User abnormal behavior identification and control method and device, and electronic equipment

Abstract

The invention discloses a user abnormal behavior recognition and control method and device and electronic equipment, and relates to the technical field of application security, and the method comprises the steps: carrying out the feature extraction of log data of a business system; the extracted target features are detected through a preset rule, the behavior risk level of the target user is obtained, and the preset rule comprises user behavior thresholds predetermined based on L preset statistical algorithms; determining a management and control strategy based on the behavior risk level and the historical management and control record; the access behavior of the target user is managed and controlled through an interceptor corresponding to the management and control strategy, and the interceptor is used for executing at least one of the following management and control measures: generating early warning information; performing access behavior flow limiting; intercepting the verification code; the user permission is forbidden; and disabling the user account. According to the method and the device, the technical problems of poor effect of managing and controlling the abnormal behavior of the user based on a single and fixed management and control strategy and low safety of a service system in the prior art are solved.

Description

Technical Field

[0001] This application relates to the field of application security technology, and more specifically, to a method, apparatus, and electronic device for identifying and controlling abnormal user behavior. Background Technology

[0002] In the current network environment, data security and integrity face enormous challenges. Malicious users exploit automated tools to gain unauthorized access to systems and scrape data. This not only infringes on the rights of data owners but also severely impacts system stability and performance. Effectively identifying and controlling abnormal user access to business systems is a hot topic in the industry. However, with the continuous evolution of attackers' methods and the increasing complexity of user behavior patterns, existing technologies still have room for improvement in terms of real-time performance, accuracy, and guidance capabilities. Specifically:

[0003] (1) Poor real-time performance: Existing technologies often use batch data processing instead of streaming computing, which makes it impossible for the system to respond to abnormal behavior in real time. For example, some systems need to run analysis tasks periodically instead of continuously monitoring the data stream, thus failing to identify and respond to abnormal events in a timely manner.

[0004] (2) Single control strategy and insufficient guidance: Existing technologies control abnormal user access behavior through fixed static control strategies, which has the technical problems of poor effect and low security of business systems.

[0005] There is currently no effective solution to the above problems. Summary of the Invention

[0006] This application provides a method, apparatus, and electronic device for identifying and controlling abnormal user behavior, in order to at least solve the technical problems of poor effectiveness and low security of business systems in controlling abnormal user behavior based on a single and fixed control strategy in the prior art.

[0007] According to one aspect of this application, a method for identifying and controlling abnormal user behavior is provided, comprising: extracting features from log data of a business system to obtain target features, wherein the target features include at least the access behavior characteristics of a target user to the business system and the business data characteristics that the target user needs to process; detecting the target features using preset rules to obtain the behavioral risk level of the target user, wherein the preset rules are used to characterize the baseline information of user behavior accessing the business system by users with risk-free operations within a historical time period; determining the control strategy for the target user based on the behavioral risk level and historical control records, wherein the historical control records include historical control strategies issued to the target user at historical times; and controlling the access behavior of the target user through an interceptor corresponding to the control strategy of the target user, wherein the interceptor is used to perform at least one of the following control measures:

[0008] Generate early warning information;

[0009] Access rate limiting;

[0010] CAPTCHA interception;

[0011] User privileges are disabled;

[0012] User account disabled.

[0013] Optionally, before feature extraction from the real-time collected logs, the method for identifying and controlling abnormal user behavior further includes: deploying a first component on the business system's server, wherein the first component is used to monitor changes in the business system's log files in real time; collecting new logs from the log files through the first component and transmitting the collected new logs to a second component, wherein the second component is a pre-defined distributed stream processing platform; transmitting the new logs to a third component for processing through the second component, wherein the third component is at least used for data parsing and format conversion operations on the new logs; and transmitting the log data in a pre-defined format obtained by the third component to a fourth component for storage, wherein the fourth component is at least used for indexing the log data.

[0014] Optionally, before detecting target features using preset rules, the method for identifying and controlling abnormal user behavior further includes: collecting historical log data from the fourth component, wherein the historical log data is used to record user access to the business system behavior information within a historical time period without risk; extracting features from the historical log data to obtain a first feature, a second feature, and a third feature, wherein the first feature is used to characterize the frequency of user access to the business system, the second feature is used to characterize the time period distribution of user access to the business system, and the third feature is the business data feature that the user needs to handle when accessing the business system; and determining preset rules based on the first feature, the second feature, and the third feature.

[0015] Optionally, the step of determining preset rules based on the first feature, the second feature, and the third feature includes: inputting the first feature, the second feature, and the third feature into a statistical model, wherein the statistical model includes at least L preset statistical algorithms, where L is a positive integer; analyzing the first feature, the second feature, and the third feature based on the L preset statistical algorithms in the statistical model to obtain L preset rules corresponding to the L preset statistical algorithms.

[0016] Optionally, the step of detecting target features using preset rules to obtain the behavioral risk level of the target user includes: determining the business level and the preset rules corresponding to the target features based on the business data features in the target features, wherein the business level is used to characterize the level of the business that the target user needs to handle and the sensitivity of the user information to be collected for handling the business; detecting the target features based on the preset rules corresponding to the target features to obtain a behavioral risk score, wherein the behavioral risk score is used to characterize the degree of deviation between the target features and the user behavior threshold in the corresponding preset rules; and determining the behavioral risk level of the target user based on the business level and the behavioral risk score.

[0017] Optionally, the step of determining the control strategy for the target user based on the target user's behavioral risk level and historical control records includes: determining a first preset strategy based on the target user's behavioral risk level, and counting the number of times the first preset strategy appears in the target user's historical control records; if the number of occurrences is less than or equal to a preset number, using the first preset strategy as the target user's control strategy; if the number of occurrences is greater than the preset number, using a second preset strategy as the target user's control strategy, wherein the priority of the second preset strategy is higher than the priority of the first preset strategy.

[0018] Optionally, the step of controlling the access behavior of the target user through the interceptor corresponding to the control policy of the target user includes: when M control policies need to be implemented, sorting the M control policies according to the priority of each control policy to obtain a policy sorting sequence, where M is a positive integer greater than or equal to 2; and controlling the access behavior of the target user through the interceptor corresponding to each control policy based on the execution order corresponding to the policy sorting sequence.

[0019] According to another aspect of this application, a device for identifying and controlling abnormal user behavior is also provided, comprising: a first extraction unit, configured to extract features from log data of a business system to obtain target features, wherein the target features include at least the access behavior features of a target user to the business system and the business data features that the target user needs to process; a detection unit, configured to detect the target features using preset rules to obtain the behavioral risk level of the target user, wherein the preset rules are used to characterize the baseline information of user behavior accessing the business system by users with risk-free operations within a historical time period; a first determination unit, configured to determine the control strategy for the target user based on the behavioral risk level of the target user and historical control records, wherein the historical control records include historical control strategies issued to the target user at historical times; and a control unit, configured to control the access behavior of the target user through an interceptor corresponding to the control strategy of the target user, wherein the interceptor is used to execute at least one of the following control measures:

[0020] Generate early warning information;

[0021] Access rate limiting;

[0022] CAPTCHA interception;

[0023] User privileges are disabled;

[0024] User account disabled.

[0025] According to another aspect of this application, a computer program product is also provided, which stores a computer program, wherein a method for identifying and controlling abnormal user behavior that controls the computer program product to perform any of the above-mentioned actions during the execution of the computer program is provided.

[0026] According to another aspect of this application, an electronic device is also provided, wherein the electronic device includes one or more processors and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method for identifying and controlling abnormal user behavior as described above.

[0027] In this application, feature extraction is first performed on the log data of the business system to obtain target features. These target features include at least the target user's access behavior characteristics to the business system and the business data characteristics that the target user needs to process. Next, the application uses preset rules to detect the target features and obtain the target user's behavioral risk level. These preset rules characterize the baseline information of user behavior accessing the business system by users with risk-free operations within a historical time period. Then, based on the target user's behavioral risk level and historical control records, the application determines the target user's control strategy. These historical control records include historical control strategies issued to the target user at historical moments. Finally, the application uses an interceptor corresponding to the target user's control strategy to control the target user's access behavior. The interceptor executes at least one of the following control measures:

[0028] Generate early warning information;

[0029] Access rate limiting;

[0030] CAPTCHA interception;

[0031] User privileges are disabled;

[0032] User account disabled.

[0033] As can be seen from the above, this application adopts a combination of real-time log analysis and intelligent control strategies. By extracting features and detecting the extracted target features based on preset rules, it achieves the goal of accurately assessing the risk level of user behavior, thereby realizing the technical effect of dynamically adjusting the control strategy based on the risk level of user behavior.

[0034] Specifically, this application first extracts features from the log data of the business system to obtain target features, including user access behavior features and business data features, in order to comprehensively reflect the user's operation mode. Then, this application uses preset rules to detect these features, assesses the user's behavioral risk level based on the behavioral baseline established by historical risk-free operations, and dynamically determines the control strategy to be adopted for the target user based on the risk level and historical control records, thus avoiding the limitations of a single static strategy.

[0035] Furthermore, the control strategy in this application is implemented through an interceptor in the business system. The interceptor supports a variety of control measures, such as generating early warning information, limiting access behavior, blocking CAPTCHAs, disabling user permissions, or disabling user accounts. This multi-level and dynamically adjusted control strategy can more accurately match abnormal user access behavior, thereby improving the effectiveness of controlling abnormal user behavior. This solves the technical problems of poor effectiveness and low security of business systems in controlling abnormal user behavior based on a single and fixed control strategy in the prior art. Attached Figure Description

[0036] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0037] Figure 1 This is a flowchart of an optional method for identifying and controlling abnormal user behavior according to an embodiment of this application;

[0038] Figure 2 This is a component diagram of an optional user abnormal behavior identification and control system according to an embodiment of this application;

[0039] Figure 3 This is a component diagram of an optional control module according to an embodiment of this application;

[0040] Figure 4 This is a component diagram of an optional detection module according to an embodiment of this application;

[0041] Figure 5 This is a flowchart of an optional log collection method according to an embodiment of this application;

[0042] Figure 6 This is a schematic diagram of an optional statistical model according to an embodiment of this application;

[0043] Figure 7 This is a diagram illustrating an optional verification code blocking effect according to an embodiment of this application;

[0044] Figure 8 This is a schematic diagram of an optional user abnormal behavior identification and control device according to an embodiment of this application;

[0045] Figure 9 This is a schematic diagram of an optional electronic device according to an embodiment of this application. Detailed Implementation

[0046] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0047] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0048] It should also be noted that all relevant information (including login information of target users and relevant information about system resources) and data (including but not limited to data used for display and analysis) involved in this application are information and data authorized by the user or fully authorized by all parties. For example, if there is an interface between this system and relevant users or organizations, before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned users or organizations through the interface, and obtain the relevant information only after receiving consent from the aforementioned users or organizations.

[0049] Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of relevant information and data involved in this application all comply with the relevant laws, regulations, and standards of the relevant regions, and necessary confidentiality measures have been taken. This application does not violate public order and good morals. In addition, this application provides a corresponding operation entry point for users to choose to agree to or refuse authorization. If the user chooses to refuse authorization, the corresponding expert decision-making process will be initiated.

[0050] This application aims to address the problem of identifying and controlling abnormal user access behavior. It proposes a behavior identification and control method that meets real-time requirements, improves identification accuracy, and provides guidance. This method improves the accuracy of identifying abnormal user behavior based on rule-based and statistical detection methods, and uses streaming computing technology to ensure real-time identification. Furthermore, this application achieves precise control by implementing hierarchical control at each level and combining it with dynamic adjustment strategies, thereby solving the technical problems of poor effectiveness in controlling abnormal user behavior and low security of business systems in existing technologies.

[0051] The technical terms used in this application are explained as follows:

[0052] Rate limiting: At the application level, rate limiting can be used to control the frequency of users using specific functions in order to ensure the stability and response speed of the application.

[0053] Streaming computing: Streaming computing is a computing model used to process continuous, real-time data streams. Unlike traditional batch processing, streaming computing does not require storing data and waiting for batch processing. Instead, it processes and analyzes data in real time to achieve rapid response and decision-making.

[0054] Mean Squared Deviation (MSD): MSD is a statistical concept used to measure the degree of difference between a set of data points and their mean. It is achieved by calculating the square of the difference between each data point and the mean, and then averaging these squared differences. MSD quantifies the dispersion of data, that is, the extent to which data points fluctuate around the mean.

[0055] Standard deviation: Standard deviation is a statistic that measures the dispersion of a set of data points. It indicates the degree of deviation between the values ​​in the dataset and the mean. The larger the standard deviation, the more dispersed the data distribution; the smaller the standard deviation, the more concentrated the data distribution.

[0056] According to an embodiment of this application, an embodiment of a method for identifying and controlling abnormal user behavior is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0057] This application provides a user abnormal behavior identification and control system (hereinafter referred to as the control system) for implementing the user abnormal behavior identification and control method in this application. Figure 1 This is a flowchart of an optional method for identifying and controlling abnormal user behavior according to an embodiment of this application, such as... Figure 1 As shown, the method includes the following steps:

[0058] Step S101: Extract features from the log data of the business system to obtain target features. The target features include at least the access behavior features of the target user to the business system and the business data features that the target user needs to process.

[0059] Optionally, access behavior characteristics are used to characterize at least the frequency and timing of a target user's access to the business system.

[0060] Optionally, business data features are used at least to characterize the type of business request and business data information initiated by the target user to the business system.

[0061] Optionally, through feature extraction, the control system can focus on truly meaningful log information, thereby improving the efficiency and accuracy of subsequent feature analysis and achieving fine-grained detection of user behavior patterns.

[0062] Step S102: Detect target features using preset rules to obtain the behavioral risk level of the target user. The preset rules are used to characterize the baseline information of user behavior when accessing the business system without risk in the historical time period.

[0063] Optionally, the control system uses statistical algorithms based on statistical models to collect and analyze user access behavior information of risk-free operations within historical time periods, identify the characteristics of normal user behavior and corresponding user access patterns, and establish a user behavior baseline.

[0064] Optionally, the control system selects a suitable preset rule for the target feature based on the characteristics of business data. Then, it detects the target feature based on the user behavior baseline information corresponding to the preset rule to assess whether the target user's behavior deviates from the normal range, thereby deriving the behavior risk level. The behavior risk level is a quantitative indicator that reflects the degree of abnormality of user behavior.

[0065] Optionally, the control system detects target features based on preset rules to obtain the target user's behavioral risk level. Then, the control system compares the behavioral risk level with the preset level. If the target user's behavioral risk level is greater than or equal to the preset level, the control system identifies the target user's access to the business system as abnormal access behavior.

[0066] Optionally, by detecting target features through preset rules, the system can obtain the behavioral risk level of target users, thereby making a more precise judgment on which user access behaviors may pose a threat, thus reducing the false alarm rate and improving the scientificity and effectiveness of behavior control decisions.

[0067] Step S103: Based on the target user's behavioral risk level and historical control records, determine the target user's control strategy. The historical control records include historical control strategies issued to the target user at historical moments.

[0068] Optionally, the control strategy corresponds one-to-one with the control measures executed by the interceptor, and the control strategy serves as the identifier for the control measures.

[0069] Optionally, the historical control records include multiple control measures implemented on the target user at historical moments and the control effects of each control measure.

[0070] Optionally, by combining behavioral risk levels and historical control records, the control system can intelligently make decisions to obtain control strategies suitable for the current situation, thereby ensuring that control measures match the risks. In particular, the strategy adjustment based on behavioral risk levels and historical control records can achieve dynamic and intelligent control, avoiding the rigidity of a single fixed strategy, improving the flexibility and efficiency of control, reducing the impact on normal users, and enhancing the control system's ability to control abnormal user behavior.

[0071] Step S104: Control the access behavior of the target user through the interceptor corresponding to the control policy of the target user, wherein the interceptor is used to perform at least one of the following control measures:

[0072] Generate early warning information;

[0073] Access rate limiting;

[0074] CAPTCHA interception;

[0075] User privileges are disabled;

[0076] User account disabled.

[0077] Optionally, interceptors exist in a chain within the management system, serving as a series of processing units within the business system. Interceptors intervene in user access behavior based on defined management policies. For example, if the management policy is a rate-limiting policy, the interceptor will limit the number of user requests per unit time; if it is a CAPTCHA interception policy, the interceptor will require users to enter CAPTCHAs when accessing specific functions; if it is a user permission disabling policy / user account disabling policy, the interceptor will directly restrict users' partial / full access to the system until the abnormal state is resolved.

[0078] Optionally, by implementing control measures through interceptors, the control system can respond to and handle abnormal access behavior in real time, thereby effectively protecting the stability and data security of the business system. This method not only increases the protection against abnormal user access behavior, but also reduces the impact on legitimate users through precise real-time control measures, thus improving the overall user experience of the business system.

[0079] As can be seen from the above, this application adopts a combination of real-time log analysis and intelligent control strategies. By extracting features and detecting the extracted target features based on preset rules, it achieves the goal of accurately assessing the risk level of user behavior, thereby realizing the technical effect of dynamically adjusting the control strategy based on the risk level of user behavior.

[0080] Specifically, this application first extracts features from the log data of the business system to obtain target features, including user access behavior features and business data features, in order to comprehensively reflect the user's operation mode. Then, this application uses preset rules to detect these features, assesses the user's behavioral risk level based on the behavioral baseline established by historical risk-free operations, and dynamically determines the control strategy to be adopted for the target user based on the risk level and historical control records, thus avoiding the limitations of a single static strategy.

[0081] Furthermore, the control strategy in this application is implemented through an interceptor in the business system. The interceptor supports a variety of control measures, such as generating early warning information, limiting access behavior, blocking CAPTCHAs, disabling user permissions, or disabling user accounts. This multi-level and dynamically adjusted control strategy can more accurately match abnormal user access behavior, thereby improving the effectiveness of controlling abnormal user behavior. This solves the technical problems of poor effectiveness and low security of business systems in controlling abnormal user behavior based on a single and fixed control strategy in the prior art.

[0082] In one alternative embodiment, Figure 2 This is a component diagram of an optional user abnormal behavior identification and control system according to an embodiment of this application, such as... Figure 2 As shown, the control system includes: a detection module, a control module, and a log storage service module (corresponding to...). Figure 2 (Log storage service in China).

[0083] Optionally, the control module is at least used for collecting and transmitting log data and taking control measures based on abnormal access behavior identified by the detection module. Figure 3 This is a component diagram of an optional control module according to an embodiment of this application, such as... Figure 3 As shown, the control module is responsible for collecting log data corresponding to the target user. The log data is used to record the target user's behavior information when accessing the business system.

[0084] Furthermore, the control module constructs a control interceptor chain in the business system to record and intercept user behavior. The control interceptor chain supports multiple control measures, including early warning, rate limiting, CAPTCHA, and permission disabling. It also adopts a multi-level control based on a hierarchical strategy to achieve customized control of abnormal user behavior. After the user provides relevant verification information based on the control measures / the control status is lifted, the target user can enter the normal business logic process of the business system.

[0085] Optionally, the detection module combines rule-based intelligent control to ensure the matching degree between control measures and abnormal behavior. By locking the access source to implement precise control, the application scope of control measures is limited, thus forming a multi-layered defense system that complements and coordinates with each other.

[0086] Optionally, the detection module is at least used to identify abnormal user access behavior and to send control notifications to the management module (i.e., to notify the management module to take measures against abnormal behavior). Figure 4 This is a component diagram of an optional detection module according to an embodiment of this application, such as... Figure 4 As shown, the detection module (i.e. Figure 4 The analysis module includes three stages: abnormal behavior analysis based on preset rules in the rule base, abnormal behavior recording, and control notification issuance.

[0087] Optionally, the detection module aims to improve the real-time performance of the identification process and the accuracy of abnormal behavior identification results. To improve real-time performance, the detection module adopts streaming computing technology, enabling the control system to respond quickly and analyze user behavior. Furthermore, the control system combines rule-based detection methods with statistical detection methods to improve the effectiveness of the identification results.

[0088] In one optional embodiment, before feature extraction from the real-time collected logs, the management and control system pre-deploys a first component on the business system's server. The first component is used to monitor changes in the business system's log files in real time. Then, the management and control system collects new logs from the log files through the first component and transmits the collected new logs to a second component, which is a pre-defined distributed stream processing platform. The management and control system then transmits the new logs to a third component for processing through the second component. The third component is at least used for data parsing and format conversion of the new logs. Finally, the management and control system transmits the log data in a pre-defined format obtained from the processing by the third component to a fourth component for storage. The fourth component is at least used for indexing the log data.

[0089] Optionally, the first component can be set to FileBeat (an open-source log collection tool). The first component is deployed on the server of the business system and is responsible for continuously monitoring and detecting any additions or changes in the log files, thereby ensuring that the management system can capture the user's operation logs as soon as possible, improving the response speed for subsequent user behavior analysis and management.

[0090] Optionally, the second component can be set to Kafka (an open-source message publish-subscribe system and stream processing platform). As a high-throughput message queue, Kafka can efficiently receive, cache, and forward log data collected by the log collector and transmit it to the downstream third component. Using the second component for log data processing not only improves the efficiency of log data transmission but also ensures the reliability and consistency of log data during transmission. Even when faced with massive amounts of log data, the second component can maintain stable log collection performance, thereby providing a continuous data stream foundation for subsequent real-time analysis and control measures.

[0091] Optionally, the third component can be set as LogStash (an open-source data collection pipeline). This component receives new logs from the second component, performs necessary data parsing to extract key information and fields, and then performs format conversion to obtain a JSON (JavaScript Object Notation, a lightweight data exchange format). The obtained JSON object is then passed to the downstream fourth component. Through data parsing and format conversion, the third component transforms the raw log data into a preset format that can be analyzed, ensuring the consistency of the log data format to be analyzed, reducing the complexity of subsequent data analysis, and laying the data foundation for high-performance data storage.

[0092] Optionally, the fourth component can be set to Elasticsearch (ES for short, an open-source full-text search and analysis engine). It is the core component for log storage and retrieval. Log data in a pre-formatted format is transmitted to it for storage. Elasticsearch indexes this data and creates an inverted index for fast retrieval, so that subsequent analysis modules can efficiently find and analyze the required data. Through indexing, the fourth component greatly improves the retrieval speed and flexibility of log data. Even when processing large-scale data, it can ensure a response time in seconds or even sub-seconds, thus providing dual protection for the management system in terms of security and performance.

[0093] Optionally, Figure 5 This is a flowchart of an optional log collection method according to an embodiment of this application, such as... Figure 5As shown, in order to meet the storage needs of massive logs and provide high-performance log query services, the log storage service is based on the ELK (Elasticsearch-Logstash-Kibana Stack, where Kibana Stack is a tool for data visualization and interactive exploration, enabling technical personnel to intuitively understand log data through charts, maps, etc.) technology stack. Specifically, the business system (App) records log data (Log4j) in a local file (LogFile). Then, FileBeat, deployed on each server, is responsible for collecting the log data and sending it to LogStash.

[0094] Optionally, LogStash performs processing and parsing operations on the logs, and then passes the processed JSON object to ElasticSearch for indexing before storing it in the database. To improve concurrency performance, the management system uses Kafka as a log transmission buffer, where the Kafka platform uses Msglog as the message collection for internal message storage and transmission.

[0095] Optionally, ElasticSearch uses inverted indexes, enabling sub-second search response times even with billions of data points, thus providing an efficient query interface for log analysis.

[0096] In summary, the log storage service module, based on the ELK technology stack, enables the storage and efficient retrieval of massive log data. ElasticSearch features a distributed architecture, fast retrieval, and efficient data aggregation capabilities, while LogStash supports efficient data transmission and preprocessing. These characteristics enable the ELK log storage solution to provide efficient storage and fast retrieval capabilities when handling massive log data.

[0097] In other words, the log storage service module, by deploying and integrating the aforementioned components (FileBeat, Kafka, LogStash, and ElasticSearch), achieves a complete process from real-time monitoring of log files, data collection, transmission, processing to storage. This not only improves the real-time performance and efficiency of data collection and processing, but also ensures data consistency and reliability through data parsing and format conversion. Finally, it achieves efficient data retrieval and analysis through indexing, thus providing strong technical support for the identification and control of abnormal user access behavior.

[0098] In an optional embodiment, before detecting target features using preset rules, the control system first collects historical log data from the fourth component. The historical log data records user access to the business system during a historical time period without risk. Then, the control system extracts features from the historical log data to obtain a first feature, a second feature, and a third feature. The first feature represents the frequency of user access to the business system, the second feature represents the time period distribution of user access to the business system, and the third feature represents the business data features that the user needs to handle when accessing the business system. Then, the control system determines preset rules based on the first feature, the second feature, and the third feature.

[0099] Optionally, historical log data refers to the normal user access behavior of the business system recorded within a specific historical period. Historical log data is considered risk-free. By collecting historical log data, the control system can obtain complete information on normal user operations, including access frequency, time period distribution, and business data characteristics, thereby providing user behavior benchmark information for subsequent abnormal behavior detection.

[0100] Optionally, feature extraction is a process of in-depth analysis of historical log data, aiming to extract key features that can characterize user behavior patterns from a large amount of log data. The first feature focuses on the frequency of user access to the business system, including but not limited to the number of user requests per unit time (i.e., request frequency); the second feature focuses on the time period distribution, i.e., the concentration and distribution pattern of user access time periods; and the third feature focuses on the characteristics of business data that need to be processed when users access the business system.

[0101] Optionally, the preset rules are based on the features extracted above (first feature, second feature, and third feature) and are used to distinguish between normal user behavior and abnormal user behavior. The preset rules take into account access frequency, time period distribution, and business data characteristics. The detection module in the control system identifies abnormal user behavior that exceeds the normal range by setting interval thresholds.

[0102] Optionally, the preset rules are based on a deep understanding of normal user behavior, which can effectively identify abnormal access patterns, improve the accuracy and intelligence of abnormal behavior detection, and by dynamically adjusting the rule thresholds, the control system can adapt to constantly changing attack patterns and business needs, improving the flexibility and effectiveness of security protection. At the same time, feature-based rule formulation can reduce the false alarm rate, thereby avoiding undue interference with normal user access behavior and improving user experience.

[0103] Optionally, in the steps corresponding to the above embodiments, the management and control system adopts streaming computing technology to ensure the real-time processing of log data. In terms of the selection of computing framework, Spark Streaming (a module for processing streaming data) is mainly selected in combination with high-performance components such as ELK and Kafka in the log storage service to complete the data analysis and storage. Specifically, after the data flows into ES, ES provides fast retrieval services, while Spark Streaming undertakes the task of real-time data processing and analysis, and can perform real-time calculation and feedback on the incoming data. Through the above steps, the management and control system improves the real-time processing capability of log data, making the storage and analysis process of massive log data of the management and control system more efficient.

[0104] In summary, by collecting historical log data from Elasticsearch and extracting its features, the control system can build a baseline model that reflects normal user behavior. Based on the features in the baseline model, preset rules can be formulated to improve the accuracy of abnormal behavior identification, while ensuring the intelligence and real-time nature of control measures, thereby enhancing the security and stability of the business system.

[0105] In one optional embodiment, the detection module in the control system first inputs the first feature, the second feature, and the third feature into the statistical model, wherein the statistical model includes at least L preset statistical algorithms, where L is a positive integer. Then, the detection module analyzes the first feature, the second feature, and the third feature based on the L preset statistical algorithms in the statistical model to obtain L preset rules corresponding to the L preset statistical algorithms.

[0106] Optionally, Figure 6 This is a schematic diagram of an optional statistical model according to an embodiment of this application, such as... Figure 6 As shown, the statistical detection method uses feature extraction from historical log data to identify the characteristics and patterns of user behavior, thereby establishing a baseline of normal user behavior. The detection module obtains behavior logs from Elasticsearch and selects key features (i.e., Figure 6 The system uses user access frequency, user access time period, and business data characteristic indicators to capture typical patterns and changes in user behavior. Then, it selects the corresponding statistical model (such as mean square deviation, standard deviation, and mean, corresponding to the above L preset statistical algorithms) for analysis based on the characteristics. Finally, it updates the rule threshold (i.e., user behavior threshold) of the preset rules based on the analysis results.

[0107] Optionally, by inputting multi-dimensional features into the statistical model, the control system can learn complex user behavior patterns from the data and identify the patterns of abnormal behavior. Compared with single-dimensional analysis, the comprehensive consideration of multiple features can more accurately reflect the whole picture of user behavior, reduce the false judgment rate, and improve the accuracy and reliability of identification.

[0108] Optionally, the L preset statistical algorithms represent a variety of different algorithms included in the statistical model, such as mean square error, mean, standard deviation, and trend analysis. Different algorithms are suitable for different feature analysis scenarios. In this embodiment, three features (first feature, second feature, and third feature) are fed into the L preset statistical algorithms for analysis, respectively, to obtain L preset rules. Each preset rule reflects the statistical model's specific understanding of user behavior features and threshold settings.

[0109] Optionally, the rule-based detection method in this embodiment identifies abnormal user behavior by pre-setting a series of pre-set rules, which include rules for user behavior in time, space and specific business scenarios.

[0110] Optionally, the application of L preset statistical algorithms enables the control system to conduct in-depth analysis of user behavior from different angles and methods, thereby obtaining a series of preset rules. These preset rules integrate the judgment of multiple statistical methods and can effectively cover various possible manifestations of abnormal behavior, thereby improving the comprehensiveness and accuracy of user abnormal behavior identification. At the same time, since the statistical model can be dynamically adjusted based on real-time data, this method also ensures the timeliness and adaptability of the preset rules, enabling the control system to maintain a relatively ideal identification effect when facing constantly changing attack patterns.

[0111] In one optional embodiment, the control system determines the business level and the preset rules corresponding to the target features based on the business data features in the target features. The business level is used to characterize the level of the business that the target user needs to handle and the sensitivity of the user information to be collected for handling the business. Then, the control system detects the target features based on the preset rules corresponding to the target features to obtain a behavioral risk score. The behavioral risk score is used to characterize the degree of deviation between the target features and the user behavior threshold in the corresponding preset rules. Finally, the control system determines the behavioral risk level of the target user based on the business level and the behavioral risk score.

[0112] Optionally, the business level is defined based on the business level and the sensitivity of user information. It can reflect the importance and risk level of business operations. By determining the business level through business data characteristics, the control system can customize and set preset rules based on the characteristics and risk level of the business, ensuring targeted identification and control of abnormal behaviors in different business scenarios. This method improves the intelligence and flexibility of the system, enabling the control system to more accurately assess and respond to abnormal access behaviors of different levels of business.

[0113] Optionally, the behavioral risk score is calculated based on the degree of deviation between the target characteristics and the preset rules. It reflects the potential abnormality of user behavior. The greater the deviation, the higher the behavioral risk score, which means that the user behavior may constitute a higher risk or a more serious abnormality. The introduction of the behavioral risk score enables the control system to quantitatively assess the risk level of user behavior, rather than simply comparing thresholds. This method can more accurately identify abnormal accesses that are close to normal behavior but still have potential risks, improve the sensitivity and accuracy of abnormal behavior identification, and at the same time reduce false alarms and false negatives.

[0114] Optionally, by combining business level and behavioral risk score to determine behavioral risk level, the control system can more comprehensively assess the potential impact of abnormal behavior and the necessity of control. This approach avoids the limitations of single-dimensional assessment, ensuring that control measures can not only protect critical business from abnormal access, but also be dynamically adjusted according to the actual risk level of user behavior, avoiding over-control of low-risk behavior and improving the accuracy of control measures and user experience.

[0115] In one optional embodiment, the control system determines a first preset strategy based on the behavioral risk level of the target user, and counts the number of times the first preset strategy appears in the target user's historical control records. Then, if the number of occurrences is less than or equal to a preset number, the control system uses the first preset strategy as the control strategy for the target user. If the number of occurrences is greater than the preset number, the control system uses a second preset strategy as the control strategy for the target user. The priority of the second preset strategy is higher than that of the first preset strategy.

[0116] Optionally, the control module in the control system dynamically adjusts strategies based on preset rules. The control system dynamically adjusts the matching degree of users, control measures, and functional guarantees according to real-time analysis data (the behavioral risk level of the target user) and historical trends (historical control records). When the control system identifies that a certain control measure (i.e., the control measure corresponding to the first preset strategy mentioned above) is no longer suitable for a certain user (for example, if a user is repeatedly identified by the system as having abnormal behavior, it will consider the current control measures to be too weak), it will dynamically increase the control intensity for that user in a targeted manner, that is, take more powerful (higher priority) control measures to counteract it, thereby realizing intelligent dynamic adjustment and optimization of user behavior control.

[0117] Optionally, by statistically analyzing the frequency of use of the first preset strategy, the control system can understand whether the strategy is effective for the target user. By dynamically adjusting the priority of the control strategy, the control system can take more powerful control measures for high-risk users, improving the efficiency and strength of security protection. At the same time, this adjustment mechanism ensures the intelligence of the control measures, enabling precise control based on the dynamic changes in the user's actual risk, and avoiding the problems of inefficient and repetitive strategy application.

[0118] Furthermore, the control system can implement precise control by locking the access source. The control system supports refined access control functions and can implement customized management policies based on user accounts, source IP addresses, and specific functional applications. When abnormal access behavior is detected, the business system will automatically trigger corresponding control measures.

[0119] For example, if the control measure is CAPTCHA verification, the system will only display the CAPTCHA to user accounts or IP addresses that are identified as exhibiting abnormal behavior, ensuring that normal access for other users is not affected. CAPTCHA verification only applies to functional modules where abnormal behavior is detected, without affecting users' normal use of other system functions. Through this precise control measure, the system can effectively restrict malicious access or abuse without interfering with normal users, thereby protecting the security of business system resources and data.

[0120] In one optional embodiment, when M control policies need to be implemented, the control system sorts the M control policies according to the priority of each control policy to obtain a policy sorting sequence, where M is a positive integer greater than or equal to 2. The control system controls the access behavior of the target user through the interceptor corresponding to each control policy, based on the execution order corresponding to the policy sorting sequence.

[0121] Optionally, the control system adopts a multi-level control strategy based on a hierarchical approach. Specifically, the control system integrates various control measures, including at least early warning, rate limiting (access frequency restriction), CAPTCHA, permission disabling, and account disabling. Figure 7 This is a diagram illustrating an optional verification code blocking effect according to an embodiment of this application.

[0122] Optionally, the control system adopts different levels of control based on the importance of business functions within the business system. Multi-level control strategies mainly include:

[0123] (1) Dynamic priority management: Each control measure is assigned a different priority according to its control intensity. When implementing control, the control system will apply control measures according to the preset priority order to ensure that measures with higher priority can be executed first.

[0124] (2) Functional importance classification: Business system functions are classified into different protection levels (corresponding to the above business levels) according to their business importance and sensitivity. Higher-level business functions will receive stricter control measures to ensure the stability and security of critical business processes.

[0125] Optionally, each control policy has its own specific priority, which can be set based on factors such as the severity of the policy, its impact on system performance, and its impact on user experience.

[0126] Optionally, by prioritizing the sorting, the system can ensure that when implementing multiple control policies, those policies that are critical to protecting system security and data integrity are executed first. This not only improves the efficiency of security control, but also ensures that the most urgent and important security issues can be addressed first when resources are limited, thus achieving effective control over business system risks.

[0127] As can be seen from the above, this application adopts a combination of real-time log analysis and intelligent control strategies. By extracting features and detecting the extracted target features based on preset rules, it achieves the goal of accurately assessing the risk level of user behavior, thereby realizing the technical effect of dynamically adjusting the control strategy based on the risk level of user behavior.

[0128] Specifically, this application first extracts features from the log data of the business system to obtain target features, including user access behavior features and business data features, in order to comprehensively reflect the user's operation mode. Then, this application uses preset rules to detect these features, assesses the user's behavioral risk level based on the behavioral baseline established by historical risk-free operations, and dynamically determines the control strategy to be adopted for the target user based on the risk level and historical control records, thus avoiding the limitations of a single static strategy.

[0129] Furthermore, the control strategy in this application is implemented through an interceptor in the business system. The interceptor supports a variety of control measures, such as generating early warning information, limiting access behavior, blocking CAPTCHAs, disabling user permissions, or disabling user accounts. This multi-level and dynamically adjusted control strategy can more accurately match abnormal user access behavior, thereby improving the effectiveness of controlling abnormal user behavior. This solves the technical problems of poor effectiveness and low security of business systems in controlling abnormal user behavior based on a single and fixed control strategy in the prior art.

[0130] According to another aspect of the embodiments of this application, a device for identifying and controlling abnormal user behavior is also provided. Figure 8 This is a schematic diagram of an optional user abnormal behavior identification and control device according to an embodiment of this application, such as... Figure 8As shown, the device for identifying and controlling abnormal user behavior includes: a first extraction unit 801, a detection unit 802, a first determination unit 803, and a control unit 804.

[0131] Optionally, the first extraction unit 801 is used to extract features from the log data of the business system to obtain target features, wherein the target features include at least the access behavior features of the target user to the business system and the business data features that the target user needs to process; the detection unit 802 is used to detect the target features through preset rules to obtain the behavioral risk level of the target user, wherein the preset rules are used to characterize the baseline information of user behavior of users accessing the business system without risk in historical time periods; the first determination unit 803 is used to determine the control strategy of the target user based on the behavioral risk level of the target user and historical control records, wherein the historical control records include historical control strategies issued to the target user at historical times; the control unit 804 is used to control the access behavior of the target user through the interceptor corresponding to the control strategy of the target user, wherein the interceptor is used to perform at least one of the following control measures:

[0132] Generate early warning information;

[0133] Access rate limiting;

[0134] CAPTCHA interception;

[0135] User privileges are disabled;

[0136] User account disabled.

[0137] In one optional embodiment, the device for identifying and controlling abnormal user behavior further includes: a component deployment unit, a first acquisition unit, a first transmission unit, and a second transmission unit.

[0138] Optionally, the component deployment unit is used to deploy a first component on the server of the business system, wherein the first component is used to monitor the changes of the log files of the business system in real time; the first collection unit is used to collect new logs from the log files through the first component and transmit the collected new logs to a second component, wherein the second component is a preset distributed stream processing platform; the first transmission unit is used to transmit the new logs to a third component for processing through the second component, wherein the third component is at least used to perform data parsing and format conversion operations on the new logs; the second transmission unit is used to transmit the log data in a preset format processed by the third component to a fourth component for storage, wherein the fourth component is at least used to perform indexing processing on the log data.

[0139] In one optional embodiment, the device for identifying and controlling abnormal user behavior further includes: a second acquisition unit, a second extraction unit, and a second determination unit.

[0140] Optionally, the second acquisition unit is used to acquire historical log data from the fourth component, wherein the historical log data is used to record user access behavior information of the business system within a historical time period without risk; the second extraction unit is used to extract features from the historical log data to obtain a first feature, a second feature, and a third feature, wherein the first feature is used to characterize the frequency of user access to the business system, the second feature is used to characterize the time period distribution of user access to the business system, and the third feature is the business data feature that the user needs to handle when accessing the business system; the second determination unit is used to determine preset rules based on the first feature, the second feature, and the third feature.

[0141] In one alternative embodiment, the second determining unit includes an input subunit and a feature analysis subunit.

[0142] Optionally, an input subunit is used to input the first feature, the second feature, and the third feature into a statistical model, wherein the statistical model includes at least L preset statistical algorithms, where L is a positive integer; a feature analysis subunit is used to analyze the first feature, the second feature, and the third feature based on the L preset statistical algorithms in the statistical model to obtain L preset rules corresponding to the L preset statistical algorithms.

[0143] In one optional embodiment, the detection unit 802 includes: a first determining subunit, a detection subunit, and a second determining subunit.

[0144] Optionally, the first determining subunit is used to determine the business level and the preset rules corresponding to the target feature based on the business data features in the target feature, wherein the business level is used to characterize the level of the business that the target user needs to handle and the sensitivity of the user information to be collected for handling the business; the detection subunit is used to detect the target feature based on the preset rules corresponding to the target feature to obtain a behavioral risk score, wherein the behavioral risk score is used to characterize the degree of deviation between the target feature and the user behavior threshold in the corresponding preset rules; the second determining subunit is used to determine the behavioral risk level of the target user based on the business level and the behavioral risk score.

[0145] In one optional embodiment, the first determining unit 803 includes a third determining subunit, a fourth determining subunit, and a fifth determining subunit.

[0146] Optionally, the third determining subunit is used to determine a first preset strategy based on the target user's behavioral risk level, and to count the number of times the first preset strategy appears in the target user's historical control records; the fourth determining subunit is used to use the first preset strategy as the target user's control strategy when the number of occurrences is less than or equal to a preset number; the fifth determining subunit is used to use a second preset strategy as the target user's control strategy when the number of occurrences is greater than a preset number, wherein the priority of the second preset strategy is greater than the priority of the first preset strategy.

[0147] In an optional embodiment, the control unit 804 includes a sorting subunit and a control subunit.

[0148] Optionally, the sorting subunit is used to sort the M control policies according to the priority of each control policy when M control policies need to be implemented, to obtain a policy sorting sequence, where M is a positive integer greater than or equal to 2; the control subunit is used to control the access behavior of the target user through the interceptor corresponding to each control policy, based on the execution order corresponding to the policy sorting sequence.

[0149] As can be seen from the above, this application adopts a combination of real-time log analysis and intelligent control strategies. By extracting features and detecting the extracted target features based on preset rules, it achieves the goal of accurately assessing the risk level of user behavior, thereby realizing the technical effect of dynamically adjusting the control strategy based on the risk level of user behavior.

[0150] Specifically, this application first extracts features from the log data of the business system to obtain target features, including user access behavior features and business data features, in order to comprehensively reflect the user's operation mode. Then, this application uses preset rules to detect these features, assesses the user's behavioral risk level based on the behavioral baseline established by historical risk-free operations, and dynamically determines the control strategy to be adopted for the target user based on the risk level and historical control records, thus avoiding the limitations of a single static strategy.

[0151] Furthermore, the control strategy in this application is implemented through an interceptor in the business system. The interceptor supports a variety of control measures, such as generating early warning information, limiting access behavior, blocking CAPTCHAs, disabling user permissions, or disabling user accounts. This multi-level and dynamically adjusted control strategy can more accurately match abnormal user access behavior, thereby improving the effectiveness of controlling abnormal user behavior. This solves the technical problems of poor effectiveness and low security of business systems in controlling abnormal user behavior based on a single and fixed control strategy in the prior art.

[0152] According to another aspect of the embodiments of this application, a computer program product is also provided, the computer program product including a stored computer program, wherein a method for identifying and controlling abnormal user behavior that controls the computer program product to perform any of the above-mentioned actions is provided during the execution of the computer program.

[0153] According to another aspect of the embodiments of this application, an electronic device is also provided, including: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform a method for identifying and controlling abnormal user behavior by executing the executable instructions.

[0154] Optionally, Figure 9 This is a schematic diagram of an optional electronic device according to an embodiment of this application, such as... Figure 9 As shown, this application provides an electronic device, which includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, it implements a method for identifying and controlling abnormal user behavior as described above.

[0155] The above-described embodiments or examples disclosed in this application are not exhaustive, but merely illustrative of some embodiments or examples, and are not intended to limit the scope of protection of this application. Unless otherwise specified, each step in a particular embodiment or example can be implemented as an independent embodiment, and the steps can be arbitrarily combined. For example, a solution after removing some steps in a particular embodiment or example can also be implemented as an independent embodiment, and the order of the steps in a particular embodiment or example can be arbitrarily interchanged. Furthermore, optional methods or examples in a particular embodiment or example can be arbitrarily combined; moreover, various embodiments or examples can be arbitrarily combined. For example, some or all steps of different embodiments or examples can be arbitrarily combined, and a particular embodiment or example can be arbitrarily combined with optional methods or examples of other embodiments or examples.

[0156] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0157] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0158] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0159] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0160] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory. Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0161] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0162] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0163] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0164] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for identifying and controlling abnormal user behavior, characterized in that, include: Feature extraction is performed on the log data of the business system to obtain target features, wherein the target features include at least the access behavior features of the target user to the business system and the business data features that the target user needs to handle. The target features are detected by a preset rule to obtain the behavioral risk level of the target user. The preset rule is used to characterize the baseline information of user behavior when accessing the business system by users who have no risk in a historical time period. Based on the target user's behavioral risk level and historical control records, a control strategy for the target user is determined, wherein the historical control records include historical control strategies issued to the target user at historical times. The access behavior of the target user is controlled by the interceptor corresponding to the control policy of the target user, wherein the interceptor is used to perform at least one of the following control measures: Generate early warning information; Access rate limiting; CAPTCHA interception; User privileges are disabled; User account disabled.

2. The method for identifying and controlling abnormal user behavior according to claim 1, characterized in that, Before performing feature extraction on the log data of the business system, the method for identifying and controlling abnormal user behavior also includes: A first component is deployed on the server of the business system, wherein the first component is used to monitor the changes of the log files of the business system in real time; The first component collects new logs from the log file and transmits the collected new logs to the second component, wherein the second component is a preset distributed stream processing platform; The newly added log is transmitted to the third component for processing via the second component, wherein the third component is at least used to perform data parsing and format conversion operations on the newly added log; The log data in a preset format obtained by the third component is transmitted to the fourth component for storage, wherein the fourth component is at least used for indexing the log data.

3. The method for identifying and controlling abnormal user behavior according to claim 1, characterized in that, Before detecting the target features using preset rules, the method for identifying and controlling abnormal user behavior further includes: Historical log data is collected from the fourth component, wherein the historical log data is used to record the behavior information of users who have no risk of operation accessing the business system within the historical time period; Feature extraction is performed on the historical log data to obtain a first feature, a second feature, and a third feature. The first feature is used to characterize the frequency of the user's access to the business system, the second feature is used to characterize the time period distribution of the user's access to the business system, and the third feature is the business data feature that the user needs to handle when accessing the business system. The preset rule is determined based on the first feature, the second feature, and the third feature.

4. The method for identifying and controlling abnormal user behavior according to claim 3, characterized in that, Determining the preset rule based on the first feature, the second feature, and the third feature includes: The first feature, the second feature, and the third feature are input into a statistical model, wherein the statistical model includes at least L preset statistical algorithms, where L is a positive integer; Based on the L preset statistical algorithms in the statistical model, the first feature, the second feature, and the third feature are analyzed to obtain L preset rules corresponding to the L preset statistical algorithms.

5. The method for identifying and controlling abnormal user behavior according to claim 1, characterized in that, The target features are detected using preset rules to obtain the behavioral risk level of the target user, including: Based on the business data features in the target features, a business level and a preset rule corresponding to the target features are determined, wherein the business level is used to characterize the level of the business that the target user needs to handle and the sensitivity of the user information that needs to be collected to handle the business. The target feature is detected based on the preset rules corresponding to the target feature to obtain a behavior risk score, wherein the behavior risk score is used to characterize the degree of deviation between the target feature and the user behavior threshold in the corresponding preset rules; The behavioral risk level of the target user is determined based on the business level and the behavioral risk score.

6. The method for identifying and controlling abnormal user behavior according to claim 1, characterized in that, Based on the target user's behavioral risk level and historical management records, determine the management strategy for the target user, including: A first preset strategy is determined based on the behavioral risk level of the target user, and the number of times the first preset strategy appears in the target user's historical management records is counted. If the number of occurrences is less than or equal to a preset number, the first preset strategy will be used as the control strategy for the target user. If the number of occurrences exceeds the preset number, the second preset strategy will be used as the control strategy for the target user, wherein the priority of the second preset strategy is higher than the priority of the first preset strategy.

7. The method for identifying and controlling abnormal user behavior according to claim 1, characterized in that, By using the interceptor corresponding to the target user's control policy, the access behavior of the target user is controlled, including: When M control strategies need to be implemented, the M control strategies are sorted according to the priority of each control strategy to obtain a strategy sorting sequence, where M is a positive integer greater than or equal to 2. By using the interceptors corresponding to each control policy, and based on the execution order corresponding to the policy sorting sequence, the access behavior of the target user is controlled.

8. A device for identifying and controlling abnormal user behavior, characterized in that, include: The first extraction unit is used to extract features from the log data of the business system to obtain target features, wherein the target features include at least the access behavior features of the target user to the business system and the business data features that the target user needs to handle. The detection unit is used to detect the target features according to preset rules to obtain the behavioral risk level of the target user, wherein the preset rules are used to characterize the baseline information of user behavior of users who have no risk in accessing the business system within a historical time period. The first determining unit is used to determine the control strategy for the target user based on the target user's behavioral risk level and historical control records, wherein the historical control records include historical control strategies issued to the target user at historical times. The control unit is configured to control the access behavior of the target user through an interceptor corresponding to the control policy of the target user, wherein the interceptor is configured to perform at least one of the following control measures: Generate early warning information; Access rate limiting; CAPTCHA interception; User privileges are disabled; User account disabled.

9. A computer program product, characterized in that, The computer program product includes a computer program, wherein... When the computer program is running, it controls the computer program product to execute the user abnormal behavior identification and control method according to any one of claims 1 to 7.

10. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the method for identifying and controlling abnormal user behavior as described in any one of claims 1 to 7.

Images