Method and system for judging and processing behavior abnormity based on link
By grouping user links and using a neural network model to analyze behavioral characteristics, the problem of low accuracy in judging abnormal behavior in existing technologies is solved, achieving higher accuracy.
Patent Information
- Application Number
- CN202511102102.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-08-07
- Publication Date
- 2025-10-17
AI Technical Summary
In the prior art, the accuracy of determining whether a user's behavior in a network link is abnormal needs to be improved.
By obtaining the first link established by the user through the service provided by the client and the server, and dividing the links whose attribute similarity meets the predetermined conditions into the same group, clustering is performed using a neural network model, and combining the behavioral characteristics on the link to determine whether it is abnormal behavior.
The accuracy of abnormal behavior judgment is improved and the possibility of misjudgment is reduced.
Smart Images
Figure CN120811718A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the field of network, in particular, to a link-based behavior abnormality judgment processing method and system. BACKGROUND
[0002] The data generated in the process of human-computer interaction of a user in a device can be referred to as behavior data. For a network, after a terminal or a device establishes a link with a server, a series of operations are performed on the link, and the data or services accessed by the operations can also be referred to as behavior data. For example, the behavior data includes at least one of access, browsing, and operation, but is not limited thereto.
[0003] Analyzing behavior data is an important way for each application program to analyze users. By analyzing the user behavior link of a user in an application program, more valuable information can be mined. For example, the objective evaluation of the user on the content of the application program can be obtained, so that the function of the application program can be iteratively adjusted, and the stickiness of a certain business to the user can also be verified.
[0004] In the field of network security, behavior data can be used to analyze whether the behavior is abnormal, and then whether the user is a malicious user can be detected. For example, a user needs to perform the operations of "sending verification code-mobile verification-password modification success" when performing the operation of modifying a password. If the user's operation is observed alone, it is a normal behavior. However, if the user performs the operation multiple times within a certain time period, there may be a possibility that the account is stolen. That is, the behavior will be determined as abnormal.
[0005] In the prior art, whether the behavior is abnormal is usually determined based on the behavior of a single user. The accuracy of this determination method needs to be improved. SUMMARY
[0006] Embodiments of the present application provide a link-based behavior abnormality judgment processing method and system to at least solve the problem that the accuracy of determining whether a behavior in a network link of a user is abnormal needs to be improved in the related art.
[0007] According to an aspect of the present application, a method for determining abnormal behavior of a link is provided, comprising: obtaining a first link established by a user through a client to a service provided by a server, and obtaining behavior of the user on the first link; obtaining a group in which the first link is located, wherein the group is established according to attributes of links, and links with attribute similarity meeting a predetermined condition are grouped into the same group; obtaining behaviors of the user occurred on all links in the group; and determining whether the behavior on the first link is abnormal behavior according to the behavior on the first link and the behaviors of the user occurred on all links in the group.
[0008] Further, the determining whether the behavior on the first link is abnormal behavior comprises: determining behaviors occurred on each link in the all links and characteristics of the behaviors occurred on each link, wherein the characteristics comprise at least one of the following: access time, behavior target, frequency, and number of times, and the behavior target comprises at least one of the following: target URL accessed, table in a database accessed, and SQL executed; determining behaviors that will occur on each link according to the characteristics of the behaviors, and determining the behaviors that will occur on each link as normal behaviors; and determining whether the behavior on the first link belongs to the normal behaviors, and determining the behavior as abnormal behavior if the behavior does not belong to the normal behaviors.
[0009] Further, the grouping links with attribute similarity meeting a predetermined condition into the same group comprises: obtaining attributes of links to be grouped, wherein the attributes comprise at least one of the following: source network address, destination network address, destination port number, and account used for access behaviors occurred on the links; and grouping links with at least one same attribute into the same group.
[0010] Further, the grouping links with attribute similarity meeting a predetermined condition into the same group comprises: obtaining attributes of links to be grouped, and inputting the attributes of the links to be grouped and behaviors occurred on the links to be grouped into a neural network model for clustering; and obtaining links grouped from the neural network model.
[0011] According to another aspect of the present application, a system for determining abnormal behavior of a link is also provided, comprising: a first obtaining module configured to obtain a first link established by a user through a client to a service provided by a server, and obtain behavior of the user on the first link; a second obtaining module configured to obtain a group in which the first link is located, wherein the group is established according to attributes of links, and links with attribute similarity meeting a predetermined condition are grouped into the same group; a third obtaining module configured to obtain behaviors of the user occurred on all links in the group; and a processing module configured to determine whether the behavior on the first link is abnormal behavior according to the behavior on the first link and the behaviors of the user occurred on all links in the group.
[0012] Further, the processing module is configured to determine behaviors that have occurred on each of the links, and characteristics of the behaviors that have occurred on each of the links, wherein the characteristics comprise at least one of the following: access time, behavior target, frequency, and number of times, and wherein the behavior target comprises at least one of the following: target URL accessed, table in database accessed, and SQL executed; determine, according to the characteristics of the behaviors, behaviors that have occurred on each of the links, and determine the behaviors that have occurred on each of the links as normal behaviors; and determine whether the behavior on the first link is the normal behavior, and if not, determine that the behavior is an abnormal behavior.
[0013] Further, the second obtaining module is configured to obtain attributes of the links to be grouped, wherein the attributes comprise at least one of the following: source network address, destination network address, destination port number, and account used for the access behavior that has occurred on the link; and group the links having at least one same attribute into the same group.
[0014] Further, the second obtaining module is configured to obtain attributes of the links to be grouped, and input the attributes of the links to be grouped and behaviors that have occurred on the links to be grouped into a neural network model for clustering; and obtain, from the neural network model, the links grouped.
[0015] According to another aspect of the present application, an electronic device is also provided, comprising a memory and a processor; wherein the memory is configured to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the method steps described above.
[0016] According to another aspect of the present application, a readable storage medium is also provided, which stores computer instructions, wherein the computer instructions are executed by a processor to implement the method steps described above.
[0017] In the embodiments of the present application, a first link established by a user through a client to a server is obtained, and behaviors of the user on the first link are obtained; a group in which the first link is located is obtained, wherein the group is established according to attributes of the links, and links having attribute similarity meeting a predetermined condition are grouped into the same group; behaviors of the user that have occurred on all links in the group are obtained; and whether the behavior on the first link is an abnormal behavior is determined according to the behavior on the first link and the behaviors of the user that have occurred on all links in the group. The present application solves the problem in the related art that the accuracy of determining whether a behavior of a user on a network link is an abnormal behavior needs to be improved, thereby improving the accuracy of determining abnormal behaviors to a certain extent. BRIEF DESCRIPTION OF DRAWINGS
[0018] The accompanying drawings, which form a part of this application, are included to provide a further understanding of the application. The application illustratively described herein suitably can be practiced in the absence of any element(s) not specifically described in this document. The drawings are not to scale and are provided merely as illustrative examples. In the drawings:
[0019] Figure 1 is a flowchart of a link-based behavior anomaly judgment processing method according to an embodiment of the present application. DETAILED DESCRIPTION
[0020] It should be noted that the embodiments and features of the embodiments in the present application can be combined with each other without conflict. The present application will be described in detail below with reference to the accompanying drawings and in conjunction with the embodiments.
[0021] It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described herein can be executed in an order different from that shown herein.
[0022] In the following embodiments, a link-based behavior anomaly judgment processing method is provided, Figure 1 is a flowchart of a link-based behavior anomaly judgment processing method according to an embodiment of the present application, as Figure 1 shown, the steps involved in the method in Figure 1 will be described below.
[0023] Step S102, obtaining a first link established by a user through a client to a service provided by a server, and obtaining the behavior of the user on the first link.
[0024] Step S104, obtaining a group in which the first link is located, wherein the group is established according to the attributes of the link, and links with attribute similarity meeting a predetermined condition are divided into the same group.
[0025] There are many ways to group, which will be described below by way of example.
[0026] For example, dividing links with attribute similarity meeting a predetermined condition into the same group includes: obtaining the attributes of the links to be grouped, wherein the attributes include at least one of the following: source network address, destination network address, destination port number, account used for access behavior occurring on the link; and dividing links with at least one of the attributes being the same into the same group.
[0027] For example, grouping the links with the attribute similarity meeting the predetermined condition into the same group comprises: obtaining the attributes of the links to be grouped, inputting the attributes on the links to be grouped and behaviors occurred on the links to be grouped into a neural network model for clustering; and obtaining the grouped links from the neural network model.
[0028] There are many implementation manners of the neural network model for clustering, which will be described below with examples.
[0029] For example, obtaining a trained deep neural network model; performing iterative quantization on the parameters of each layer in the deep neural network model layer by layer, the iterative quantization being quantization performed once on all layers in the deep neural network model; performing N times of iterative quantization on the deep neural network model until the quantized deep neural network model meets the preset compression volume requirement, N≥0; wherein, for the first time, performing quantization processing on the i-th layer parameters in the trained deep neural network model, performing clustering analysis on the i-th layer parameters in the trained deep neural network model, determining the corresponding quantization range and quantization level according to the clustering analysis result, i being a natural number greater than 1; and quantizing the parameters in the quantization range of the i-th layer according to the determined quantization level.
[0030] The determination of the corresponding quantization range and quantization level according to the clustering analysis result comprises: determining the corresponding quantization range according to the number of cluster centers and the cluster center values in the clustering analysis result; and determining the quantization level according to the number of cluster centers and the corresponding quantization range. The clustering analysis on the i-th layer parameters in the trained deep neural network model comprises: performing the clustering analysis on the i-th layer parameters in the trained deep neural network model by using subtractive clustering. After the quantization of the parameters in the quantization range of the i-th layer according to the determined quantization level, the method further comprises: obtaining the compensation coefficient corresponding to the i-th layer; obtaining the compensated quantized parameters of the i-th layer according to the compensation coefficient of the i-th layer and the quantized parameters, and taking the compensated quantized parameters as the quantized parameters of the i-th layer. The obtaining of the compensation coefficient corresponding to the i-th layer comprises: calculating the compensation coefficient of the i-th layer according to the parameters before quantization and the quantized parameters.
[0031] For example, in the network layers in the target neural network model, a network connection layer is determined as a candidate split layer, where the network connection layer connects the target neural network model, and if the network connection layer is removed from the target neural network model, the target neural network model is divided into two independent parts, and the target neural network model is a neural network model trained by using network link attributes of a first scenario as training data; an added sample set is obtained, where the added sample set is network link attributes of a second scenario; the added sample set is input into the target neural network model to obtain feature data sets output by at least one candidate split layer in the target neural network model; for each candidate split layer, according to categories to which each added sample in the added sample set belongs, a category to which each feature data in the feature data set output by the candidate split layer belongs is determined, and feature data of each category forms a feature data subset of the category; for each feature data subset of each category, a corresponding feature mean value is determined; a clustering distance between each feature data in each feature data subset of each category and the feature mean value corresponding to the feature data subset is calculated; based on the clustering distance between each feature data in each feature data subset of each category and the feature mean value corresponding to the feature data subset, and the number of feature data of the category, a first clustering distance mean value corresponding to the feature data subset of the category is determined; based on the first clustering distance mean value corresponding to each feature data subset of each category and the number of categories, a second clustering distance mean value corresponding to the feature data set output by the candidate split layer is determined; in the second clustering distance mean values corresponding to the feature data sets output by all candidate split layers, a target clustering distance mean value satisfying a preset condition is determined; a candidate split layer corresponding to the target clustering distance mean value is determined as a target split layer; based on the added sample set, network layers after the target split layer are trained, where in training the target neural network model, parameters of the target split layer and each network layer before the target split layer are fixed, and only parameters of each network layer after the target split layer are adjusted.
[0032] The determining of the target clustering distance mean satisfying the preset condition comprises: determining a third clustering distance mean less than a first preset threshold; and determining a minimum value in the third clustering distance mean as the target clustering distance mean. The determining of the target clustering distance mean satisfying the preset condition from the second clustering distance means corresponding to the feature data sets output by all candidate segmentation layers comprises: determining a fourth clustering distance mean less than a second preset threshold from the second clustering distance means; and if a fifth clustering distance mean less than a third preset threshold exists in the fourth clustering distance mean, determining a candidate segmentation layer farthest from an input layer in the target neural network model in a candidate segmentation layer corresponding to the fifth clustering distance mean as the target segmentation layer; if no fifth clustering distance mean less than the third preset threshold exists in the fourth clustering distance mean, determining a minimum value in the fourth clustering distance mean as the target clustering distance mean; and determining a candidate segmentation layer corresponding to the target clustering distance mean as the target segmentation layer.
[0033] In an optional implementation, if the group to which the first link belongs is not acquired, a behavior set of a highest security level is determined, wherein behaviors in the behavior set of the highest security level are all safe to the service; and it is judged whether the behavior on the first link is in the behavior set of the highest security level, and if not, the behavior on the first link is determined as an abnormal behavior.
[0034] In step S106, user behaviors occurred on all links in the group are acquired.
[0035] In step S108, it is judged whether the behavior on the first link is an abnormal behavior according to the behavior on the first link and the user behaviors occurred on all links in the group.
[0036] In an optional implementation (it is to be noted that examples in the following implementation and optional implementations can be combined when there is no technical contradiction and conflict), after it is judged that the behavior on the first link is an abnormal behavior, it is determined whether the abnormal behavior involves data acquisition, and if so, the data acquired by the abnormal behavior is acquired, and the acquired data is compared with data involved in a leak in type, and in a case where the types are consistent, an alarm information is sent, wherein the alarm information is used to indicate that the abnormal behavior causes data leak.
[0037] In an optional example, after sending the alarm information, the source network address of the first link is recorded and / or the user account making the abnormal behavior is recorded, alarm information corresponding to the user account or the source network address is counted, and if the occurrence frequency of the alarm information exceeds a threshold or the cumulative number exceeds a threshold, the source network address or the user account is added to a blacklist, wherein the source network address or the user account added to the blacklist is limited to access the server.
[0038] For example, determining whether the behavior on the first link is an abnormal behavior includes: determining the behavior that occurs on each link in the all links and the characteristics of the behavior occurring on each link, wherein the characteristics include at least one of: access time, behavior target, frequency, and number, wherein the behavior target includes at least one of: a target URL accessed, a table in a database accessed, and a SQL executed; determining the behavior that occurs on each link according to the characteristics of the behavior, and determining the behavior that occurs on each link as a normal behavior (for example, determining the behavior that occurs on each link more than a predetermined frequency or number as a normal behavior); and determining whether the behavior on the first link belongs to the normal behavior, and if not, determining the behavior as an abnormal behavior.
[0039] As an optional implementation, determining whether the behavior on the first link is an abnormal behavior includes: obtaining a pre-set abnormal behavior set or a normal behavior set, wherein the abnormal behavior set and the normal behavior set are determined according to the behavior of a user on a link; determining the behavior that occurs on each link in the all links and the characteristics of the behavior occurring on each link in a case that the behavior on the first link is not in the abnormal behavior set or in the normal behavior set, wherein the characteristics include at least one of: access time, behavior target, frequency, and number, wherein the behavior target includes at least one of: a target URL accessed, a table in a database accessed, and a SQL executed; determining the behavior that occurs on each link according to the characteristics of the behavior, and determining the behavior that occurs on each link as a normal behavior; and determining whether the behavior on the first link belongs to the normal behavior, and if not, determining the behavior as an abnormal behavior.
[0040] The above steps solve the problem in the related art that the accuracy of determining whether a behavior of a user on a network link is an abnormal behavior needs to be improved, thereby improving the accuracy of abnormal behavior determination to a certain extent.
[0041] In the above steps, we first analyze the behavioral similarities between different links (client IP, account, service address), and label links with similar behaviors as a group of behavioral roles. When a behavior is outside the behavioral baseline, we first confirm whether it exists in the behavioral baseline of links with similar roles. If so, we can lower the anomaly level or set it as not an anomaly.
[0042] There are many ways to determine abnormal behavior, which are explained below with examples.
[0043] For example, the server data content is divided into public areas and restricted areas, where the public area stores public resources, information or files, and the restricted area stores sensitive data and private files; all access terminals accessing the server are obtained, and based on the access history of the access terminals, they are divided into public areas and restricted areas, and all newly accessed access terminals are connected to the public area; the access behavior of newly accessed access terminals in the public area is collected in real time, and matched with the historical abnormal behavior in the database, and anomaly judgment is made based on the matching results; based on the anomaly judgment results, the newly accessed access terminals are divided into different security levels, and different security measures are taken.
[0044] The server data content is divided into a public area and a restricted area, wherein the public area stores public resources, information or files, and the restricted area stores sensitive data and private files. Specifically, the server public area is open to all non-prohibited access terminals; the server restricted area is only accessible to trusted access terminals and ordinary access terminals that have been authenticated by the server. The acquisition of all access terminals that have accessed the server, based on the access history of the access terminals, divides them into public areas and restricted areas, and accesses all newly accessed access terminals to the public area specifically includes: acquiring all access terminals that have accessed the server and querying their access history data in a database; if the access terminal has been accessed, the corresponding access area is opened to it based on the security level of the access terminal in the historical data; if there is no historical data, it is a newly accessed access terminal, and the public area is opened to it. The real-time collection of access behaviors of newly connected access terminals in public areas is matched with historical abnormal behaviors in a database, and abnormality judgment is made based on the matching results. Specifically, the method includes: based on the historical abnormal data in the database, obtaining the access behavior patterns when abnormalities occur in the access terminals, and building an abnormal behavior model; based on the abnormal behavior model, analyzing the access behaviors of the access terminals collected in real time, and performing feature matching between the access behaviors of the access terminals and the abnormal access behaviors; and judging the abnormality of the current access terminal based on the matching degree between the access behaviors of the access terminals and the abnormal access behaviors.
[0045] For example, after identifying the behavior anomaly, a safe login method can be adopted, i.e., the identity verification is enhanced. In this example, the method is based on an application system using a username and a password, the account information of the user in the application system has a username, a password, and an account-associated mobile phone number or email address, or the account information of the user in the application system has a username and a password, a mobile phone number, or an email address, the user has a smart mobile terminal with computing and photographing functions, and the data flow of the user accessing the application system needs to pass through the enhanced identity authentication system for authentication before data exchange is realized.
[0046] The enhanced authentication method can include the following steps:
[0047] Step 1. An enhanced identity authentication system is added in the application system, and a user installs an enhanced identity authentication system client on a smart mobile terminal thereof; Step 2. On the enhanced identity authentication system client, an asymmetric key pair or an identity private key corresponding to a mobile phone number or an email address associated with an account is installed, and the enhanced identity authentication system client and the enhanced identity authentication system associate the mobile phone number or the email address of the user with the public key of the user through a secure method or the enhanced identity authentication system client needs to download the identity corresponding private key from a key generation center of an identity password system, the enhanced identity authentication system is the key generation center or accepts identity system parameters and identity private keys generated by the key generation center; Step 3. The user uses a browser to request access to a login page of the application system; Step 4. After the enhanced identity authentication system obtains the user access request, the enhanced identity authentication system determines whether the request is a login access request, and if the determination result is a login access request, the enhanced identity authentication system returns a user login page simulating the application system, wherein the login page further includes at least a two-dimensional code picture in addition to the content of the original application system login page, and the login page further includes an enhanced authentication button for a terminal using a smart terminal to access, wherein the two-dimensional code picture contains a submitted authentication URL address and a randomly generated challenge value C, the enhanced authentication button is associated with a protocol link that can be processed by the enhanced identity authentication system client, and the protocol link contains the submitted authentication URL address and the randomly generated challenge value C, if the login page contains the two-dimensional code picture, step 5 is entered, if the login page contains the enhanced authentication button, step 6 is entered, and if the determination result is a non-login access request, step 11 is entered; Step 5. The user scans the two-dimensional code by using the enhanced identity authentication system client on the smart mobile terminal, the enhanced identity authentication system client performs a signature operation on the challenge value C by using the private key installed in step 2 after obtaining the authentication URL address in the picture and the randomly generated challenge value C, and after the signature operation is completed, the enhanced identity authentication system client submits the signature result V and the ID associated with the signature private key to the obtained authentication URL address; Step 6.When the user uses the smart mobile terminal to access the login page, the user clicks the enhanced authentication button, which causes the operating system on the smart device to call the enhanced identity authentication system client and submit the authentication URL address and the randomly generated challenge value C information to the enhanced identity authentication system client. The enhanced identity authentication system client uses the private key installed in step 2 to perform a signature operation on the challenge value C. After the signature is completed, the enhanced identity authentication system client submits the signature result V and the ID associated with the signature private key to the obtained authentication URL address. In step 7, the signature verification module of the enhanced identity authentication system corresponding to the authentication URL address obtains the random challenge value C, the signature result V, and the ID associated with the signature private key, and checks whether the signature result V is legal. If the signature is legal, the random challenge value C and the ID associated with the signature private key are recorded, and the user is returned a successful verification state. Otherwise, a verification failure state is returned. In step 8, the user submits the username and password through the login page. In step 9, the enhanced identity authentication system checks whether the session has passed the enhanced identity authentication. If the session has passed the enhanced identity authentication, the username and password are submitted to the application system. If the session has not passed the enhanced identity authentication, the user request is rejected, and an error is returned or the login page is jumped to. In step 10, the application system detects the username and password. If the detection is successful, a successful result is returned. Otherwise, a failure result is returned. The enhanced identity authentication system checks the return result of the application system. If the return result is a successful result, the session identification information with the session ID number or the COOKIE value in the result is recorded. The enhanced identity authentication system forwards the return result of the application system to the user browser. In step 11, the enhanced identity authentication system checks the non-login request sent to the application system. If the request does not contain the session ID number or the COOKIE value, the request is rejected and is not forwarded to the application system or the login page is jumped to. If the request contains the session ID number or the COOKIE value, it is checked whether the session ID number or the COOKIE value is in the record in step 10. If the session ID number or the COOKIE value is not in the record, the request is rejected and is not forwarded to the application system or the login page is jumped to.
[0048] In step 2, in the process of associating with the public key or downloading the private key, the enhanced identity authentication system client submits the device identification code D of the mobile terminal to the enhanced identity authentication system, and the device identification code is any identification information associated with the device and having uniqueness; in steps 5 and 6, the signed content further includes the device identification code of the device, and the data submitted to the obtained authentication URL address further includes the device identification code or the irreversible transformation I of the device identification code in addition to the signature result and the ID associated with the signature private key; in step 7, the enhanced identity authentication system corresponding to the authentication URL address needs to check whether the device identification code used for signature matches the user association before verifying the signature; if the submitted data includes the device identification code, it is checked whether the device identification code matches a certain device identification associated with the user, if it is a device identification code transformation, all device identifications associated with the user can be traversed and transformed, and then it is checked whether the transformation of a device identification code is the same as the data in the record, so as to obtain the corresponding device identification code, if the device identification code fails to match, a verification failure state is returned, and if the matching succeeds, the matched device identification code is used to participate in the verification of the signature result. After step 7 is completed, the enhanced identity authentication system client notifies the enhanced identity authentication system that the signature containing the challenge value C is passed, and the enhanced identity authentication system queries the record result of step 7 after receiving the notification, including whether the record contains C and whether the ID of the signature private key associated in the record matches the user name, if all checks pass, it means that the enhanced identity authentication passes, and the client browser can be notified that the enhanced identity authentication is successful. The login page returned in step 4 can include a signature authentication state timing query function, which instructs the enhanced identity authentication system to query whether the signature containing the challenge value C passes the verification at a timing, and the enhanced identity authentication system queries the record result of step 7 after receiving the query request, including whether the record contains C and whether the ID of the signature private key associated in the record matches the user name, if all checks pass, it means that the enhanced identity authentication passes, and the client browser can be notified that the enhanced identity authentication is successful.
[0049] The above embodiment solves the problem in the related art that the accuracy of determining whether a user's behavior in a network link is abnormal behavior is to be improved, thereby improving the accuracy of abnormal behavior determination to a certain extent.
[0050] In the embodiment, an electronic device is provided, including a memory and a processor, the memory stores a computer program, and the processor is configured to run the computer program to execute the method in the above embodiment.
[0051] The above-described processes can be implemented on a processor, or can be stored in a memory (or referred to as a computer readable medium), which includes permanent and non-permanent, removable and non-removable media, and can be implemented by any method or technology to store information. The information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible by a computing device.
[0052] These computer programs can also be loaded into a computer or other programmable data processing device, so that a series of operation steps are performed on the computer or other programmable device to generate a computer implemented process, so that the instructions executed on the computer or other programmable device provide a process for implementing the flow Figure 1 The flow or multiple flows and / or the functions of the block Figure 1 The steps of the function specified in one or more blocks or multiple blocks correspond to different steps, which can be implemented by different modules.
[0053] Such a device or system is provided in the present embodiment. The system is referred to as a link-based behavior anomaly judgment processing system, which comprises: a first acquisition module configured to acquire a first link established by a user through a client and a server to provide a service, and to acquire the behavior of the user on the first link; a second acquisition module configured to acquire a group in which the first link is located, wherein the group is established according to the attributes of the links, and links with similar attributes meeting predetermined conditions are grouped into the same group; a third acquisition module configured to acquire the user behaviors that have occurred on all links in the group; and a processing module configured to judge whether the behavior on the first link is an abnormal behavior according to the behavior on the first link and the user behaviors that have occurred on all links in the group.
[0054] The system or device is used to realize the functions of the method in the above-described embodiments. Each module in the system or device corresponds to each step in the method, which has been described in the method and will not be repeated here.
[0055] Optionally, the processing module is configured to: determine a behavior that has occurred on each of the links, and a feature of the behavior that has occurred on each of the links, wherein the feature comprises at least one of: a time of access, a behavior target, a frequency, a number of times, wherein the behavior target comprises at least one of: a target URL of access, a table in a database of access, a SQL of execution; determine, according to the feature of the behavior, a behavior that will have occurred on each of the links, and determine the behavior that will have occurred on each of the links as a normal behavior; determine whether the behavior on the first link belongs to the normal behavior, and if not, determine that the behavior is an abnormal behavior.
[0056] Optionally, the second obtaining module is configured to: obtain attributes of the links to be grouped, wherein the attributes comprise at least one of: a source network address, a destination network address, a destination port number, an account used by an access behavior that has occurred on the link; group links with at least one same attribute into a same group.
[0057] Optionally, the second obtaining module is configured to: obtain attributes of the links to be grouped, input the attributes of the links to be grouped and behaviors that have occurred on the links to be grouped into a neural network model for clustering; and obtain the links grouped from the neural network model.
[0058] The above embodiments solve the problem in the related art that the accuracy of determining whether a behavior of a user in a network link is abnormal is to be improved, thereby improving the accuracy of abnormal behavior determination to a certain extent.
[0059] The above merely describes the embodiments of the present application, but is not intended to limit the present application. The present application can have various modifications and changes for those skilled in the art. Any modification, equivalent replacement, improvement, etc. within the spirit and principles of the present application shall be included in the scope of claims of the present application.
Claims
1. A link-based behavior abnormality judgment and processing method, characterized in that: include: Acquire a first link established by a user through a client and a service provided by a server, and acquire behavior of the user on the first link; Obtaining a group to which the first link belongs, wherein the group is established based on attributes of the links, and links whose attribute similarity meets a predetermined condition are grouped into the same group; Obtain user behaviors that occurred on all links in the group; Whether the behavior on the first link is abnormal behavior is determined according to the behavior on the first link and user behaviors that have occurred on all links in the group.
2. The method according to claim 1, characterized in that Determining whether the behavior on the first link is abnormal behavior includes: Determine the behavior that has occurred on each link of all the links, and the characteristics of the behavior that occurred on each link, wherein the characteristics include at least one of the following: access time, behavior target, frequency, and number of times, wherein the behavior target includes at least one of the following: a target URL visited, a table in a database visited, and an executed SQL; According to the characteristics of the behavior, it is determined that the behavior has occurred on each link, and the behavior that has occurred is determined to be normal behavior; It is determined whether the behavior on the first link belongs to the normal behavior; if not, the behavior is determined to be abnormal behavior.
3. The method according to claim 1, characterized in that Grouping links whose attribute similarity meets predetermined conditions into the same group includes: Acquire attributes of the links to be grouped, wherein the attributes include at least one of the following: a source network address, a destination network address, a destination port number, and an account used for access behavior occurring on the link; Links having at least one of the same attributes are grouped into the same group.
4. The method according to claim 1, characterized in that Grouping links whose attribute similarity meets predetermined conditions into the same group includes: Acquiring attributes of links to be grouped, and inputting the attributes of the links to be grouped and behaviors that have occurred on the links to be grouped into a neural network model for clustering; The grouped links are obtained from the neural network model.
5. A link-based behavior abnormality judgment and processing system, characterized in that: include: A first acquisition module, configured to acquire a first link established by a user through a client and a service provided by a server, and acquire behavior of the user on the first link; a second acquisition module, configured to acquire a group to which the first link belongs, wherein the group is established based on attributes of the links, and links whose attribute similarity meets a predetermined condition are grouped into the same group; A third acquisition module is used to acquire user behaviors that have occurred on all links in the group; The processing module is configured to determine whether the behavior on the first link is abnormal behavior based on the behavior on the first link and user behaviors that have occurred on all links in the group.
6. The system according to claim 5, characterized in that The processing module is used for: Determine the behavior that has occurred on each link of all the links, and the characteristics of the behavior that occurred on each link, wherein the characteristics include at least one of the following: access time, behavior target, frequency, and number of times, wherein the behavior target includes at least one of the following: a target URL visited, a table in a database visited, and an executed SQL; According to the characteristics of the behavior, it is determined that the behavior has occurred on each link, and the behavior that has occurred is determined to be normal behavior; It is determined whether the behavior on the first link belongs to the normal behavior; if not, the behavior is determined to be abnormal behavior.
7. The system according to claim 5, characterized in that The second acquisition module is used for: Acquire attributes of the links to be grouped, wherein the attributes include at least one of the following: a source network address, a destination network address, a destination port number, and an account used for access behavior occurring on the link; Links having at least one of the same attributes are grouped into the same group.
8. The system according to claim 5, characterized in that The second acquisition module is used for: Acquiring attributes of links to be grouped, and inputting the attributes of the links to be grouped and behaviors that have occurred on the links to be grouped into a neural network model for clustering; The grouped links are obtained from the neural network model.
9. An electronic device comprising a memory and a processor; wherein: The memory is configured to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the method steps according to any one of claims 1 to 4.
10. A readable storage medium having computer instructions stored thereon, wherein: When the computer instructions are executed by a processor, the method steps according to any one of claims 1 to 4 are implemented.