Abnormal behavior detection method and system based on network traffic

Abstract

The invention provides an abnormal behavior detection method and system based on network traffic. The method comprises the following steps: acquiring traffic data corresponding to a proxy IP address accessing a target ticketing platform within a preset time period; constructing a proxy IP address table according to a target data request packet in the traffic data; area flow for accessing the target ticketing platform in a target area is obtained, a source IP address in the target area is determined according to the proxy IP address table, and the source IP address is determined based on data request packet information for accessing a target proxy IP address in the proxy IP address table in the area flow; and on the basis of a preset access frequency threshold, abnormal behavior detection is carried out on target access frequency information, an abnormal behavior detection result of the source IP address is acquired, and the target access frequency information is access frequency information of the source IP address accessing the target ticketing platform within the preset time period. According to the invention, the abnormal behavior of ticket swiping by using the agent is found in time.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an abnormal behavior detection method and system based on network traffic. Background Art

[0002] With the continuous advancement and innovation of technology, the Internet has been deeply integrated into every aspect of our daily lives. While we are immersed in the convenience and efficiency brought by technological leaps, some daily activities have quietly become extremely difficult to carry out, such as tickets for popular tourist destinations, concerts, and sports events are frequently in short supply.

[0003] Some ticket fraudsters use technical tools to hoard a large number of ticket resources and then resell them at prices far higher than the original price. This abnormal behavior infringes the legitimate rights and interests of consumers and event organizers. Given that these ticket fraudsters often use proxy services to cover up their real network addresses and geographic locations, and tamper with device information to evade detection, existing methods such as IP address and device feature identification are difficult to quickly and accurately identify abnormal behavior.

[0004] Therefore, there is an urgent need for an abnormal behavior detection method and system based on network traffic to solve the above problems. Summary of the invention

[0005] In view of the problems existing in the prior art, the present invention provides a method and system for detecting abnormal behavior based on network traffic.

[0006] The present invention provides a method for detecting abnormal behavior based on network traffic, comprising: Obtain traffic data corresponding to the proxy IP address accessing the target ticketing platform within a preset period; Constructing a proxy IP address table according to the target data request packet in the traffic data; Acquire the regional traffic in the target area accessing the target ticketing platform, and determine the source IP address in the target area according to the proxy IP address table, wherein the source IP address is determined based on the data request packet information in the regional traffic accessing the target proxy IP address in the proxy IP address table; Based on a preset access frequency threshold, abnormal behavior detection is performed on the target access frequency information to obtain the abnormal behavior detection result of the source IP address, wherein the target access frequency information is the access frequency information of the source IP address accessing the target ticketing platform within the preset time period.

[0007] According to a method for detecting abnormal behavior based on network traffic provided by the present invention, the step of constructing a proxy IP address table according to a target data request packet in the traffic data includes: Obtaining identification bit information of each data request packet in the traffic data; Determine the data request packet whose identification bit information is PSH type in the traffic data as the target data request packet; obtain the number of data packets of the target data request packets of different proxy IP addresses within the preset time period; The proxy IP address is used as the key and the number of data packets is used as the value to construct a HashMap, and the HashMap is sorted in descending order based on the number of data packets to obtain the proxy IP address table.

[0008] According to a method for detecting abnormal behavior based on network traffic provided by the present invention, before obtaining the regional traffic of accessing the target ticketing platform in the target area, the method further includes: The target area is determined based on the area location information corresponding to the historical abnormal behavior detection results.

[0009] According to a method for detecting abnormal behavior based on network traffic provided by the present invention, determining the source IP address in the target area according to the proxy IP address table includes: Determine a plurality of target proxy IP addresses according to the sorting result of the HashMap in the proxy IP address table; Obtaining identification bit information of each regional traffic data packet accessing the target proxy IP address in the regional traffic; Determine the IP address corresponding to the regional traffic data packet whose identification bit information is of PSH type as the pending IP address; The same pending IP address corresponding to the multiple target proxy IP addresses is determined as the source IP address in the target area.

[0010] According to an abnormal behavior detection method based on network traffic provided by the present invention, based on a preset access frequency threshold, abnormal behavior detection is performed on the target access frequency information to obtain the abnormal behavior detection result of the source IP address, including: obtaining the target access frequency information of the source IP address accessing the target proxy IP address within the preset time period; if the target access frequency information is greater than or equal to the preset access frequency threshold, it is determined that the source IP address has abnormal behavior, and the real IP address corresponding to the source IP address is obtained.

[0011] According to a method for detecting abnormal behavior based on network traffic provided by the present invention, after performing abnormal behavior detection on target access frequency information based on a preset access frequency threshold and obtaining the abnormal behavior detection result of the source IP address, the method further includes: Obtaining access time information corresponding to when the source IP address accesses the target proxy IP address; According to the source IP address, the access time information and the target access frequency information, an abnormal behavior information display result is constructed.

[0012] The present invention also provides an abnormal behavior detection system based on network traffic, comprising: The ticketing platform traffic collection module is used to obtain the traffic data corresponding to the proxy IP address accessing the target ticketing platform within a preset period of time; A proxy IP analysis module, used to construct a proxy IP address table according to a target data request packet in the traffic data; A regional traffic analysis module, used to obtain the regional traffic in the target area accessing the target ticketing platform, and determine the source IP address in the target area according to the proxy IP address table, wherein the source IP address is determined based on the data request packet information in the regional traffic accessing the target proxy IP address in the proxy IP address table; The abnormal behavior detection module is used to perform abnormal behavior detection on the target access frequency information based on a preset access frequency threshold, and obtain the abnormal behavior detection result of the source IP address, wherein the target access frequency information is the access frequency information of the source IP address accessing the target ticketing platform within the preset time period.

[0013] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the abnormal behavior detection method based on network traffic as described above is implemented.

[0014] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the abnormal behavior detection method based on network traffic as described in any one of the above is implemented.

[0015] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements any of the above-mentioned abnormal behavior detection methods based on network traffic.

[0016] The abnormal behavior detection method and system based on network traffic provided by the present invention construct a proxy IP address table for accessing the ticketing platform, and then determine the access frequency of the source IP address information of the target proxy IP address in the access proxy IP address table. This can timely detect abnormal behavior of using a proxy to swipe tickets without any perception. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 A schematic diagram of a flow chart of an abnormal behavior detection method based on network traffic provided by the present invention; Figure 2 A schematic diagram of the structure of the abnormal behavior detection system based on network traffic provided by the present invention; Figure 3 This is a schematic structural diagram of an electronic device provided by the present invention. DETAILED DESCRIPTION

[0019] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0020] Figure 1 The flowchart of the abnormal behavior detection method based on network traffic provided by the present invention is as follows: Figure 1 As shown, the present invention provides a method for detecting abnormal behavior based on network traffic, comprising: Step 101, obtaining traffic data corresponding to the proxy IP address accessing the target ticketing platform within a preset period of time.

[0021] In the present invention, the target ticketing platform and its specific network address (IP address or domain name) are monitored. During the monitoring process, the preset time period can be set to the key time point before and after the ticketing platform opens for ticket grabbing, for example, the first 60 seconds before and after the ticket grabbing starts, which is the time period when the proxy IP activities are most frequent.

[0022] Furthermore, network packet capture tools, such as Wireshark or tcpdump, are used to capture packets during the ordering process on the ticketing platform. These tools can capture and analyze packets during network communications, thereby identifying the IP addresses used when interacting with the ticketing platform. These IP addresses may be servers that users directly access, or they may contain requests forwarded through proxy servers.

[0023] In the present invention, a flow collection unit (such as a NetFlow sensor, sFlow collector, etc.) can be deployed in advance at the data center or network node where the ticketing platform server is located. These devices can capture and record the network flow data in real time, especially focusing on the data within a preset time period. If it is not possible to directly deploy the flow collection unit at the location of the ticketing platform server, the log files or network flow records of the ticketing platform in a specific time period can be exported by data export, ensuring that the data contains all requests to access the ticketing platform, especially those that may be made through a proxy IP.

[0024] Step 102: construct a proxy IP address table according to the target data request packet in the traffic data.

[0025] In the present invention, the source, destination, port and data stream of the traffic data are deeply detected and traced, and all target data request packets are screened out from the collected traffic data. In the screened data request packets, it is necessary to detect the flag bit of the TCP transport layer, that is, to detect the request packet with the TCP flag bit as the PSH (Push) type, wherein the PSH flag bit is used to indicate that the receiver should immediately pass the data from the TCP receiving buffer to the upper layer application, indicating that the priority of the data packet is higher.

[0026] Furthermore, the number of requests for each source address (i.e., proxy IP address) is counted. The present invention implements this by maintaining a hash table (HashMap), in which the key is the source address and the value is the number of requests issued by the address. Whenever a PSH type request packet (i.e., target data request packet) is detected, the record of the source address of the request packet in the hash table is searched, and the corresponding value is increased by 1.

[0027] After completing the data request packet count, sort them by the number of requests to get a proxy IP address table arranged from high to low in terms of access frequency. Finally, the sorted proxy IP address table is used as the output result. This proxy IP address table contains the proxy IP addresses of high-frequency access to the ticketing platform and their corresponding number of requests, providing an important basis for subsequent security analysis, monitoring and response.

[0028] Step 103, obtaining the regional traffic in the target area for accessing the target ticketing platform, and determining the source IP address in the target area according to the proxy IP address table, wherein the source IP address is determined based on the data request packet information in the regional traffic for accessing the target proxy IP address in the proxy IP address table.

[0029] In the present invention, the target area may be a geographical area (such as a city or a community), or a network area (such as a corporate intranet). Further, all network traffic data accessing the target ticketing platform in this specific area is obtained.

[0030] Furthermore, all data request packets accessing the target proxy IP address in the proxy IP address table are filtered out from the regional traffic in the target area, which involves in-depth analysis of the regional traffic, especially checking the header information of each data packet, including the source address, destination address, port number, and transport layer protocol (such as TCP or UDP), etc. By matching the destination address of the data packet with the proxy IP address in the proxy IP address table, requests to access the ticketing platform through the proxy server can be identified.

[0031] In the present invention, for each data request packet that is screened out in the regional traffic, its source IP address needs to be further determined. The source IP address is the network address of the sender of the data packet, which is usually located in the IP header of the data packet. By extracting this address, it can be determined which network node or user device initiated the access request to the proxy IP address.

[0032] Step 104, based on a preset access frequency threshold, perform abnormal behavior detection on the target access frequency information to obtain the abnormal behavior detection result of the source IP address, wherein the target access frequency information is the access frequency information of the source IP address accessing the target ticketing platform within the preset time period.

[0033] In the present invention, a reasonable access frequency threshold is set, and then the access frequency information of each source IP address in the target period is collected. Then, the access frequency information is compared with the access frequency threshold to detect whether there is abnormal behavior. Finally, the abnormal behavior detection result of each source IP address is obtained.

[0034] The abnormal behavior detection method based on network traffic provided by the present invention constructs a proxy IP address table for accessing the ticketing platform, and then determines the access frequency of the source IP address information of the target proxy IP address in the access proxy IP address table. It can timely discover the abnormal behavior of using a proxy to swipe tickets without perception.

[0035] On the basis of the above embodiment, the step of constructing a proxy IP address table according to the target data request packet in the traffic data includes: Obtaining identification bit information of each data request packet in the traffic data; Determine the data request packet whose identification bit information is PSH type in the traffic data as the target data request packet; obtain the number of data packets of the target data request packets of different proxy IP addresses within the preset time period; The proxy IP address is used as the key and the number of data packets is used as the value to construct a HashMap, and the HashMap is sorted in descending order based on the number of data packets to obtain the proxy IP address table.

[0036] In the present invention, the identification bit information of each data request packet is extracted, and the identification bit information is usually located in the transport layer header of the data packet, such as the flag field in the TCP header. These identification bit information are used to indicate the status of the data packet and transmission control information, such as SYN (synchronization sequence number), ACK (acknowledgement), FIN (end connection) and PSH (push).

[0037] After extracting the identification information of each data request packet, those data request packets whose identification information is of PSH type are screened out. The PSH flag is used to indicate that the receiver should immediately pass the data from the receiving buffer to the upper layer application, which is data that needs to be processed immediately. Therefore, the present invention regards these PSH type data request packets as target data request packets.

[0038] Next, it is necessary to count the number of target data request packets (i.e., PSH type packets) sent by each proxy IP address within a preset period of time. After obtaining the number of target data request packets of different proxy IP addresses, a HashMap is constructed to store this information. In this HashMap, the proxy IP address is used as the key (Key) and the corresponding number of packets is used as the value (Value). Then, the HashMap is sorted based on the number of packets, from large to small, to obtain a proxy IP address table arranged from high to low according to the access frequency.

[0039] Based on the above embodiment, before obtaining the regional traffic of accessing the target ticketing platform in the target area, the method further includes: The target area is determined based on the area location information corresponding to the historical abnormal behavior detection results.

[0040] In the process of operating the ticketing platform, in order to effectively monitor and prevent potential malicious ticket grabbing and ticket swiping and other abnormal behaviors, it is necessary to be familiar with the ticketing platform's ticket release rules in advance, and extract traffic samples before and after the ticket release to understand the areas where abnormal behaviors may occur. Historical abnormal behavior detection refers to an in-depth analysis of the ticketing platform's traffic data over a period of time in the past to identify those abnormal behaviors that significantly deviate from normal ticket purchase behaviors. These abnormal behaviors include but are not limited to: high-frequency, large-scale request access, the use of illegal means to bypass verification code verification, and the use of proxy IP addresses for batch ticket purchases.

[0041] After detecting historical abnormal behaviors, further analysis is performed on the sources of these behaviors, that is, determining the regional location where the historical abnormal behaviors occurred. This usually involves parsing the geographic location information of traffic data, such as obtaining the visitor's geographic location information through IP address attribution query, DNS resolution, etc.

[0042] Based on the regional location information corresponding to the historical abnormal behavior detection results, the present invention can determine those areas where abnormal behaviors frequently occurred in the past period of time as target areas. These target areas may be certain specific cities or network areas, which have a higher risk of abnormal behavior due to factors such as geographical location, network environment or user behavior. Once the target areas are determined, the flow data of these areas during the opening period of the ticketing platform can be collected in a targeted manner. For example, the flow data of a certain area 60 seconds before and after the ticket is released can be extracted to avoid excessive flow that increases the subsequent abnormal behavior detection load.

[0043] Based on the above embodiment, determining the source IP address in the target area according to the proxy IP address table includes: Determine a plurality of target proxy IP addresses according to the sorting result of the HashMap in the proxy IP address table; Obtaining identification bit information of each regional traffic data packet accessing the target proxy IP address in the regional traffic; Determine the IP address corresponding to the regional traffic data packet whose identification bit information is of PSH type as the pending IP address; The same pending IP address corresponding to the multiple target proxy IP addresses is determined as the source IP address in the target area.

[0044] In the present invention, multiple target proxy IP addresses are determined based on the sorting results of the HashMap in the proxy IP address table. The key in this HashMap is the proxy IP address, and the value is the number of times or requests of the proxy IP address to access the ticketing platform within a specific time period. Through sorting, multiple proxy IP addresses with more access times (i.e., target proxy addresses) can be obtained.

[0045] Furthermore, the identification bit information of each regional flow data packet accessing these target proxy IP addresses in the regional flow is obtained, that is, the header information of each regional flow data packet is checked, including the source address, destination address, port number, transport layer protocol (such as TCP) and identification bit field, etc. The identification bit field is used in the TCP header to indicate the status of the data packet and transmission control information, such as SYN, ACK, FIN and PSH, etc.

[0046] After obtaining the identification information of the regional traffic data packets, those regional traffic data packets whose identification information is of PSH type are screened out, and the IP addresses corresponding to these PSH type data packets are determined as pending IP addresses, which may be potential source IP addresses for accessing the target proxy IP address. In the present invention, the pending IP addresses that have accessed multiple target proxy IP addresses at the same time are checked. These pending IP addresses have accessed multiple high-frequency access proxy IP addresses within a period of time, and then these pending IP addresses are determined as source IP addresses in the target area, and they are included in the list of addresses to be verified, so as to perform subsequent abnormal behavior analysis and verification.

[0047] In the present invention, Python or other programming languages ​​can be used to process network traffic data, and the hyperscan high-performance regular expression matching library can be used to accelerate the parsing of data packets and the extraction of identification information. Hyperscan supports a large number of rule matches and can optimize performance according to the complexity of the rules, thereby better processing large traffic data.

[0048] On the basis of the above embodiment, the abnormal behavior detection is performed on the target access frequency information based on the preset access frequency threshold, and the abnormal behavior detection result of the source IP address is obtained, including: Obtain the target access frequency information of the source IP address accessing the target proxy IP address within the preset time period; if the target access frequency information is greater than or equal to the preset access frequency threshold, determine that the source IP address has abnormal behavior, and obtain the real IP address corresponding to the source IP address.

[0049] In the present invention, the preset time period can be set to 60 seconds before and after the time when the ticketing platform opens for ticket grabbing, which is the time period when abnormal ticket grabbing behavior is most likely to occur. Further, the access frequency information of the source IP address accessing these target proxy IP addresses within the preset time period is counted, and the access frequency information can be the number of requests, the number of data packets, or other related indicators.

[0050] After obtaining the target access frequency information, the target access frequency information is compared with the preset access frequency threshold, which can be derived based on historical data and analysis results to distinguish normal access from abnormal access. If the target access frequency information is greater than or equal to the preset access frequency threshold, it can be determined that the source IP address has abnormal behavior, that is, it may be conducting abnormal ticket grabbing activities.

[0051] After determining that the source IP address has abnormal behavior, the present invention can further obtain the real IP address corresponding to the source IP address. If the source IP address is a cloud server address, the real IP address can be found by analyzing the remote access traffic characteristics in the network traffic. For example, based on accessing the cloud server port 3389 (Remote Desktop Protocol), those requests whose destination address is the cloud server IP address and the port number is 3389 are matched, and the IP addresses of these requests are regarded as real user IP addresses.

[0052] On the basis of the above embodiment, after performing abnormal behavior detection on the target access frequency information based on the preset access frequency threshold and obtaining the abnormal behavior detection result of the source IP address, the method further includes: Obtaining access time information corresponding to when the source IP address accesses the target proxy IP address; According to the source IP address, the access time information and the target access frequency information, an abnormal behavior information display result is constructed.

[0053] In the present invention, the access time information corresponding to the source IP address accessing the target proxy IP address is parsed from the traffic data, wherein the access time information can be a timestamp accurate to seconds, or other forms of time representation.

[0054] After obtaining the access time information, it is necessary to integrate it with the source IP address and the target access frequency information. The target access frequency information is the number of times or frequency that the source IP address accesses the target proxy IP address within a specific time period. The present invention integrates this information together to construct a complete data set containing parameters such as the source IP address, access time and access frequency.

[0055] Furthermore, the abnormal behavior information display result is constructed based on the integrated data set. The present invention uses data visualization technology, such as bar charts and line charts, to display the change trend of the access frequency of the source IP address over time, as well as the comparison of the access frequency between different source IP addresses. Through these charts, it is possible to quickly identify which source IP addresses have abnormal behavior, such as a sudden increase in access frequency, access time concentrated in a specific period of time, etc.

[0056] To facilitate subsequent query and analysis, the present invention stores the constructed abnormal behavior information display results in a database, file system or other storage medium. For example, a MySQL database is used to store parameters such as user IP, access time and access frequency to achieve persistent storage and efficient query of data.

[0057] The abnormal behavior detection system based on network traffic provided by the present invention is described below. The abnormal behavior detection system based on network traffic described below and the abnormal behavior detection method based on network traffic described above can refer to each other.

[0058] Figure 2 The schematic diagram of the structure of the abnormal behavior detection system based on network traffic provided by the present invention is as follows: Figure 2 As shown, the present invention provides an abnormal behavior detection system based on network traffic, including a ticketing platform traffic collection module 201, a proxy IP analysis module 202, a regional traffic analysis module 203 and an abnormal behavior detection module 204, wherein the ticketing platform traffic collection module 201 is used to obtain traffic data corresponding to the proxy IP address accessing the target ticketing platform within a preset time period; the proxy IP analysis module 202 is used to construct a proxy IP address table according to the target data request packet in the traffic data; the regional traffic analysis module 203 is used to obtain the regional traffic in the target area accessing the target ticketing platform, and determine the source IP address in the target area according to the proxy IP address table, wherein the source IP address is determined based on the data request packet information of the target proxy IP address in the regional traffic accessing the proxy IP address table; the abnormal behavior detection module 204 is used to perform abnormal behavior detection on the target access frequency information based on a preset access frequency threshold, and obtain the abnormal behavior detection result of the source IP address, wherein the target access frequency information is the access frequency information of the source IP address accessing the target ticketing platform within the preset time period.

[0059] The abnormal behavior detection system based on network traffic provided by the present invention constructs a proxy IP address table for accessing the ticketing platform, and then determines the access frequency of the source IP address information of the target proxy IP address in the access proxy IP address table. It can promptly detect the abnormal behavior of using a proxy to swipe tickets without perception.

[0060] The system provided in the embodiment of the present invention is used to execute the above-mentioned method embodiments. Please refer to the above-mentioned embodiments for the specific process and detailed contents, which will not be repeated here.

[0061] Figure 3 A schematic diagram of the structure of an electronic device provided by the present invention, such as Figure 3As shown, the electronic device may include: a processor (Processor) 301, a communication interface (Communications Interface) 302, a memory (Memory) 303 and a communication bus 304, wherein the processor 301, the communication interface 302, and the memory 303 complete mutual communication through the communication bus 304. The processor 301 can call the logic instructions in the memory 303 to execute the abnormal behavior detection method based on network traffic, the method comprising: obtaining the traffic data corresponding to the proxy IP address accessing the target ticketing platform within a preset period; constructing a proxy IP address table according to the target data request packet in the traffic data; obtaining the regional traffic accessing the target ticketing platform in the target area, and determining the source IP address in the target area according to the proxy IP address table, wherein the source IP address is determined based on the data request packet information of the target proxy IP address in the regional traffic accessing the proxy IP address table; based on the preset access frequency threshold, performing abnormal behavior detection on the target access frequency information, and obtaining the abnormal behavior detection result of the source IP address, wherein the target access frequency information is the access frequency information of the source IP address accessing the target ticketing platform within the preset period.

[0062] In addition, the logic instructions in the above-mentioned memory 303 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0063] On the other hand, the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the abnormal behavior detection method based on network traffic provided by the above-mentioned methods, and the method includes: obtaining traffic data corresponding to the proxy IP address accessing the target ticketing platform within a preset time period; constructing a proxy IP address table according to the target data request packet in the traffic data; obtaining the regional traffic accessing the target ticketing platform in the target area, and determining the source IP address in the target area according to the proxy IP address table, wherein the source IP address is determined based on the data request packet information of the target proxy IP address in the regional traffic accessing the proxy IP address table; based on a preset access frequency threshold, performing abnormal behavior detection on the target access frequency information, and obtaining the abnormal behavior detection result of the source IP address, wherein the target access frequency information is the access frequency information of the source IP address accessing the target ticketing platform within the preset time period.

[0064] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the abnormal behavior detection method based on network traffic provided in the above-mentioned embodiments, the method comprising: obtaining traffic data corresponding to the proxy IP address accessing the target ticketing platform within a preset time period; constructing a proxy IP address table according to the target data request packet in the traffic data; obtaining the regional traffic in the target area accessing the target ticketing platform, and determining the source IP address in the target area according to the proxy IP address table, wherein the source IP address is determined based on the data request packet information in the regional traffic accessing the target proxy IP address in the proxy IP address table; performing abnormal behavior detection on the target access frequency information based on a preset access frequency threshold, and obtaining the abnormal behavior detection result of the source IP address, wherein the target access frequency information is the access frequency information of the source IP address accessing the target ticketing platform within the preset time period.

[0065] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0066] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0067] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting abnormal behavior based on network traffic, characterized in that: include: Obtain traffic data corresponding to the proxy IP address accessing the target ticketing platform within a preset period; Constructing a proxy IP address table according to the target data request packet in the traffic data; Acquire the regional traffic in the target area accessing the target ticketing platform, and determine the source IP address in the target area according to the proxy IP address table, wherein the source IP address is determined based on the data request packet information in the regional traffic accessing the target proxy IP address in the proxy IP address table; Based on a preset access frequency threshold, abnormal behavior detection is performed on the target access frequency information to obtain the abnormal behavior detection result of the source IP address, wherein the target access frequency information is the access frequency information of the source IP address accessing the target ticketing platform within the preset time period.

2. The abnormal behavior detection method based on network traffic according to claim 1 is characterized in that: The step of constructing a proxy IP address table according to the target data request packet in the traffic data includes: Obtaining identification bit information of each data request packet in the traffic data; Determine the data request packet whose identification bit information in the traffic data is of PSH type as the target data request packet; Obtaining the number of data packets of the target data request packets of different proxy IP addresses within the preset time period; The proxy IP address is used as the key and the number of data packets is used as the value to construct a HashMap, and the HashMap is sorted in descending order based on the number of data packets to obtain the proxy IP address table.

3. The abnormal behavior detection method based on network traffic according to claim 1 is characterized in that: Before obtaining the regional traffic for accessing the target ticketing platform in the target area, the method further includes: The target area is determined based on the area location information corresponding to the historical abnormal behavior detection results.

4. The abnormal behavior detection method based on network traffic according to claim 2 is characterized in that: The step of determining the source IP address in the target area according to the proxy IP address table includes: Determine a plurality of target proxy IP addresses according to the sorting result of the HashMap in the proxy IP address table; Obtaining identification bit information of each regional traffic data packet accessing the target proxy IP address in the regional traffic; Determine the IP address corresponding to the regional traffic data packet whose identification bit information is of PSH type as the pending IP address; The same pending IP address corresponding to the multiple target proxy IP addresses is determined as the source IP address in the target area.

5. The abnormal behavior detection method based on network traffic according to claim 1 is characterized in that: The abnormal behavior detection is performed on the target access frequency information based on the preset access frequency threshold, and the abnormal behavior detection result of the source IP address is obtained, including: Obtain the target access frequency information of the source IP address accessing the target proxy IP address within the preset time period; if the target access frequency information is greater than or equal to the preset access frequency threshold, determine that the source IP address has abnormal behavior, and obtain the real IP address corresponding to the source IP address.

6. The abnormal behavior detection method based on network traffic according to claim 5 is characterized in that: After performing abnormal behavior detection on the target access frequency information based on the preset access frequency threshold and obtaining the abnormal behavior detection result of the source IP address, the method further includes: Obtaining access time information corresponding to when the source IP address accesses the target proxy IP address; According to the source IP address, the access time information and the target access frequency information, an abnormal behavior information display result is constructed.

7. An abnormal behavior detection system based on network traffic, characterized in that: include: The ticketing platform traffic collection module is used to obtain the traffic data corresponding to the proxy IP address accessing the target ticketing platform within a preset period of time; A proxy IP analysis module, used to construct a proxy IP address table according to a target data request packet in the traffic data; A regional traffic analysis module, used to obtain the regional traffic in the target area accessing the target ticketing platform, and determine the source IP address in the target area according to the proxy IP address table, wherein the source IP address is determined based on the data request packet information in the regional traffic accessing the target proxy IP address in the proxy IP address table; The abnormal behavior detection module is used to perform abnormal behavior detection on the target access frequency information based on a preset access frequency threshold, and obtain the abnormal behavior detection result of the source IP address, wherein the target access frequency information is the access frequency information of the source IP address accessing the target ticketing platform within the preset time period.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the abnormal behavior detection method based on network traffic as described in any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the abnormal behavior detection method based on network traffic as claimed in any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the abnormal behavior detection method based on network traffic as claimed in any one of claims 1 to 6 is implemented.

Images