handle different businesses.

[0036] Specifically, if it is necessary to identify the behavior of plug-in programs in a certain application system, the operation log generated by the application system within a preset time period is obtained from the log file, and all operation behavior records in the operation log and the operation account, operation time and operation business type in each operation behavior record are obtained.

[0037] S120: Determine operation behavior characteristic information corresponding to each operation behavior record based on the operation account, operation time, and operation business type.

[0038] The operation behavior characteristic information is used to characterize the operation behavior characteristics in each operation behavior record. For example, the operation behavior characteristic information may include the operation behavior frequency information of the same type under the same account. Specifically, based on the operation account, operation time and operation business type corresponding to each operation behavior record, the operation behavior characteristic information corresponding to each operation behavior record is effectively extracted.

[0039] It should be noted that this embodiment only needs to extract and mine useful operation behavior feature information based on three types of information: operation account, operation time, and operation business type, thereby realizing feature extraction of operation behavior with less record information, and has high scalability.

[0040] Exemplarily, the operation behavior characteristic information corresponding to each operation behavior record includes at least one of the following:

[0041] The average number of operations, the operation time interval between the operation behavior record and the previous record, the number of second-level operations generated within the second in which the operation behavior record is located, the number of minute-level operations generated within the minute in which the operation behavior record is located, and the number of interval operations within the continuous operation interval in which the operation behavior record is located.

[0042] The average number of operations can refer to the average number of operations per unit time, such as the average number of operations per minute. The operation time interval is used to characterize the operation interval between two adjacent operation behaviors. The number of operations per second refers to the total number of operations generated within the second in which the operation behavior is recorded, that is, the number of operations that occur within one second. The number of operations per minute refers to the total number of operations generated within the minute in which the operation behavior is recorded, that is, the number of operations that occur within one minute.

[0043] Among them, the operation time interval between each two adjacent operation behavior records in the continuous operation interval is less than or equal to the preset time interval, and the operation time interval between the first operation behavior record and the previous record in the continuous operation interval is greater than the preset time interval, and the operation time interval between the last operation behavior record and the next record in the continuous operation interval is greater than the preset time interval. The previous record corresponding to the first operation behavior record refers to an operation behavior record whose operation time is earlier than the operation time of the first operation behavior record and is closest to the operation time of the first operation behavior record. The next record corresponding to the last operation behavior record refers to an operation behavior record whose operation time is later than the operation time of the last operation behavior record and is closest to the operation time of the last operation behavior record. The continuous operation interval is composed of at least one operation behavior record. If the operation time interval between a certain operation behavior record and the previous record is greater than the preset time interval, and the operation time interval between a certain operation behavior record and the next record is greater than the preset time interval, it is determined that the operation behavior record itself constitutes a continuous operation interval. The number of interval operations refers to the number of operation behavior records contained in the continuous operation interval in which the operation behavior record is located. The operation behaviors corresponding to all operation behavior records in the same continuous operation interval are interrelated, that is, all operation behaviors in the same continuous operation interval can be regarded as the same type of operation behaviors), while the operation behaviors in different continuous operation intervals are unrelated to each other.

[0044] Exemplarily, step S120 may include: grouping all operation behavior records based on the operation account and the operation business type to obtain a first record set corresponding to each operation business type in each operation account; sorting all operation behavior records in each first record set based on the operation time corresponding to each operation behavior record in each first record set to obtain a sorted second record set; performing record statistics based on the operation time corresponding to each operation behavior record in each second record set to determine the operation behavior feature information corresponding to each operation behavior record in each second record set.

[0045] Specifically, all operation behavior records are grouped according to the operation account and operation business type in each operation behavior record, and a first record set corresponding to each operation business type in each operation account is obtained. For example, all operation behavior records are first grouped according to the operation account in each operation behavior record to obtain a record set corresponding to each operation account, and then the record set corresponding to each operation account is grouped again according to the operation business type in each operation behavior record to obtain a first record set corresponding to each operation business type in each operation account. All operation behavior records in each first record set have the same operation account and the same operation business type. According to the operation time corresponding to each operation behavior record in each first record set, all operation behavior records in each first record set are sorted, such as sorting the operation time from early to late, to obtain a sorted second record set. The first record set corresponds to the second record set one by one. The first record set is an unordered set, and the second record set is an ordered set. Based on the operation time corresponding to each operation behavior record in each second record set, the operation behavior feature information corresponding to each operation behavior record in each second record set is determined, such as the average number of operations, operation time interval, number of operations in seconds, number of operations in minutes, and number of operations in intervals corresponding to each operation behavior record. By grouping and sorting the operation behavior records by operation account, operation time, and operation business type, the operation behavior feature information that can characterize the operation frequency can be effectively and accurately extracted, thereby improving the accuracy of plug-in behavior recognition.

[0046] S130: Clustering all operation behavior records based on the operation behavior feature information corresponding to each operation behavior record to obtain multiple clusters.

[0047] Specifically, a density-based clustering algorithm is used to cluster all operation behavior records according to the operation behavior feature information corresponding to each operation behavior record to obtain multiple clusters. Among them, the density-based clustering algorithm does not need to pre-set the number of clusters, so that any type of clusters can be found, and it will not stick to a fixed pattern, and has a certain robustness. For example, the density-based clustering algorithm can be but is not limited to the DBSCAN (Density-Based Spatial Clustering of Applications with Noise) clustering algorithm. Each cluster includes multiple operation behavior records with similar operation behaviors. Exemplarily, according to the operation account and operation business type in each operation behavior record, all operation behavior records are grouped to obtain the first record set corresponding to each operation business type in each operation account. Based on the density-based clustering algorithm and the operation behavior feature information corresponding to each operation behavior record, each first record set is clustered respectively to obtain all clusters after each first record set is clustered. By grouping based on operation account and operation business type, and clustering each first record set obtained after grouping, the operation behavior records in each cluster obtained have the same operation account and operation business type, which further improves the clustering effect and the accuracy of plug-in behavior identification.

[0048] For example, after clustering all operation behavior records, if there are discrete points, that is, data in the cluster that obviously deviates from other points, then since the operation behaviors corresponding to these discrete points cannot be plug-in behaviors, these discrete points can be deleted at this time, and subsequent analysis can be performed based on the cluster after deleting the discrete points, thereby ensuring the accuracy of plug-in behavior identification.

[0049] S140: Determine the abnormal probability corresponding to each operation behavior record in each cluster based on the operation behavior feature information corresponding to each operation behavior record in each cluster.

[0050] The abnormal probability may refer to the probability value that the operation behavior corresponding to the operation behavior record is a plug-in program behavior. Specifically, for each cluster, within the cluster range, the operation frequency is statistically analyzed based on the operation behavior feature information corresponding to each operation behavior record, and the abnormal probability corresponding to each operation behavior record in the cluster is determined. If the operation frequency within the cluster range is higher, it indicates that the abnormal probability corresponding to the operation behavior record is higher.

[0051] S150. Determine an abnormal operation behavior record based on the abnormal probability, and determine the operation behavior corresponding to the abnormal operation behavior record as a plug-in program behavior.

[0052] Among them, abnormal operation behavior records may refer to operation behavior records generated by plug-in program behaviors. Abnormal operation behavior records refer to high-frequency, similar, large-scale and rhythmic operation behavior records. Specifically, operation behavior records with abnormal probability greater than a preset probability are determined as abnormal operation behavior records, and the operation behavior corresponding to each abnormal operation behavior record is determined as an operation behavior performed by a plug-in program, thereby effectively identifying all plug-in program behaviors existing in the application system, reducing the false alarm rate and missed alarm rate, and only requiring less record information for identification, with high robustness and accuracy.

[0053] The technical solution of this embodiment is to obtain the operation log of the application system, the operation log includes multiple operation behavior records, each operation behavior record includes the operation account, operation time and operation business type; based on the operation account, operation time and operation business type, determine the operation behavior feature information corresponding to each operation behavior record, and based on the operation behavior feature information corresponding to each operation behavior record, cluster all operation behavior records to obtain multiple clusters, and all operation behavior records in each cluster are records with similar behaviors. Based on the operation behavior feature information corresponding to each operation behavior record in each cluster, determine the abnormal probability corresponding to each operation behavior record in each cluster, and determine the abnormal operation behavior record based on the abnormal probability, and determine the operation behavior corresponding to the abnormal operation behavior record as the plug-in program behavior, so that the plug-in program behavior can be accurately identified by clustering and parsing the operation behavior records in the operation log, reducing the false alarm rate and the missed alarm rate, and improving the accuracy and robustness of plug-in program behavior recognition.

[0054] Figure 2 A flowchart of another plug-in behavior identification method based on log analysis provided by an embodiment of the present invention, based on the above embodiments, this embodiment describes in detail the operation behavior feature information corresponding to each operation behavior record and the determination process of abnormal probability. The explanations of the terms that are the same or corresponding to the above embodiments are not repeated here.

[0055] See also Figure 2 Another plug-in program behavior identification method based on log analysis provided in this embodiment specifically includes the following steps:

[0056] S210: Obtain an operation log of the application system, where the operation log includes multiple operation behavior records, each of which includes an operation account, operation time, and operation business type.

[0057] S220: Group all operation behavior records based on the operation account and the operation business type, and obtain a first record set corresponding to each operation business type in each operation account.

[0058] S230: Sort all operation behavior records in each first record set based on the operation time corresponding to each operation behavior record in each first record set to obtain a sorted second record set.

[0059] S240. For each second record set, based on the operation time corresponding to each operation behavior record in the second record set, determine the operation duration and the number of operations corresponding to the second record set, and based on the operation duration and the number of operations, determine the average number of operations corresponding to each operation behavior record in the second record set.

[0060] Specifically, for each second record set, based on the operation time corresponding to each operation behavior record in the second record set, the operation duration corresponding to the second record set is counted, and the operation duration may refer to the time difference between the operation time corresponding to the first operation behavior record and the operation time corresponding to the last operation behavior record in the second record set. The operation duration may be characterized by minutes so as to obtain the average number of operations per minute. The number of operation behavior records contained in the second record set is determined as the number of operations corresponding to the second record set. The result obtained by dividing the number of operations corresponding to the second record set by the operation duration is determined as the average number of operations corresponding to each operation behavior record in the second record set. Different operation behavior records in the same second record set have the same average number of operations.

[0061] S250. Based on the operation time corresponding to each operation behavior record in the second record set, determine the operation time interval, the number of operations in seconds, the number of operations in minutes, and the number of operations in intervals corresponding to each operation behavior record in the second record set.

[0062] Specifically, the operation time corresponding to each operation behavior record in the second record set is compared to determine the operation time interval between each operation behavior record in the second record set and the previous record, the number of second-level operations generated within the second where each operation behavior record is located, the number of minute-level operations generated within the minute where each operation behavior record is located, and the number of interval operations within the continuous operation interval where each operation behavior record is located. It should be noted that different operation behavior records in the same second record set may have different operation time intervals, different numbers of second-level operations, different numbers of minute-level operations, and different numbers of interval operations.

[0063] Exemplarily, step S250 may include: for each operation behavior record in the second record set, based on the operation time corresponding to the operation behavior record and the operation time corresponding to the previous record of the operation behavior record, determining the operation time interval between the operation behavior record and the previous record; based on the operation time corresponding to the operation behavior record and the operation time corresponding to other operation behavior records in the second record set except the operation behavior record, determining the number of second-level operations generated within the second in which the operation behavior record is located, the number of minute-level operations generated within the minute in which the operation behavior record is located, and the continuous operation interval in which the operation behavior record is located; counting the number of operation behavior records in the continuous operation interval to obtain the number of interval operations corresponding to the operation behavior record.

[0064] Specifically, for each operation behavior record in the second record set, the operation time corresponding to the operation behavior record is subtracted from the operation time corresponding to the previous record of the operation behavior record to determine the operation time interval between the operation behavior record and the previous record. The previous record of the operation behavior record refers to the previous operation behavior record adjacent to the operation behavior record in the second record set. If the operation time of the operation behavior record and the previous record are exactly the same, then the operation time interval corresponding to the operation behavior record is determined to be 0, or the previous record in the second record set that is different from the operation time of the operation behavior record but the closest distance is obtained, and the operation time interval between the operation behavior record and the previous record is determined, and in this case, the operation time interval corresponding to the operation behavior record is not 0.

[0065] Based on the operation time corresponding to the operation behavior record, determine the second and minute of the operation behavior record, count the number of operation behavior records with operation time within the second, and use the number as the number of second-level operations generated within the second of the operation behavior record, and count the number of operation behavior records with operation time within the minute, and use the number as the number of second-level operations generated within the minute of the operation behavior record.

[0066] Taking the operation behavior record as the starting point, detect whether the operation time interval between the operation behavior record and the previous record is less than or equal to the preset time interval. If so, determine that the operation behavior record and the previous record are in the same continuous operation interval, and continue to detect whether the operation time interval between the previous record and the first two records is less than or equal to the preset time interval; if not, determine that the operation behavior record is the last operation behavior record in the continuous operation interval, and at this time, one end boundary of the continuous operation interval where the operation behavior record is located is determined. Then detect whether the operation time interval between the operation behavior record and the next record is less than or equal to the preset time interval to determine the other end boundary of the continuous operation interval where the operation behavior record is located, thereby completing the determination of the continuous operation interval where the operation behavior record is located. It should be noted that if the operation behavior record is the first operation behavior record or the last operation behavior record in the second record set, since there is no previous record or next record of the operation behavior record, it is only necessary to determine one end of the continuous operation interval where the operation behavior record is located. The number of operation behavior records in the continuous operation interval where the operation behavior record is located is determined as the number of interval operations corresponding to the operation behavior record.

[0067] Exemplarily, if the second record set is: {record A, record B, record C, record D}, where the operation time interval between record A and record B is greater than the preset time interval, the operation time interval between record B and record C is less than or equal to the preset time interval, and the operation time interval between record C and record D is less than or equal to the preset time interval, then the continuous operation interval where record A is located is determined to be: {record A}, and the continuous operation intervals where records B, record C, and record D are located are all: {record B, record C, record D}. The number of interval operations corresponding to record A is 1, and the number of interval operations corresponding to records B, record C, and record D are all 3.

[0068] S260: Cluster all operation behavior records based on the operation behavior feature information corresponding to each operation behavior record to obtain multiple clusters.

[0069] S270: For each cluster, based on the average number of operations and the interval number of operations corresponding to each operation behavior record in the cluster, group all operation behavior records in the cluster to obtain multiple third record sets.

[0070] Specifically, for each cluster, all operation behavior records in the cluster are grouped according to the average number of operations and interval operation times corresponding to each operation behavior record in the cluster to obtain multiple third record sets, and all operation behavior records in each third record set have the same average number of operations and interval operation times. By grouping based on the average number of operations and interval operation times, more similar records can be further grouped together, thereby achieving a more detailed division of similar operation behaviors and further improving the accuracy of recognition.

[0071] S280: Determine the abnormal probability corresponding to each operation behavior record in each third record set based on the number of second-level operations, the number of minute-level operations, and the number of interval operations corresponding to each operation behavior record in each third record set.

[0072] Specifically, for each operation behavior record in each third record set, frequency statistics are performed based on the number of second-level operations, minute-level operations, and interval operations corresponding to the operation behavior record to determine the abnormal probability corresponding to the operation behavior record.

[0073] Exemplarily, step S280 may include: for each operation behavior record in each third record set, determining a first ratio based on the number of second operations and the number of minute operations corresponding to the operation behavior record; determining the total number of second operations corresponding to the third record set based on the number of second operations corresponding to each operation behavior record in the third record set; determining a second ratio based on the total number of second operations and the number of interval operations corresponding to the operation behavior record; determining the abnormality probability corresponding to the operation behavior record based on the first ratio, the second ratio and the number of operation behavior records in the third record set.

[0074] Specifically, for each operation behavior record in each third record set, the number of second-level operations corresponding to the operation behavior record is divided by the number of minute-level operations to obtain a first ratio. The number of second-level operations corresponding to each operation behavior record in the third record set is added together to obtain the total number of second-level operations corresponding to the third record set. The number of interval operations corresponding to the operation behavior record is divided by the total number of second-level operations to obtain a second ratio. The first ratio, the second ratio, and the number of operation behavior records in the third record set are multiplied, and the multiplication result is used as the abnormal probability corresponding to the operation behavior record. Among them, the higher the first ratio, the second ratio, and the number of operation behavior records in the third record set, the higher the frequency of occurrence of the operation behavior record, that is, the greater the possibility that the operation behavior record is a plug-in behavior record, that is, the higher the abnormal probability.

[0075] S290. Determine an abnormal operation behavior record based on the abnormal probability, and determine the operation behavior corresponding to the abnormal operation behavior record as a plug-in program behavior.

[0076] The technical solution of this embodiment realizes effective extraction of operation behavior features by determining the average number of operations, operation time interval, number of operations in seconds, number of operations in minutes, and number of interval operations corresponding to each operation behavior record in each second record set. By grouping all operation behavior records in the cluster based on the average number of operations and number of interval operations corresponding to each operation behavior record in the cluster, and determining the abnormal probability corresponding to each operation behavior record in each third record set, a more detailed division of similar operation behaviors is achieved, and the abnormal probability is determined more accurately, further improving the accuracy of plug-in behavior recognition.

[0077] Figure 3 This is a flowchart of another plug-in behavior identification method based on log analysis provided by an embodiment of the present invention. Based on the above embodiments, this embodiment optimizes the step of "determining abnormal operation behavior records based on abnormal probability". The explanations of the terms that are the same or corresponding to the above embodiments are not repeated here.

[0078] See also Figure 3 Another plug-in program behavior identification method based on log analysis provided in this embodiment specifically includes the following steps:

[0079] S310: Obtain the operation log of the application system. The operation log includes multiple operation behavior records. Each operation behavior record includes the operation account, operation time and operation business type.

[0080] S320: Determine the operation behavior characteristic information corresponding to each operation behavior record based on the operation account, operation time, and operation business type.

[0081] S330: Cluster all operation behavior records based on the operation behavior feature information corresponding to each operation behavior record to obtain multiple clusters.

[0082] S340: Determine the abnormal probability corresponding to each operation behavior record in each cluster based on the operation behavior feature information corresponding to each operation behavior record in each cluster.

[0083] S350: Group all operation behavior records based on the operation account and the operation business type, and obtain a first record set corresponding to each operation business type in each operation account.

[0084] Specifically, all operation behavior records are grouped according to the operation account and the operation business type in each operation behavior record, and a first record set corresponding to each operation business type in each operation account is obtained. For example, all operation behavior records are first grouped according to the operation account in each operation behavior record to obtain a record set corresponding to each operation account, and then the record set corresponding to each operation account is grouped again according to the operation business type in each operation behavior record to obtain a first record set corresponding to each operation business type in each operation account. All operation behavior records in each first record set have the same operation account and the same operation business type.

[0085] S360: Sort all operation behavior records in each first record set based on the operation time corresponding to each operation behavior record in each first record set to obtain a sorted second record set.

[0086] Specifically, all operation behavior records in each first record set are sorted according to the operation time corresponding to each operation behavior record in each first record set, for example, the operation time is sorted from early to late, and a sorted second record set is obtained. The first record set corresponds to the second record set one by one. The first record set is an unordered set, and the second record set is an ordered set.

[0087] It should be noted that if steps S350 and S360 have been executed in the process of determining the operation behavior characteristic information corresponding to each operation behavior record, there is no need to execute steps S350 and S360 again after step S340, and the subsequent step S370 can be directly executed based on the multiple second record sets obtained previously.

[0088] S370: Subtract the operation time corresponding to the first operation behavior record from the operation time corresponding to each operation behavior record in each second record set to obtain a time interval sequence corresponding to each second record set.

[0089] The first operation behavior record refers to the operation behavior record with the earliest operation time in the second record set. Specifically, for each second record set, the operation time corresponding to each operation behavior record in the second record set is subtracted from the operation time corresponding to the first operation behavior record to obtain the time interval corresponding to each operation behavior record in the second record set, and all time intervals are sorted according to the order of records in the second record set to obtain the time interval sequence corresponding to the second record set. For example, the second record set is {I0, I1, I2…I n}, the corresponding time interval sequence is {0, t1, t2…t n}.

[0090] S380: Determine an abnormal record sequence in each second record set based on the time interval sequence corresponding to each second record set, wherein the time intervals between each two adjacent operation behavior records in the abnormal record sequence are equal.

[0091] Among them, the abnormal record sequence is used to characterize the sequence of regular operation behaviors generated, that is, an operation is performed once every fixed time, and a corresponding operation record is generated. The time interval corresponding to each operation behavior record in the abnormal record sequence constitutes an abnormal time interval sequence. The abnormal time interval sequence can be any arithmetic progression. The abnormal time interval sequence corresponds to the abnormal record sequence one by one. The number of abnormal record sequences present in each second record set can be one or more.

[0092] Specifically, for each second record set, a two-layer loop traversal can be performed on the time interval sequence corresponding to the second record set to determine each abnormal time interval sequence in the time interval sequence, and based on the operation behavior record corresponding to the time interval in each abnormal time interval sequence, the abnormal record sequence corresponding to each abnormal time interval sequence is determined, thereby obtaining all abnormal record sequences in the second record set. The process of the two-layer loop traversal is as follows: use an external loop to traverse each element in the time interval sequence corresponding to the second record set, with index i; in the external loop body, use an internal loop to traverse each element from index i+1 to the end; in the internal loop body, calculate the difference between the inner and outer elements, and add the difference to the inner element to determine whether the added result is in the time interval sequence. If so, it means that the three elements constitute an arithmetic progression (i.e., an abnormal time interval sequence), continue to add the difference to the new element to determine whether it is in the new list, and so on; if not, enter the next internal loop. After the internal loop ends, continue the next iteration of the external loop; after the external loop ends, all abnormal time interval sequences in the time interval sequence are found. The above two-layer loop traversal process reflects the greedy idea, that is: a 1, ,a2,…,a n-1 ,a n is an arithmetic progression of n elements, then a1,a2,…,a n-1 It must also be an arithmetic progression, that is, after finding an arithmetic progression in the sequence, it is only necessary to determine whether the next element is in the sequence. By using the two-layer loop traversal method, all abnormal record sequences existing in each second record set can be accurately determined, thereby further improving the accuracy of plug-in behavior recognition.

[0093] S390. Based on the abnormal probability and the abnormal record sequence, determine the abnormal operation behavior record, and determine the operation behavior corresponding to the abnormal operation behavior record as the plug-in program behavior.

[0094] Specifically, the abnormal record sequence is a record of regular operations, in which the operation behavior has a high probability of being executed by a plug-in program, so that the plug-in program behavior can be identified by combining the abnormal probability and the abnormal record sequence at the same time, further improving the accuracy of plug-in program behavior identification.

[0095] Exemplarily, “determining abnormal operation behavior records based on abnormal probability and abnormal record sequence” in step S390 may include: determining an operation behavior record whose abnormal probability is greater than a preset probability and is located in the abnormal record sequence as an abnormal operation behavior record.

[0096] Specifically, the greater the abnormal probability corresponding to the operation behavior record, the greater the possibility that the operation behavior record is an abnormal operation behavior record. The operation behavior record located in the abnormal record sequence has a high probability of being an abnormal operation behavior record. Accordingly, the operation behavior records with an abnormal probability greater than a preset probability and located in the abnormal record sequence are determined as abnormal operation behavior records, and then the operation behaviors corresponding to these abnormal operation behavior records are determined as plug-in program behaviors, thereby further improving the accuracy of plug-in program behavior identification.

[0097] The technical solution of this embodiment can more accurately determine abnormal operation behavior records by simultaneously considering the abnormal probability and the abnormal record sequence, thereby further improving the accuracy of plug-in program behavior identification.

[0098] Figure 4 This is a schematic diagram of the structure of a plug-in behavior identification device based on log analysis provided by an embodiment of the present invention. This embodiment is applicable to the situation of identifying plug-in behaviors existing in an application system. Figure 4 As shown, the device specifically includes: an operation log acquisition module 410, an operation behavior characteristic information determination module 420, an operation behavior record clustering module 430, an abnormal probability determination module 440 and a plug-in program behavior determination module 450.

[0099] Among them, the operation log acquisition module 410 is used to obtain the operation log of the application system, and the operation log includes multiple operation behavior records, each operation behavior record includes an operation account, an operation time and an operation business type; the operation behavior characteristic information determination module 420 is used to determine the operation behavior characteristic information corresponding to each operation behavior record based on the operation account, the operation time and the operation business type; the operation behavior record clustering module 430 is used to cluster all operation behavior records based on the operation behavior characteristic information corresponding to each operation behavior record to obtain multiple clusters; the abnormal probability determination module 440 is used to determine the abnormal probability corresponding to each operation behavior record in each cluster based on the operation behavior characteristic information corresponding to each operation behavior record in each cluster; the plug-in behavior determination module 450 is used to determine the abnormal operation behavior record based on the abnormal probability, and determine the operation behavior corresponding to the abnormal operation behavior record as the plug-in behavior.

[0100] Optionally, the operation behavior characteristic information corresponding to each operation behavior record includes at least one of the following:

[0101] The average number of operations, the time interval between an operation record and the previous record, the number of second-level operations generated within the second in which the operation record is recorded, the number of minute-level operations generated within the minute in which the operation record is recorded, and the number of interval operations within the continuous operation interval in which the operation record is recorded;

[0102] Among them, the operation time interval between each two adjacent operation behavior records in the continuous operation interval is less than or equal to the preset time interval, and the operation time interval between the first operation behavior record and the previous record in the continuous operation interval is greater than the preset time interval, and the operation time interval between the last operation behavior record and the next record in the continuous operation interval is greater than the preset time interval.

[0103] Optionally, the operation behavior characteristic information determining module 420 includes:

[0104] A first record set determining unit, configured to group all operation behavior records based on the operation account and the operation business type, and obtain a first record set corresponding to each operation business type in each operation account;

[0105] A second record set determining unit, configured to sort all the operation behavior records in each first record set based on the operation time corresponding to each operation behavior record in each first record set, to obtain a sorted second record set;

[0106] The characteristic information determining unit is used to perform record statistics based on the operation time corresponding to each operation behavior record in each second record set, and determine the operation behavior characteristic information corresponding to each operation behavior record in each second record set.

[0107] Optionally, the feature information determining unit includes:

[0108] a first characteristic information determination subunit, for each second record set, determining, based on the operation time corresponding to each operation behavior record in the second record set, an operation duration and an operation number corresponding to the second record set, and determining, based on the operation duration and the operation number, an average number of operations corresponding to each operation behavior record in the second record set;

[0109] The second characteristic information determination subunit is used to determine the operation time interval, the number of second-level operations, the number of minute-level operations and the number of interval operations corresponding to each operation behavior record in the second record set based on the operation time corresponding to each operation behavior record in the second record set.

[0110] Optionally, the second characteristic information determination subunit is specifically used to: for each operation behavior record in the second record set, determine the operation time interval between the operation behavior record and the previous record based on the operation time corresponding to the operation behavior record and the operation time corresponding to the previous record of the operation behavior record; determine the number of second-level operations generated within the second in which the operation behavior record is located, the number of minute-level operations generated within the minute in which the operation behavior record is located, and the continuous operation interval in which the operation behavior record is located based on the operation time corresponding to the operation behavior record and the operation time corresponding to other operation behavior records in the second record set except the operation behavior record; count the number of operation behavior records in the continuous operation interval to obtain the number of interval operations corresponding to the operation behavior record.

[0111] Optionally, the abnormal probability determination module 440 includes:

[0112] A third record set determination unit is used to group all the operation behavior records in each cluster based on the average number of operations and the number of interval operations corresponding to each operation behavior record in the cluster to obtain multiple third record sets;

[0113] The abnormality probability determination unit is used to determine the abnormality probability corresponding to each operation behavior record in each third record set based on the second-level operation number, minute-level operation number and interval operation number corresponding to each operation behavior record in each third record set.

[0114] Optionally, the abnormality probability determination unit is specifically used to: determine a first ratio for each operation behavior record in each third record set based on the number of second operations and the number of minute operations corresponding to the operation behavior record; determine the total number of second operations corresponding to the third record set based on the number of second operations corresponding to each operation behavior record in the third record set; determine a second ratio based on the total number of second operations and the number of interval operations corresponding to the operation behavior record; and determine the abnormality probability corresponding to the operation behavior record based on the first ratio, the second ratio and the number of operation behavior records in the third record set.

[0115] Optionally, the plug-in behavior determination module 450 includes:

[0116] A first record set determining unit, configured to group all operation behavior records based on the operation account and the operation business type, and obtain a first record set corresponding to each operation business type in each operation account;

[0117] A second record set determining unit, configured to sort all the operation behavior records in each first record set based on the operation time corresponding to each operation behavior record in each first record set, to obtain a sorted second record set;

[0118] a time interval sequence determining unit, configured to subtract the operation time corresponding to the first operation behavior record from the operation time corresponding to each operation behavior record in each second record set, to obtain the time interval sequence corresponding to each second record set;

[0119] An abnormal record sequence determination unit is used to determine the abnormal record sequence existing in each second record set based on the time interval sequence corresponding to each second record set, wherein the time intervals between each two adjacent operation behavior records in the abnormal record sequence are equal;

[0120] The abnormal operation behavior record determining unit is used to determine the abnormal operation behavior record based on the abnormal probability and the abnormal record sequence.

[0121] Optionally, the abnormal operation behavior record determination unit is specifically configured to determine an operation behavior record whose abnormal probability is greater than a preset probability and is located in the abnormal record sequence as an abnormal operation behavior record.

[0122] The plug-in behavior identification device based on log analysis provided in the embodiment of the present invention can execute the plug-in behavior identification method based on log analysis provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of executing the plug-in behavior identification method based on log analysis.

[0123] Figure 5A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. Figure 5 A block diagram of an exemplary electronic device 12 suitable for use in implementing embodiments of the present invention is shown. Figure 5 The electronic device 12 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0124] like Figure 5 As shown, the electronic device 12 is in the form of a general purpose computing device. The components of the electronic device 12 may include, but are not limited to: one or more processors or processing units 16, a system memory 28, and a bus 18 that connects various system components (including the system memory 28 and the processing unit 16).

[0125] Bus 18 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor or a local bus using any of a variety of bus architectures. By way of example, these architectures include, but are not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MAC) bus, an Enhanced ISA bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.

[0126] The electronic device 12 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the electronic device 12, including volatile and non-volatile media, removable and non-removable media.

[0127] The system memory 28 may include computer system readable media in the form of volatile memory, such as random access memory 30 (RAM) and / or cache memory 32. The electronic device 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 34 may be used to read and write non-removable, non-volatile magnetic media ( Figure 5 not shown, usually called a "hard drive"). Although Figure 5 Not shown in the figure, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to the bus 18 via one or more data medium interfaces. The system memory 28 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present invention.

[0128] A program / utility 40 having a set (at least one) of program modules 42 may be stored, for example, in system memory 28, such program modules 42 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. Program modules 42 generally perform the functions and / or methods of the embodiments described herein.

[0129] The electronic device 12 may also communicate with one or more external devices 14 (e.g., keyboards, pointing devices, displays 24, etc.), may communicate with one or more devices that enable a user to interact with the electronic device 12, and / or may communicate with any device that enables the electronic device 12 to communicate with one or more other computing devices (e.g., network cards, modems, etc.). Such communication may be performed via an input / output (I / O) interface 22. Furthermore, the electronic device 12 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 20. As shown, the network adapter 20 communicates with other modules of the electronic device 12 via a bus 18. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 12, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0130] The processing unit 16 executes various functional applications and data processing by running the programs stored in the system memory 28, such as implementing a method and steps for identifying plug-in program behavior based on log analysis provided in any embodiment of the present invention.

[0131] Of course, those skilled in the art can understand that the processor can also implement the technical solution of the plug-in program behavior identification method based on log analysis provided by any embodiment of the present invention.

[0132] This embodiment provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps of the plug-in program behavior identification method based on log analysis as provided in any embodiment of the present invention are implemented.

[0133] The computer storage medium of the embodiment of the present invention can adopt any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to: an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it.

[0134] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0135] It should be understood by those skilled in the art that the modules or steps of the present invention described above can be implemented by a general-purpose computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, optionally, they can be implemented by a program code executable by a computer device, so that they can be stored in a storage device and executed by the computing device, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0136] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A plug-in behavior identification method based on log analysis, characterized in that: include: Obtaining an operation log of the application system, wherein the operation log includes multiple operation behavior records, each operation behavior record includes an operation account, operation time, and operation business type; Determine the operation behavior characteristic information corresponding to each operation behavior record based on the operation account, the operation time, and the operation business type; Based on the operation behavior feature information corresponding to each operation behavior record, all operation behavior records are clustered to obtain multiple clusters; Determine the abnormal probability corresponding to each operation behavior record in each cluster based on the operation behavior feature information corresponding to each operation behavior record in each cluster; An abnormal operation behavior record is determined based on the abnormal probability, and the operation behavior corresponding to the abnormal operation behavior record is determined as a plug-in program behavior.

2. The method according to claim 1, characterized in that The operation behavior feature information corresponding to each operation behavior record includes at least one of the following: The average number of operations, the time interval between an operation record and the previous record, the number of second-level operations generated within the second in which the operation record is recorded, the number of minute-level operations generated within the minute in which the operation record is recorded, and the number of interval operations within the continuous operation interval in which the operation record is recorded; Among them, the operation time interval between each two adjacent operation behavior records in the continuous operation interval is less than or equal to the preset time interval, and the operation time interval between the first operation behavior record and the previous record in the continuous operation interval is greater than the preset time interval, and the operation time interval between the last operation behavior record and the next record in the continuous operation interval is greater than the preset time interval.

3. The method according to claim 1, characterized in that Based on the operation account, the operation time and the operation business type, the operation behavior characteristic information corresponding to each operation behavior record is determined, including: Based on the operation account and the operation business type, group all operation behavior records to obtain a first record set corresponding to each operation business type in each operation account; Based on the operation time corresponding to each operation behavior record in each first record set, sorting all the operation behavior records in each first record set to obtain a sorted second record set; Record statistics are performed based on the operation time corresponding to each operation behavior record in each second record set to determine the operation behavior feature information corresponding to each operation behavior record in each second record set.

4. The method according to claim 3, characterized in that Performing record statistics based on the operation time corresponding to each operation behavior record in each second record set, and determining the operation behavior feature information corresponding to each operation behavior record in each second record set, includes: For each second record set, based on the operation time corresponding to each operation behavior record in the second record set, determine the operation duration and the number of operations corresponding to the second record set, and based on the operation duration and the number of operations, determine the average number of operations corresponding to each operation behavior record in the second record set; Based on the operation time corresponding to each operation behavior record in the second record set, the operation time interval, the number of operations in seconds, the number of operations in minutes, and the number of operations in intervals corresponding to each operation behavior record in the second record set are determined.

5. The method according to claim 4, characterized in that Determining the operation time interval, the number of operations in seconds, the number of operations in minutes, and the number of operations in intervals corresponding to each operation behavior record in the second record set based on the operation time corresponding to each operation behavior record in the second record set includes: For each operation behavior record in the second record set, based on the operation time corresponding to the operation behavior record and the operation time corresponding to the previous record of the operation behavior record, determine the operation time interval between the operation behavior record and the previous record; Based on the operation time corresponding to the operation behavior record and the operation times corresponding to other operation behavior records in the second record set except the operation behavior record, determine the number of second-level operations generated in the second in which the operation behavior record is located, the number of minute-level operations generated in the minute in which the operation behavior record is located, and the continuous operation interval in which the operation behavior record is located; The number of operation behavior records within the continuous operation interval is counted to obtain the interval operation times corresponding to the operation behavior record.

6. The method according to claim 2, characterized in that Based on the operation behavior feature information corresponding to each operation behavior record in each cluster, determining the abnormal probability corresponding to each operation behavior record in each cluster includes: For each cluster, based on the average number of operations and the number of interval operations corresponding to each operation behavior record in the cluster, all operation behavior records in the cluster are grouped to obtain multiple third record sets; Based on the number of second-level operations, the number of minute-level operations, and the number of interval operations corresponding to each operation behavior record in each third record set, the abnormal probability corresponding to each operation behavior record in each third record set is determined.

7. The method according to claim 6, characterized in that Determining the abnormal probability corresponding to each operation behavior record in each third record set based on the number of second-level operations, the number of minute-level operations, and the number of interval operations corresponding to each operation behavior record in each third record set includes: For each operation behavior record in each third record set, determining a first ratio based on the number of second-level operations and the number of minute-level operations corresponding to the operation behavior record; Determine the total number of second-level operations corresponding to the third record set based on the number of second-level operations corresponding to each operation behavior record in the third record set; Determining a second ratio based on the total number of second-level operations and the number of interval operations corresponding to the operation behavior record; Based on the first ratio, the second ratio, and the number of operation behavior records in the third record set, an abnormal probability corresponding to the operation behavior record is determined.

8. The method according to claim 1, characterized in that Determining abnormal operation behavior records based on the abnormal probability includes: Based on the operation account and the operation business type, group all operation behavior records to obtain a first record set corresponding to each operation business type in each operation account; Based on the operation time corresponding to each operation behavior record in each first record set, sorting all the operation behavior records in each first record set to obtain a sorted second record set; Subtract the operation time corresponding to the first operation behavior record from the operation time corresponding to each operation behavior record in each second record set to obtain a time interval sequence corresponding to each second record set; Based on the time interval sequence corresponding to each second record set, determining the abnormal record sequence existing in each second record set, wherein the time intervals between each two adjacent operation behavior records in the abnormal record sequence are equal; Based on the abnormal probability and the abnormal record sequence, an abnormal operation behavior record is determined.

9. The method according to claim 8, characterized in that Determining abnormal operation behavior records based on the abnormal probability and the abnormal record sequence includes: The operation behavior record whose abnormal probability is greater than the preset probability and is located in the abnormal record sequence is determined as an abnormal operation behavior record.

10. A plug-in program behavior identification device based on log analysis, characterized in that: include: An operation log acquisition module is used to acquire the operation log of the application system, wherein the operation log includes multiple operation behavior records, each of which includes the operation account, operation time and operation business type; An operation behavior characteristic information determination module, used to determine the operation behavior characteristic information corresponding to each operation behavior record based on the operation account, the operation time and the operation business type; An operation behavior record clustering module is used to cluster all operation behavior records based on the operation behavior feature information corresponding to each operation behavior record to obtain multiple clusters; An abnormality probability determination module, used to determine the abnormality probability corresponding to each operation behavior record in each cluster based on the operation behavior feature information corresponding to each operation behavior record in each cluster; The plug-in program behavior determination module is used to determine the abnormal operation behavior record based on the abnormal probability, and determine the operation behavior corresponding to the abnormal operation behavior record as the plug-in program behavior.

Images