Method, apparatus, device, medium and product for constructing a white hat portrait

Abstract

The present application provides a method, apparatus, device, medium and product for constructing a white hat portrait. The method includes: obtaining login log information of the white hat; obtaining the network behavior information of the white hat from the login log information; obtaining the probability that the white hat belongs to each of the preset companies within a set time period according to the network behavior information and the user identification information corresponding to at least one preset company; and determining the belonging company of the white hat according to the probability that the white hat belongs to each of the preset companies within the set time period. In this way, the probability that the white hat belongs to each preset company within the set time period can be effectively determined, and then its belonging company can be effectively anchored, improving the accuracy of the portrait.

Description

Technical Field

[0001] The present application relates to the field of white hat portraits. Specifically, it relates to a method, device, equipment, medium and product for constructing a white hat portrait. Background Art

[0002] With the continuous development of information technology, the degree of informatization of human society is getting higher and higher, and the entire society's dependence on network information is also getting higher and higher, so the importance of network security is also getting higher and higher. Currently, there are more and more attacks that pose threats to network security. For example, vulnerability attacks. A vulnerability is a defect in the specific implementation of hardware, software, protocols, or system security policies, which allows an attacker to access or damage the system without authorization. Currently, many companies have built network security service platforms. By recruiting professional network security technicians across the country (hereinafter referred to as white hats), they provide professional technical services such as network crowdsourcing testing for third parties. In order to more effectively identify and recruit suitable white hats, white hat portraits are usually constructed in network security service platforms.

[0003] However, the construction of current white hat portraits usually relies on the personal information filled in by users during registration. Since users rarely actively update their company information after the initial filling, it is difficult for the records on the network security service platform to reflect the latest company affiliation of white hats. Summary of the Invention

[0004] The purpose of the embodiments of the present application is to provide a method, device, equipment, medium and product for constructing a white hat portrait, so as to solve the problem in the related technology that the company affiliation of white hats cannot be accurately determined.

[0005] In a first aspect, an embodiment of the present application provides a method for constructing a white hat portrait, including:

[0006] Obtain the login log information of the white hat;

[0007] Obtain the network behavior information of the white hat from the login log information;

[0008] According to the network behavior information and the user identification information corresponding to at least one preset company, obtain the probability that the white hat belongs to each of the preset companies within a set time period;

[0009] Determine the affiliated company of the white hat according to the probability that the white hat belongs to each of the preset companies within the set time period.

[0010] In the above implementation process, by obtaining the network behavior information of the white hat and obtaining the probability that the white hat belongs to each preset company within a set time period based on the network behavior information and the user identification information corresponding to at least one preset company, the probability that the white hat belongs to each preset company within the set time period can be determined. And since the white hat is a person providing network security services, the network behavior information of the white hat will more directly reflect the work behavior of the white hat, so that the company to which the white hat belongs can be effectively anchored, making the probability that the white hat belongs to each preset company within the set time period more representative, and thus making the accuracy of the company to which the white hat belongs determined according to the probability that the white hat belongs to each preset company within the set time period higher, improving the accuracy of the portrait.

[0011] Further, the user identification information corresponding to each of the preset companies includes the network behavior information corresponding to each of the preset companies. Obtaining the probability that the white hat belongs to each of the preset companies within the set time period according to the network behavior information and the user identification information corresponding to at least one preset company includes:

[0012] For each preset company, if there is network behavior information with the same content between the network behavior information of the white hat within the set time period and the network behavior information corresponding to this preset company, then aggregate the network behavior information with the same content within the set time period to obtain the number of occurrences of the network behavior information with the same content within the set time period.

[0013] According to the number of occurrences of the network behavior information with the same content within the set time period, obtain the probability that the white hat belongs to this preset company within the set time period; the probability that the white hat belongs to this preset company within the set time period is positively correlated with the number of occurrences of the network behavior information with the same content within the set time period.

[0014] In the above implementation process, by counting the number of occurrences of the same network behavior information as the white hat in the network behavior information of the preset company within the set time period and predicting the probability that the white hat belongs to each preset company according to the number of occurrences of the same network behavior information. Since the white hat is a person providing network security services, the network behavior information of the white hat will more directly reflect the work behavior of the white hat, and since the network behavior information of the white hats using the resources of the same company tends to be consistent. It makes the number of occurrences of the same network behavior information between the white hat and each preset company more representative, and thus makes the accuracy of the company to which the white hat belongs determined according to the probability that the white hat belongs to each preset company predicted according to the number of occurrences of the same network behavior information higher, improving the accuracy of the portrait.

[0015] Further, obtaining the probability that the white hat belongs to the preset company within the set time period according to the number of occurrences of the same network behavior information within the set time period includes:

[0016] In the corresponding relationship between the preset number of occurrences and the probability, use the number of occurrences of the same network behavior information within the set time period to perform a matching operation to obtain the probability that the white hat belongs to the preset company within the set time period.

[0017] In the above implementation process, by directly using the number of occurrences of the same network behavior information within the set time period from the corresponding relationship between the preset number of occurrences and the probability to perform a matching operation, the probability that the white hat belongs to the preset company within the set time period can be obtained more quickly.

[0018] Further, the user identification information includes the user identifications of at least one first user; obtaining the probability that the white hat belongs to each of the preset companies within the set time period according to the network behavior information and the user identification information corresponding to at least one preset company includes:

[0019] Obtain the network behavior information with different contents of the white hat;

[0020] For each network behavior information with different contents, obtain the number of occurrences of this network behavior information corresponding to each user identification within the set time period;

[0021] According to the number of occurrences of this network behavior information corresponding to each user identification, obtain the probability that the white hat belongs to the preset companies corresponding to each of the first users within the set time period; the probability that the white hat belongs to the preset companies corresponding to each of the first users within the set time period is positively correlated with the number of occurrences of this network behavior information of each of the first users within the set time period.

[0022] In the above implementation process, for the network behavior information of each different content of the white hat, the occurrence times of the network behavior information corresponding to the user identifier included in the preset company within the set time period are obtained, and according to the occurrence times of the network behavior information corresponding to each user identifier, the probability that the white hat belongs to the preset company corresponding to each first user within the set time period is obtained. Since the white hat is a person providing network security services, the network behavior information of the white hat will more directly reflect the work behavior of the white hat. Also, since the network behavior information of the white hats using the resources of the same company tends to be consistent. This makes the determined occurrence times of the same network behavior information corresponding to the white hat and the user identifiers included in each preset company more representative, so that the probability that the white hat belongs to the preset company corresponding to each first user can be predicted more accurately based on the occurrence times of the network behavior information corresponding to each user identifier, and thus the affiliated company of the white hat can be determined more accurately, improving the accuracy of the portrait.

[0023] Further, obtaining the probability that the white hat belongs to the preset company corresponding to each first user within the set time period according to the occurrence times of the network behavior information corresponding to each user identifier includes:

[0024] In the corresponding relationship between the preset occurrence times and probabilities, a matching operation is performed using the occurrence times of the network behavior information corresponding to each user identifier to obtain the probability that the white hat belongs to the preset company corresponding to each first user within the set time period.

[0025] In the above implementation process, by directly performing a matching operation using the occurrence times of the network behavior information corresponding to each user identifier from the corresponding relationship between the preset occurrence times and probabilities, the probability that the white hat belongs to the preset company corresponding to each first user within the set time period can be obtained more quickly.

[0026] Further, the user identifier information includes the user identifiers of at least one first user; obtaining the probability that the white hat belongs to each preset company within the set time period according to the network behavior information and the user identifier information corresponding to at least one preset company includes:

[0027] For each preset company, obtain the number of target first user identifiers within the set time period; the target first user identifier is: the user identifier of the first user in the preset company who has the same network behavior information as the white hat;

[0028] Obtain the probability that the white hat belongs to the preset company within the set time period according to the number of the target first user identifiers; the probability that the white hat belongs to the preset company within the set time period is positively correlated with the number of the target first user identifiers.

[0029] In the above implementation process, for each preset company, obtain the number of user identifiers of the first users in the preset company who have the same network behavior information as the white hat within the set time period. Since the white hat is a person providing network security services, the network behavior information of the white hat will more directly reflect the work behavior of the white hat. Also, since the network behavior information of the white hats using the resources of the same company tends to be consistent. Therefore, by determining the number of user identifiers of the first users in the preset company who use the same network behavior information as the white hat, the probability that the white hat belongs to the preset company can be effectively determined, so that the accuracy of the affiliated company of the white hat determined according to the probability that the white hat belongs to each preset company within the set time period is higher, improving the accuracy of the portrait.

[0030] Further, there are multiple set time periods, and the multiple set time periods belong to a continuous time period; determining the affiliated company of the white hat according to the probability that the white hat belongs to each preset company within the set time period includes:

[0031] For each preset company, calculate the initial probability that the white hat belongs to the preset company within the continuous time period according to the probability that the white hat belongs to the preset company within the multiple set time periods;

[0032] If the probability that the white hat belongs to the preset company within multiple set time periods is greater than the preset threshold, increase the initial probability that the white hat belongs to the preset company within the continuous time period by a preset increment to obtain the target probability that the white hat belongs to the preset company within the continuous time period;

[0033] Determine the affiliated company of the white hat within the continuous time period according to the target probability that the white hat belongs to each preset company within the continuous time period.

[0034] In the above implementation process, if the probability that the white hat belongs to the preset company in multiple set time periods is greater than the preset threshold, the initial probability that the white hat belongs to the preset company in consecutive time periods can be increased according to a preset increment. Since multiple set time periods belong to consecutive time periods, the probability that the white hat belongs to each preset company in consecutive time periods is actually related to the probability that the white hat belongs to each preset company in the set time periods. Therefore, when the probability that the white hat belongs to the preset company in multiple set time periods is greater than the preset threshold, increasing the initial probability that the white hat belongs to the preset company in consecutive time periods according to the preset increment can more accurately obtain the target probability that the white hat belongs to the preset company in consecutive time periods.

[0035] Further, after determining the company to which the white hat belongs during the consecutive time periods according to the target probability that the white hat belongs to each of the preset companies during the consecutive time periods, it further includes:

[0036] During the consecutive time periods, obtain the first date when there is first network behavior information with the same content between the network behavior information corresponding to the company to which the white hat belongs and the network behavior information of the white hat, and the last date when there is last network behavior information with the same content between the network behavior information corresponding to the company to which the white hat belongs and the network behavior information of the white hat;

[0037] Determine the working time period of the white hat in the company to which it belongs according to the first date and the last date.

[0038] In the above implementation process, when determining the company to which the white hat belongs during consecutive time periods, by obtaining the first date when there is first network behavior information with the same content between the network behavior information corresponding to the company to which the white hat belongs and the network behavior information of the white hat, the starting time when the white hat enters the company to which it belongs can be determined. And by obtaining the last date when there is last network behavior information with the same content between the network behavior information corresponding to the company to which the white hat belongs and the network behavior information of the white hat, the latest time of the white hat in the company to which it belongs can be obtained. In this way, the working time period of the white hat in the company to which it belongs can be determined.

[0039] Further, determining the working time period of the white hat in the company to which it belongs according to the first date and the last date includes:

[0040] Calculate the sum of the first date and a preset working duration to obtain a first date;

[0041] Calculate the sum of the last date and the length of service, obtain a second date, and get the period of service; wherein, the period of service is a time period starting from the first date and ending at the second date.

[0042] In the above implementation process, since the company usually gives a probation period to the user in the initial stage of joining the company, and only when the probation is passed, the company resources will be opened to the user. Therefore, in the above implementation process, by calculating the sum of the first date and the preset length of service, the probation period given by the company to the user can be compensated, so as to more accurately estimate the start time of the user joining the company. Similarly, when the user leaves the company, there is usually a handover period, and by calculating the sum of the last date and the length of service, this handover period can be compensated, so as to more accurately estimate the end time of the user leaving the company.

[0043] Further, obtain the network behavior information of the white hat from the login log information, including:

[0044] Obtain the personal information of the white hat, and the personal information includes the company name;

[0045] Obtain the used email of the white hat from the login log information;

[0046] In the case where the company name corresponding to the used email of the white hat is inconsistent with the company name in the personal information, obtain the network behavior information of the white hat from the login log information.

[0047] In the above implementation process, in the case where the company name corresponding to the used email of the white hat is inconsistent with the company name in the personal information, it can be determined that the company name in the personal information of the white hat is incorrect. In this way, the timing for re-determining the company affiliation of the white hat can be determined, that is, to determine when to obtain the network behavior information of the white hat from the login log information, so as to avoid wasting resources to obtain the network behavior information of the white hat when there is no need to re-determine the company affiliation of the white hat.

[0048] Further, determine the affiliated company of the white hat according to the probabilities of the white hat belonging to each of the preset companies within the set time period, including:

[0049] Determine the preset company with the highest probability as the affiliated company of the white hat within the set time period.

[0050] In the above implementation process, determining the preset company with the highest probability as the affiliated company of the white hat within the set time period can improve the accuracy of determining the company affiliation of the white hat.

[0051] Second aspect, an embodiment of the present application further provides an apparatus for constructing a white hat portrait, including:

[0052] A first acquisition module, configured to acquire login log information of the white hat;

[0053] A second acquisition module, configured to acquire the network behavior information of the white hat from the login log information;

[0054] A third acquisition module, configured to obtain the probabilities of the white hat belonging to each of the preset companies within a set time period according to the network behavior information and the user identification information corresponding to at least one preset company;

[0055] A determination module, configured to determine the affiliated company of the white hat according to the probabilities of the white hat belonging to each of the preset companies within the set time period.

[0056] Third aspect, an embodiment of the present application further provides an electronic device, including a processor, a memory and a communication bus; the communication bus is used to realize the connection and communication between the processor and the memory; the processor is used to execute one or more programs stored in the memory to implement the method for constructing a white hat portrait according to any one of the above.

[0057] Fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, where the computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the method for constructing a white hat portrait according to any one of the above.

[0058] Fifth aspect, an embodiment of the present application further provides a computer program product, where the computer program product includes a computer program, and when the computer program is executed by a processor, the method for constructing a white hat portrait according to any one of the above is implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings required to be used in the embodiments of the present application. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as limiting the scope. For those of ordinary skill in the art, other related drawings can be obtained based on these drawings without creative efforts.

[0060] Figure 1 It is a schematic flowchart of a method for constructing a white hat portrait provided in an embodiment of the present application;

[0061] Figure 2 It is a schematic flowchart of another method for constructing a white hat portrait provided in an embodiment of the present application;

[0062] Figure 3 It is a schematic flowchart of another method for constructing a white hat portrait provided in an embodiment of the present application;

[0063] Figure 4 It is a schematic flowchart of another method for constructing a white hat portrait provided in an embodiment of the present application;

[0064] Figure 5 It is a schematic flowchart of a method for determining the employment time of a white hat within the affiliated company provided in an embodiment of the present application;

[0065] Figure 6 It is a schematic structural diagram of a device for constructing a white hat portrait provided in an embodiment of the present application;

[0066] Figure 7 It is a schematic structural diagram of an electronic device provided in an embodiment of the present application. Detailed implementation manners

[0067] Next, the technical solutions in the embodiments of the present application will be described with reference to the accompanying drawings in the embodiments of the present application. The following embodiments can be freely combined with each other without conflict to obtain new embodiments.

[0068] Embodiment 1:

[0069] To solve the problem in the related art that the company affiliation of the white hat cannot be accurately determined, an embodiment of the present application provides a method for constructing a white hat portrait. It can be seen in Figure 1 as shown Figure 1 It is a schematic flowchart of the method for constructing a white hat portrait provided in an embodiment of the present application, including:

[0070] Step S101, obtain the login log information of the white hat.

[0071] When the white hat logs in to the network security platform, the network security platform will record the detailed information of the white hat logging in to the network security platform. For example, the user identifier of the white hat, the timestamp of logging in to the network security platform, and the network behavior information of the white hat.

[0072] The network behavior information may include the IP address and the device identifier.

[0073] IP (Internet Protocol Address) is the unique identifier assigned by the Internet to each device on the network so that the device can communicate in the network.

[0074] The device identifier is a unique identifier assigned by the network security platform to the device for use within a set time period. That is, the device identifier of each device is only valid within the set time period. In different time periods, the device identifiers of the same device may also be different.

[0075] Step S102, obtain the network behavior information of the white hat from the login log information.

[0076] Exemplarily, the personal information of the white hat can be obtained, including the company name; the used email of the white hat is obtained from the login log information; in the case where the company name corresponding to the used email of the white hat is inconsistent with the company name in the personal information, the network behavior information of the white hat is obtained from the login log information.

[0077] The personal information of the white hat can be the information filled in by the white hat when registering on the network security platform, including the used email, the company name to which it belongs, and the occupation information.

[0078] If the company name filled in by the white hat when registering on the network security platform cannot be fully corresponded to the pre-stored company name, then the company name with the highest similarity to the company name filled in by the white hat in the pre-set stored company names can be used as the company name to which the white hat belongs. In this way, the company names can be unified, so that in the case of determining the company belonging of the white hat with unknown company belonging subsequently, the belonging company of the white hat with unknown company belonging can be determined more accurately based on the unified company name.

[0079] After obtaining the used email from the login log information, if the used email in the login log information is different from the used email in the personal information of the white hat, then the used email in the personal information can be updated with the used email in the login log information.

[0080] The company domain name can be obtained from the used email, and in the corresponding relationship between the pre-set company domain name and the company name, a matching operation is performed using the company domain name to obtain the company name corresponding to the used email.

[0081] Step S103, obtain the probability that the white hat belongs to each pre-set company within a set time period according to the network behavior information and the user identification information corresponding to at least one pre-set company.

[0082] In an alternative implementation manner of the embodiment of the present application, the user identification information corresponding to each pre-set company includes the network behavior information corresponding to each pre-set company, combined with Figure 2 As shown, the above step S103 can be replaced with:

[0083] Step S201: For each preset company, if there is network behavior information with the same content between the network behavior information of the white hat within the set time period and the network behavior information corresponding to the preset company, then aggregate the network behavior information with the same content within the set time period to obtain the number of occurrences of the network behavior information with the same content within the set time period.

[0084] The network behavior information can be an IP address. The white hat can use one or more IP addresses within the set time period. Correspondingly, the IP addresses corresponding to the preset company can include at least one IP address used by the white hat within the set time period. Similarly, the IP addresses corresponding to the preset company may not include all the IP addresses used by the white hat within the set time period.

[0085] In some embodiments, the IP addresses corresponding to the preset company can be obtained in the following manner: In the corresponding relationship between the preset company names and IP addresses, perform a matching operation using the company name of each preset company respectively to obtain all the IP addresses corresponding to each preset company respectively.

[0086] The network behavior information can be a device identifier. The device identifiers used by the white hat within the set time period can be one or more. Correspondingly, the device identifiers corresponding to the preset company can include at least one device identifier used by the white hat within the set time period. However, the device identifiers corresponding to the preset company may not include all the device identifiers used by the white hat within the set time period.

[0087] In the case where the IP addresses corresponding to the preset company include at least one IP address used by the white hat within the set time period, and / or the device identifiers corresponding to the preset company can include at least one device identifier used by the white hat within the set time period, it can be determined that there is network behavior information with the same content between the network behavior information of the white hat within the set time period and the network behavior information corresponding to the preset company.

[0088] In the case where the IP addresses corresponding to the preset company do not include all the IP addresses used by the white hat within the set time period, and the device identifiers corresponding to the preset company do not include all the device identifiers used by the white hat within the set time period, it can be determined that there is no network behavior information with the same content between the network behavior information of the white hat within the set time period and the network behavior information corresponding to the preset company.

[0089] Step S202: According to the number of occurrences of the network behavior information with the same content within the set time period, obtain the probability that the white hat belongs to the preset company within the set time period. The probability that the white hat belongs to the preset company within the set time period is positively correlated with the number of occurrences of the network behavior information with the same content within the set time period.

[0090] In an alternative implementation of the embodiment of the present application, if there are multiple network behavior information with the same content between the network behavior information of the white hat within the set time period and the network behavior information corresponding to the preset company, for each network behavior information with the same content, the occurrence times of the network behavior information within the set time period can be obtained, and the initial probability that the white hat belongs to the preset company within the set time period can be obtained according to the occurrence times of the network behavior information within the set time period. The sum of the initial probabilities that the white hat belongs to the preset company within the set time period is used as the probability that the white hat belongs to the preset company within the set time period.

[0091] Correspondingly, in the corresponding relationship between the preset occurrence times and probabilities, the occurrence times of the network behavior information within the set time period can be used for matching operations to obtain the initial probability that the white hat belongs to the preset company within the set time period.

[0092] Moreover, the relationship between the occurrence times of the network behavior information within the set time period and the initial probability that the white hat belongs to the preset company within the set time period satisfies the formula: y = kx + b, where k and b are both preset positive numbers. y represents the probability value determined according to the occurrence times of the network behavior information within the set time period, and x represents the occurrence times of the network behavior information within the set time period.

[0093] In another alternative implementation of the embodiment of the present application, if there are multiple network behavior information with the same content between the network behavior information of the white hat within the set time period and the network behavior information corresponding to the preset company, the sum of the occurrence times of the multiple network behavior information with the same content within the set time period is obtained, and the probability that the white hat belongs to the preset company within the set time period is obtained according to the sum of the occurrence times of the multiple network behavior information with the same content within the set time period.

[0094] Exemplarily, for each network behavior information with the same content, the occurrence times of the network behavior information within the set time period can be obtained, and the occurrence times of each network behavior information with the same content within the set time period are added together to obtain the sum of the occurrence times of all network behavior information with the same content within the set time period.

[0095] Similarly, in the corresponding relationship between the preset occurrence times and probabilities, the sum of the occurrence times of all network behavior information within the set time period can be used for matching operations to obtain the probability that the white hat belongs to the preset company within the set time period.

[0096] Moreover, the relationship between the sum of the occurrence times of all network behavior information within the set time period and the probability that the white hat belongs to the preset company within the set time period also satisfies the formula: y = kx + b.

[0097] In an alternative implementation of the embodiment of the present application, if there is only one network behavior information with the same content between the network behavior information of the white hat within the set time period and the network behavior information corresponding to the preset company, the probability that the white hat belongs to the preset company within the set time period can be directly obtained according to the number of occurrences of the network behavior information within the set time period.

[0098] In another alternative implementation of the embodiment of the present application, the user identification information includes the user identifications of at least one first user. Combining Figure 3 As shown, the above step S103 can also be replaced by:

[0099] Step S301, obtain the network behavior information of different contents of the white hat.

[0100] Each time the white hat logs in to the network security platform, the network behavior information of the white hat will be recorded once in the login log information. If the white hat logs in to the network security platform multiple times within the set time period, multiple network behavior information of the white hat can be obtained from the network security platform. Among these multiple network behavior information, the contents can be the same or different. Therefore, the network behavior information of different contents of the white hat can be obtained from the login log information of the white hat.

[0101] Step S302, for each network behavior information of different contents, obtain the number of occurrences of the network behavior information corresponding to each user identification within the set time period.

[0102] The login log information corresponding to each user identification can be obtained, and all the network behavior information corresponding to each user identification can be obtained from the login log information corresponding to each user identification. And from all the network behavior information corresponding to each user identification, the number of occurrences of the network behavior information corresponding to each user identification within the set time period can be obtained.

[0103] Step S303, according to the number of occurrences of the network behavior information corresponding to each user identification, obtain the probability that the white hat belongs to the preset companies corresponding to each first user within the set time period; the probability that the white hat belongs to the preset companies corresponding to each first user within the set time period is positively correlated with the number of occurrences of the network behavior information of each first user within the set time period.

[0104] In an alternative implementation of the embodiment of the present application, to obtain the probability that the white hat belongs to the preset company corresponding to each first user within a set time period according to the occurrence times of the network behavior information corresponding to each user identifier, the following steps may be included: For each preset company, the sum of the occurrence times of all the network behavior information corresponding to all user identifiers within the preset company may be calculated, and according to the sum of the occurrence times of all the network behavior information corresponding to all user identifiers within the preset company, the probability that the white hat belongs to the preset company within the set time period may be obtained.

[0105] Exemplarily, in the corresponding relationship between the preset probability and the occurrence times, the sum of the occurrence times of all the network behavior information corresponding to all user identifiers within the preset company may be used for matching operations to obtain the probability that the white hat belongs to the preset company within the set time period.

[0106] Exemplarily, to obtain the probability that the white hat belongs to the preset company corresponding to each first user within a set time period according to the occurrence times of the network behavior information corresponding to each user identifier, the following steps may be included: For each preset company, the sum of the occurrence times of all the network behavior information corresponding to each user identifier within the preset company may be calculated, and based on the sum of the occurrence times of all the network behavior information corresponding to each user identifier within the preset company, the initial probability that the white hat belongs to the preset company within the set time period may be obtained. The sum of the initial probabilities that the white hat belongs to the preset company within the set time period may be calculated to obtain the probability that the white hat belongs to the preset company within the set time period.

[0107] Similarly, in the corresponding relationship between the preset probability and the occurrence times, the sum of the occurrence times of all the network behavior information corresponding to each user identifier may be used for matching operations respectively to obtain the initial probability that the white hat belongs to the preset company within the set time period.

[0108] Exemplarily, to obtain the probability that the white hat belongs to the preset company corresponding to each first user within a set time period according to the occurrence times of the network behavior information corresponding to each user identifier, the following steps may be included: In the corresponding relationship between the preset occurrence times and the probability, the occurrence times of the network behavior information corresponding to each user identifier may be used for matching operations to obtain the probability that the white hat belongs to the preset company corresponding to each first user within the set time period.

[0109] If there are multiple probability values for the probability that the white hat belongs to the preset company corresponding to each first user within the set time period, that is, if there are multiple probability values for the probability that the white hat belongs to the preset company within the set time period, the maximum probability value may be used as the probability that the white hat belongs to the preset company within the set time period. Alternatively, the sum of the multiple probability values may also be used as the probability that the white hat belongs to the preset company within the set time period.

[0110] In another alternative implementation of the embodiment of the present application, in combination with Figure 4 as shown, the above step S103 can also be replaced with:

[0111] Step S401, for each preset company, obtain the number of target first user identifiers within the preset company during a set time period. The target first user identifier is: the user identifier of the first user within the preset company who has the same network behavior information as the white hat.

[0112] Step S402, according to the number of target first user identifiers, obtain the probability that the white hat belongs to the preset company during the set time period. The probability that the white hat belongs to the preset company during the set time period is positively correlated with the number of target first user identifiers.

[0113] Exemplarily, in the corresponding relationship between the preset number of user identifiers and the probability, the number of target first user identifiers within the preset company can be used for matching operations to obtain the probability that the white hat belongs to the preset company during the set time period.

[0114] The number of target first user identifiers and the probability that the white hat belongs to the preset company during the set time period satisfy the formula: h = fa + c, where f and c are both positive numbers, a represents the number of target first user identifiers, and h represents the probability value calculated according to the number of target first user identifiers.

[0115] Step S104, determine the affiliated company of the white hat according to the probabilities that the white hat belongs to each preset company during the set time period.

[0116] Exemplarily, the preset company with the highest probability can be determined as the affiliated company of the white hat during the set time period. Or, the preset companies with probabilities greater than a preset threshold can also be determined as the affiliated companies of the white hat during the set time period.

[0117] The method for constructing a white hat portrait provided by the embodiment of the present application obtains the network behavior information of the white hat, and obtains the probabilities that the white hat belongs to each preset company during the set time period according to the network behavior information and the user identifier information corresponding to at least one preset company. The probabilities that the white hat belongs to each preset company during the set time period can be determined. Since the white hat is a person providing network security services, the network behavior information of the white hat will more directly reflect the work behavior of the white hat, so that its affiliated company can be effectively anchored, making the probabilities that the white hat belongs to each preset company during the set time period more representative, and thus making the affiliated company of the white hat determined according to the probabilities that the white hat belongs to each preset company during the set time period more accurate, improving the accuracy of the portrait.

[0118] Embodiment 2:

[0119] Based on the first embodiment, this embodiment provides multiple set time periods, and the multiple set time periods belong to a continuous time period. This embodiment takes the probability that the white hat belongs to each preset company within each set time period as the basis to determine the employment time of the white hat within the affiliated company for illustrative purposes. Combining Figure 5 As shown, the method for determining the employment time of the white hat within the affiliated company may include the following steps:

[0120] Step S501, for each preset company, calculate the initial probability that the white hat belongs to the preset company within the continuous time period according to the probability that the white hat belongs to the preset company within multiple set time periods.

[0121] Exemplarily, the maximum probability that the white hat belongs to the preset company within multiple set time periods can be used as the initial probability that the white hat belongs to the preset company within the continuous time period. Alternatively, the average probability that the white hat belongs to the preset company within multiple set time periods can also be calculated and used as the initial probability that the white hat belongs to the preset company within the continuous time period.

[0122] Step S502, if the probability that the white hat belongs to the preset company within multiple set time periods is greater than the preset threshold, increase the initial probability that the white hat belongs to the preset company within the continuous time period according to the preset increment to obtain the target probability that the white hat belongs to the preset company within the continuous time period.

[0123] In some embodiments, the following relationship holds between the target probability that the white hat belongs to the preset company within the continuous time period and the initial probability that the white hat belongs to the preset company within the continuous time period: W = H + Rt, where W represents the target probability that the white hat belongs to the preset company within the continuous time period, H represents the initial probability that the white hat belongs to the preset company within the continuous time period, t represents the preset increment, and R represents the number of target set time periods, and the target set time period is the set time period when the probability that the white hat belongs to the preset company is greater than the preset threshold.

[0124] Step S503, determine the affiliated company of the white hat within the continuous time period according to the target probability that the white hat belongs to each preset company within the continuous time period.

[0125] Determine the preset company with the highest target probability as the affiliated company of the white hat within the continuous time period.

[0126] Step S504: Within a continuous time period, obtain the first date when there is a network behavior information with the same content for the first time between the network behavior information corresponding to the affiliated company of the white hat and the network behavior information of the white hat, and the last date when there is a network behavior information with the same content for the last time between the network behavior information corresponding to the affiliated company of the white hat and the network behavior information of the white hat.

[0127] Step S505: Determine the working period of the white hat within the affiliated company according to the first date and the last date.

[0128] Exemplarily, the sum of the first date and a preset working duration can be calculated to obtain a first date; the sum of the last date and the working duration can be calculated to obtain a second date, and the working period is obtained; wherein, the working period is a time period starting from the first date and ending at the second date.

[0129] Or, the working period is a time period starting from the first date and ending at the last date.

[0130] In some embodiments, within a continuous time period, the first date when there is a network behavior information with the same content for the first time between the network behavior information corresponding to the affiliated company of the white hat and the network behavior information of the white hat is, for example, January 2020, and the last date when there is a network behavior information with the same content for the last time between the network behavior information corresponding to the affiliated company of the white hat and the network behavior information of the white hat is, for example, July 2022. Then, the working period of the white hat within the affiliated company can be from January 2020 to July 2022.

[0131] For the method provided in the embodiments of the present application for determining the employment time of the white hat within the affiliated company, if the probabilities of the white hat belonging to the preset company in multiple set time periods are all greater than the preset threshold, the initial probability of the white hat belonging to the preset company within the continuous time period can be increased according to a preset increment. Since multiple set time periods all belong to the continuous time period, therefore, the probability of the white hat belonging to each preset company within the continuous time period is substantially related to the probability of the white hat belonging to each preset company within the set time period. Therefore, in the case where the probabilities of the white hat belonging to the preset company in multiple set time periods are all greater than the preset threshold, increasing the initial probability of the white hat belonging to the preset company within the continuous time period according to a preset increment can more accurately obtain the target probability of the white hat belonging to the preset company within the continuous time period.

[0132] Embodiment 3:

[0133] Based on the above embodiments, this embodiment further illustrates the present application by way of example:

[0134] In some embodiments, as shown in Table 1, for white hat a, white hat a used the IP a total of 5 times within the set time period T1, a total of 3 times within the set time period T2, a total of 3 times within the set time period T3, a total of 2 times within the set time period T4, and a total of 7 times within the set time period T5. Obtain the number of occurrences of the network behavior information with the same content between the network behavior information of white hat within T1 and the network behavior information corresponding to the preset company A within T1, for example, it is 0. Obtain the number of occurrences of the IP with the same content between the IP of white hat within T2 and the IP corresponding to the preset company A within T2, for example, it is 0. Obtain the number of occurrences of the IP with the same content between the IP of white hat within T3 and the IP corresponding to the preset company A within T3, for example, it is 1. Obtain the number of occurrences of the IP with the same content between the IP of white hat within T4 and the IP corresponding to the preset company A within T4, for example, it is 1. Obtain the number of occurrences of the IP with the same content between the IP of white hat within T5 and the IP corresponding to the preset company A within T5, for example, it is 2. In this way, the statistical results as shown in Table 1 can be obtained.

[0135] Table 1

[0136]

[0137] In some embodiments, if white hat a has login records in multiple set time periods, that is, there are IP login times in T1, T2, T3, T4, and T5, but white hat a only shares IP with the preset company A within the set time periods T3, T4, and T5. The initial probability that white hat a belongs to the preset company A can be determined first, for example, 75%. Then, by calculating W = H + Rt, where t is, for example, 5%. Obtain the target probability that white hat a belongs to the preset company A as 90%.

[0138] In some embodiments, if in multiple set time periods, white hat a only has a login record in one of the set time periods. For example, it only uses the IP within the set time period T6. And within the set time period T6, only the target first user identifier is included within the preset company A, that is, the user identifier of the first user with the same IP as white hat a. If there is only one target first user identifier, then the probability that white hat a belongs to the preset company A can be determined to be 70%. If the number of target first user identifiers is 2 or 3, then the probability that white hat a belongs to the preset company A can be determined to be 75%. If the number of target first user identifiers exceeds 3, then the probability that white hat a belongs to the preset company A can be determined to be 80%.

[0139] In some embodiments, if in multiple set time periods, white hat a only has a login record in one of the set time periods, for example, the IP is only used in the set time period T7. And in the set time period T7, the preset company A, the preset company B, and the preset company C all include the target first user identifier, that is, the preset company A, the preset company B, and the preset company C all include the user identifier of the first user with the same IP as the white hat a. If the matching operation can be performed using the target first user identifier number in the preset company A, the target first user identifier number in the preset company B, and the target first user identifier number in the preset company C in the corresponding relationship between the preset user identifier number and the probability, the probability that the white hat a belongs to the preset company A, the preset company B, and the preset company C is obtained.

[0140] Embodiment 4:

[0141] Based on the same inventive concept, the present application also provides a device 600 for constructing a white hat portrait. Figure 6 , Figure 6 Shows the use of Figure 1 The method shown is a device for constructing a white hat portrait. It should be understood that the specific functions of the device 600 can be found in the description above. To avoid repetition, the detailed description is appropriately omitted here. The device 600 includes at least one software function module that can be stored in a memory in the form of software or firmware or solidified in the operating system of the device 600. Specifically:

[0142] See also Figure 6 As shown, the apparatus 600 for constructing a white hat portrait includes: a first acquisition module 601, a second acquisition module 602, a third acquisition module 603 and a determination module 604. Among them:

[0143] The first acquisition module 601 is used to obtain login log information of white hats.

[0144] The second acquisition module 602 is used to obtain the network behavior information of the white hat from the login log information.

[0145] The third acquisition module 603 is used to acquire the probability that the white hat belongs to each preset company within a set time period according to the network behavior information and the user identification information corresponding to at least one preset company.

[0146] The determination module 604 is used to determine the company to which the white hat belongs according to the probability that the white hat belongs to each preset company within a set time period.

[0147] In a feasible implementation manner of the embodiment of the present application, the third acquisition module 603 may be configured to, for each preset company, if there is network behavior information with the same content between the network behavior information of the white hat within a set time period and the network behavior information corresponding to the preset company, aggregate the network behavior information with the same content within the set time period to obtain the number of occurrences of the network behavior information with the same content within the set time period;

[0148] According to the number of occurrences of the network behavior information with the same content within the set time period, obtain the probability that the white hat belongs to the preset company within the set time period; the probability that the white hat belongs to the preset company within the set time period is positively correlated with the number of occurrences of the network behavior information with the same content within the set time period.

[0149] In this embodiment, the third acquisition module 603 may specifically be configured to perform a matching operation using the number of occurrences of the network behavior information with the same content within the set time period in the corresponding relationship between the preset number of occurrences and the probability, to obtain the probability that the white hat belongs to the preset company within the set time period.

[0150] In another feasible implementation manner of the embodiment of the present application, the user identification information includes the user identifications of at least one first user; the third acquisition module 603 may be configured to obtain the network behavior information of different contents of the white hat; for each network behavior information of different contents, obtain the number of occurrences of the network behavior information corresponding to each user identification within the set time period; according to the number of occurrences of the network behavior information corresponding to each user identification, obtain the probability that the white hat belongs to the preset companies corresponding to each first user within the set time period; the probability that the white hat belongs to the preset companies corresponding to each first user within the set time period is positively correlated with the number of occurrences of the network behavior information of each first user within the set time period.

[0151] In this feasible embodiment, the third acquisition module 603 may specifically be configured to perform a matching operation using the number of occurrences of the network behavior information corresponding to each user identification in the corresponding relationship between the preset number of occurrences and the probability, to obtain the probability that the white hat belongs to the preset companies corresponding to each first user within the set time period.

[0152] In another feasible implementation manner of the embodiment of the present application, the user identification information includes the user identifications of at least one first user; the third acquisition module 603 may be configured to, for each preset company, acquire the number of target first user identifications within the preset company during a set time period; the target first user identification is: the user identification of the first user within the preset company who has the same network behavior information as the white hat; according to the number of target first user identifications, acquire the probability that the white hat belongs to the preset company during the set time period; the probability that the white hat belongs to the preset company during the set time period is positively correlated with the number of target first user identifications.

[0153] In a feasible implementation manner of the embodiment of the present application, there are multiple set time periods, and the multiple set time periods belong to a continuous time period; the determination module 604 may be configured to: for each preset company, calculate the initial probability that the white hat belongs to the preset company during the continuous time period according to the probability that the white hat belongs to the preset company during the multiple set time periods.

[0154] If the probability that the white hat belongs to the preset company during the multiple set time periods is greater than the preset threshold, then increase the initial probability that the white hat belongs to the preset company during the continuous time period by a preset increment to obtain the target probability that the white hat belongs to the preset company during the continuous time period.

[0155] Determine the affiliated company of the white hat during the continuous time period according to the target probabilities that the white hat belongs to each preset company during the continuous time period.

[0156] In this feasible embodiment, the determination module 604 may further be configured to: during the continuous time period, acquire the first date when there is the first network behavior information with the same content between the network behavior information of the affiliated company of the white hat and the network behavior information of the white hat, and the last date when there is the last network behavior information with the same content between the network behavior information of the affiliated company of the white hat and the network behavior information of the white hat.

[0157] Determine the working time period of the white hat within the affiliated company according to the first date and the last date.

[0158] Exemplarily, the determination module 604 may be configured to: calculate the sum of the first date and the preset working duration to obtain the first date; calculate the sum of the last date and the working duration to obtain the second date, and obtain the working time period; wherein, the working time period is the time period with the first date as the start date and the second date as the end date.

[0159] In another feasible implementation manner of the embodiment of the present application, the determination module 604 may specifically be configured to: determine the preset company with the highest probability as the affiliated company of the white hat during the set time period.

[0160] In a feasible implementation manner of the embodiment of the present application, the second acquisition module 602 may be configured to acquire personal information of a white hat, where the personal information includes the company name; acquire the email used by the white hat from the login log information; and when the company name corresponding to the email used by the white hat is inconsistent with the company name in the personal information, acquire the network behavior information of the white hat from the login log information.

[0161] It should be understood that, for the sake of brevity of description, the content described in some of the first embodiments will not be repeated in this embodiment.

[0162] Embodiment Five:

[0163] Based on the same inventive concept, this embodiment provides an electronic device. Refer to Figure 7 as shown, which includes a processor 701 and a memory 702. Among them:

[0164] The processor 701 is configured to execute one or more programs stored in the memory 702 to implement the method for constructing the white hat portrait described above.

[0165] It can be understood that the processor 701 may be a processor core or a processor chip, or other circuits that can be programmed and run. The memory 702 may be RAM (Random Access Memory), ROM (Read-Only Memory), flash memory, etc., but is not limited thereto.

[0166] It can also be understood that Figure 7 the structure shown is only for illustration, and the electronic device may further include more or fewer components than those shown in Figure 7 or have a different configuration from that shown in Figure 7 For example, it may also have an internal communication bus for realizing communication between the processor 701 and the memory 702; for another example, it may also have an external communication interface, such as a USB (Universal Serial Bus) interface, a CAN (Controller Area Network) bus interface, etc.; for another example, it may also have an information display component such as a display screen, but is not limited thereto.

[0167] Based on the same inventive concept, this embodiment also provides a computer-readable storage medium, such as a floppy disk, optical disc, hard disk, flash memory, USB flash drive, SD (Secure Digital Memory Card) card, MMC (Multimedia Card) card, etc. One or more programs for implementing the above-mentioned various steps are stored in the computer-readable storage medium, and the one or more programs can be executed by one or more processors to implement the method for constructing a white hat portrait. Details are not described herein again.

[0168] Based on the same inventive concept, this embodiment also provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, it implements the method for constructing a white hat portrait described above.

[0169] In the embodiments provided in the present application, it should be understood that the disclosed device and method can be implemented in other ways. The device embodiments described above are only illustrative. For example, the division of the units is only a logical function division, and there may be other division methods in actual implementation. For another example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed mutual coupling or direct coupling or communication connection may be through some communication interfaces, and the indirect coupling or communication connection of the device or unit may be in an electrical, mechanical or other form.

[0170] In addition, the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0171] Furthermore, in each embodiment of the present application, the various functional modules may be integrated together to form an independent part, or each module may exist alone, or two or more modules may be integrated to form an independent part.

[0172] In this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations.

[0173] In this article, "a plurality of" means two or more.

[0174] The above are only embodiments of the present application and are not intended to limit the protection scope of the present application. For those skilled in the art, various modifications and changes can be made to the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included within the protection scope of the present application.

Claims

1. A method for constructing a white hat portrait, characterized in that, Including: Obtaining the login log information of the white hat; Obtaining the network behavior information of the white hat from the login log information; The network behavior information includes an IP address or a device identifier; Obtaining the probability that the white hat belongs to each of the preset companies within a set time period according to the network behavior information and the user identifier information corresponding to at least one preset company; the user identifier information corresponding to the preset company includes the user identifiers of at least one first user and the network behavior information corresponding to the preset company; Determining the affiliated company of the white hat according to the probability that the white hat belongs to each of the preset companies within the set time period; Obtaining the probability that the white hat belongs to each of the preset companies within a set time period according to the network behavior information and the user identifier information corresponding to at least one preset company, including: For each preset company, if there is network behavior information with the same content between the network behavior information of the white hat within the set time period and the network behavior information corresponding to the preset company, then aggregate the network behavior information with the same content within the set time period to obtain the number of occurrences of the network behavior information with the same content within the set time period; according to the number of occurrences of the network behavior information with the same content within the set time period, obtain the probability value that the white hat belongs to the preset company within the set time period; the probability value that the white hat belongs to the preset company within the set time period is positively correlated with the number of occurrences of the network behavior information with the same content within the set time period; Obtaining the network behavior information with different contents of the white hat; for each network behavior information with different contents, obtaining the number of occurrences of the network behavior information corresponding to each user identifier within the set time period; according to the number of occurrences of the network behavior information corresponding to each user identifier, obtaining the probability value that the white hat belongs to the preset company corresponding to each first user within the set time period; the probability value that the white hat belongs to the preset company corresponding to each first user within the set time period is positively correlated with the number of occurrences of the network behavior information of each first user within the set time period; For each preset company, if there are multiple probability values that the white hat belongs to the preset company within the set time period, then use the sum of the multiple probability values as the probability that the white hat belongs to the preset company within the set time period.

2. The method according to claim 1, wherein Obtaining the probability value that the white hat belongs to the preset company within the set time period according to the number of occurrences of the network behavior information with the same content within the set time period, including: In the corresponding relationship between the preset number of occurrences and the probability value, perform a matching operation using the number of occurrences of the network behavior information with the same content within the set time period to obtain the probability value that the white hat belongs to the preset company within the set time period.

3. The method according to claim 1, characterized in that, Obtaining the probability value that the white hat belongs to the preset company corresponding to each first user within the set time period according to the number of occurrences of the network behavior information corresponding to each user identifier, including: In the corresponding relationship between the preset occurrence times and probability values, a matching operation is performed using the occurrence times of the network behavior information corresponding to each user identifier to obtain the probability value that the white hat belongs to the preset company corresponding to each first user within the set time period.

4. The method according to claim 1, wherein Obtaining the probability that the white hat belongs to each preset company within the set time period according to the network behavior information and the user identifier information corresponding to at least one preset company includes: For each preset company, obtain the number of target first user identifiers within the set time period; the target first user identifier is: the user identifier of the first user in the preset company who has the same network behavior information as the white hat; According to the number of the target first user identifiers, obtain the probability that the white hat belongs to the preset company within the set time period; the probability that the white hat belongs to the preset company within the set time period is positively correlated with the number of the target first user identifiers.

5. The method according to any one of claims 1 to 4, characterized in that, There are multiple set time periods, and the multiple set time periods belong to a continuous time period; determining the affiliated company of the white hat according to the probability that the white hat belongs to each preset company within the set time period includes: For each preset company, calculate the initial probability that the white hat belongs to the preset company within the continuous time period according to the probability that the white hat belongs to the preset company within multiple set time periods; If the probability that the white hat belongs to the preset company within multiple set time periods is greater than a preset threshold, increase the initial probability that the white hat belongs to the preset company within the continuous time period by a preset increment to obtain the target probability that the white hat belongs to the preset company within the continuous time period; Determine the affiliated company of the white hat within the continuous time period according to the target probability that the white hat belongs to each preset company within the continuous time period.

6. The method according to claim 5, wherein After determining the affiliated company of the white hat within the continuous time period according to the target probability that the white hat belongs to each preset company within the continuous time period, it further includes: Within the continuous time period, obtain the first date when there is a network behavior information with the same content for the first time between the network behavior information of the affiliated company of the white hat and the network behavior information of the white hat, and the last date when there is a network behavior information with the same content for the last time between the network behavior information of the affiliated company of the white hat and the network behavior information of the white hat; Determine the working time period of the white hat within the affiliated company according to the first date and the last date.

7. The method according to claim 6, wherein Determining the working time period of the white hat within the affiliated company according to the first date and the last date includes: Calculate the sum of the first date and the preset working duration to obtain a first date; Calculate the sum of the last date and the working duration to obtain a second date, and obtain the working time period; wherein, the working time period is a time period with the first date as the start date and the second date as the end date.

8. The method according to any one of claims 1 to 4, characterized in that, Obtain the network behavior information of the white hat from the login log information, including: Obtain the personal information of the white hat, where the personal information includes the company name; Obtain the used email of the white hat from the login log information; In the case where the company name corresponding to the used email of the white hat is inconsistent with the company name in the personal information, obtain the network behavior information of the white hat from the login log information.

9. The method according to any one of claims 1 to 4, characterized in that Determine the affiliated company of the white hat according to the probability that the white hat belongs to each of the preset companies within the set time period, including: Determine the preset company with the highest probability as the affiliated company of the white hat within the set time period.

10. An apparatus for constructing a white hat portrait, characterized in that, Include: The first acquisition module is used to acquire the login log information of the white hat; The second acquisition module is used to acquire the network behavior information of the white hat from the login log information; The network behavior information includes an IP address or a device identifier; The third acquisition module is used to obtain the probability that the white hat belongs to each of the preset companies within the set time period according to the network behavior information and the user identifier information corresponding to at least one preset company; the user identifier information corresponding to the preset company includes the user identifiers of at least one first user and the network behavior information corresponding to the preset company; The determination module is used to determine the affiliated company of the white hat according to the probability that the white hat belongs to each of the preset companies within the set time period; Specifically, the third acquisition module is used for: For each preset company, if there is network behavior information with the same content between the network behavior information of the white hat within the set time period and the network behavior information corresponding to the preset company, aggregate the network behavior information with the same content within the set time period to obtain the number of occurrences of the network behavior information with the same content within the set time period; According to the number of occurrences of the network behavior information with the same content within the set time period, obtain the probability value that the white hat belongs to the preset company within the set time period; the probability value that the white hat belongs to the preset company within the set time period is positively correlated with the number of occurrences of the network behavior information with the same content within the set time period; Obtain the network behavior information with different contents of the white hat; For each network behavior information with different contents, obtain the number of occurrences of the network behavior information corresponding to each user identifier within the set time period; According to the number of occurrences of the network behavior information corresponding to each user identifier, obtain the probability value that the white hat belongs to the preset companies corresponding to each of the first users within the set time period; the probability value that the white hat belongs to the preset companies corresponding to each of the first users within the set time period is positively correlated with the number of occurrences of the network behavior information of each of the first users within the set time period; For each preset company, if there are multiple probability values that the white hat belongs to the preset company within the set time period, then take the sum of the multiple probability values as the probability that the white hat belongs to the preset company within the set time period.

11. An electronic device, characterized in that, It includes a processor and a memory, and the memory stores computer-executable instructions that can be executed by the processor. The processor executes the computer-executable instructions to implement the method for constructing a white hat portrait according to any one of claims 1 to 9.

12. A storage medium, characterized in that, The storage medium stores computer-executable instructions. When the computer-executable instructions are called and executed by a processor, the computer-executable instructions cause the processor to implement the method for constructing a white hat portrait according to any one of claims 1 to 9.

13. A computer program product, characterized in that, The computer program product includes a computer program. When the computer program is executed by a processor, it implements the method for constructing a white hat portrait according to any one of claims 1 to 9.

Images