Method, device and equipment for constructing white hat portrait, medium and product

Abstract

The invention provides a method and device for constructing a white hat portrait, equipment, a medium and a product. The method comprises the steps of obtaining login log information of a white hat; acquiring network behavior information of the white cap from the login log information; according to the network behavior information and user identification information corresponding to at least one preset company, obtaining the probability that the white hat belongs to each preset company in a set time period; and determining an affiliation company of the white hat according to the probability that the white hat belongs to each preset company in the set time period. Therefore, the probability that the white hat belongs to each preset company in the set time period can be effectively determined, the company to which the white hat belongs can be effectively anchored, and the portrait accuracy is improved.

Description

Technical Field

[0001] The present application relates to the field of white hat portraits, and more specifically, to a method, device, equipment, medium and product for constructing white hat portraits. Background Art

[0002] With the continuous development of information technology, the degree of informatization of human society is getting higher and higher, and the whole society is becoming more and more dependent on network information, so the importance of network security is also increasing. At present, there are more and more attacks that threaten network security, such as vulnerability attacks. Vulnerabilities are defects in the specific implementation of hardware, software, protocols or system security policies, which can enable attackers to access or damage the system without authorization. At present, many companies have built network security service platforms. By recruiting professional network security technology talents across the country (hereinafter referred to as white hats), we provide professional technical services such as network crowd testing to third parties. In order to more effectively identify and recruit suitable white hats, a portrait of white hats is usually constructed in the network security service platform.

[0003] However, the current construction of white hat portraits usually relies on the personal information filled in by users when registering. Since users rarely actively update company information after the initial filling, the records on the network security service platform are difficult to reflect the latest company affiliation of white hats. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide a method, device, equipment, medium and product for constructing a white hat portrait, so as to solve the problem existing in the related technology that the company affiliation of the white hat cannot be accurately determined.

[0005] In a first aspect, an embodiment of the present application provides a method for constructing a white hat portrait, including: Get the login log information of the white hat; Obtaining the network behavior information of the white hat from the login log information; Obtaining the probability that the white hat belongs to each of the preset companies within a set time period according to the network behavior information and user identification information corresponding to at least one preset company; The company to which the white hat belongs is determined according to the probability that the white hat belongs to each of the preset companies within the set time period.

[0006] In the above implementation process, by obtaining the network behavior information of the white hat, and obtaining the probability that the white hat belongs to each preset company within a set time period based on the network behavior information and the user identification information corresponding to at least one preset company, the probability that the white hat belongs to each preset company within the set time period can be determined. Since the white hat is a person who provides network security services, the network behavior information of the white hat will more directly reflect the white hat's work behavior, thereby effectively anchoring its affiliated company, making the determined probability that the white hat belongs to each preset company within the set time period more representative, thereby making the white hat's affiliated company determined according to the probability that the white hat belongs to each preset company within the set time period more accurate, thereby improving the accuracy of the portrait.

[0007] Further, the user identification information corresponding to each of the preset companies includes network behavior information corresponding to each of the preset companies, and obtaining the probability that the white hat belongs to each of the preset companies within the set time period according to the network behavior information and the user identification information corresponding to at least one preset company includes: For each preset company, if there is network behavior information with the same content between the network behavior information of the white hat in the set time period and the network behavior information corresponding to the preset company, the network behavior information with the same content is aggregated in the set time period to obtain the number of occurrences of the network behavior information with the same content in the set time period; According to the number of occurrences of the network behavior information with the same content within the set time period, the probability that the white hat belongs to the preset company within the set time period is obtained; the probability that the white hat belongs to the preset company within the set time period is positively correlated with the number of occurrences of the network behavior information with the same content within the set time period.

[0008] In the above implementation process, the number of occurrences of the same network behavior information as the white hat in the preset company's network behavior information within the set time period is counted, and the probability of the white hat belonging to each preset company is predicted based on the number of occurrences of the same network behavior information. Since the white hat is a person who provides network security services, the network behavior information of the white hat will more directly reflect the white hat's work behavior, and since the network behavior information of the white hat using the same company's resources tends to be consistent. This makes the number of occurrences of the same network behavior information of the white hat and each preset company more representative, so that the company to which the white hat belongs determined by predicting the probability of the white hat belonging to each preset company based on the number of occurrences of the same network behavior information is more accurate, thereby improving the accuracy of the portrait.

[0009] Further, according to the number of occurrences of the network behavior information with the same content within the set time period, the probability that the white hat belongs to the preset company within the set time period is obtained, including: In the correspondence between the preset number of occurrences and the probability, a matching operation is performed using the number of occurrences of the network behavior information with the same content within the set time period to obtain the probability that the white hat belongs to the preset company within the set time period.

[0010] In the above implementation process, by directly using the correspondence between the preset number of occurrences and the probability to perform a matching operation on the number of occurrences of network behavior information with the same content within the set time period, the probability that the white hat belongs to the preset company within the set time period can be obtained more quickly.

[0011] Further, the user identification information includes a user identification of at least one first user; obtaining the probability that the white hat belongs to each of the preset companies within the set time period according to the network behavior information and the user identification information corresponding to at least one preset company, includes: Obtain network behavior information of different contents of the white hat; For each network behavior information of different contents, obtaining the number of occurrences of the network behavior information corresponding to each user identifier within the set time period; According to the number of occurrences of the network behavior information corresponding to each of the user identifiers, the probability that the white hat belongs to the preset company corresponding to each of the first users within the set time period is obtained; the probability that the white hat belongs to the preset company corresponding to each of the first users within the set time period is positively correlated with the number of occurrences of the network behavior information of each of the first users within the set time period.

[0012] In the above implementation process, the number of occurrences of the network behavior information corresponding to the user identification included in the preset company within the set time period is obtained for each different content of the network behavior information of the white hat, and the probability that the white hat belongs to the preset company corresponding to each first user within the set time period is obtained according to the number of occurrences of the network behavior information corresponding to each user identification. Since the white hat is a person who provides network security services, the network behavior information of the white hat will more directly reflect the work behavior of the white hat, and since the network behavior information of the white hat using the same company resources tends to be consistent. In this way, the number of occurrences of the same network behavior information corresponding to the user identification included in the preset company determined by the white hat is more representative, so that the probability of the white hat belonging to the preset company corresponding to each first user can be more accurately predicted according to the number of occurrences of the network behavior information corresponding to each user identification, so that the company to which the white hat belongs can be more accurately determined, thereby improving the accuracy of the portrait.

[0013] Further, according to the number of occurrences of the network behavior information corresponding to each of the user identifiers, the probability that the white hat belongs to the preset company corresponding to each of the first users within the set time period is obtained, including: In the correspondence between the preset number of occurrences and probabilities, a matching operation is performed using the number of occurrences of the network behavior information corresponding to each of the user identifiers to obtain the probability that the white hat belongs to the preset company corresponding to each of the first users within the set time period.

[0014] In the above implementation process, by directly using the correspondence between the preset number of occurrences and the probability to perform a matching operation using the number of occurrences of the network behavior information corresponding to each user identifier, the probability that the white hat belongs to the preset company corresponding to each first user within the set time period can be obtained more quickly.

[0015] Further, the user identification information includes a user identification of at least one first user; obtaining the probability that the white hat belongs to each of the preset companies within the set time period according to the network behavior information and the user identification information corresponding to at least one preset company, includes: For each preset company, the number of target first user identifiers in the preset company within the set time period is obtained; the target first user identifier is: the user identifier of the first user in the preset company who has the same network behavior information as the white hat; According to the number of the target first user identifiers, the probability that the white hat belongs to the preset company within the set time period is obtained; the probability that the white hat belongs to the preset company within the set time period is positively correlated with the number of the target first user identifiers.

[0016] In the above implementation process, for each preset company, the number of user identifiers of the first users with the same network behavior information as the white hat in the preset company within the set time period is obtained. Since the white hat is a person who provides network security services, the network behavior information of the white hat will more directly reflect the white hat's work behavior, and since the network behavior information of the white hat using the same company resources tends to be consistent. Therefore, by determining the number of user identifiers of the first users with the same network behavior information as the white hat in the preset company, the probability that the white hat belongs to the preset company can be effectively determined, so that the company to which the white hat belongs determined based on the probability that the white hat belongs to each preset company within the set time period is more accurate, thereby improving the accuracy of the portrait.

[0017] Furthermore, there are multiple set time periods, and the multiple set time periods belong to a continuous time period; determining the company to which the white hat belongs according to the probability that the white hat belongs to each preset company within the set time period includes: For each preset company, calculating the initial probability that the white hat belongs to the preset company in the consecutive time periods according to the probability that the white hat belongs to the preset company in the multiple set time periods; If the probability that the white hat belongs to the preset company in multiple set time periods is greater than a preset threshold, the initial probability that the white hat belongs to the preset company in the consecutive time periods is increased according to a preset increment to obtain a target probability that the white hat belongs to the preset company in the consecutive time periods; The company to which the white hat belongs in the continuous time period is determined according to the target probability that the white hat belongs to each of the preset companies in the continuous time period.

[0018] In the above implementation process, if the probability that the white hat belongs to the preset company in multiple set time periods is greater than the preset threshold, the initial probability that the white hat belongs to the preset company in the continuous time period can be increased according to the preset increment. Since the multiple set time periods are continuous time periods, the probability that the white hat belongs to each preset company in the continuous time period is actually related to the probability that the white hat belongs to each preset company in the set time period. Therefore, when the probability that the white hat belongs to the preset company in multiple set time periods is greater than the preset threshold, the initial probability that the white hat belongs to the preset company in the continuous time period is increased according to the preset increment, and the target probability that the white hat belongs to the preset company in the continuous time period can be obtained more accurately.

[0019] Furthermore, after determining the company to which the white hat belongs in the continuous time period according to the target probability that the white hat belongs to each of the preset companies in the continuous time period, the method further includes: During the continuous time period, obtain the first date when the network behavior information corresponding to the company to which the white hat belongs and the network behavior information of the white hat have the same network behavior information for the first time, and the last date when the network behavior information corresponding to the company to which the white hat belongs and the network behavior information of the white hat have the same network behavior information for the last time; The working period of the white hat in the affiliated company is determined according to the first date and the last date.

[0020] In the above implementation process, when determining the company to which the white hat belongs in a continuous time period, the start time of the white hat's entry into the company can be determined by obtaining the first date when the network behavior information corresponding to the white hat's company and the network behavior information of the white hat have the same content for the first time. In addition, by obtaining the last date when the network behavior information corresponding to the white hat's company and the network behavior information of the white hat have the same content for the last time, the latest time of the white hat in the company can be obtained. In this way, the white hat's employment period in the company can be determined.

[0021] Further, determining the period of time during which the white hat has worked in the company according to the first date and the last date includes: Calculate the sum of the first date and the preset working time to obtain the first date; The sum of the last date and the duration of employment is calculated to obtain a second date, thereby obtaining the employment time period; wherein the employment time period is a time period starting from the first date and ending from the second date.

[0022] In the above implementation process, since the user is in the early stage of joining the company, the company usually gives the user a probation period, and the company resources will be opened to the user only if the probation is passed. Therefore, in the above implementation process, by calculating the sum of the first date and the preset employment time, the company can compensate for the probation time given to the user, so as to more accurately estimate the start time of the user's entry into the company. Similarly, when a user resigns, there is usually a handover period, and by calculating the sum of the last date and the employment time, the handover period can be compensated, so as to more accurately estimate the end time of the user's leaving the company.

[0023] Further, obtaining the network behavior information of the white hat from the login log information includes: Obtaining personal information of the white hat, wherein the personal information includes the company name; Obtain the email address used by the white hat from the login log information; When the company name corresponding to the email address used by the white hat is inconsistent with the company name in the personal information, the network behavior information of the white hat is obtained from the login log information.

[0024] In the above implementation process, when the company name corresponding to the white hat's email address is inconsistent with the company name in the personal information, it can be determined that there is an error in the company name in the white hat's personal information. In this way, it can be determined when the white hat's company affiliation needs to be re-determined, that is, when to obtain the white hat's network behavior information from the login log information, so as to avoid wasting resources to obtain the white hat's network behavior information when there is no need to re-determine the white hat's company affiliation.

[0025] Further, determining the company to which the white hat belongs according to the probability that the white hat belongs to each of the preset companies within the set time period includes: The preset company with the highest probability is determined as the company to which the white hat belongs within the set time period.

[0026] In the above implementation process, the preset company with the highest probability is determined as the company to which the white hat belongs within the set time period, which can improve the accuracy of determining the company to which the white hat belongs.

[0027] In a second aspect, the embodiment of the present application further provides a device for constructing a white hat portrait, including: The first acquisition module is used to obtain the login log information of the white hat; A second acquisition module is used to obtain the network behavior information of the white hat from the login log information; A third acquisition module is used to acquire the probability that the white hat belongs to each preset company within a set time period according to the network behavior information and the user identification information corresponding to at least one preset company; The determination module is used to determine the company to which the white hat belongs according to the probability that the white hat belongs to each of the preset companies within the set time period.

[0028] In the third aspect, an embodiment of the present application also provides an electronic device, including a processor, a memory and a communication bus; the communication bus is used to realize the connection and communication between the processor and the memory; the processor is used to execute one or more programs stored in the memory to realize any of the above-mentioned methods of constructing a white hat portrait.

[0029] In a fourth aspect, a computer-readable storage medium is also provided in an embodiment of the present application, wherein the computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement any of the above-mentioned methods for constructing a white hat portrait.

[0030] In a fifth aspect, an embodiment of the present application further provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it performs any of the above-mentioned methods for constructing a white hat portrait. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0032] Figure 1 A schematic diagram of a process for constructing a white hat portrait provided in an embodiment of the present application; Figure 2 A schematic diagram of a process for constructing a white hat portrait in another method provided in an embodiment of the present application; Figure 3 A schematic diagram of a process for constructing a white hat portrait in another method provided in an embodiment of the present application; Figure 4 A schematic diagram of a process for constructing a white hat portrait in another method provided in an embodiment of the present application; Figure 5 A flowchart of a method for determining the tenure time of a white hat in a company provided in an embodiment of the present application; Figure 6 A schematic diagram of the structure of a device for constructing a white hat portrait provided in an embodiment of the present application; Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0033] The technical solutions in the embodiments of the present application will be described below in conjunction with the accompanying drawings in the embodiments of the present application. The following embodiments can be freely combined with each other to obtain new embodiments without conflict.

[0034] Embodiment 1: In order to solve the problem that the related art cannot accurately determine the company a white hat belongs to, a method for constructing a white hat portrait is provided in the embodiment of the present application. Figure 1 As shown, Figure 1 A schematic diagram of a process for constructing a white hat portrait provided in an embodiment of the present application includes: Step S101, obtaining login log information of the white hat.

[0035] When a white hat logs in to the network security platform, the network security platform will record the detailed information of the white hat logging in to the network security platform, such as the white hat's user ID, the timestamp of logging in to the network security platform, and the white hat's network behavior information.

[0036] Network behavior information may include IP addresses and device identifiers.

[0037] IP (Internet Protocol Address) is a unique identifier assigned by the Internet to each device on the network so that the devices can communicate within the network.

[0038] The device ID is a unique identifier assigned to a device by the network security platform and is allowed to be used within a set time period. That is, the device ID of each device is only valid within the set time period. The device ID of the same device may be different in different time periods.

[0039] Step S102, obtaining the network behavior information of the white hat from the login log information.

[0040] Exemplarily, the personal information of the white hat can be obtained, the personal information includes the company name; the white hat's email address is obtained from the login log information; when the company name corresponding to the white hat's email address is inconsistent with the company name in the personal information, the white hat's network behavior information is obtained from the login log information.

[0041] The personal information of a white hat can be the information filled in by the white hat when registering on a network security platform, including the email address used, the company name to which the white hat belongs, and occupational information.

[0042] If the company name filled in by the white hat when registering the network security platform does not completely correspond to the pre-stored company name, the company name with the highest similarity to the company name filled in by the white hat can be used as the company name to which the white hat belongs. In this way, the company names can be unified, so that when the company to which the white hat belongs to an unknown company is determined later, the company to which the white hat belongs to an unknown company can be more accurately determined based on the unified company name.

[0043] After obtaining the used email address from the login log information, if the used email address in the login log information is different from the used email address in the white hat's personal information, the used email address in the personal information can be updated with the used email address in the login log information.

[0044] The company domain name can be obtained from the mailbox used, and the company domain name is used to perform a matching operation in the correspondence between the preset company domain name and the company name to obtain the company name corresponding to the mailbox used.

[0045] Step S103, obtaining the probability that the white hat belongs to each preset company within a set time period according to the network behavior information and the user identification information corresponding to at least one preset company.

[0046] In an optional implementation of the embodiment of the present application, the user identification information corresponding to each preset company includes the network behavior information corresponding to each preset company, combined with Figure 2 As shown, the above step S103 can be replaced by: Step S201, for each preset company, if there is network behavior information with the same content between the white hat's network behavior information within the set time period and the network behavior information corresponding to the preset company, the network behavior information with the same content is aggregated within the set time period to obtain the number of occurrences of the network behavior information with the same content within the set time period.

[0047] The network behavior information may be an IP address. A white hat may use one or more IP addresses within a set time period. Correspondingly, the IP addresses corresponding to the preset company may include at least one IP address used by the white hat within the set time period. Similarly, the IP addresses corresponding to the preset company may not include all IP addresses used by the white hat within the set time period.

[0048] In some embodiments, the IP addresses corresponding to the preset companies can be obtained in the following manner: in the correspondence between the preset company names and the IP addresses, matching operations are performed using the company names of each preset company to obtain all IP addresses corresponding to each preset company.

[0049] The network behavior information may be a device identifier. The device identifier used by the white hat in the set time period may be one or more. Correspondingly, the device identifier corresponding to the preset company may include at least one device identifier used by the white hat in the set time period. However, the device identifier corresponding to the preset company may not include all device identifiers used by the white hat in the set time period.

[0050] When the IP address corresponding to the preset company includes at least one IP address used by the white hat within the set time period, and / or the device identification corresponding to the preset company can include at least one device identification used by the white hat within the set time period, it can be determined that there is network behavior information with the same content between the network behavior information of the white hat within the set time period and the network behavior information corresponding to the preset company.

[0051] When the IP address corresponding to the preset company does not include all IP addresses used by the white hat within the set time period, and the device identification corresponding to the preset company does not include all device identifications used by the white hat within the set time period, it can be determined that there is no network behavior information with the same content between the network behavior information of the white hat within the set time period and the network behavior information corresponding to the preset company.

[0052] Step S202, according to the number of occurrences of network behavior information with the same content within the set time period, obtain the probability that the white hat belongs to the preset company within the set time period. The probability that the white hat belongs to the preset company within the set time period is positively correlated with the number of occurrences of network behavior information with the same content within the set time period.

[0053] In an optional implementation of the embodiment of the present application, if there are multiple network behavior information with the same content between the network behavior information of the white hat in the set time period and the network behavior information corresponding to the preset company, for each network behavior information with the same content, the number of occurrences of the network behavior information in the set time period can be obtained, and the initial probability that the white hat belongs to the preset company in the set time period can be obtained based on the number of occurrences of the network behavior information in the set time period. The sum of the initial probabilities that the white hat belongs to the preset company in the set time period is used as the probability that the white hat belongs to the preset company in the set time period.

[0054] Correspondingly, in the correspondence between the preset number of occurrences and the probability, the number of occurrences of the network behavior information within the set time period can be used for matching operations to obtain the initial probability that the white hat belongs to the preset company within the set time period.

[0055] Furthermore, the relationship between the number of occurrences of the network behavior information within the set time period and the initial probability that the white hat belongs to the preset company within the set time period satisfies the formula: y=kx+b, where k and b are both preset positive numbers. y represents the probability value determined based on the number of occurrences of the network behavior information within the set time period, and x represents the number of occurrences of the network behavior information within the set time period.

[0056] In another optional implementation method of the embodiment of the present application, if there is multiple network behavior information with the same content between the network behavior information of the white hat within a set time period and the network behavior information corresponding to the preset company, the sum of the number of occurrences of the multiple network behavior information with the same content within the set time period is obtained, and based on the sum of the number of occurrences of the multiple network behavior information with the same content within the set time period, the probability that the white hat belongs to the preset company within the set time period is obtained.

[0057] Exemplarily, for each piece of network behavior information with the same content, the number of occurrences of the network behavior information within a set time period can be obtained, and the number of occurrences of each piece of network behavior information with the same content within the set time period can be added together to obtain the sum of the number of occurrences of all the network behavior information with the same content within the set time period.

[0058] Similarly, in the correspondence between the preset number of occurrences and the probability, the sum of the number of occurrences of all network behavior information within the set time period can be used for matching operations to obtain the probability that the white hat belongs to the preset company within the set time period.

[0059] Moreover, the relationship between the sum of the number of occurrences of all network behavior information within the set time period and the probability that the white hat belongs to the preset company within the set time period also satisfies the formula: y=kx+b.

[0060] In an optional implementation method of the embodiment of the present application, if there is only one network behavior information with the same content between the network behavior information of the white hat within the set time period and the network behavior information corresponding to the preset company, the probability that the white hat belongs to the preset company within the set time period can be directly obtained based on the number of appearances of the network behavior information within the set time period.

[0061] In another optional implementation of the embodiment of the present application, the user identification information includes at least one user identification of the first user, combined with Figure 3 As shown, the above step S103 can also be replaced by: Step S301, obtaining network behavior information of different contents of white hats.

[0062] Every time a white hat logs into the network security platform, the network behavior information of the white hat will be recorded in the login log information. If the white hat logs into the network security platform multiple times within a set time period, multiple network behavior information of the white hat can be obtained from the network security platform. The content of these multiple network behavior information can be the same or different. Therefore, the network behavior information of the white hat with different contents can be obtained from the login log information of the white hat.

[0063] Step S302: for each network behavior information of different contents, obtain the number of occurrences of the network behavior information corresponding to each user identification within a set time period.

[0064] The login log information corresponding to each user ID can be obtained, and all network behavior information corresponding to each user ID can be obtained from the login log information corresponding to each user ID. And from all network behavior information corresponding to each user ID, the number of occurrences of the network behavior information corresponding to each user ID within a set time period can be obtained.

[0065] Step S303, based on the number of occurrences of the network behavior information corresponding to each user identification, obtain the probability that the white hat belongs to the preset company corresponding to each first user within the set time period; the probability that the white hat belongs to the preset company corresponding to each first user within the set time period is positively correlated with the number of occurrences of the network behavior information of each first user within the set time period.

[0066] In an optional implementation method of the embodiment of the present application, based on the number of occurrences of the network behavior information corresponding to each user identifier, obtaining the probability that the white hat belongs to the preset company corresponding to each first user within a set time period can include the following steps: for each preset company, the sum of the number of occurrences of all network behavior information corresponding to all user identifiers in the preset company can be calculated, and based on the sum of the number of occurrences of all network behavior information corresponding to all user identifiers in the preset company, the probability that the white hat belongs to the preset company within the set time period is obtained.

[0067] Exemplarily, in the correspondence between the preset probability and the number of occurrences, the sum of the number of occurrences of all network behavior information corresponding to all user identifiers in the preset company can be used for matching operations to obtain the probability that the white hat belongs to the preset company within a set time period.

[0068] Exemplarily, according to the number of occurrences of the network behavior information corresponding to each user identifier, obtaining the probability that the white hat belongs to the preset company corresponding to each first user within the set time period may include the following steps: for each preset company, the sum of the number of occurrences of all network behavior information corresponding to each user identifier in the preset company may be calculated, and the sum of the number of occurrences of all network behavior information corresponding to each user identifier in the preset company may be calculated to obtain the initial probability that the white hat belongs to the preset company within the set time period. The sum of the initial probabilities that the white hat belongs to the preset company within the set time period is calculated to obtain the probability that the white hat belongs to the preset company within the set time period.

[0069] Similarly, in the correspondence between the preset probability and the number of occurrences, the sum of the number of occurrences of all network behavior information corresponding to each user identification can be used to perform matching operations to obtain the initial probability that the white hat belongs to the preset company within the set time period.

[0070] Exemplarily, obtaining the probability that a white hat belongs to a preset company corresponding to each first user within a set time period based on the number of occurrences of the network behavior information corresponding to each user identifier may include the following steps: in the correspondence between the preset number of occurrences and the probability, a matching operation is performed using the number of occurrences of the network behavior information corresponding to each user identifier to obtain the probability that a white hat belongs to the preset company corresponding to each first user within the set time period.

[0071] If there are multiple probability values ​​that the white hat belongs to the preset company corresponding to each first user within the set time period, that is, there are multiple probability values ​​that the white hat belongs to the preset company within the set time period, the maximum probability value can be used as the probability that the white hat belongs to the preset company within the set time period. Alternatively, the sum of multiple probability values ​​can be used as the probability that the white hat belongs to the preset company within the set time period.

[0072] In another optional implementation of the embodiment of the present application, combined with Figure 4 As shown, the above step S103 can also be replaced by: Step S401, for each preset company, obtain the number of target first user identifiers in the preset company within a set time period. The target first user identifier is: the user identifier of the first user in the preset company who has the same network behavior information as the white hat.

[0073] Step S402: According to the number of target first user identifiers, the probability that the white hat belongs to the preset company within the set time period is obtained. The probability that the white hat belongs to the preset company within the set time period is positively correlated with the number of target first user identifiers.

[0074] Exemplarily, in the correspondence between the preset number of user identifiers and the probability, a matching operation can be performed using the number of target first user identifiers in the preset company to obtain the probability that the white hat belongs to the preset company within a set time period.

[0075] The number of target first user identifiers and the probability that a white hat belongs to the preset company within a set time period satisfy the formula: h=fa+c, where f and c are both positive numbers, a represents the number of target first user identifiers, and h represents the probability value calculated based on the number of target first user identifiers.

[0076] Step S104, determining the company to which the white hat belongs according to the probability that the white hat belongs to each preset company within a set time period.

[0077] For example, the preset company with the highest probability can be determined as the company to which the white hat belongs within the set time period. Alternatively, the preset company with a probability greater than a preset threshold can be determined as the company to which the white hat belongs within the set time period.

[0078] The method for constructing a white hat portrait provided in the embodiment of the present application obtains the network behavior information of the white hat, and obtains the probability that the white hat belongs to each preset company within a set time period based on the network behavior information and the user identification information corresponding to at least one preset company. The probability that the white hat belongs to each preset company within the set time period can be determined, and since the white hat is a person who provides network security services, the network behavior information of the white hat will more directly reflect the white hat's work behavior, so that the company to which it belongs can be effectively anchored, so that the determined probability that the white hat belongs to each preset company within the set time period is more representative, so that the company to which the white hat belongs determined based on the probability that the white hat belongs to each preset company within the set time period is more accurate, thereby improving the accuracy of the portrait.

[0079] Embodiment 2: Based on the first embodiment, this embodiment provides multiple set time periods, and the multiple set time periods belong to a continuous time period. This embodiment uses the probability of a white hat belonging to each preset company in each set time period as the basis to determine the time the white hat has worked in the company to which he belongs as an example. Figure 5 As shown, the method for determining the tenure time of a white hat in the affiliated company may include the following steps: Step S501, for each preset company, the initial probability of a white hat belonging to the preset company in a continuous time period is calculated according to the probability of a white hat belonging to the preset company in multiple set time periods.

[0080] For example, the maximum probability that the white hat belongs to the preset company in multiple set time periods can be used as the initial probability that the white hat belongs to the preset company in the continuous time period. Alternatively, the average probability that the white hat belongs to the preset company in multiple set time periods can be calculated, and the average probability can be used as the initial probability that the white hat belongs to the preset company in the continuous time period.

[0081] Step S502, if the probability that the white hat belongs to the preset company in multiple set time periods is greater than the preset threshold, the initial probability that the white hat belongs to the preset company in the continuous time period is increased according to the preset increment to obtain the target probability that the white hat belongs to the preset company in the continuous time period.

[0082] In some embodiments, the target probability that a white hat belongs to the preset company within a continuous time period and the initial probability that a white hat belongs to the preset company within a continuous time period satisfy the following relationship: W=H+Rt, wherein W represents the target probability that a white hat belongs to the preset company within a continuous time period, H represents the initial probability that a white hat belongs to the preset company within a continuous time period, t represents the preset increment, and R represents the number of target setting time periods, where the target setting time period is a set time period in which the probability that a white hat belongs to the preset company is greater than a preset threshold.

[0083] Step S503, determining the company to which the white hat belongs in the continuous time period according to the target probability that the white hat belongs to each preset company in the continuous time period.

[0084] The preset company with the highest target probability is determined as the company to which the white hat belongs in the continuous time period.

[0085] Step S504, within a continuous time period, obtain the first date when the network behavior information corresponding to the white hat's affiliated company and the network behavior information of the white hat have the same network behavior information for the first time, and the last date when the network behavior information corresponding to the white hat's affiliated company and the network behavior information of the white hat have the same network behavior information for the last time.

[0086] Step S505, determining the period of time the white hat has been employed in the company according to the first date and the last date.

[0087] Exemplarily, the sum of the first date and the preset duration of employment can be calculated to obtain the first date; the sum of the last date and the duration of employment can be calculated to obtain the second date, thereby obtaining the employment time period; wherein the employment time period is a time period starting from the first date and ending from the second date.

[0088] Alternatively, the employment period is a period starting from the first date and ending with the last date.

[0089] In some embodiments, within a continuous time period, the first date when the network behavior information corresponding to the white hat's affiliated company and the network behavior information of the white hat have the same network behavior information is, for example, January 2020, and the last date when the network behavior information corresponding to the white hat's affiliated company and the network behavior information of the white hat have the same network behavior information is, for example, July 2022. Then the white hat's employment period in the affiliated company can be from January 2020 to July 2022.

[0090] In the method for determining the tenure of a white hat in the company to which it belongs provided by the embodiment of the present application, if the probability that the white hat belongs to the preset company in multiple set time periods is greater than a preset threshold, the initial probability that the white hat belongs to the preset company in the continuous time period can be increased according to a preset increment. Since the multiple set time periods are continuous time periods, the probability that the white hat belongs to each preset company in the continuous time period is substantially related to the probability that the white hat belongs to each preset company in the set time period. Therefore, when the probability that the white hat belongs to the preset company in multiple set time periods is greater than a preset threshold, the initial probability that the white hat belongs to the preset company in the continuous time period is increased according to a preset increment, so that the target probability that the white hat belongs to the preset company in the continuous time period can be obtained more accurately.

[0091] Embodiment three: This embodiment is based on the above embodiment and further illustrates the present application: In some embodiments, combined with Table 1, for white hat a, white hat a used IP 5 times in the set time period T1, used IP 3 times in the set time period T2, used IP 3 times in the set time period T3, used IP 2 times in the set time period T4, and used IP 7 times in the set time period T5. Obtain the number of occurrences of network behavior information with the same content between the network behavior information of the white hat in T1 and the network behavior information corresponding to the preset company A in T1, for example, 0. Obtain the number of occurrences of IP with the same content between the IP of the white hat in T2 and the IP corresponding to the preset company A in T2, for example, 0. Obtain the number of occurrences of IP with the same content between the IP of the white hat in T3 and the IP corresponding to the preset company A in T3, for example, 1. Obtain the number of occurrences of IP with the same content between the IP of the white hat in T4 and the IP corresponding to the preset company A in T4, for example, 1. Obtain the number of occurrences of IP with the same content between the IP of the white hat in T5 and the IP corresponding to the preset company A in T5, for example, 2. In this way, the statistical results shown in Table 1 can be obtained.

[0092] Table 1

[0093] In some embodiments, if white hat a has login records in multiple set time periods, that is, there are IP login times in T1, T2, T3, T4, and T5, but white hat a only shares an IP with the preset company A in the set time periods T3, T4, and T5. The initial probability that white hat a belongs to the preset company A can be determined first, for example, 75%. Then, by calculating W=H+Rt, where t is, for example, 5%, the target probability of white hat a belonging to the preset company A is obtained, which is 90%.

[0094] In some embodiments, if in multiple set time periods, white hat a only has a login record in one of the set time periods, for example, the IP is only used in the set time period T6. And, in the set time period T6, only the preset company A includes the target first user identifier, that is, the user identifier of the first user with the same IP as white hat a. If there is only one target first user identifier, it can be determined that the probability that white hat a belongs to the preset company A is 70%. If the number of target first user identifiers is 2 or 3, it can be determined that the probability that white hat a belongs to the preset company A is 75%. If the number of target first user identifiers exceeds 3, it can be determined that the probability that white hat a belongs to the preset company A is 80%.

[0095] In some embodiments, if in multiple set time periods, white hat a only has a login record in one of the set time periods, for example, the IP is only used in the set time period T7. And in the set time period T7, the preset company A, the preset company B, and the preset company C all include the target first user identifier, that is, the preset company A, the preset company B, and the preset company C all include the user identifier of the first user with the same IP as the white hat a. If the matching operation can be performed using the target first user identifier number in the preset company A, the target first user identifier number in the preset company B, and the target first user identifier number in the preset company C in the corresponding relationship between the preset user identifier number and the probability, the probability that the white hat a belongs to the preset company A, the preset company B, and the preset company C is obtained.

[0096] Embodiment 4: Based on the same inventive concept, the present application also provides a device 600 for constructing a white hat portrait. Figure 6 , Figure 6 Shows the use of Figure 1 The method shown is a device for constructing a white hat portrait. It should be understood that the specific functions of the device 600 can be found in the description above. To avoid repetition, the detailed description is appropriately omitted here. The device 600 includes at least one software function module that can be stored in a memory in the form of software or firmware or solidified in the operating system of the device 600. Specifically: See also Figure 6 As shown, the apparatus 600 for constructing a white hat portrait includes: a first acquisition module 601, a second acquisition module 602, a third acquisition module 603 and a determination module 604. Among them: The first acquisition module 601 is used to obtain login log information of white hats.

[0097] The second acquisition module 602 is used to obtain the network behavior information of the white hat from the login log information.

[0098] The third acquisition module 603 is used to acquire the probability that the white hat belongs to each preset company within a set time period according to the network behavior information and the user identification information corresponding to at least one preset company.

[0099] The determination module 604 is used to determine the company to which the white hat belongs according to the probability that the white hat belongs to each preset company within a set time period.

[0100] In a feasible implementation of the embodiment of the present application, the third acquisition module 603 may be configured to aggregate the network behavior information with the same content within the set time period for each preset company if the network behavior information of the white hat within the set time period and the network behavior information corresponding to the preset company have the same network behavior information within the set time period to obtain the number of occurrences of the network behavior information with the same content within the set time period; According to the number of occurrences of network behavior information with the same content within a set time period, the probability that the white hat belongs to the preset company within the set time period is obtained; the probability that the white hat belongs to the preset company within the set time period is positively correlated with the number of occurrences of network behavior information with the same content within the set time period.

[0101] In this embodiment, the third acquisition module 603 can be specifically configured to perform a matching operation using the number of occurrences of network behavior information with the same content within a set time period in the correspondence between the preset number of occurrences and the probability, and obtain the probability that the white hat belongs to the preset company within the set time period.

[0102] In another feasible implementation of the embodiment of the present application, the user identification information includes a user identification of at least one first user; the third acquisition module 603 can be configured to obtain network behavior information of different contents of the white hat; for each network behavior information of different contents, the number of occurrences of the network behavior information corresponding to each user identification within a set time period is obtained; based on the number of occurrences of the network behavior information corresponding to each user identification, the probability that the white hat belongs to the preset company corresponding to each first user within the set time period is obtained; the probability that the white hat belongs to the preset company corresponding to each first user within the set time period is positively correlated with the number of occurrences of the network behavior information of each first user within the set time period.

[0103] In this feasible embodiment, the third acquisition module 603 can be specifically configured to perform a matching operation using the number of occurrences of the network behavior information corresponding to each user identifier in the correspondence between the preset number of occurrences and the probability, so as to obtain the probability that the white hat belongs to the preset company corresponding to each first user within the set time period.

[0104] In another feasible implementation of the embodiment of the present application, the user identification information includes the user identification of at least one first user; the third acquisition module 603 can be configured to obtain, for each preset company, the number of target first user identifications in the preset company within a set time period; the target first user identification is: the user identification of the first user in the preset company who has the same network behavior information as the white hat; based on the number of target first user identifications, the probability that the white hat belongs to the preset company within the set time period is obtained; the probability that the white hat belongs to the preset company within the set time period is positively correlated with the number of target first user identifications.

[0105] In a feasible implementation of the embodiment of the present application, there are multiple set time periods, and the multiple set time periods belong to a continuous time period; the determination module 604 can be configured to: for each preset company, calculate the initial probability that the white hat belongs to the preset company in the continuous time period according to the probability that the white hat belongs to the preset company in the multiple set time periods; If the probability that the white hat belongs to the preset company in multiple set time periods is greater than the preset threshold, the initial probability that the white hat belongs to the preset company in the consecutive time periods is increased according to the preset increment to obtain the target probability that the white hat belongs to the preset company in the consecutive time periods; The company to which the white hat belongs in a continuous time period is determined based on the target probability that the white hat belongs to each preset company in a continuous time period.

[0106] In this feasible embodiment, the determination module 604 may also be configured to: obtain, within a continuous time period, the first date on which network behavior information corresponding to the white hat's affiliated company and the white hat's network behavior information first have the same network behavior information, and the last date on which network behavior information corresponding to the white hat's affiliated company and the white hat's network behavior information last have the same network behavior information; The first date and the last date are used to determine the period of time that the white hat has worked in the company.

[0107] Exemplarily, the determination module 604 may be configured to: calculate the sum of the first date and the preset duration of employment to obtain the first date; calculate the sum of the last date and the duration of employment to obtain the second date, and obtain the employment time period; wherein the employment time period is a time period starting from the first date and ending with the second date.

[0108] In another feasible implementation of the embodiment of the present application, the determination module 604 can be specifically configured to: determine the preset company with the highest probability as the company to which the white hat belongs within a set time period.

[0109] In a feasible implementation of the embodiment of the present application, the second acquisition module 602 can be configured to obtain the personal information of the white hat, the personal information including the company name; obtain the white hat's usage email address from the login log information; when the company name corresponding to the white hat's usage email address is inconsistent with the company name in the personal information, obtain the white hat's network behavior information from the login log information.

[0110] It should be understood that, for the sake of brevity, some of the contents described in the first embodiment will not be repeated in this embodiment.

[0111] Embodiment five: Based on the same inventive concept, this embodiment provides an electronic device, see Figure 7 As shown, it includes a processor 701 and a memory 702. Among them: The processor 701 is used to execute one or more programs stored in the memory 702 to implement the above-mentioned method of constructing a white hat portrait.

[0112] It is understood that the processor 701 may be a processor core or a processor chip, or other circuits capable of program configuration and operation. The memory 702 may be a RAM (Random Access Memory), a ROM (Read-Only Memory), a flash memory, etc., but is not limited thereto.

[0113] It is understandable. Figure 7 The structure shown is for illustration only. The electronic device may also include Figure 7 More or fewer components as shown, or with Figure 7 For example, it may also have an internal communication bus for realizing communication between the processor 701 and the memory 702; for another example, it may also have an external communication interface, such as a USB (Universal Serial Bus) interface, a CAN (Controller Area Network) bus interface, etc.; for another example, it may also have an information display component such as a display screen, but this is not a limitation.

[0114] Based on the same inventive concept, this embodiment also provides a computer-readable storage medium, such as a floppy disk, an optical disk, a hard disk, a flash memory, a USB flash disk, an SD (Secure Digital Memory Card) card, an MMC (Multimedia Card) card, etc., in which one or more programs for implementing the above steps are stored, and the one or more programs can be executed by one or more processors to implement the above method of building a white hat portrait. No further details will be given here.

[0115] Based on the same inventive concept, this embodiment also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the above-mentioned method of constructing a white hat portrait.

[0116] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0117] In addition, the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0118] Furthermore, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0119] In this document, relational terms such as first and second, etc. are used merely to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any such actual relationship or order between these entities or operations.

[0120] As used herein, a plurality refers to two or more than two.

[0121] The above description is only an embodiment of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for constructing a white hat portrait, characterized in that: include: Get the login log information of the white hat; Obtaining the network behavior information of the white hat from the login log information; Obtaining the probability that the white hat belongs to each of the preset companies within a set time period according to the network behavior information and user identification information corresponding to at least one preset company; The company to which the white hat belongs is determined according to the probability that the white hat belongs to each of the preset companies within the set time period.

2. The method according to claim 1, characterized in that The user identification information corresponding to each preset company includes network behavior information corresponding to each preset company, and obtaining the probability that the white hat belongs to each preset company within the set time period according to the network behavior information and the user identification information corresponding to at least one preset company includes: For each preset company, if there is network behavior information with the same content between the network behavior information of the white hat in the set time period and the network behavior information corresponding to the preset company, the network behavior information with the same content is aggregated in the set time period to obtain the number of occurrences of the network behavior information with the same content in the set time period; According to the number of occurrences of the network behavior information with the same content within the set time period, the probability that the white hat belongs to the preset company within the set time period is obtained; the probability that the white hat belongs to the preset company within the set time period is positively correlated with the number of occurrences of the network behavior information with the same content within the set time period.

3. The method according to claim 2, characterized in that According to the number of occurrences of the network behavior information with the same content within the set time period, the probability that the white hat belongs to the preset company within the set time period is obtained, including: In the correspondence between the preset number of occurrences and the probability, a matching operation is performed using the number of occurrences of the network behavior information with the same content within the set time period to obtain the probability that the white hat belongs to the preset company within the set time period.

4. The method according to claim 1, characterized in that: The user identification information includes a user identification of at least one first user; obtaining the probability that the white hat belongs to each of the preset companies within the set time period according to the network behavior information and the user identification information corresponding to at least one preset company, including: Obtain network behavior information of different contents of the white hat; For each network behavior information of different contents, obtaining the number of occurrences of the network behavior information corresponding to each user identifier within the set time period; According to the number of occurrences of the network behavior information corresponding to each of the user identifiers, the probability that the white hat belongs to the preset company corresponding to each of the first users within the set time period is obtained; the probability that the white hat belongs to the preset company corresponding to each of the first users within the set time period is positively correlated with the number of occurrences of the network behavior information of each of the first users within the set time period.

5. The method according to claim 4, characterized in that According to the number of occurrences of the network behavior information corresponding to each of the user identifiers, obtaining the probability that the white hat belongs to the preset company corresponding to each of the first users within the set time period includes: In the correspondence between the preset number of occurrences and probabilities, a matching operation is performed using the number of occurrences of the network behavior information corresponding to each of the user identifiers to obtain the probability that the white hat belongs to the preset company corresponding to each of the first users within the set time period.

6. The method according to claim 1, characterized in that The user identification information includes a user identification of at least one first user; obtaining the probability that the white hat belongs to each of the preset companies within the set time period according to the network behavior information and the user identification information corresponding to at least one preset company, including: For each preset company, the number of target first user identifiers in the preset company within the set time period is obtained; the target first user identifier is: the user identifier of the first user in the preset company who has the same network behavior information as the white hat; According to the number of the target first user identifiers, the probability that the white hat belongs to the preset company within the set time period is obtained; the probability that the white hat belongs to the preset company within the set time period is positively correlated with the number of the target first user identifiers.

7. The method according to any one of claims 1 to 6, characterized in that: There are multiple set time periods, and the multiple set time periods belong to a continuous time period; determining the company to which the white hat belongs according to the probability that the white hat belongs to each preset company within the set time period includes: For each preset company, calculating the initial probability that the white hat belongs to the preset company in the consecutive time periods according to the probability that the white hat belongs to the preset company in the multiple set time periods; If the probability that the white hat belongs to the preset company in multiple set time periods is greater than a preset threshold, the initial probability that the white hat belongs to the preset company in the consecutive time periods is increased according to a preset increment to obtain a target probability that the white hat belongs to the preset company in the consecutive time periods; The company to which the white hat belongs in the continuous time period is determined according to the target probability that the white hat belongs to each of the preset companies in the continuous time period.

8. The method according to claim 7, characterized in that After determining the company to which the white hat belongs in the continuous time period according to the target probability that the white hat belongs to each preset company in the continuous time period, the method further includes: During the continuous time period, obtain the first date when the network behavior information corresponding to the company to which the white hat belongs and the network behavior information of the white hat have the same network behavior information for the first time, and the last date when the network behavior information corresponding to the company to which the white hat belongs and the network behavior information of the white hat have the same network behavior information for the last time; The working period of the white hat in the affiliated company is determined according to the first date and the last date.

9. The method according to claim 8, characterized in that Determining the period of time during which the white hat has worked in the company according to the first date and the last date includes: Calculate the sum of the first date and the preset working time to obtain the first date; The sum of the last date and the duration of employment is calculated to obtain a second date, thereby obtaining the employment time period; wherein the employment time period is a time period starting from the first date and ending from the second date.

10. The method according to any one of claims 1 to 6, characterized in that: Obtaining the network behavior information of the white hat from the login log information includes: Obtaining personal information of the white hat, wherein the personal information includes the company name; Obtain the email address used by the white hat from the login log information; When the company name corresponding to the email address used by the white hat is inconsistent with the company name in the personal information, the network behavior information of the white hat is obtained from the login log information.

11. The method according to any one of claims 1 to 6, characterized in that: Determining the company to which the white hat belongs according to the probability that the white hat belongs to each of the preset companies within the set time period includes: The preset company with the highest probability is determined as the company to which the white hat belongs within the set time period.

12. A device for constructing a white hat portrait, characterized in that: include: The first acquisition module is used to obtain the login log information of the white hat; A second acquisition module is used to obtain the network behavior information of the white hat from the login log information; A third acquisition module is used to acquire the probability that the white hat belongs to each preset company within a set time period according to the network behavior information and the user identification information corresponding to at least one preset company; The determination module is used to determine the company to which the white hat belongs according to the probability that the white hat belongs to each of the preset companies within the set time period.

13. An electronic device, characterized in that: It includes a processor and a memory, the memory stores computer-executable instructions that can be executed by the processor, and the processor executes the computer-executable instructions to implement the method for constructing a white hat portrait as described in any one of claims 1 to 11.

14. A storage medium, characterized in that: The storage medium stores computer-executable instructions. When the computer-executable instructions are called and executed by the processor, the computer-executable instructions enable the processor to implement the method for constructing a white hat portrait as described in any one of claims 1 to 11.

15. A computer program product, characterized in that The computer program product includes a computer program, and when the computer program is executed by a processor, the method for constructing a white hat portrait according to any one of claims 1 to 11 is implemented.

Images