Method, computing device, and storage medium for determining a security status of a gateway request behavior

Abstract

Embodiments of the present invention relate to a method, computing device, and storage medium for determining the security status of gateway request behaviors. The method includes generating a request behavior time series table based on the occurrence times of multiple request behaviors of the gateway received in real time; determining the current request behavior, the current time window, and multiple request behaviors within the current time window based on a predetermined sliding time window for the request behavior time series table; extracting multiple behavior attribute data for each of the multiple request behaviors within the current time window to generate multiple groups of behavior attribute data for the multiple request behaviors; generating multiple security features for the current request behavior based on the multiple groups of behavior attribute data for the multiple request behaviors within the current time window via a security perception model; and determining the security label and security level of the current request behavior based on the multiple security features of the current request behavior. The method can effectively improve the accuracy of security status determination and effectively respond to zero-day vulnerability attacks.

Description

Technical Field

[0001] Embodiments of the present invention generally relate to the field of network security, and more particularly to a method, computing device, and storage medium for determining a security status of a gateway request behavior. Background Art

[0002] Traditional methods for sensing gateway request behavior security are typically based on static detection methods using rule libraries. These methods have the following shortcomings: Because they rely on static rule settings, they are unable to directly detect new attacks. For example, attack behaviors targeting zero-day vulnerabilities (Zero-Day Attack refers to a network attack that exploits security vulnerabilities that have not yet been discovered or patched by software vendors. Its core characteristic is that the defender is in an absolutely passive state of "zero-day response time") cannot be directly detected, requiring a lot of manual analysis. Furthermore, they are highly dependent on rule maintenance, for example, manual attention must be paid to vendor updates and the update of the attack signature library. Furthermore, they have a high false alarm rate, such as when a normal API call is mistakenly intercepted due to dynamic parameter changes.

[0003] In summary, the shortcomings of traditional object recommendation methods are: reliance on rule bases, high false positive rates, and inability to meet the requirements for zero-response-time request security behavior detection. Summary of the Invention

[0004] To address the above issues, the present invention provides a method, computing device, and storage medium for determining the security status of gateway request behavior, which can effectively improve the accuracy of security status determination and effectively respond to 0day vulnerability attacks.

[0005] According to a first aspect of the present invention, a method for determining a security status of a gateway request behavior includes: generating a request behavior time sequence table based on real-time received occurrence times of multiple request behaviors of the gateway; determining, based on a predetermined sliding time window, a current request behavior, a current time window, and multiple request behaviors within the current time window in the request behavior time sequence table;

[0006] For multiple request behaviors within the current time window, multiple behavior attribute data of each request behavior are extracted respectively to generate multiple groups of behavior attribute data of multiple request behaviors, each group of behavior attribute data includes multiple behavior attribute data of the corresponding request behavior; through the security perception model, based on the multiple groups of behavior attribute data of multiple request behaviors within the current time window, multiple security features about the current request behavior are generated, and the security perception model is constructed based on the neural network model; and based on the multiple security features of the current request behavior, the security label of the current request behavior is determined to determine the security level of the current request behavior.

[0007] According to a second aspect of the present invention, a computing device is provided, comprising: at least one processing unit; at least one memory, the at least one memory being coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit, the instructions, when executed by the at least one processing unit, enabling the computing device to perform the steps of the method according to the first aspect.

[0008] According to a third aspect of the present invention, a computer-readable storage medium is provided, wherein a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a machine, the method according to the first aspect of the present invention is executed.

[0009] According to a fourth aspect of the present invention, there is further provided a computer program product, comprising a computer program, wherein when the computer program is executed by a machine, the method of the first aspect of the present invention is performed.

[0010] In some embodiments, the various behavioral attribute data of each request behavior include: basic request information, including: request time information, request method type, requested target resource path and / or request query parameters; client and network identification information, including: client IP, IP sequence of the request link, request target domain name and port, client device and browser information and / or source page URL that triggers the current request; transmission and response information, including: request message length, total response data volume and / or HTTP response status code.

[0011] In some embodiments, through a security perception model, based on multiple sets of behavioral attribute data of multiple request behaviors within the current time window, multiple security features about the current request behavior are generated, including: based on the request basic information of multiple request behaviors within the current time window, client and network identification information and one or more behavioral attribute information in the transmission and response information, at least two security features about the current request behavior are generated, and the at least two security features include: the cumulative access feature of the client IP, the response code feature, the URL variant feature, the parameter variant feature, the traffic baseline feature, the request link IP sequence feature, the user agent entropy value feature, and the request source entropy value feature.

[0012] In some embodiments, generating at least two security features about the current request behavior includes: calculating the cumulative access features of the client IP of the current request behavior via KMeans clustering based on the access frequency of the client IP in the current time window; calculating the response code features of the current request behavior via the isolation forest detection method based on the abnormal frequency of the response code in the current time window; calculating the URL variant features of the current request behavior via BERT semantic clustering based on the request target domain name and port information and the target resource path of the request in the current time window; calculating the URL variant features of the current request behavior via edit distance detection based on the request method type, the target resource path of the request, and the request query parameters in the current time window. Calculate the parameter variation characteristics of the current request behavior; based on the request message length and the total response data volume in the current time window, calculate the traffic baseline characteristics of the current request behavior through the Gaussian mixture model; based on the IP sequence of the request link in the current time window, perform chain length detection and forged IP detection to calculate the request link IP sequence characteristics of the current request behavior; based on the client IP, client device and browser information in the current time window, calculate the user agent entropy value characteristics of the current request behavior; based on the target resource path of the request in the current time window, the request query information and the source page URL that triggers the current request, construct a splicing string to calculate the request source entropy value characteristics of the current request behavior.

[0013] In some embodiments, determining a security label of the current request behavior based on multiple security features of the current request behavior so as to determine the security level of the current request behavior includes: determining the weight of each of the multiple security features of the current request behavior via a security perception model based on the current network status; and calculating the security factor of the current request behavior based on the value and weight of each security feature of the current request behavior to determine the security label of the current request behavior.

[0014] In some embodiments, the security perception model is trained through the following steps: obtaining training sample data, the training sample data including a request behavior timing table for training, and a plurality of behavioral attribute data about the request behavior; for the request behavior timing table for training, based on the step size of a predetermined sliding time window, sliding backward step by step in time sequence, so that with each sliding of the time window, the current time window, the multiple request behaviors in the current time window and the current request behavior are determined in sequence; the current request behavior is the last request behavior occurring in the current time window; based on multiple sets of behavioral attribute data of multiple request behaviors in each current time window, multiple security features are generated for the current request behavior in the training sample data through the security perception model, so as to determine the pseudo security label of the request behavior in the training sample data; and initializing the weight of each security feature, and based on the training objective, calculating the error between the pseudo security label and the true security label of the current request behavior in the sample data, so as to update the parameters of the security perception model.

[0015] In some embodiments, the request behavior data in the request behavior time series table used for training includes: request behavior data that occurred in the past, request behavior data generated by simulation, and / or request behavior data that occurs in real time.

[0016] In some embodiments, in response to determining that the security level of the current request behavior exceeds a predetermined security threshold, the current request behavior is intercepted; for the intercepted request behavior, multiple security features of the intercepted request behavior are determined for synchronizing security policy update parameters to upstream security devices, and / or sending security warning information to downstream business risk control systems.

[0017] Therefore, the present invention can fully consider the dynamic changes of request behaviors in different time periods based on multiple request behaviors that occur successively in the time window and their corresponding multiple sets of behavior attribute data, and the security features of the determined current request behavior can not only be improved in accuracy, but also the timeliness can be guaranteed.

[0018] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present invention, nor is it intended to limit the scope of the present invention. Other features of the present invention will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The above and other features, advantages and aspects of the embodiments of the present invention will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements.

[0020] Figure 1 A schematic diagram of a system for implementing a method for determining a security status of a gateway request behavior according to an embodiment of the present invention is shown.

[0021] Figure 2 A flow chart of a method for determining a security status of a gateway request behavior according to an embodiment of the present invention is shown.

[0022] Figure 3 A flowchart of a method for training a security perception model according to an embodiment of the present invention is shown.

[0023] Figure 4 A flowchart of a method for determining a security level of a current request behavior according to an embodiment of the present invention is shown.

[0024] Figure 5 A block diagram of an electronic device according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0025] The following description of exemplary embodiments of the present invention is made in conjunction with the accompanying drawings, in which various details of the embodiments of the present invention are included to facilitate understanding. These details should be considered as merely exemplary. Therefore, it should be appreciated by those skilled in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0026] As used herein, the term "including" and its variations represent open inclusion, i.e., "including but not limited to." Unless otherwise stated, the term "or" means "and / or." The term "based on" means "based at least in part on." The terms "an example embodiment" and "an embodiment" mean "at least one example embodiment." The term "another embodiment" means "at least one additional embodiment." The terms "first," "second," etc. may refer to different or the same objects. Other explicit and implicit definitions may also be included below.

[0027] As described above, the traditional method for object recommendation has the following shortcomings: it relies on a rule base, has a high false positive rate, and cannot meet the security detection requirements for request security behaviors with zero response time.

[0028] To at least partially address one or more of the aforementioned and other potential issues, an exemplary embodiment of the present invention proposes a solution for determining the security status of gateway request behaviors. In this solution, a request behavior time series table is first generated based on the occurrence times of multiple request behaviors of the gateway received in real time. With respect to the request behavior time series table, a current request behavior, a current time window, and multiple request behaviors within the current time window are determined based on a predetermined sliding time window. Subsequently, for the multiple request behaviors within the current time window, multiple behavior attribute data of each request behavior are extracted to generate multiple sets of behavior attribute data for the multiple request behaviors, each set of behavior attribute data including multiple behavior attribute data for the corresponding request behaviors. Then, a security awareness model is used to generate multiple security features for the current request behavior based on the multiple sets of behavior attribute data for the multiple request behaviors within the current time window. The security awareness model is constructed based on a neural network model. This allows for full consideration of the dynamic changes of the request behaviors in different time periods based on the multiple request behaviors that occur successively in the time window and their corresponding multiple sets of behavior attribute data. Furthermore, the security features of the current request behavior determined are not only improved in accuracy but also ensured in timeliness.

[0029] The present invention also determines a security tag for the current request behavior based on multiple security features of the current request behavior, thereby determining the security level of the current request behavior. Thus, based on the more real-time and accurate multiple security features of the current request behavior provided by the above solution, a more reliable security status of the gateway request behavior can be obtained.

[0030] Therefore, the present invention can effectively improve recommendation accuracy, cold start capability and generalization capability, and reduce dependence on specific training data.

[0031] Figure 1 FIG2 shows a schematic diagram of a system 100 (referred to as system 100 ) for implementing a method for determining a security status of a gateway request behavior according to an embodiment of the present invention. Figure 1 As shown in FIG, system 100 includes a computing device 110, a server 130, a network 140, and a user terminal 150. The computing device 110, the server 130, and the user terminal 150 (e.g., 150-1, 150-2, and 105-N shown in the figure) can exchange data through the network 140 (e.g., the Internet, a local area network, or a wide area network, etc.).

[0032] Regarding the user terminal 150 (such as 150-1, 150-2 and 105-N shown in the figure), it is, for example, a mobile device, a personal terminal, a desktop computer, a smart watch, a tablet computer, an interactive device, a proxy server, etc. The user can perform interactive operations on its display interface, or other preset operations to initiate various behavioral requests to the server gateway, such as requesting to obtain information, requesting to redeem a verification code, requesting to receive benefits, entering a verification code, updating information, inquiring about gifts, etc.

[0033] Regarding server 130, it can be, for example, an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud database, cloud storage, network services, cloud communications, middleware services, domain name services, security services, as well as big data and artificial intelligence platforms.

[0034] Server 130 is deployed with a method for determining the security status of gateway request behaviors according to an embodiment of the present invention. This method determines whether request behaviors from various user terminals are secure and, based on the security status of the request behaviors, performs corresponding actions, such as denying or allowing the request behaviors. Server 130 can also collect information about request behaviors, such as generating a request behavior time sequence table based on the order in which the request behaviors occur, and transmit this information to computing device 110 for use in training the security awareness model provided by an embodiment of the present invention.

[0035] Regarding the computing device 110, it is used, for example, to train the network model of the method for determining the security status of gateway request behavior according to an embodiment of the present invention. The computing device 110 may have one or more processing units, including dedicated processing units such as GPUs, FPGAs, and ASICs, as well as general-purpose processing units such as CPUs. The computing device 110 may be an integration of multiple physical servers, an integration of multiple processing units, etc. In addition, one or more virtual machines may also be running on each computing device 110. In some embodiments, the computing device 110 and the server 130 may be integrated together or provided separately from each other. In some embodiments, the computing device 110 includes, for example, a time sequence table generation module 112, a time window sliding module 114, a behavior attribute extraction module 116, a security feature generation module 118, and a security level determination module 120.

[0036] The time sequence table generating module 112 is configured to generate a request behavior time sequence table based on the occurrence times of multiple request behaviors of the gateway received in real time.

[0037] The time window sliding module 114 is configured to determine, for the request behavior time sequence table, a current request behavior, a current time window, and multiple request behaviors within the current time window based on a predetermined sliding time window.

[0038] Regarding the behavior attribute extraction module 116, it is used to extract multiple behavior attribute data of each request behavior for multiple request behaviors within the current time window, so as to generate multiple groups of behavior attribute data of multiple request behaviors, each group of behavior attribute data includes multiple behavior attribute data of the corresponding request behavior.

[0039] Regarding the security feature generation module 118, it is used to generate multiple security features about the current request behavior based on multiple groups of behavior attribute data of multiple request behaviors in the current time window via a security perception model. The security perception model is constructed based on a neural network model.

[0040] The security level determination module 120 is configured to determine a security tag of the current request behavior based on multiple security features of the current request behavior, so as to determine a security level of the current request behavior.

[0041] Figure 2 FIG. 2 is a flow chart showing a method 200 for determining a security status of a gateway request behavior according to an embodiment of the present invention. Figure 1 The computing device 110 shown is executed, and may also be executed on Figure 5 The method 200 is executed at the electronic device 500. It should be understood that the method 200 may further include additional steps not shown and / or may omit the steps shown, and the scope of the present invention is not limited in this respect.

[0042] In step 202 , the computing device 110 receives in real time the occurrence times of multiple request behaviors of the gateway and generates a request behavior timing table.

[0043] For example, Table 1 illustrates a request behavior timing table of an embodiment of the present invention. The first column of the timing table, timestamp, indicates the exact time point when the request occurs, which is used to determine the timing of the request. It is followed by multiple columns of attribute data about a certain request behavior. Table 1 only gives a few examples. The various attribute data that may be involved in the request behavior timing table will be further described in detail later.

[0044] Table 1

[0045]

[0046] In step 204 , the computing device 110 determines, for the request behavior time series table, a current request behavior, a current time window, and a plurality of request behaviors within the current time window based on a predetermined sliding time window.

[0047] Regarding the current time window, for example, the length of time spanned by the sliding time window is predetermined, such as 3 minutes, 5 minutes, 10 minutes, etc.; for example, if the step size of the sliding time window is 1 second, the sliding time window slides backward by 1 second each time; for example, if the step size is 2 seconds, the sliding time window slides backward by 2 seconds every 2 seconds; for example, if the step size of the sliding time window is 1 request behavior, the sliding time window slides backward by one request behavior each time; thus, the duration spanned by the sliding time window can be a predetermined length of time, and the step size of each movement of the sliding time window can be a period of time, or n request behaviors (n is greater than or equal to 1), where n is an integer. Thus, by sliding the time window, the current request behavior and each request behavior in the sliding time window can be continuously updated (newly determined); regarding the current request behavior, for example, it is the request behavior that occurred last in the current time window. For example, if there are currently 100 request behaviors in the sliding time window, and the request behaviors are arranged in order of occurrence, the current request behavior is the latest of these 100 request behaviors.

[0048] In step 206, the computing device 110 extracts multiple behavior attribute data of each request behavior for multiple request behaviors within the current time window, so as to generate multiple groups of behavior attribute data of the multiple request behaviors, each group of behavior attribute data including multiple behavior attribute data of the corresponding request behavior.

[0049] In some embodiments, the multiple behavior attribute data of each request behavior includes: basic request information, client and network identification information, and client and network identification information.

[0050] Basic request information includes, for example, request time information (timestamp), request method type (method), requested target resource path (uri) and / or request query parameters (args).

[0051] Information about the client and network identification, such as the client IP address (remote_addr), the IP address sequence of the request link (x_forwarded_for (XFF)), the target domain name and port (host), the client device and browser information (http_user_agent (UA)), and / or the source page URL that triggered the current request (http_referer‌).

[0052] Transmission and response information, such as request message length (request_length), total response data size (bytes_sent), and / or HTTP response status code (response_code).

[0053] For ease of understanding, Table 2 shows the names, meanings, and examples of various behavioral attribute data.

[0054] Table 2

[0055]

[0056] In step 208 , the computing device 110 generates a plurality of security features about the current request behavior based on a plurality of groups of behavior attribute data of a plurality of request behaviors within the current time window via a security perception model, where the security perception model is constructed based on a neural network model.

[0057] In some embodiments, via a security perception model, multiple security features about the current request behavior are generated based on multiple sets of behavioral attribute data of multiple request behaviors within the current time window, including: generating at least two security features about the current request behavior based on one or more behavioral attribute information in the request basic information, client and network identification information, and transmission and response information of multiple request behaviors within the current time window.

[0058] In some embodiments, at least two security features include: client IP cumulative access features, response code features, URL variant features, parameter variant features, traffic baseline features, request link IP sequence features, user agent entropy features, and request source entropy features. The specific acquisition process and practical significance and advantages of the above features will be described in detail below, which will not be repeated here. Figure 3 The training method of the security perception model is described in detail and will not be repeated here.

[0059] In step 210 , the computing device 110 determines a security tag of the current request behavior based on multiple security features of the current request behavior, so as to determine a security level of the current request behavior.

[0060] In the above scheme, the present invention not only considers the timing impact of the request behavior, but also considers the multiple behavioral attributes of the request behavior. It can determine the current request behavior and several request behaviors that occurred before the current request through a sliding time window, and then determine multiple security features of the current request behavior based on multiple groups of behavioral attribute data of multiple request behaviors within the sliding time window; and then perceive the security status of the current request behavior based on multiple security features.

[0061] In some embodiments, generating at least two security features about the current request behavior includes: calculating the cumulative access features of the client IP of the current request behavior via KMeans clustering based on the access frequency of the client IP in the current time window.

[0062] Regarding the cumulative access features of the client IP, for example, if the sliding time window is 5 minutes, the remote_addr cumulative access anomaly is calculated for the request behavior within these 5 minutes (KMeans clustering); Feature extraction: Count the number of requests for each remote_addr every 5 minutes; Enhancement method: KMeans clustering identifies the centroid distance, and the distance away from the center point (abnormal access density) can be weighted, such as feature expression (1):

[0063] (1)

[0064] in:

[0065] Indicates that within 5 minutes x ( x (all represent samples) The number of requests with the same remote_addr, sample x is selected from the request behavior in the sliding time window. The characteristic expression (1) can be understood as the sample x The cumulative number of times the same remote_addr appears within the window period.

[0066] In some embodiments, generating at least two security features about the current request behavior includes: calculating the response code features of the current request behavior via an isolation forest detection method based on the abnormal frequency of the response code in the current time window.

[0067] In this way, it is possible to determine whether the IP corresponding to the current request behavior has accumulated too many visits, which affects the security characteristics of the current request behavior from the perspective of cumulative visits.

[0068] Regarding response code features, for example, if the sliding time window is 5 minutes, for the request behavior within these 5 minutes, calculate the response code anomaly (isolation forest) within 5 minutes; feature extraction: count the number of 4xx / 5xx errors that occur every 5 minutes; enhancement method: isolation forest (Isolation Forest) detection anomaly window scoring, for example, feature expression (2):

[0069] (2)

[0070] in:

[0071] : The number of requests with response_code 4xx / 5xx within 5 minutes.

[0072] Therefore, based on whether there are too many abnormal responses in the time period of the current sliding time window, the response code characteristics of the current request behavior can be determined according to the abnormal response conditions in the time period. For example, the current request behavior itself is the correct response code, but a large number of abnormal conditions occur in the time window where it is located. It is possible that the current network attacker is continuously trying and failing parameters, which may affect the response code characteristics of the current request behavior (for example, after multiple trials and errors, the current request behavior has tested the correct response code. In this case, although the response code is normal, the request behavior is obviously risky). Therefore, the response code situation affects the security characteristics of the current request behavior.

[0073] In some embodiments, generating at least two security features about the current request behavior includes: calculating the URL variant features of the current request behavior through BERT semantic clustering based on the request target domain name and port information within the current time window, and the target resource path of the request.

[0074] Regarding URL variant features, for example, if the sliding time window is 5 minutes, for the request behavior within these 5 minutes, the host+uri of the request behavior within these 5 minutes is calculated to perform semantic variant detection (BERT clustering); feature extraction: for example, splicing host+uri and encoding through BERT, refer to feature expression (3):

[0075] (3)

[0076] in: , Indicates the probability of occurrence of the combination in the window, the lower the probability, the rarer it is.

[0077] This allows us to semantically assess the content of a request and determine whether it complies with business logic. For example, if a URL variation indicates a high coefficient of semantic variation within a time window (e.g., repeated modification of a verification code), we can test the permeability of the business and, therefore, increase the security risk of the current request. This allows us to determine the security characteristics of the current request based on the URL variation.

[0078] In some embodiments, generating at least two security features about the current request behavior includes: calculating the parameter variation feature of the current request behavior based on the request method type, the target resource path of the request, and the request query parameters within the current time window through edit distance detection.

[0079] Regarding parameter variant features, for example, if the sliding time window is 5 minutes, illegal pattern recognition (edit distance detection) is performed on the "Method (request method) + uri (request path) + args (request parameters)" of the request behavior within these 5 minutes; feature extraction is performed: the three are spliced ​​together to form a complete path feature, referring to feature expression (4):

[0080] (4)

[0081] in: : Indicates the request string length (method+uri+args), : Indicates the average length of the combination in the current window.

[0082] Therefore, based on the illegal characteristics of the parameters in multiple request behaviors within the current time window, the parameter variation characteristics of the current request behavior can be determined, and its security risks in parameter changes can be determined. For example, there may be security risks if the frequency of parameter changes is high; thereby affecting the security characteristics of the current request behavior from the parameter variation situation.

[0083] In some embodiments, generating at least two security features about the current request behavior includes: calculating the traffic baseline feature of the current request behavior via a Gaussian mixture model based on the request message length and the total response data volume in the current time window.

[0084] Regarding the traffic baseline characteristics, for example, if the sliding time window is 5 minutes, the traffic baseline deviation (Gaussian mixture model GMM) is calculated for the request behavior within these 5 minutes; feature extraction: construct a two-dimensional vector [request_length, bytes_sent], and after modeling using the Gaussian mixture model (GMM), calculate the Log-likelihood for each sample, referring to the feature expression (5):

[0085] (5)

[0086] in: , u j represents the average byte size in the sliding window samples, σ j Represents the standard deviation of the byte size in the sliding window samples.

[0087] This allows us to determine the traffic baseline characteristics of the current request behavior based on the total traffic volume within the current time window, thereby reflecting the traffic security risks of the current request behavior. For example, the current time is 0:00, and during this time period, the business system provided by Guanaitong is usually accessed very little. However, during the current time window, there is an abnormally high traffic volume, which causes the current request behavior to be in an abnormal traffic period, thus affecting the security characteristics of the current request behavior.

[0088] In some embodiments, generating at least two security features about the current request behavior includes: performing chain length detection and forged IP detection based on the IP sequence of the request link within the current time window to calculate the request link IP sequence feature of the current request behavior.

[0089] Regarding the request link IP sequence feature, for example, the sliding time window is 5 minutes, and the request behavior within these 5 minutes is "x_forwarded_for chain length anomaly + forgery detection"; Feature extraction: Calculate the number of IPs in x_forwarded_for. If one of the IPs appears repeatedly in remote_addr, the probability of fraudulent behavior is high. Refer to feature expression (6):

[0090] (6)

[0091] in: : Indicates the number of IPs in the XFF chain, If remote_addr appears in the XFF chain (indicating suspected spoofing),

[0092] Therefore, the request link IP sequence characteristics of the current request behavior can be obtained through the XFF situation in the current time window, affecting the security characteristics of the current request behavior from the perspective of the proxy situation.

[0093] In some embodiments, generating at least two security features about the current request behavior includes: calculating a user agent entropy feature of the current request behavior based on the client IP, client device, and browser information within the current time window.

[0094] Regarding the user agent entropy feature, for example, if the sliding time window is 5 minutes, the entropy analysis is performed on the "remote_addr+http_user_agent (request terminal name identifier)" of the request behavior within these 5 minutes, and the complexity and disguise of the feature are combined; for example, feature extraction: character-level entropy calculation is performed on the client IP of the request behavior and the User-Agent of the request behavior, referring to the feature expression (7):

[0095] (7)

[0096] in: , represents character entropy.

[0097] Therefore, the security characteristics of the current request behavior can be affected from the perspective of UA changes; for example, frequently changing browsers and terminal devices is obviously a risky behavior.

[0098] In some embodiments, generating at least two security features about the current request behavior includes: constructing a concatenated string based on the target resource path of the request within the current time window, the request query information, and the source page URL that triggers the current request to calculate the request source entropy value feature of the current request behavior.

[0099] Regarding the entropy value characteristics of the request source, for example, if the sliding time window is 5 minutes, the information entropy enhancement (double-source comparison) of the "uri+args+referer" request behavior within these 5 minutes is calculated to obtain the abnormal behavior characteristics of the Referer chain; for example, feature extraction: construct the uri+args+referer splicing string, refer to the feature expression (8):

[0100] (8)

[0101] in, Indicates that multiple fields are combined to calculate the feature score. The meaning of the three fields (uri+args+referer) is independent. In the sample, the meaning is that different referer features appear in the same request body transformation.

[0102] Therefore, the security characteristics of the current request behavior can be affected from the perspective of changes in the request page jump; for example, jump relationships that have no business connection or are unlikely to exist may pose security risks.

[0103] Figure 3 FIG. 3 is a flow chart of a method 300 for training a security perception model according to an embodiment of the present invention. Figure 1 The computing device 110 shown is executed, and may also be executed on Figure 5 The method 300 is executed at the electronic device 500. It should be understood that the method 300 may further include additional steps not shown and / or may omit the steps shown, and the scope of the present invention is not limited in this respect.

[0104] In step 302 , the computing device 110 obtains training sample data, where the training sample data includes a request behavior time series table used for training and a variety of behavior attribute data about the request behavior.

[0105] Examples of request behavior time series and various behavior attribute data have been provided above and will not be repeated here. Based on the above method, the training data provided by the present invention includes multiple behavior attribute data for request behaviors, such as the 12 types of attribute data mentioned in the above embodiment (other attribute data can also be selected as needed). This allows for comprehensive consideration of the security risk factors affecting request behaviors from multiple perspectives, providing a data foundation for more accurate security status perception results.

[0106] In step 304, the computing device 110 slides the request behavior timing table used for training backward in time sequence based on the step size of the predetermined sliding time window, so as to determine the current time window, multiple request behaviors within the current time window, and the current request behavior in sequence with each slide of the time window; the current request behavior is the last request behavior that occurred in the current time window.

[0107] For example, the training step size can be 1 second, 3 seconds, or 5 seconds; for example, the step size can be 1 request action, 2 request actions, etc. The step size can be a certain length of time for each backward slide, or a certain number of request actions for each backward slide. The current request action has been explained and given an example in the previous article, so I will not repeat it here.

[0108] In step 306, the computing device 110 generates multiple security features for the current request behavior in the training sample data based on multiple sets of behavioral attribute data of multiple request behaviors within each current time window via a security perception model, so as to determine a pseudo security label for the request behavior in the training sample data.

[0109] In step 308 , the computing device 110 initializes the weight of each security feature and calculates the error between the pseudo security label and the true security label of the current request behavior in the sample data based on the training objective, so as to update the parameters of the security perception model.

[0110] Therefore, the above method can fully consider the multiple attribute characteristics of the request behavior and fully consider multiple request behaviors within the same time window to realize the rapid security feature labeling of multiple current request behaviors, and based on the error between the pseudo security label and the real security label, train the parameters of the security perception model, so that the security perception model can accurately determine the security features for the request behavior.

[0111] In some embodiments, the method for training a security perception model further includes giving a sample vector representation h=BERT(x)h = BERT(x)h=BERT(x), and the output layer is Formula (9):

[0112] (9)

[0113] Set the training target formula (10):

[0114] (10)

[0115] The steps for training are:

[0116] ① Initialize weights; including setting weights: w 1=0; w 2=0; w 3=0; w 4=0; w 5=0; w 6=0; w 7=0; w 8=0; b =0;

[0117] in, w 1， w 2， w 3， w 4， w 5， w 6， w 7， w 8 respectively map the characteristic index x 1， x 2， The weights of x3, x4, x5, x6, x7, x8, where b is the offset;

[0118] ② Set the learning step size a=0.01;

[0119] ③Calculate the predicted value ; ; ; represents the abnormal prediction value, Represents the first characteristic index in the i-th sample, is the weight of the feature index, i=1,2,3,...n (i.e., there are n samples);

[0120] ④ Calculate the average sum of squared errors between the predicted value and the true value (11):

[0121] (11)

[0122] represents the abnormal prediction value, Indicates that the sample corresponds to a real outlier;

[0123] ⑤Calculate the loss function for weights Partial derivatives of : ; , calculate the partial derivative of the loss function with respect to b: , k=1,2,3,...8 refer to 8 characteristic indicators respectively;

[0124] ⑥Update weights ; ; If the weight is updated, then loop step ② to step ⑥; If the weight update is less than the threshold (for example, 0.01), the training is completed and the obtained weight w j and b This is the weight obtained from the security perception model training.

[0125] In some embodiments, the request behavior data in the request behavior time series table used for training includes: request behavior data that occurred in the past, request behavior data generated by simulation, and / or request behavior data that occurs in real time.

[0126] Therefore, through the above method, various types of request behavior data can be comprehensively used without relying on certain specific data, and real-time request behavior data can be introduced to achieve dynamic training of the model and dynamic updating of parameters. For real-time vulnerabilities and real-time security issues, it can respond in a timely manner and promptly confirm various new types of request behavior security issues.

[0127] Figure 4 FIG. 4 is a flow chart showing a method 400 for determining the security level of a current request behavior according to an embodiment of the present invention. Figure 1 The computing device 110 shown is executed, and may also be executed on Figure 5 The method 400 is executed at the electronic device 500. It should be understood that the method 400 may further include additional steps not shown and / or may omit the steps shown, and the scope of the present invention is not limited in this respect.

[0128] In step 402 , the computing device 110 determines the weight of each of the multiple security features of the current request behavior via a security awareness model based on the current network status.

[0129] In step 404 , the computing device 110 calculates a security factor of the current request behavior based on the value and weight of each security feature of the current request behavior to determine a security tag of the current request behavior.

[0130] At step 406 , the computing device 110 intercepts the current request behavior in response to determining that the security level of the current request behavior exceeds a predetermined security threshold.

[0131] In step 408, the computing device 110 determines multiple security features of the intercepted request behavior for synchronizing security policy update parameters to the upstream security device and / or sending security warning information to the downstream business risk control system.

[0132] Regarding sending security warning information to downstream business risk control systems to help business systems improve their risk identification and / or risk handling capabilities.

[0133] Regarding synchronizing security policy update parameters with upstream security devices, such as synchronizing with WAF security devices, in order to update and / or build security rules, such as interception rules and / or release rules; and deploying the updated security rules and / or newly built security rules to the corresponding security devices.

[0134] Regarding updating and / or creating security rules, for example, a contribution rate assessment is performed on the security features of the request behavior to obtain a contribution rate ranking of the security features; based on the contribution rate ranking, a weight update value of each security feature is determined to determine the need for new security rules and / or determine the security rules that need to be updated.

[0135] For example, the Shapley model is used to calculate the contribution of each feature value to the prediction score. For the security feature subset , the marginal contribution of security feature i Calculated by formula (12):

[0136] (12)

[0137] Where v(S) represents the contribution rate of feature subset S to the prediction result.

[0138] For example, convert sample 1:

[0139] Safety feature Feature_1: 0.0001 (contribution rate: 0.03%);

[0140] Safety feature Feature_2: 0.0000 (contribution rate: 0.00%);

[0141] Safety feature Feature_3: 0.0012 (contribution rate: 0.39%);

[0142] Safety feature Feature_4: 0.0003 (contribution rate: 0.10%);

[0143] Safety feature Feature_5: 0.0000 (contribution rate: 0.00%);

[0144] Safety feature Feature_6: 0.0002 (contribution rate: 0.07%);

[0145] Safety feature Feature_7: 0.0045 (contribution rate: 1.48%);

[0146] Safety feature Feature_8: 0.0038 (contribution rate: 1.25%);

[0147] Baseline: 0.2998;

[0148] in: The SHAP value is calculated through the Shapley value in game theory to obtain the marginal contribution of each security feature. The baseline value is the predicted value when the contribution rate of all security features is 0.

[0149] Final prediction value = baseline value + ∑(SHAP value of each feature);

[0150] The contribution rates are sorted, so that new security rules are created and / or security rules that need to be updated are determined for the corresponding original samples, and the rules are then made effective to the security devices WAF and SIP through the synchronization protocol.

[0151] The contribution rate can intuitively reflect the security feature that plays the greatest role in a single prediction, and therefore can be used to fine-tune the weight of each security feature in security perception model training.

[0152] For example, methods for fine-tuning the weights of security features include:

[0153] After each prediction, the security feature with the top contribution rate accumulates 1 "top contribution times". When initializing the weight of each security feature, the initial weight of the security feature is adjusted according to the accumulated contribution record. For example, the security feature weight is updated every few minutes (such as 5 minutes) :

[0154] (13)

[0155] The following are some examples of the technical value and practical application of the above-mentioned security features in this solution.

[0156] Example 1 (accumulated access characteristics of client IP):

[0157] Scenario: Detecting an abnormal surge in requests from a certain IP address within 5 minutes;

[0158] Example: A financial API receives an average of 100 requests per minute during normal hours. However, at one point, a certain IP address initiates 2,000 requests within 5 minutes, far exceeding the threshold.

[0159] Purpose: Identify CC attacks, crawler batch requests, or abnormal high-frequency access behaviors to prevent service paralysis caused by sudden traffic surges;

[0160] Technical Value: Based on the cumulative access characteristics of client IP addresses, cluster analysis can distinguish normal fluctuations from malicious attacks, identify legitimate traffic peaks during e-commerce promotions, and reduce the misjudgment rate.

[0161] Example 2 (Response Code Characteristics)

[0162] Scenario: The same IP returns a large number of 4xx (permission error) or 5xx (server error) response codes within 5 minutes;

[0163] Example: A user attempts to log in 10 times and fails, triggering the account lockout mechanism.

[0164] Purpose: Identify brute force attacks, invalid parameter attempts, or service vulnerability detection behaviors;

[0165] Technical value: The response code feature can dynamically adjust the threshold based on business logic to reduce false interceptions.

[0166] Example 3 (URL variant characteristics)

[0167] Scenario: Non-standard API path access is detected, such as / admin / login being replaced with / adm1n / logn;

[0168] Case: An attacker attempts to bypass WAF rules and access sensitive interfaces by using character obfuscation.

[0169] Function: Identify new attack methods such as path deformation and parameter tampering, and fill the blind spots of traditional rule bases in detecting variant attacks;

[0170] Technical Value: URL variant features can use natural language processing technology to capture semantic differences and improve the ability to identify 0-day vulnerability attacks.

[0171] Example 4 (parametric variant feature)

[0172] Scenario: The normal request parameter is ?id=123, and the attacker sends ?id=123' OR '1'='1 to attempt SQL injection;

[0173] Case: A payment interface receives a malicious parameter combination containing special symbols;

[0174] Function: Detect abnormal patterns such as parameter sequence substitution and injection attacks to prevent data leakage;

[0175] Technical Value: Parameter variant features can distinguish legitimate parameter variations such as user input errors from malicious attacks through dynamic baseline modeling.

[0176] Example 5 (Traffic Baseline Characteristics)

[0177] Scenario: A normal request body size for an interface is 2KB, but a burst of requests carries a 20MB attachment (e.g., a malicious file upload).

[0178] Case: A user uploads an oversized file, causing abnormal bandwidth usage and triggering the traffic cleaning mechanism.

[0179] Function: Identify DDoS attacks or resource abuse such as traffic surges and abnormal data packets;

[0180] Technical value: Traffic baseline characteristics are combined with business traffic models such as peak bandwidth peaks to dynamically adjust the detection threshold.

[0181] Example 6 (Request Link IP Sequence Characteristics)

[0182] Scenario: The request header X-Forwarded-For contains multiple IP addresses (such as 1.2.3.4, 5.6.7.8), but the actual IP address is not in the trusted proxy list;

[0183] Case: Attackers forged CDN node IPs to bypass regional restrictions;

[0184] Function: Identify behaviors that evade detection, such as IP forgery and excessively long proxy chains, and improve attack tracing capabilities;

[0185] Technical value: The IP sequence characteristics of the request link can be linked to the CDN blacklist library to block illegal proxy traffic.

[0186] Example 7 (User Agent Entropy Feature)

[0187] Scenario: A request's User-Agent is Mozilla / 5.0 (Windows NT 10.0; Win64; x64), but the entropy value is abnormally low, such as a combination of only numbers or letters.

[0188] Example: A scanning tool uses a common UA ​​template to initiate a probe request.

[0189] Function: Identify non-human behaviors such as disguised browsers and automated scripts to reduce false positives;

[0190] Technical value: Combined with the device fingerprint library, it can distinguish real users from malicious crawlers.

[0191] Example 8 (Request Source Entropy Characteristics)

[0192] Scenario: The Referer header of a payment page request is empty or points to an unrelated domain (for example, https: / / example.com / login redirects to / pay);

[0193] Case: Attackers construct phishing links to trick users into clicking on them, thus bypassing login verification.

[0194] Function: Detect CSRF attacks, illegal external link jumps and other behaviors, and strengthen cross-domain security strategies;

[0195] Technical value: Combined with business whitelists, malicious referers can be accurately intercepted.

[0196] Therefore, the above solution can supplement and optimize the rules of traditional network security protection systems, such as situational awareness platforms. The core function of the above solution is to identify and mark malicious request behaviors that are carefully designed to evade detection by traditional network security protection systems. For example, after using the above solution to analyze access and request behaviors, if the security level of the request behavior is determined to be high risk (High), blacklist rules based on the source IP address, destination IP address, port number, protocol type, and application identifier will be automatically generated. These rules will be synchronized in real time to security devices such as firewalls (FWs) and web application firewalls (WAFs), providing risk avoidance guidance to upstream security devices.

[0197] Furthermore, the above solution can be integrated into a centralized security management platform, such as a situational awareness platform, that has threat information aggregation, automatic analysis, and disposal capabilities. This will significantly enhance the platform's ability to detect and handle malicious behavior disguised as legitimate business, and can provide risk avoidance guidance to downstream business platforms.

[0198] Figure 5 Schematic diagram of an example electronic device 500 that can be used to implement the embodiments of the present specification. Figure 1 The computing device 110 shown can be implemented by an electronic device 500. As shown, the electronic device 500 includes a central processing unit (CPU) 501, which can perform various appropriate actions and processes according to computer program instructions stored in a read-only memory (ROM) 502 or loaded from a storage unit 508 into a random access memory (RAM) 503. The random access memory 503 may also store various programs and data required for the operation of the electronic device 500. The CPU 501, the read-only memory 502, and the random access memory 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0199] Multiple components in the electronic device 500 are connected to the input / output interface 505, including: an input unit 506, such as a keyboard, a mouse, a microphone, etc.; an output unit 507, such as various types of displays, speakers, etc.; a storage unit 508, such as a magnetic disk, an optical disk, etc.; and a communication unit 509, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 509 allows the electronic device 500 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0200] The various processes and procedures described above, such as methods 200 to 400, may be performed by the central processing unit 501. For example, in some embodiments, methods 200 to 600 may be implemented as a computer software program that is tangibly contained in a machine-readable medium, such as the storage unit 508. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 500 via the read-only memory 502 and / or the communication unit 509. When the computer program is loaded into the random access memory 503 and executed by the central processing unit 501, one or more actions of the methods 200 to 400 described above may be performed.

[0201] The present invention relates to methods, apparatuses, systems, electronic devices, computer-readable storage media and / or computer program products. The computer program products may include computer-readable program instructions for executing various aspects of the present invention.

[0202] A computer-readable storage medium can be a tangible device that can hold and store instructions for use by an instruction execution device. A computer-readable storage medium can be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or raised-in-groove structure on which instructions are stored, and any suitable combination thereof. As used herein, a computer-readable storage medium is not to be construed as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through an electrical wire.

[0203] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge computing devices. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0204] The computer program instructions for performing the operations of the present invention may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, the state information of the computer-readable program instructions is used to personalize an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), so that the electronic circuit can execute the computer-readable program instructions, thereby implementing various aspects of the present invention.

[0205] Various aspects of the present invention are described herein with reference to flowcharts and / or step diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present invention. It should be understood that each step of the flowcharts and / or step diagrams, and any combination of the steps in the flowcharts and / or step diagrams, can be implemented by computer-readable program instructions.

[0206] These computer-readable program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine such that when these instructions are executed by the processing unit of the computer or other programmable data processing device, a device is generated that implements the functions / actions specified in one or more steps in the flowchart and / or step diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium, where these instructions cause the computer, programmable data processing device, and / or other device to operate in a specific manner. Thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing various aspects of the functions / actions specified in one or more steps in the flowchart and / or step diagram.

[0207] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operational steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more steps in the flowchart and / or step diagram.

[0208] The flowcharts and step diagrams in the accompanying drawings show the possible architectures, functions and operations of the systems, methods and computer program products according to multiple embodiments of the present invention. In this regard, each step in the flowchart or step diagram can represent a module, program segment or part of an instruction, and a module, program segment or part of an instruction contains one or more executable instructions for implementing the specified logical function. In some alternative implementations, the functions marked in the steps can also occur in an order different from that marked in the accompanying drawings. For example, two consecutive steps can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each step in the step diagram and / or flowchart, and the combination of the steps in the step diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or action, or can be implemented using a combination of dedicated hardware and computer instructions.

[0209] While various embodiments of the present invention have been described above, the above descriptions are intended to be illustrative, non-exhaustive, and not limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is selected to best explain the principles of the embodiments, their practical applications, or technological improvements in the marketplace, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A method for determining the security status of a gateway request behavior, characterized in that: include: Generate a request behavior time sequence table based on the occurrence time of multiple request behaviors of the gateway received in real time; For the request behavior time sequence table, based on a predetermined sliding time window, determine a current request behavior, a current time window, and multiple request behaviors within the current time window; For multiple request behaviors within the current time window, extract multiple behavior attribute data of each request behavior respectively, so as to generate multiple groups of behavior attribute data of the multiple request behaviors, each group of behavior attribute data including multiple behavior attribute data of the corresponding request behavior; generating, via a security perception model, a plurality of security features regarding the current request behavior based on a plurality of sets of behavior attribute data of a plurality of request behaviors within a current time window, wherein the security perception model is constructed based on a neural network model; as well as Determining a security label of the current request behavior based on multiple security features of the current request behavior, so as to determine a security level of the current request behavior; The various behavior attribute data for each request behavior include: Basic request information, including request time, request method type, target resource path, and / or query parameters. Client and network identification information, including: client IP, IP sequence of the request link, request target domain name and port, client device and browser information, and / or source page URL that triggered the current request; Transmission and response information, including: request message length, total response data volume and / or HTTP response status code.

2. The method according to claim 1, characterized in that The security awareness model generates multiple security features about the current request behavior based on multiple sets of behavior attribute data of multiple request behaviors within the current time window, including: Based on the request basic information, client and network identification information, and one or more behavior attribute information in the transmission and response information of multiple request behaviors within the current time window, at least two security features about the current request behavior are generated, and the at least two security features include: the cumulative access feature of the client IP, the response code feature, the URL variation feature, the parameter variation feature, the traffic baseline feature, the request link IP sequence feature, the user agent entropy value feature, and multiple features of the request source entropy value feature.

3. The method according to claim 2, characterized in that Generating at least two security features about the current request behavior includes: Based on the access frequency of the client IP in the current time window, the cumulative access characteristics of the client IP of the current request behavior are calculated through KMeans clustering; Based on the abnormal frequency of response codes within the current time window, the response code characteristics of the current request behavior are calculated using the isolation forest detection method; Based on the target domain name and port information of the request within the current time window, as well as the target resource path of the request, BERT semantic clustering is used to calculate the URL variant features of the current request behavior. Based on the request method type, target resource path, and query parameters within the current time window, the parameter variation characteristics of the current request behavior are calculated through edit distance detection. Based on the request message length and total response data volume in the current time window, the traffic baseline characteristics of the current request behavior are calculated using a Gaussian mixture model. Based on the IP sequence of the request link within the current time window, chain length detection and forged IP detection are performed to calculate the IP sequence characteristics of the request link of the current request behavior; Calculate the user agent entropy value characteristics of the current request behavior based on the client IP, client device and browser information within the current time window; Based on the target resource path of the request within the current time window, the request query information, and the source page URL that triggers the current request, a concatenated string is constructed to calculate the request source entropy value characteristics of the current request behavior.

4. The method according to claim 1, wherein Determining a security label of the current request behavior based on multiple security features of the current request behavior to determine the security level of the current request behavior includes: Based on the current network state, determining, via a security awareness model, a weight of each of the multiple security features of the current request behavior; and Based on the value and weight of each security feature of the current request behavior, a security factor of the current request behavior is calculated to determine a security label of the current request behavior.

5. The method according to any one of claims 1 to 4, characterized in that The security perception model is trained through the following steps: Acquire training sample data, wherein the training sample data includes a request behavior time sequence table used for training and a plurality of behavior attribute data about the request behavior; The request behavior time series table for training is progressively slid backward in time sequence based on a predetermined step size of the sliding time window, so as to sequentially determine the current time window, the multiple request behaviors within the current time window, and the current request behavior with each sliding of the time window; The current request behavior is the last request behavior that occurred in the current time window; Based on multiple sets of behavior attribute data of multiple request behaviors within each current time window, generating multiple security features for the current request behavior in the training sample data via a security awareness model, so as to determine a pseudo security label for the request behavior in the training sample data; as well as The weight of each security feature is initialized, and based on the training objective, the error between the pseudo security label and the true security label of the current request behavior in the sample data is calculated to update the parameters of the security perception model.

6. The method according to claim 5, characterized in that The request behavior data in the request behavior timing table for training includes: Past request behavior data, simulated request behavior data, and / or real-time request behavior data.

7. The method according to claim 5, characterized in that Also includes: In response to determining that the security level of the current request behavior exceeds a predetermined security threshold, intercepting the current request behavior; For the intercepted request behavior, multiple security features of the intercepted request behavior are determined to synchronize security policy update parameters to upstream security devices and / or send security warning information to downstream business risk control systems.

8. A computing device, characterized in that include: at least one processing unit; At least one memory, the at least one memory being coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit, the instructions, when executed by the at least one processing unit, causing the apparatus to perform the steps of the method according to any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a machine, the method according to any one of claims 1 to 7 is implemented.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a machine, the method according to any one of claims 1 to 7 is performed.

Images