Web application abnormal access detection method based on access time portrait

Abstract

The invention discloses a Web application abnormal access detection method based on an access time portrait. The method comprises the following steps: S1, obtaining a historical access time period of a user; s2, establishing an access time portrait of the user; and S3, performing anomaly detection on a subsequent user access time period based on the access time portrait. According to the method, the dynamic access time distribution is constructed through the user access history, and the access time distribution characteristics of the user can be flexibly and accurately described, so that the abnormal access behavior of the Web application can be better detected, and the problem that the time period cannot be defined or the difference between the access peak and the access valley cannot be intuitively indicated in the prior art is solved.

Description

Technical Field

[0001] The present invention relates to the field of computer network technology, and in particular to a method for detecting abnormal access of Web applications based on access time profiles. Background Art

[0002] Web application access includes both normal user access and abnormal user access, such as network attacks. In order to detect abnormal user access behavior in Web application access, many features can be used, such as access time, network traffic, access frequency, and transmitted content.

[0003] Access time is an important feature of user web application access behavior. There is a difference in access time between network attacks and normal access behaviors. The existing access time quantification methods mainly include: 1. The access time is quantified by duration. This method loses the information of the time point and only retains the information of the time period. It cannot distinguish the difference between the peak and the trough of the same access duration.

[0004] 2. After the access time is discretized into points, it often exists in the form of blacklists and whitelists. For example, the office hours in the whitelist are normal access, and the rest of the time is abnormal access. This method cannot flexibly express the time point. Summary of the invention

[0005] In order to solve the above problems, the present invention provides a method for detecting abnormal access of Web applications based on access time profile, comprising the following steps: S1. obtaining the user's historical access time period; S2. establishing the user's access time profile; S3. performing abnormal detection on subsequent user access time periods based on the access time profile.

[0006] Furthermore, the step S2 specifically includes the following sub-steps: S21. List all access time points in each time period in a day; S22. Calculate the number of each time point in the set of all time points to obtain the number of accesses per minute in a day; S23. Fit the obtained number of accesses per minute in a day with a normal distribution.

[0007] Furthermore, the S3 step specifically includes the following sub-steps: S31. Recording the access behavior of each user and tracking the start and end time of the user's session; S32. Extracting the number of visits to the web application service within the start and end time period of the user's session and calculating the average; S33. Comparing the average with the access time portrait to determine whether the user's access is abnormal.

[0008] Furthermore, in the step S31, the tracking of the start and end time of the user's session is mainly based on the user's access time and the access time interval.

[0009] Furthermore, the identification of the start and end time of the user's session in the step S31 specifically includes the following steps: setting a time interval; determining whether a session already exists, if not, starting a new session and recording the start time; if so, determining whether the time interval with the last access time is greater than the set time interval; if greater than the set time interval, ending the previous session and starting a new session and recording the time information; otherwise, continuing the current session.

[0010] Furthermore, the specific judgment rule for determining whether the user access is abnormal in step S33 is: comparing the mean with the standard deviation or minimum value of the access time portrait, when the mean is smaller than the standard deviation or minimum value of the access time portrait, it is judged that the user access is abnormal.

[0011] The present invention provides a method for detecting abnormal access of Web applications based on access time profile, which has the following beneficial effects: The present invention constructs a dynamic access time distribution through user access history, which can flexibly and accurately describe the user's access time distribution characteristics, thereby better detecting abnormal access behavior of Web applications, solving the problem in the prior art that it is impossible to clearly define the time period or intuitively indicate the difference between access peaks and access troughs. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the structures shown in these drawings without paying creative work.

[0013] Figure 1 The present invention provides a flow chart of the method. DETAILED DESCRIPTION

[0014] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0015] The following is a detailed description of the implementation method of the present invention in conjunction with the accompanying drawings. Only some embodiments are described, not all embodiments. For the purpose of clarity, representations and descriptions that are not related to the present invention are omitted in the drawings and descriptions.

[0016] In order to have a clearer understanding of the technical features, purposes and beneficial effects of the present invention, the technical solution of the present invention is now described in detail below. Obviously, the implementation cases described are part of the embodiments of the present invention, not all of the embodiments, and cannot be understood as limiting the scope of the implementation of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work belong to the protection scope of the present invention.

[0017] like Figure 1 As shown, the present invention provides a method for detecting abnormal access of Web applications based on access time profiles, comprising the following steps: S1. obtaining the user's historical access time periods; S2. establishing the user's access time profiles; S3. performing abnormal detection on subsequent user access time periods based on the access time profiles.

[0018] Step S2 specifically includes the following sub-steps: S21. List all access time points in each time period in a day; S22. Calculate the number of each time point in the set of all time points to obtain the number of accesses per minute in a day; S23. Fit the obtained number of accesses per minute in a day with a normal distribution.

[0019] In a Web application service, users access the service in the form of sessions. The access time period of a session is (s, e), where s is the start time of the session and e is the end time of the session. For the convenience of subsequent analysis, the units of s and e are minutes.

[0020] Given a Web application service, its historical access session is (s i , e i ), i=1,2,…,n. The steps to establish the access time profile of the Web application service are as follows: List all access time points (minutes) in each time period during the day. i , e i ), the access time of the day is y i ={x%1440|s i ≤x≤e i}.

[0021] Calculate the set y of all time points i The number of visits at each time point in (i=1,2,…,n) is obtained to obtain the number of visits in each minute of the 1440 minutes of a day. Note: There are 1440 minutes in a day. If multiple people visit the Web service at the kth minute on different dates, the number of visits at the kth minute counts all visits by all people. The number of visits in 1440 minutes of a day is approximately regarded as a normal distribution, and the abnormal detection method of the normal distribution (mean-3=standard deviation) is used for subsequent abnormal access time detection.

[0022] Web application access is stateless, and access logs cannot save the user's session status. Each user has multiple Web application access records, each record has a timestamp, and when the time interval between two consecutive visits of a user is less than a certain length of time, such as 30 minutes, the two visits can be considered to be in one session. When the time interval between two consecutive visits of a user is greater than the time length, the two visits belong to two sessions.

[0023] Step S3 specifically includes the following sub-steps: S31. Record the access behavior of each user and track the start and end time of the user's session; S32. Extract the number of visits to the web application service within the start and end time period of the user's session and calculate the average; S33. Compare the average with the access time portrait to determine whether the user's access is abnormal.

[0024] In step S31, the tracking of the user's session start and end time is mainly based on the user's access time and the access time interval (for example, 30 minutes). The identification of the user's session start and end time specifically includes the following steps: setting the time interval; determining whether a session already exists, if not, starting a new session and recording the start time; if so, determining whether the time interval with the last access time is greater than the set time interval; if greater than the set time interval, ending the previous session and starting a new session and recording the time information; otherwise, continuing the current session.

[0025] The specific judgment rule for determining whether the user access is abnormal in step S33 is: compare the mean with the standard deviation (mean - 3 = standard deviation) or the minimum value of the access time portrait. When the mean is smaller than the standard deviation (mean - 3 = standard deviation) or the minimum value of the access time portrait, it is determined that the user access is abnormal.

[0026] The present invention constructs a dynamic access time distribution through user access history, which can flexibly and accurately describe the user's access time distribution characteristics, thereby better detecting abnormal access behavior of Web applications, solving the problem in the prior art that it is impossible to clearly define the time period or intuitively indicate the difference between access peaks and access troughs.

[0027] The above is only a preferred embodiment of the present invention. It should be understood that the present invention is not limited to the form disclosed herein, and should not be regarded as excluding other embodiments, but can be used in various other combinations, modifications and environments, and can be modified within the scope of the concept described herein through the above teachings or the technology or knowledge of the relevant field. The changes and modifications made by those skilled in the art shall not deviate from the spirit and scope of the present invention, and shall be within the scope of protection of the claims attached to the present invention.

Claims

1. A method for detecting abnormal access to Web applications based on access time profiles, characterized in that: The following steps are involved: S1. Obtain the user's historical access time period; S2. Establish a user's access time profile; S3. Perform anomaly detection on subsequent user access time periods based on access time profiles.

2. The method for detecting abnormal access of Web applications based on access time profile according to claim 1 is characterized in that: The S2 step specifically includes the following sub-steps: S21. List all access time points in each time period during the day; S22. Calculate the number of each time point in the set of all time points to obtain the number of visits per minute in a day; S23. Perform normal distribution fitting on the obtained number of visits per minute in a day.

3. The method for detecting abnormal access of Web applications based on access time profile according to claim 1 is characterized in that: The S3 step specifically includes the following sub-steps: S31. Record each user's access behavior and track the start and end time of the user's session; S32. Extract the number of visits to the web application service within the start and end time period of the user's session and calculate the average; S33. Compare the mean with the access time profile to determine whether the user access is abnormal.

4. The method for detecting abnormal access of Web applications based on access time profile according to claim 3 is characterized in that: The tracking of the start and end time of the user's session in step S31 is mainly based on the user's access time and the access time interval.

5. The method for detecting abnormal access of Web applications based on access time profile according to claim 4 is characterized in that: The identification of the start and end time of the user's session in the step S31 specifically includes the following steps: setting a time interval; determining whether a session already exists, if not, starting a new session and recording the start time; if so, determining whether the time interval with the last access time is greater than the set time interval, if greater than the set time interval, ending the previous session and starting a new session and recording the time information; otherwise, continuing the current session.

6. The method for detecting abnormal access of Web applications based on access time profile according to claim 3 is characterized in that: The specific judgment rule for determining whether the user access is abnormal in step S33 is: compare the mean with the standard deviation or minimum value of the access time portrait, and when the mean is smaller than the standard deviation or minimum value of the access time portrait, determine that the user access is abnormal.

Images