Data processing method and apparatus for user enumeration detection

Abstract

This application discloses a data processing method and apparatus for user enumeration detection. Applied to an enterprise network environment, it detects user enumeration within the enterprise network environment, including: acquiring data to be processed, which is multi-dimensional behavioral data representing user requests and platform responses in the enterprise network environment; performing behavioral feature extraction processing on the data to be processed based on multi-dimensional analysis to obtain behavioral feature data, which is feature data representing the consistency of user behavior; performing abnormal behavior detection processing on the behavioral feature data based on link reconstruction to obtain enumeration behavior detection data; and intervening in the enumeration behavior detection data to obtain intervention strategy response data. By performing multi-dimensional analysis of the response behavior of authentication-related interfaces and reconstructing the links based on the behavioral features of the multi-dimensional analysis, the method identifies identity enumeration behavior in the Microsoft cloud platform interface response, thus achieving effective detection of user enumeration behavior.

Description

Technical Field

[0001] This application relates to the field of cloud computing security, and more specifically, to a data processing method and apparatus for user enumeration detection. Background Technology

[0002] In modern enterprise cloud environments, the concept of "identity as boundary" has been widely adopted. Enterprises extensively utilize mainstream public cloud platforms such as Microsoft Azure for business operations, establishing identity authentication, access authorization, multi-factor authentication, and team collaboration mechanisms on top of these platforms. Microsoft cloud platforms offer numerous standard interfaces and services, including Azure Active Directory, Microsoft Teams, Outlook Web Access, Microsoft Entra, and TeamsFederation. Some of these interfaces, without proper identity verification, present visitors with inconsistent responses regarding account existence, organizational affiliation, and tenant alliances.

[0003] Attackers can precisely craft access requests and, by comparing and analyzing these responses, infer the existence of specific accounts. For example, when attempting to initiate a collaboration request to an arbitrary name in Microsoft Teams, the system's returned message will vary depending on whether the user exists on the platform. In the Azure AD registration portal, error messages can also reflect whether an account has already been registered. Furthermore, error status codes returned based on OAuth login processes also contain clues about the user's identity status. These differential responses form a crucial basis for attackers to conduct side-channel enumeration attacks.

[0004] Currently, protection solutions against user probing behavior in the industry are quite fragmented. The Azure platform itself provides some security tools, such as conditional access policies, multi-factor authentication configuration, anomaly detection, and IP restriction policies. Some users leverage Security Information and Event Management (SIEM) platforms such as Microsoft Sentinel for aggregation and analysis of login failure events. However, these methods cannot systematically handle interface-level response differences, multi-dimensional enumeration behavior sequences, and complex attack behaviors across service links. Attackers often distribute the probing process across multiple interfaces, multiple time stages, and even use IPs from different regions, making it difficult to determine the purpose and malicious intent of a single point in time. Furthermore, existing security devices such as firewalls and traditional WAF systems are mostly based on static rules or rate limiting measures, making it difficult to detect highly covert structured data probing strategies.

[0005] With the widespread adoption of the Microsoft Azure cloud platform, its numerous authentication and verification interfaces have become exploitable by attackers to identify user identities and organizational structures. By calling Microsoft's public identity authentication and user registration interfaces, attackers can determine the existence of a target account based on details such as error codes, prompts, HTTP response sequences, and content formats returned by the backend, without logging into the system. They can even further probe the user's online status, affiliated organization, and tenant structure.

[0006] These identification behaviors do not rely on platform vulnerabilities, but rather utilize system default mechanisms to construct enumeration methods, falling into the typical category of "side-channel enumeration attacks." Attackers may use automated probing based on REST interface definitions, OAuth return structures, MFA verification processes, etc., to build a user identity graph, thereby obtaining the composition of enterprise users and business topology without authorization, seriously threatening the internal privacy and business intelligence security of organizations.

[0007] Therefore, this application is proposed to address the problems existing in the detection of user probing behavior in the prior art. Summary of the Invention

[0008] The main objective of this application is to provide a data processing method and apparatus for user enumeration detection, so as to solve the above-mentioned technical problems and realize the effective detection of user enumeration behavior.

[0009] To achieve the above objectives, the first aspect of this application proposes a data processing method for user enumeration detection, applied in an enterprise network environment, to achieve user enumeration detection in the enterprise network environment, including:

[0010] Acquire data to be processed, wherein the data to be processed is multi-dimensional behavioral data representing user requests and platform responses in the enterprise network environment;

[0011] The data to be processed is subjected to behavioral feature extraction processing based on multidimensional analysis to obtain behavioral feature data, wherein the behavioral feature data is feature data used to represent the consistency of user behavior;

[0012] The behavioral feature data is subjected to abnormal behavior detection processing based on link reconstruction to obtain enumerated behavior detection data;

[0013] The detection data of the aforementioned units are used to implement response actions to obtain intervention strategy response data.

[0014] Furthermore, the data to be processed is subjected to behavioral feature extraction processing based on multidimensional analysis to obtain behavioral feature data including:

[0015] The data to be processed is subjected to multi-dimensional indicator extraction processing based on structured request analysis to obtain multi-dimensional indicator data, wherein the multi-dimensional indicator data is data used to represent the multi-dimensional indicators corresponding to the multi-dimensional behavioral data respectively;

[0016] The multi-dimensional indicator data is subjected to a first feature extraction process based on a static structural difference determination rule to obtain first process feature data, wherein the first process feature data is data used to represent behavioral features extracted based on the static structural difference determination rule;

[0017] The multi-dimensional indicator data is subjected to a second feature extraction process based on a response feature model to obtain second process feature data, wherein the second process feature data is data used to represent behavioral features extracted based on the response feature model;

[0018] Behavioral feature data is obtained by performing behavioral feature analysis based on confidence scores on the first process feature data and the second process feature data.

[0019] Furthermore, the multi-dimensional indicator data undergoes a second feature extraction process based on a response feature model to obtain the second process feature data, including:

[0020] The multi-dimensional indicator data is subjected to identification to obtain first-dimensional indicator data, second-dimensional indicator data and third-dimensional indicator data, wherein the first-dimensional indicator data is indicator data used to represent HTTP status codes, the second-dimensional indicator data is indicator data used to represent return structure and the third-dimensional indicator data is indicator data used to represent authentication redirection.

[0021] Based on the response feature model, behavioral consistency feature extraction processing is performed on the first dimension indicator data, the second dimension indicator data, and the third dimension indicator data to obtain the second process feature data.

[0022] Furthermore, the behavioral feature data is processed using link reconstruction-based abnormal behavior detection to obtain enumerated behavioral detection data, including:

[0023] The behavioral feature data is processed by link identification based on a single identifier to obtain the triggering link, wherein the triggering link is a service link triggered by a single identifier at different time points.

[0024] Based on the triggering link, an access trajectory corresponding to a single identifier is constructed to obtain the access trajectory of the entire reconstruction process.

[0025] The access trajectory of the entire reconstruction process is processed by constructing a set of behaviors based on path similarity to obtain reconstruction behavior data;

[0026] The reconstructed behavioral data is subjected to abnormal behavior detection based on behavioral index analysis to obtain the enumerated behavior detection data, wherein the enumerated behavior detection data includes a suspicious behavior map and behavioral attack units.

[0027] Furthermore, abnormal behavior detection based on behavioral index analysis is performed on the reconstructed behavioral data to obtain the enumerated behavioral detection data, which includes:

[0028] The reconstructed behavior data is processed based on structural sequence features to obtain access graph node combination data;

[0029] The access graph node data is processed by region aggregation to construct a graph and obtain a behavioral graph.

[0030] The access graph node data is subjected to attack cluster determination processing to obtain attack behavior data;

[0031] The null terminology is determined as detection data based on the behavioral graph and the attack behavior data.

[0032] Furthermore, the intervention action is performed on the detected data to obtain intervention strategy response data, including:

[0033] The detection data of the array is processed based on attack parameters to obtain first attack parameter data, second attack parameter data and third attack parameter data. The first attack parameter data is used to represent the danger level of the attack behavior, the second attack parameter data is used to represent the span of the attack behavior chain, and the third attack parameter data is used to represent the scope affected by the attack behavior.

[0034] The intervention strategy response data is obtained by dynamically matching the first attack parameter data, the second attack parameter data, and the third attack parameter data.

[0035] Furthermore, before acquiring the data to be processed, the method further includes:

[0036] Obtain sample interface request data, wherein the sample interface request data is data used to represent the data generated by the sample user during the interface request process;

[0037] The sample interface request data is processed based on multidimensional feature extraction to obtain multidimensional response difference features, wherein the multidimensional response difference dimension features are features used to represent the structured response difference dimensions present in the sample request data.

[0038] The sample interface request data is subjected to semantic layering-based interface extraction processing to obtain multiple interface feature data, wherein the multiple interface feature data are feature data used to represent multiple categories of interfaces, and each interface feature data includes the category interface and the response mode feature corresponding to the category interface.

[0039] A response feature model is constructed based on the multidimensional response difference features and the multiple interface feature data to obtain the response feature model.

[0040] According to a second aspect of this application, a data processing apparatus for user enumeration detection is proposed, applied in an enterprise network environment, to realize user enumeration detection in the enterprise network environment, including:

[0041] The data acquisition module is used to acquire data to be processed, wherein the data to be processed is multi-dimensional behavioral data representing user requests and platform responses in the enterprise network environment;

[0042] The multidimensional analysis module is used to perform behavioral feature extraction processing on the data to be processed based on multidimensional analysis to obtain behavioral feature data, wherein the behavioral feature data is feature data used to represent the consistency of user behavior;

[0043] The behavior aggregation module is used to perform abnormal behavior detection processing on the behavior feature data based on link reconstruction to obtain enumerated behavior detection data;

[0044] The response module is used to intervene in the detection data of the array by responding to the action, and to obtain the intervention strategy response data.

[0045] According to a third aspect of this application, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing the computer to perform the above-described data processing method for user enumeration detection.

[0046] According to a fourth aspect of this application, an electronic device is provided, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, the computer program being executed by the at least one processor to cause the at least one processor to perform the data processing method for user enumeration detection described above.

[0047] The technical solutions provided by the embodiments of this application may include the following beneficial effects:

[0048] This application proposes a data processing method for user enumeration detection, applied to an enterprise network environment, to achieve user enumeration detection in the enterprise network environment. The method includes: acquiring data to be processed, wherein the data to be processed is multi-dimensional behavioral data representing user requests and platform responses in the enterprise network environment; performing behavioral feature extraction processing on the data to be processed based on multi-dimensional analysis to obtain behavioral feature data, wherein the behavioral feature data is feature data representing the consistency of user behavior; performing abnormal behavior detection processing on the behavioral feature data based on link reconstruction to obtain enumeration behavior detection data; and intervening in the enumeration behavior detection data to obtain intervention strategy response data. By performing multi-dimensional analysis of response behaviors of various authentication-related interfaces and performing link reconstruction based on the behavioral features obtained from the multi-dimensional analysis, the method identifies identity enumeration behavior in Microsoft cloud platform interface responses, achieving passive identification and active blocking of account existence detection behavior, and improving the detection capability of user enumeration behavior. Attached Figure Description

[0049] The accompanying drawings, which form part of this application, are used to provide a further understanding of the application and to make other features, objects, and advantages of the application more apparent. The illustrative embodiments and descriptions of this application are used to explain the application and do not constitute an undue limitation of the application. In the drawings:

[0050] Figure 1 A flowchart of a data processing method for user enumeration detection provided in this application;

[0051] Figure 2 A flowchart of a data processing method for user enumeration detection provided in this application;

[0052] Figure 3 A flowchart of a data processing method for user enumeration detection provided in this application;

[0053] Figure 4 A flowchart of a data processing method for user enumeration detection provided in this application;

[0054] Figure 5 This is a schematic diagram of a data processing device for user enumeration detection provided in this application. Detailed Implementation

[0055] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0056] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this application described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0057] In this application, the terms "upper," "lower," "left," "right," "front," "rear," "top," "bottom," "inner," "outer," "middle," "vertical," "horizontal," "lateral," and "longitudinal" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. These terms are primarily for the purpose of better describing this application and its embodiments, and are not intended to limit the indicated device, element, or component to having a specific orientation, or to be constructed and operated in a specific orientation.

[0058] Furthermore, in addition to indicating location or positional relationship, some of the aforementioned terms may also have other meanings. For example, the term "above" may also be used in some cases to indicate a certain dependency or connection relationship. Those skilled in the art can understand the specific meaning of these terms in this application based on the specific circumstances.

[0059] Furthermore, the terms "installation," "setup," "equipped with," "connection," "linked," and "socketing" should be interpreted broadly. For example, "connection" can be a fixed connection, a detachable connection, or an integral structure; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, or an internal connection between two devices, components, or parts. Those skilled in the art can understand the specific meaning of the above terms in this application according to the specific circumstances.

[0060] Current research on user identity information probing and side-channel enumeration attacks based on Microsoft cloud interfaces has not yet formed a structured defense system. Among existing security protection technologies, the Azure platform provides some policy-based restriction mechanisms, such as conditional access policies, login failure lockout mechanisms, multi-factor authentication, and domain-level login auditing. However, most of these mechanisms are based on processing events that occur after user-initiated behavior, lacking specialized detection capabilities against unauthorized information probing attempts.

[0061] In practice, attackers often pre-construct a large number of probing requests and combine this with different response characteristics returned by interfaces (such as status codes, prompts, interface redirection paths, error types, etc.) to determine the existence of target users. These requests are characterized by low frequency, wide distribution, and multiple layers, making them difficult to identify using traditional intrusion detection systems. Meanwhile, existing log backtracking solutions cannot accurately reconstruct cross-service and cross-region interface response chain behavior paths, making it difficult to discover potential organizational structure leaks or mapping behaviors of inter-enterprise cooperation relationships. Furthermore, there is currently a lack of a universal standard for modeling cross-platform lateral enumeration behavior. Attackers can initiate enumerations from multiple branch interfaces such as Teams, Entra ID, Outlook, and M365 shared directories, and existing solutions lack a unified judgment and identification of the interface response behavior of these services.

[0062] In some optional embodiments of this application, a data processing method for user enumeration detection is proposed and applied to an enterprise network environment to achieve user enumeration detection in the enterprise network environment. Figure 1 A flowchart of a data processing method for user enumeration detection provided in this application is shown below. Figure 1 As shown, the method includes the following steps:

[0063] S101: Obtain the data to be processed;

[0064] The data to be processed is multi-dimensional behavioral data representing user requests and platform responses within the enterprise network environment;

[0065] In an optional embodiment of this application, a Microsoft Cloud user enumeration detection system is provided, comprising: a data collection and response awareness module, a multi-dimensional analysis engine, a behavior aggregation module, and a linkage response control module. The system is deployed on the network boundary layer of the target tenant environment and can interface with Azure native API Gateway, Log Service, and SIEM platform, while also supporting data mirroring input from third-party reverse proxy environments (such as Nginx and Envoy).

[0066] In this embodiment, the data to be processed is collected through the aforementioned data collection and response awareness module. This module is deployed in the external boundary forwarding layer or in-depth gateway node within the tenant network environment. Its main function is to monitor access traffic and collect structured response information for interfaces related to Microsoft cloud platform authentication, such as login.microsoftonline.com, graph.microsoft.com, and teams.microsoft.com. The module acquires multi-dimensional behavioral data of user requests and platform responses based on passive mirroring or access-based API strategies, covering, but not limited to, the following fields: HTTP status code, JSON structure of the return body, OAuth redirection chain, compressed size of the response content, handshake transmission time, error page fields, latency distribution, etc. The module supports real-time parsing of the request and response bodies in the transmission protocol and generates standardized event records for subsequent analysis engine calls.

[0067] This module employs an anomaly response chain buffer mechanism to continuously track interface interactions within a specific time window, generating event time-series snapshots to capture short-term changes in anomaly behavior chains. For example, if a structural error occurs during multiple account login attempts, the module will trigger intermediate data output, which will then be fed into a multi-dimensional analysis engine for pattern refinement and comparison. Furthermore, the acquisition module operates in bypass mode, avoiding disruption to existing business paths and improving business stability; it also supports mirror forwarding and asynchronous storage, providing the capacity and stability to handle high-concurrency traffic acquisition.

[0068] S102: Perform behavioral feature extraction processing on the data to be processed based on multidimensional analysis to obtain behavioral feature data;

[0069] Behavioral feature data refers to feature data used to represent the consistency of user behavior.

[0070] In this embodiment of the application, the above-mentioned multidimensional analysis engine module is used to identify behavioral features in the data to be processed, so as to identify the features of the behavior in the data to be processed and infer the intent of the behavior in the data to be processed.

[0071] In some optional embodiments of this application, a data processing method for user enumeration detection is proposed. Figure 2 A flowchart of a data processing method for user enumeration detection provided in this application is shown below. Figure 2 As shown, the method includes the following steps:

[0072] S201: Perform multi-dimensional indicator extraction processing on the data to be processed based on structured request analysis to obtain multi-dimensional indicator data;

[0073] Multidimensional indicator data refers to data used to represent the multidimensional indicators corresponding to the multidimensional behavioral data.

[0074] By parsing the structured request and response pairs in the data to be processed, various dimensional indicators are extracted, including indicators such as the frequency distribution of status code usage, differences in error message content (TLS), high-frequency path redirection patterns, and consistency of OAuthtoken request behavior.

[0075] S202: Perform first feature extraction processing on multi-dimensional indicator data based on static structural difference judgment rules to obtain first process feature data;

[0076] The first process feature data is data used to represent behavioral features extracted based on the static structural difference determination rules;

[0077] The multidimensional analysis engine module in this application has a two-level identification mechanism, including an identification mechanism based on static structural difference rules and an identification mechanism based on response feature models. The identification mechanism based on static structural difference rules configures a static judgment rule set based on response structural difference, and identifies the general interface through this rule set.

[0078] S203: Perform second feature extraction processing on multi-dimensional indicator data based on the response feature model to obtain second process feature data;

[0079] The second process feature data is data used to represent behavioral features extracted based on the response feature model;

[0080] In the multidimensional analysis engine module of this application, the identification mechanism based on the response feature model is based on the dynamic clustering of behavioral sequences. It performs in-depth analysis through the combination and change of specific difference factors to detect masquerading behavior and multi-stage camouflage.

[0081] In some optional embodiments of this application, a data processing method for user enumeration detection is proposed, including: performing identification on multi-dimensional indicator data to obtain first-dimensional indicator data, second-dimensional indicator data, and third-dimensional indicator data, wherein the first-dimensional indicator data is indicator data used to represent HTTP status codes, the second-dimensional indicator data is indicator data used to represent return structures, and the third-dimensional indicator data is indicator data used to represent authentication redirection; and performing behavioral consistency feature extraction processing on the first-dimensional indicator data, second-dimensional indicator data, and third-dimensional indicator data respectively according to a response feature model to obtain second process feature data.

[0082] In an optional embodiment of this application, behavioral feature identification is performed on multi-dimensional indicator data through a response feature model to obtain second process feature data, which includes behavioral features and the confidence score corresponding to the behavioral features.

[0083] S204: Perform behavioral feature analysis based on confidence scores on the first process feature data and the second process feature data to obtain behavioral feature data.

[0084] S103: Perform abnormal behavior detection processing based on link reconstruction on the behavioral feature data to obtain enumerated behavior detection data;

[0085] In this embodiment of the application, the above-mentioned behavior aggregation module is used to construct an access behavior sequence, and to perform graph modeling and cross-temporal behavior association reconstruction of multi-interface access activities.

[0086] In some optional embodiments of this application, a data processing method for user enumeration detection is proposed. Figure 3 A flowchart of a data processing method for user enumeration detection provided in this application is shown below. Figure 3 As shown, the method includes the following steps:

[0087] S301: Perform link identification processing on behavioral feature data based on a single identifier to obtain the trigger link;

[0088] A trigger link is a service link triggered by a single identifier at different points in time.

[0089] In this application embodiment, based on a single source IP, device ID, or cookie identifier, the entire access trajectory is reconstructed by identifying the service links triggered at different points in time.

[0090] S302: Construct the access trajectory corresponding to a single identifier based on the triggering link to obtain the access trajectory of the entire reconstruction process;

[0091] The access trajectory includes information such as the access path topology, interface call chain relationship, status code transition logic, and request template evolution path.

[0092] S303: Perform path-similar behavior union construction on the access trajectory of the entire reconstruction process to obtain reconstruction behavior data;

[0093] The module maintains the state stream based on a queue window mechanism and constructs the behavior union through a path similarity calculation strategy. At the platform level, it identifies commonalities in behavior jumps and flashes at the boundaries of multi-tenant services, such as path probing from the login interface to the Graph API, or multi-round traversal behavior between Teams and OneDrive file collaboration interfaces.

[0094] S304: Perform abnormal behavior detection on the reconstructed behavioral data based on behavioral index analysis to obtain enumerated behavioral detection data.

[0095] The detection data includes suspicious behavior maps and behavioral attack units.

[0096] In some optional embodiments of this application, a data processing method for user enumeration detection is proposed, which performs abnormal behavior detection on reconstructed behavioral data based on behavioral indicator analysis, including:

[0097] The reconstructed behavior data is processed based on structural sequence features to obtain access graph node combination data; the access graph node data is processed based on region aggregation to obtain a behavior graph; the access graph node data is processed to determine attack clusters to obtain attack behavior data; and the enumeration is determined as detection data based on the behavior graph and attack behavior data.

[0098] By using behavioral indicators such as failure rate curve inflection points, request interval exponential variation, and path parameter iteration sequences, a suspicious behavior graph is generated, and a structured attack graph event unit is output. Based on indicators such as interface response comparison depth and path coupling concentration, abnormal interface access jump frequency bands are identified, and false alarm traffic is filtered out to detect attack behaviors that highly simulate the characteristics of normal user access, thereby realizing the detection of malicious behavior path disguise.

[0099] S104: Intervene in response to the detection data of the sample to obtain the intervention strategy response data.

[0100] In this embodiment of the application, the above-mentioned linkage response control module responds to the detection result of the coin-making behavior, executes and feeds back management tasks. After the above-mentioned module identifies a highly credible sequence of coin-making behavior, the linkage response control module configures a response strategy according to the identification result to intervene in the coin-making behavior.

[0101] In some optional embodiments of this application, a data processing method for user enumeration detection is proposed, including:

[0102] The attack parameter-based identification processing is performed on the attack behavior detection data to obtain first attack parameter data, second attack parameter data, and third attack parameter data. The first attack parameter data is used to represent the danger level of the attack behavior, the second attack parameter data is used to represent the span of the attack behavior chain, and the third attack parameter data is used to represent the scope affected by the attack behavior. An intervention strategy is dynamically matched based on the first attack parameter data, the second attack parameter data, and the third attack parameter data to obtain intervention strategy response data.

[0103] In optional embodiments of this application, the identification of enumeration is used as parameters such as the danger level, attack chain span, and affected resource range in the detection data, and a set of response actions are dynamically selected for intervention. The response types include: immediate blocking, such as tenant isolation, IP blacklisting, and interface closure; disguised feedback, such as consistent error messages and resource existence hiding; behavioral intervention, such as delayed return insertion and structural adjustment disturbance; and log advancement and reporting to external platforms.

[0104] In another optional embodiment of this application, enumeration behavior within a preset time period is obtained, and cumulative interaction anomaly scoring is performed on the enumeration behavior data within this period. A cumulative interaction anomaly scoring model is used to score the enumeration behavior within the preset period, resulting in a cumulative interaction anomaly score. If the cumulative interaction anomaly score is greater than or equal to a preset anomaly score threshold, a response strategy enhancement process is applied to the enumeration behavior, including, for example, increasing the return delay or dynamically adjusting the response message structure to mislead the attacker's behavior reasoning process. This yields an updated response strategy and corresponding response effect evaluation data, thereby improving the controllability of execution configuration changes and reducing the impact on business behavior. Furthermore, the module provides a standardized response result encapsulation interface to support collaboration with third-party log platforms and SOAR orchestration systems.

[0105] After identifying enumeration threat activities, the linkage response control module matches the corresponding policy response mechanism with the enumeration behavior, including methods such as low-frequency warnings, threshold blocking, IP blocking, tenant behavior isolation, and interface pseudo-response control, so as to effectively curb the attack behavior without affecting the normal experience of real users.

[0106] In the optional embodiments of this application, the linkage response control module constructs a response level association matrix and dynamically matches the priority of policy rules after cross-validating the attack confidence, access depth, and repetition rate parameters. Configurable response types include, but are not limited to: (1) Interface response data disturbance: unified 404 prompt page, fuzzy group return, and differential field clearing processing; (2) Organizational blocking instructions: add access restrictions to accounts or subdomain tenants with attack events; (3) Automatic audit push mechanism: submit attack chain event summaries to internal and external audit systems or CSIRT response teams; (4) Dynamic blacklist generation: implant attack behavior fingerprints into a reusable blocking rule library for WAF / CDN linkage; (5) Improve protection strength based on risk classification: such as short-term activation of account locking mechanism and restriction of Federation API access frequency; (6) Lateral threat propagation blocking: combine inter-domain access trust authorization graph to apply access control to potentially enumerated adjacent tenants; (7) Security fusion mechanism support: with the help of SIEM platform attribute rule linkage, form multi-dimensional alarms by mapping the risk between user source IP and tenant organizational structure.

[0107] In some optional embodiments of this application, a data processing method for user enumeration detection is proposed to enable the response feature model in the aforementioned multidimensional analysis engine module to identify behavioral features of differential behaviors. Figure 4 A flowchart of a data processing method for user enumeration detection provided in this application is shown below. Figure 4 As shown, the method includes the following steps:

[0108] S401: Obtain sample interface request data;

[0109] The sample interface request data is used to represent the data generated by the sample user during the interface request process; the sample user includes real users, non-existent users, and users with abnormal status. The sample interface request data includes HTTP structure, protocol fields, link characteristics, and other data generated by real users, non-existent users, and users with abnormal status during the interface request process.

[0110] S402: Perform multi-dimensional feature extraction processing on the sample interface request data to obtain multi-dimensional response difference features;

[0111] The multidimensional response difference dimension features are features used to represent the structured response difference dimensions present in the sample request data. By summarizing the HTTP structure, protocol fields, link features, etc. generated by real users, non-existent users, and users with abnormal status during the interface request process, a series of structured response difference dimensions that can be used to determine the existence of users are abstracted.

[0112] The platform's feedback behavior in multiple interface scenarios, such as authentication process, registration verification, tenant routing, and collaboration requests, includes features such as the distribution pattern of status code combinations, the consistency of error return structure, the difference in behavior chain during OAuth jump, the change in response packet size and content compression structure, and the difference in TLS handshake and data transmission latency in the transmission channel. These features are used to extract multidimensional response difference features.

[0113] By extracting joint features from the above multi-dimensional structure, a response feature model can be constructed to detect structural differences in interface requests. For example, if the same interface returns content fields with statistical shifts in depth, semantic ambiguity in error descriptions, and structural splits in the length of jump paths in the authentication chain, in two scenarios where the account exists or does not exist, the model can identify attackers who use return differences to perform condition enumeration, state traversal, and other behaviors.

[0114] S403: Perform semantic-layered interface extraction processing on the sample interface request data to obtain multiple interface feature data;

[0115] Multiple interface feature data are feature data used to represent multiple categories of interfaces. Each interface feature data includes the category interface and the corresponding response mode feature of the category interface.

[0116] Different Microsoft interfaces are categorized into several interface clusters based on service attributes, data carrying modes, and typical interaction processes. A mapping table between interface categories and response modes is then established. For example, the Azure login authentication interface and the Teams collaboration target binding interface will have significant semantic differences in their interface functions. By constructing interface identification templates and path behavior mapping rules, the ability to identify common differences across multiple service links is improved.

[0117] S404: Construct a response feature model based on multidimensional response difference characteristics and multiple interface feature data to obtain the response feature model.

[0118] In another optional embodiment of this application, the response feature model is used to identify interface request behavior data in the data to be processed. Within a preset response model running cycle, abnormal matching behavior feature data is obtained. This abnormal matching behavior feature data indicates that the response feature model has failed to match behavior features or that the execution degree of the identified behavior features has decreased. The abnormal matching behavior feature data includes time features, i.e., the frequency of abnormal matching results. When the frequency of abnormal matching results in the abnormal matching behavior feature data is greater than a preset abnormal matching threshold, updated sample interface request data is obtained. The updated sample interface request data is subjected to the aforementioned multidimensional feature extraction and interface extraction processing to obtain updated multidimensional response difference features and updated multiple interface feature data. The response feature model is updated based on the updated multidimensional response difference features and updated multiple interface feature data to obtain an updated response feature model. Further, if the frequency of abnormal matching results in the abnormal matching behavior feature data is greater than a preset abnormal matching threshold, an update prompt message is output, and manual intervention is performed through a rule building engine to correct the issue, thereby meeting the adaptation requirements of custom interface scenarios.

[0119] To address scenarios where attackers use strategies such as parameter perturbation, request field noise injection, and path jump compression to evade response model judgment, the system introduces an adversarial learning strategy during the model construction phase. It also evaluates the model's robustness by combining behavioral chain consistency scoring, client fingerprint stability assessment, and path semantic reconstruction distance. During the identification process, if a sample is found to possess strong anti-probe masking characteristics, the system will further link with the behavioral graph module to perform high-order risk value modeling and forcibly trigger a multi-factor cross-validation identification process, performing full-stack threat confirmation from response structure to path semantics.

[0120] In an optional embodiment of this application, by constructing the response feature model and combining it with static structural difference judgment rules, the module performs enumeration behavior identification of multi-dimensional responses to the data to be processed. This includes: constructing attack path partitions based on time correlation and interface path graph connectivity; identifying access graph node combinations with specific structural sequence characteristics using a sliding window algorithm; calculating the state change, response field spatial change, and error message entropy change values ​​in each access event using a data perturbation measurement model; and constructing a behavior fan-out graph by region aggregation; and determining attack clusters by interface homology and return response vector similarity, further subdividing deep side-channel operation behaviors that cannot be perceived by traditional threshold strategies. The behavior aggregation module transforms the identified behavioral features into a chain event sequence model, which can be considered a subgraph matching task of the behavior graph. Based on a supervised sliding clustering algorithm, behavioral feature functions such as node state fingerprints, path jump patterns, and parameter sequence growth rhythms are defined. Through dynamic feature matching, the module can also achieve continuous tracking capabilities for strategy-avoidance attack behaviors, such as traffic band attack analysis initiated by methods like IP node switching, UA field perturbation, and path filling masquerading.

[0121] In this embodiment, by analyzing interface response behavior, reconstructing access trajectories, and mapping state differences, horizontal and low-frequency distributed account enumeration paths are identified and aggregated to achieve end-to-end threat mapping and mitigation. This enables real-time awareness of differences in Microsoft cloud platform interface responses and accurate identification of potential identity probe behaviors.

[0122] In some optional embodiments of this application, a data processing apparatus for user enumeration detection is proposed, applied in an enterprise network environment, to achieve user enumeration detection in the enterprise network environment. Figure 5 A schematic diagram of a data processing device for user enumeration detection provided in this application is shown below. Figure 5 As shown, it includes:

[0123] The data acquisition module 51 is used to acquire data to be processed, wherein the data to be processed is multi-dimensional behavioral data representing user requests and platform responses in the enterprise network environment;

[0124] The multidimensional analysis module 52 is used to perform behavioral feature extraction processing on the data to be processed based on multidimensional analysis to obtain behavioral feature data, wherein the behavioral feature data is feature data used to represent the consistency of user behavior;

[0125] The behavior aggregation module 53 is used to perform abnormal behavior detection processing based on link reconstruction on the behavior feature data to obtain enumerated behavior detection data;

[0126] The response module 54 is used to intervene in the detection data of the array and obtain intervention strategy response data.

[0127] The specific methods of execution of each unit in the above embodiments have been described in detail in the embodiments of the method, and will not be elaborated here.

[0128] In summary, this application proposes a data processing method for user enumeration detection, applied to an enterprise network environment, to achieve user enumeration detection in the enterprise network environment. The method includes: acquiring data to be processed, wherein the data to be processed is multi-dimensional behavioral data representing user requests and platform responses in the enterprise network environment; performing behavioral feature extraction processing on the data to be processed based on multi-dimensional analysis to obtain behavioral feature data, wherein the behavioral feature data is feature data representing the consistency of user behavior; performing abnormal behavior detection processing on the behavioral feature data based on link reconstruction to obtain enumeration behavior detection data; and intervening in the enumeration behavior detection data to obtain intervention strategy response data. By performing multi-dimensional analysis of response behaviors of various authentication-related interfaces and performing link reconstruction based on the behavioral features obtained from the multi-dimensional analysis, the method identifies identity enumeration behavior in Microsoft cloud platform interface responses, achieving passive identification and active blocking of account existence detection behavior, and improving the detection capability of user enumeration behavior.

[0129] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0130] Obviously, those skilled in the art should understand that the various units or steps of this application described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. Optionally, they can be implemented using computer-executable program code, thereby storing them in a storage device for execution by a computing device, or fabricating them separately as individual integrated circuit modules, or fabricating multiple modules or steps into a single integrated circuit module. Thus, this application is not limited to any particular combination of hardware and software.

[0131] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A data processing method for user enumeration detection, characterized in that, Applied to an enterprise network environment to achieve user enumeration detection in the enterprise network environment, comprising: Obtaining to-be-processed data, wherein the to-be-processed data is multi-dimensional behavior data for representing user requests and platform feedback in an enterprise network environment; Performing multi-dimensional analysis-based behavior feature extraction processing on the to-be-processed data to obtain behavior feature data, wherein the behavior feature data is feature data for representing user behavior consistency, comprising: Performing multi-dimensional index extraction processing on the to-be-processed data based on structured request analysis to obtain multi-dimensional index data, wherein the multi-dimensional index data is data for representing multi-dimensional indexes respectively corresponding to the multi-dimensional behavior data; performing first feature extraction processing on the multi-dimensional index data based on a static structure difference judgment rule to obtain first process feature data, wherein the first process feature data is data for representing behavior features extracted based on the static structure difference judgment rule; performing second feature extraction processing on the multi-dimensional index data based on a response feature model to obtain second process feature data, wherein the second process feature data is data for representing behavior features extracted based on the response feature model; performing behavior feature analysis based on confidence score on the first process feature data and the second process feature data to obtain the behavior feature data; Performing abnormal behavior detection processing on the behavior feature data based on link reconstruction to obtain enumeration behavior detection data, comprising: Performing link identification processing on the behavior feature data based on a single identifier to obtain a trigger link, wherein the trigger link is a service link triggered by the single identifier at different time points; constructing an access track corresponding to the single identifier according to the trigger link to obtain a reconstructed full-process access track; performing behavior union construction processing on the reconstructed full-process access track based on path similarity to obtain reconstructed behavior data; performing abnormal behavior detection based on behavior index analysis on the reconstructed behavior data to obtain the enumeration behavior detection data, wherein the enumeration behavior detection data comprises behavior graph data and attack behavior data; Performing response action intervention on the enumeration behavior detection data to obtain intervention strategy response data.

2. The data processing method according to claim 1, characterized in that, Performing second feature extraction processing on the multi-dimensional index data based on a response feature model to obtain second process feature data, comprising: Identifying the multi-dimensional index data to obtain first-dimensional index data, second-dimensional index data, and third-dimensional index data, wherein the first-dimensional index data is index data for representing HTTP status codes, the second-dimensional index data is index data for representing return structures, and the third-dimensional index data is index data for representing authentication jumps; Performing behavior consistency feature extraction processing on the first-dimensional index data, the second-dimensional index data, and the third-dimensional index data based on the response feature model respectively to obtain the second process feature data.

3. The data processing method of claim 1, wherein, Performing abnormal behavior detection based on behavior index analysis on the reconstructed behavior data to obtain the enumeration behavior detection data, comprising: The reconstruction behavior data is subjected to structure sequence feature-based identification processing to obtain access graph node combination data; The access graph node combination data is subjected to region aggregation-based graph construction processing to obtain behavior graph data; The access graph node combination data is subjected to attack cluster determination processing to obtain attack behavior data; The behavior graph and the attack behavior data are used to determine the enumeration behavior detection data.

4. The data processing method of claim 1, wherein, The enumeration behavior detection data is subjected to response action intervention to obtain intervention strategy response data, including: The enumeration behavior detection data is subjected to attack parameter-based identification processing to obtain first attack parameter data, second attack parameter data, and third attack parameter data, wherein the first attack parameter data is data used to represent an attack behavior risk level, the second attack parameter data is data used to represent an attack behavior chain span, and the third attack parameter data is data used to represent an attack behavior affected range; The first attack parameter data, the second attack parameter data, and the third attack parameter data are used to dynamically match an intervention strategy to obtain the intervention strategy response data.

5. The data processing method of claim 1, wherein, Before the processing data is obtained, the method further includes: Obtaining sample interface request data, wherein the sample interface request data is data generated by a sample user in an interface request process; The sample interface request data is subjected to multi-dimensional feature extraction processing based on a multi-dimensional feature to obtain a multi-dimensional response difference feature, wherein the multi-dimensional response difference feature is a feature used to represent a structured response difference dimension existing in sample request data; The sample interface request data is subjected to interface extraction processing based on semantic layering to obtain a plurality of interface feature data, wherein the plurality of interface feature data is feature data used to represent a plurality of category interfaces, and each interface feature data includes a category interface and a response mode feature corresponding to the category interface; A response feature model is constructed based on the multi-dimensional response difference feature and the plurality of interface feature data to obtain a response feature model.

6. A data processing apparatus for user enumeration detection, the data processing apparatus comprising: The application is applied to an enterprise network environment to realize user enumeration detection in the enterprise network environment, including: A data acquisition module is configured to acquire processing data, wherein the processing data is multi-dimensional behavior data used to represent user requests and platform feedback in an enterprise network environment; A multi-dimensional analysis module is configured to perform multi-dimensional analysis-based behavior feature extraction processing on the processing data to obtain behavior feature data, wherein the behavior feature data is feature data used to represent user behavior consistency, including: The multi-dimensional index extraction processing based on the structured request analysis is performed on the to-be-processed data, and multi-dimensional index data is obtained, where the multi-dimensional index data is data used to represent the multi-dimensional index corresponding to the multi-dimensional behavior data respectively; the first feature extraction processing based on the static structure difference determination rule is performed on the multi-dimensional index data, and first process feature data is obtained, where the first process feature data is data used to represent the behavior feature extracted based on the static structure difference determination rule; the second feature extraction processing based on the response feature model is performed on the multi-dimensional index data, and second process feature data is obtained, where the second process feature data is data used to represent the behavior feature extracted based on the response feature model; the behavior feature analysis based on the confidence score is performed on the first process feature data and the second process feature data, and the behavior feature data is obtained. The behavior aggregation module is configured to perform the abnormal behavior detection processing based on the link reconstruction on the behavior feature data, and enumeration behavior detection data is obtained, including: The link identification processing based on the single identification is performed on the behavior feature data, and a trigger link is obtained, where the trigger link is a service link triggered by the single identification at different time points; the access track corresponding to the single identification is constructed according to the trigger link, and a reconstructed whole-process access track is obtained; the behavior union construction processing based on the path similarity is performed on the reconstructed whole-process access track, and reconstructed behavior data is obtained; the abnormal behavior detection based on the behavior index analysis is performed on the reconstructed behavior data, and the enumeration behavior detection data is obtained, where the enumeration behavior detection data includes behavior graph data and attack behavior data. The response module is configured to perform the response action intervention on the enumeration behavior detection data, and intervention strategy response data is obtained.

7. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions, and the computer instructions are used to make the computer execute the data processing method for user enumeration detection in any one of claims 1-5.

8. An electronic device, comprising: Including: At least one processor; And a memory connected with the at least one processor in communication; wherein the memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor to make the at least one processor execute the data processing method for user enumeration detection in any one of claims 1-5.

Images