Token anomaly detection method and device, computer equipment and storage medium

Abstract

The invention discloses a token anomaly detection method and device, computer equipment and a storage medium. The method comprises the following steps: determining an original token generated when a user logs in a client in a current page scene; when a preset burying point triggered by a current execution operation of a user is received, recording operation log information corresponding to the current execution operation, and dynamically updating the position of the original token based on the operation log information and a pre-constructed operation tree structure so as to generate a new token position; determining an executable node corresponding to the current execution operation based on the new token position, and performing anomaly detection on the token according to the executable node; according to the technical scheme, the abnormal behavior of the token can be timely and accurately detected, so that an early warning prompt is given out, and the security of system login is improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method, apparatus, computer device, and storage medium for detecting token anomalies. Background Technology

[0002] In existing technologies, monitoring token usage can help system administrators promptly detect abnormal activity or potential security threats. Current token anomaly monitoring techniques mainly include monitoring frequent token requests or abnormal access locations or devices. However, existing solutions have limitations and cannot detect anomalies accurately and promptly. For example, when monitoring token frequency, hackers can evade detection by simulating normal user usage; when monitoring access locations, hackers can evade detection by using proxy servers or being on the same local area network as the user; and device monitoring is not suitable for web projects. Therefore, there is an urgent need for a token anomaly detection method to solve the above-mentioned technical problems. Summary of the Invention

[0003] In view of this, the present invention provides a token anomaly detection method, apparatus, computer equipment, and storage medium, which can detect abnormal token behavior in a timely and accurate manner, thereby issuing early warning prompts and improving the security of system login.

[0004] According to one aspect of the present invention, an embodiment of the present invention provides a token anomaly detection method, the method comprising:

[0005] Determine the original token generated when the user logs into the client in the current page scenario; wherein, the current page scenario includes: serial operation page scenario and parallel operation page scenario;

[0006] When the user's current execution operation triggers the preset tracking point, the operation log information corresponding to the current execution operation is recorded, and the position of the original token is dynamically updated based on the operation log information and the pre-built operation tree structure to generate a new token position;

[0007] Based on the location of the new token, determine the executable node corresponding to the currently executed operation, and perform anomaly detection on the token based on the executable node.

[0008] According to another aspect of the present invention, embodiments of the present invention also provide a token anomaly detection device, the device comprising:

[0009] The generation module is used to determine the original token generated when a user logs into the client in the current page scenario; wherein, the current page scenario includes: serial operation page scenario and parallel operation page scenario;

[0010] The location update module is used to record the operation log information corresponding to the current operation when the user's current operation triggers the preset tracking point, and dynamically update the position of the original token based on the operation log information and the pre-built operation tree structure to generate a new token position.

[0011] An anomaly detection module is used to determine the executable node corresponding to the currently executed operation based on the location of the new token, and to perform anomaly detection on the token based on the executable node.

[0012] According to another aspect of the present invention, embodiments of the present invention also provide a computer device, the computer device comprising:

[0013] At least one processor; and

[0014] A memory communicatively connected to the at least one processor; wherein,

[0015] The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the token anomaly detection method according to any embodiment of the present invention.

[0016] According to another aspect of the present invention, embodiments of the present invention also provide a computer-readable storage medium storing computer instructions for causing a processor to execute and implement the token anomaly detection method described in any embodiment of the present invention.

[0017] According to another aspect of the present invention, an embodiment of the present invention also provides a computer program product, characterized in that the computer program product includes a computer program, which, when executed by a processor, implements the token anomaly detection method described in any embodiment of the present invention.

[0018] The technical advantage of this invention lies in that, when the user's current execution operation triggers a preset tracking point, the operation log information corresponding to the current execution operation is recorded. Based on this, the position of the original token is dynamically updated according to the operation log information and the pre-built operation tree structure. Based on the new token position, the executable node corresponding to the current execution operation is determined, and the token is anomaly detected according to the executable node. This enables timely and accurate detection of abnormal token behavior, thereby issuing early warning prompts and improving the security of system login.

[0019] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart of a token anomaly detection method provided in an embodiment of the present invention;

[0022] Figure 2 This is a schematic diagram of the structure of a first historical operation log sequence provided in an embodiment of the present invention;

[0023] Figure 3 This is a schematic diagram illustrating the construction process of a first operation tree structure in a serial operation page scenario according to an embodiment of the present invention;

[0024] Figure 4 This is a schematic diagram of the architecture of a first operation tree structure provided in an embodiment of the present invention;

[0025] Figure 5 This is a schematic diagram illustrating the construction process of a second operation tree structure in a parallel operation page scenario according to an embodiment of the present invention;

[0026] Figure 6 This is a schematic diagram of a second operation tree structure provided in an embodiment of the present invention;

[0027] Figure 7 This is a flowchart illustrating another token anomaly detection method provided in an embodiment of the present invention;

[0028] Figure 8 This is a schematic diagram illustrating the process of detecting anomalies in a serial operation page scenario according to an embodiment of the present invention.

[0029] Figure 9 This is a schematic diagram illustrating the process of detecting anomalies in a serial operation page scenario according to an embodiment of the present invention.

[0030] Figure 10 This is a structural block diagram of a token anomaly detection device provided in an embodiment of the present invention;

[0031] Figure 11 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0032] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0033] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0034] In one embodiment, Figure 1 This is a flowchart of a token anomaly detection method provided in an embodiment of the present invention. This embodiment is applicable to situations where anomaly detection is performed on the behavior of a token. The method can be executed by a token anomaly detection device, which can be implemented in hardware and / or software and can be configured in a computer device.

[0035] like Figure 1 As shown, the token anomaly detection method in this embodiment specifically includes the following steps:

[0036] S110. Determine the original token generated when the user logs into the client under the current page scenario; wherein, the current page scenario includes: serial operation page scenario and parallel operation page scenario.

[0037] Among them, the serial operation page scenario refers to a scenario where a user can only operate on one page; the parallel operation page scenario refers to a scenario where a user can operate on multiple pages.

[0038] In this embodiment, when the front-end logs in, it sends a request to the server. If the server verifies the login successfully, it generates a token and sends the token back to the front-end. In this embodiment, the user's login client records the user's operation sequence in different page scenarios. That is, in the case of serial page operation, the operation record under a single page is recorded. In the case of parallel page operation, the operation record of the user under multiple pages is recorded, as well as the unique identifier of each page, so as to determine the user's operation record under each page through the unique identifier of the page.

[0039] It should be noted that in the serial operation page scenario, the token structure consists of two parts: a static part and a dynamic part. The static part includes the hash value of the user identifier and the server key; the dynamic part includes the timestamp, a random string, and the HMAC value of the server key. The token's composition includes both static and dynamic parts. The dynamic part includes, but is not limited to, user identity information, validity period, and timestamp. Then, an appropriate encryption algorithm (such as HMAC, RSA, etc.) is used in conjunction with the key to encrypt and decrypt the constituent information; finally, the token is generated. Token verification can include parsing the token and verifying both the static and dynamic parts separately. In the parallel operation page scenario, in addition to the serial operation page scenario, page information (Page_Part) is added. Page_Part includes page_id (page identifier) ​​and page_specific_data (page-specific data), and the entire Page_Part is encrypted to protect its information. Through Page_Part, user operations on specific pages can be tracked and verified in a multi-page environment. The token structure in the multi-page scenario provides more accurate user behavior tracking and anomaly detection. In this multi-page scenario, multi-page token generation, building upon the single-page scenario, encodes the encrypted information of specific pages into the token. This not only ensures the token's uniqueness and timeliness but also encodes page-specific information, enabling the token to more accurately track and verify user behavior in a multi-page environment. Similarly, multi-page token verification also incorporates page information verification. This multi-layered verification process not only ensures the token's validity and timeliness but also verifies that the operation occurred on the correct page, significantly improving security in a multi-page environment.

[0040] S120. For the current page scenario, when the user's current execution operation triggers the preset tracking point, record the operation log information corresponding to the current execution operation, and dynamically update the position of the original token based on the operation log information and the pre-built operation tree structure to generate a new token position.

[0041] The operation log information may include, but is not limited to, the user identifier, operation identifier, timestamp of the operation execution, and the user's IP address, etc., under the current operation.

[0042] In this embodiment, the preset tracking points are trigger mechanisms pre-set by the user. Users can set them themselves based on experience or needs. Of course, since the user's current operation may be in a serial operation page scenario or a parallel operation page scenario, the preset tracking points also include tracking points in the serial operation page scenario and tracking points in the parallel operation page scenario. This embodiment does not impose any restrictions here.

[0043] In this embodiment, different operation page scenarios correspond to different operation tree structures. It can be understood that serial operation page scenarios correspond to the corresponding first operation tree structure, and parallel operation page scenarios correspond to the corresponding second operation tree structure. Regardless of the operation page scenario, the corresponding operation tree structure is constructed based on the user's historical operation log sequence in the corresponding page operation scenario. In this embodiment, when the current page scenario is a serial operation page scenario, when the user's current execution operation triggers the preset tracking point, the operation log information corresponding to the current execution operation is first recorded. Then, based on the operation log information and the pre-built first operation tree structure, the position of the original token is updated to generate a new token position. Specifically, the first operation tree structure corresponding to the user is found through the operation log information, and the corresponding current operation node is found in the first operation tree structure. The position of the original token is then updated to the current operation node. When the current page scenario is a parallel operation page scenario, the operation log information corresponding to the current execution operation also needs to be recorded. Then, based on the operation log information and the pre-built second operation tree structure, the position of the original token is updated to generate a new token position. Specifically, the user's associated operation tree on the corresponding page is found according to the operation log information, the corresponding current operation node is found in the associated operation tree of the corresponding page, and the position of the original token is then updated to the current operation node.

[0044] In one embodiment, the operation tree structure includes a first operation tree structure corresponding to a serial operation page scenario and a second operation tree structure corresponding to a parallel operation page scenario.

[0045] Accordingly, the construction of the first operation tree structure includes: for serial operation page scenarios, obtaining the first historical operation log sequence corresponding to the user; wherein, the first historical operation log sequence includes at least: user identifier, operation identifier, timestamp and context information; and determining the corresponding first operation tree structure based on the first historical operation log sequence and a preset frequent sequence mining algorithm.

[0046] The construction of the second operation tree structure includes: for parallel operation page scenarios, obtaining the second historical operation log sequence corresponding to the user; wherein, the second historical operation log sequence includes at least: user identifier, operation identifier, timestamp, page ID identifier and context information; and determining the corresponding second operation tree structure based on the second historical operation log sequence and a preset frequent sequence mining algorithm.

[0047] In this embodiment, the Prefix Frequent Sequence Mining Algorithm, also known as the PrefixSpan algorithm, is an algorithm used to mine frequent sequences. It focuses on discovering frequently occurring sequence patterns. These sequence patterns consist of a series of itemsets arranged chronologically or otherwise.

[0048] In this embodiment, for a serial operation page scenario, the first historical operation log sequence corresponding to the user is obtained respectively. The corresponding first operation tree structure is determined based on the first historical operation log sequence and a preset frequent sequence mining algorithm. Specifically, determining the corresponding first operation tree structure based on the first historical operation log sequence and the preset frequent sequence mining algorithm includes: extracting user operation log sequences within a preset time window from each first historical operation log sequence; finding frequent items in the user operation log sequence and selecting one frequent item from each frequent item as the current prefix; constructing a corresponding current projection database based on the current prefix; selecting the next frequent item from the current projection database as the next prefix, and using the next prefix as the current prefix, returning to execute the step of constructing the corresponding current projection database based on the current prefix, until all frequent sequences satisfying a preset minimum support threshold are obtained; and constructing a corresponding first operation tree structure based on the frequent sequences. The first operation tree structure includes a root node and its corresponding child nodes. Each node represents an operation, and each operation includes an operation identifier, a node list, and a frequency counter.

[0049] For example, to better understand the construction process of the first operation tree structure in a serial operation page scenario, Figure 2 This is a schematic diagram of the structure of a first historical operation log sequence provided in an embodiment of the present invention. Figure 3 This is a schematic diagram illustrating the construction process of a first operation tree structure in a serial operation page scenario according to an embodiment of the present invention; as shown... Figure 2 As shown, `user_id`: a unique identifier for the user; `operation_id`: an identifier for the executed operation; `timestamp`: a timestamp of the operation execution; `context_info`: additional context information stored in JSON format. This structural design allows the system to comprehensively capture user behavior, providing a foundation for subsequent analysis. Figure 3As shown, the specific process of constructing the first operation tree structure in the serial operation page scenario is as follows:

[0050] a1. Set the time window and minimum support threshold.

[0051] Among them, the time window is such as the most recent 7 days, and the minimum support threshold is such as 0.1.

[0052] a2. Scan the sequence database and extract the user operation sequence within the specified time window.

[0053] a3. Find frequent items and determine if frequent items exist.

[0054] a4. If there are frequent terms, select one frequent term from among them as the current prefix.

[0055] a5. If there are no frequent items, then end the process.

[0056] a6. Construct the corresponding current projection database based on the current prefix.

[0057] a7. Recursively mine in the current projection database and return a3 until frequent sequences are obtained.

[0058] a8. Construct the corresponding first operation tree structure based on the frequent sequences.

[0059] The specific steps are as follows: 1) Create the root node; 2) For each frequent sequence S =<s1, s2, ..., sn> If s1 is not in the tree, add it as a child node of the root node; for si (i > 1), add it as a child node of si-1; (for example, if it is s2, add s2 as a child node of s1); 3) Each node contains an operation identifier, a list of child nodes and a frequency counter. Figure 4 This is a schematic diagram of a first operation tree structure provided in an embodiment of the present invention, as shown below. Figure 4 As shown, Figure 4 An example of an operation tree structure is shown. Each node represents an operation, and the number in parentheses indicates the frequency of that operation. For example, OP_LOGIN (100) is the most frequent operation. After logging in, the user is most likely to execute OP_SEARCH (50) or OP_LOGOUT (30). After viewing the profile (OP_VIEW_PROFILE), the user is more likely to view messages (OP_VIEW_MESSAGES) than edit the profile (OP_EDIT_PROFILE). This tree structure allows the system to quickly identify normal operation sequences, providing a benchmark for anomaly detection.

[0060] In this embodiment, for parallel operation page scenarios, a second historical operation log sequence corresponding to the user is obtained. The second historical operation log sequence includes at least: a user identifier, an operation identifier, a timestamp, a page ID, and context information. A corresponding second operation tree structure is determined based on the second historical operation log sequence and a preset frequent sequence mining algorithm. Specifically, determining the corresponding second operation tree structure based on the second historical operation log sequence and the preset frequent sequence mining algorithm includes: grouping the second historical operation log sequence according to the page ID to obtain a grouped single-page operation log sequence; analyzing each single-page operation log sequence using the preset frequent sequence mining algorithm to obtain a single-page operation tree structure corresponding to each single page; creating a main operation tree for each page; where the main operation tree represents the switching relationship between pages; constructing a second operation tree structure based on the single-page operation tree structure, frequent switching operations, and the main operation tree; where the second operation tree structure includes a root node and multiple page nodes connected to the root node, with each page node corresponding to a switching probability and switching frequency for page switching; each page node is connected to a corresponding candidate operation sequence, and each candidate operation sequence corresponds to a corresponding operation probability.

[0061] For example, to better understand the construction process of the second operation tree structure in a scenario of parallel page operations, Figure 5 This is a schematic diagram illustrating the construction process of a second operation tree structure in a parallel operation page scenario according to an embodiment of the present invention. Compared to the single-page scenario, a `page_id` field is added to identify the specific page where the operation occurs. This enables the system to track user behavior across pages, providing a foundation for the construction of a multi-dimensional operation tree. In this embodiment, firstly, sequence pattern mining is performed on each `page_id` individually, and then cross-page operation sequences are considered. Specifically, the construction process of the second operation tree structure in the parallel operation page scenario is as follows:

[0062] b1. Group data by page_id.

[0063] b2. Perform PrefixSpan algorithm analysis on each page separately.

[0064] b3. Identify frequent switching operations between pages.

[0065] b4. Merge single-page and cross-page patterns to obtain the second operation tree structure.

[0066] Specifically, an independent operation tree is built for each frequently used page, and a main operation tree is created to represent the switching relationship between pages. For example, Figure 6 This is a schematic diagram of a second operation tree structure provided in an embodiment of the present invention, as shown below. Figure 6As shown in the diagram, this illustrates the structure of a multi-dimensional operation tree. Key features include: 1) the root node connects multiple page nodes (Page1, Page2); 2) each page node contains a unique sequence of operations specific to that page; and 3) dashed lines connect pages, indicating the probability and frequency of page switching. This structure not only represents the order of operations within a single page but also reflects user switching behavior across different pages, providing a comprehensive benchmark for anomaly detection in multi-page environments.

[0067] In one embodiment, the first operation tree structure and the second operation tree structure are updated according to a preset period. The update method includes: obtaining the new first operation log sequence and the new second operation log sequence corresponding to the serial operation page scenario and the parallel operation page scenario, respectively; reconstructing the new first operation tree structure and the new second operation tree structure corresponding to the different page scenarios using the new first operation log sequence and the new second operation log sequence, respectively; and updating the first operation tree structure and the second operation tree structure according to the new first operation tree structure and the new second operation tree structure, respectively.

[0068] In this embodiment, the new first operation log sequence is the operation log sequence data newly generated by the user in the serial operation page scenario, and the new second operation log sequence is the operation log sequence data newly generated by the user in the parallel operation page scenario. The field information contained in the new first operation log sequence and the new second operation log sequence is the same as the content information corresponding to the first historical operation log sequence and the second historical operation log sequence, except that the corresponding time is different.

[0069] This can be understood as follows: when updating the operation tree structure, the sequence pattern is re-mined using new log data to construct the operation tree structure for the corresponding page scenario. In a specific embodiment, the updated first operation tree structure and the second operation tree structure can directly replace the first operation tree structure and the second operation tree structure before the update. Alternatively, the operation tree structures before and after the update can be compared, and the parts that have changed can be updated structurally, while the parts that have not changed can be left unchanged.

[0070] S130. Determine the executable node corresponding to the current operation based on the new token location, and perform anomaly detection on the token based on the executable node.

[0071] The executable nodes can include executable nodes corresponding to serial operation page scenarios and executable nodes corresponding to parallel operation page scenarios, and the number of executable nodes can be one or more.

[0072] In this embodiment, in the serial operation page scenario, the first operation tree structure and the corresponding new token position can be obtained, and then executable nodes can be calculated based on the first operation tree structure and the new token position to form an executable node set, thereby performing token anomaly detection; in the parallel operation page scenario, the associated operation tree of the corresponding page and the corresponding new token position are obtained, and the main operation tree and page state are obtained. The possibility of page jump is determined based on the main operation tree and page state. Executable nodes are calculated based on the associated operation tree of the corresponding page, the corresponding new token position, and the possibility of page jump to form an executable node set.

[0073] The technical solution of this invention records the operation log information corresponding to the current operation when the user's current operation triggers a preset tracking point. Based on this, the position of the original token is dynamically updated according to the operation log information and the pre-built operation tree structure. The executable node corresponding to the current operation is determined based on the new token position, and the token is anomaly detected according to the executable node. This can detect abnormal behavior of the token in a timely manner, greatly reduce false alarms and false negatives, improve the accuracy of detection, and thus issue an early warning prompt, thereby improving the security of system login.

[0074] In one embodiment, Figure 7 This is a flowchart illustrating another token anomaly detection method provided in an embodiment of the present invention. Based on the above embodiments, this embodiment further refines the following: dynamically updating the position of the original token based on operation log information and a pre-built operation tree structure to generate a new token position; determining the executable node corresponding to the currently executed operation based on the new token position; and performing anomaly detection on the token based on the executable node.

[0075] like Figure 7 As shown, the token anomaly detection method in this embodiment may specifically include the following steps:

[0076] S710. Determine the original token generated when the user logs into the client in the current page scenario; wherein, the current page scenario includes: serial operation page scenario and parallel operation page scenario.

[0077] S720. For the current page scenario, when the user's current execution operation triggers the preset tracking point, record the operation log information corresponding to the current execution operation.

[0078] S730. In the case that the current page scenario is a serial operation page scenario, find the first operation tree structure corresponding to the user based on the operation log information, and find the corresponding current operation node in the first operation tree structure.

[0079] In this embodiment, when the current page scenario is a serial operation page scenario, the user's current execution operation (i.e. the user's actual operation) will trigger the tracking point, thereby recording the operation log information corresponding to the current execution operation. Thus, the first operation tree structure corresponding to the user can be found based on the operation log information, and the token position can be updated in the operation tree structure.

[0080] S740, Update the position of the original token to the current operation node.

[0081] In this embodiment, the position of the original token is updated to the current operation node; wherein, the position of the original token is located at the root node in the first operation tree structure. Specifically, the update method may include: starting from the root node of the first operation tree structure, moving the position of the original token along the path matching the current operation, so as to update the position of the original token to the current operation node.

[0082] S750. Mark the position of the new token in the current operation node to update the latest operation position.

[0083] In this embodiment, the position of the new token is marked in the current operation node to update the latest operation position, which reflects the latest operation status.

[0084] S760. In the case that the current page scenario is a parallel operation page scenario, find the user's associated operation tree on the corresponding page based on the operation log information.

[0085] In this embodiment, when the current page scenario is a parallel operation page scenario, the user's current execution operation (i.e., the user's actual operation) will trigger the instrumentation, thereby recording the operation log information corresponding to the current execution operation. From this operation log information, the user's associated operation tree on the corresponding page can be found. This associated operation tree includes the single-page operation tree structure and the page switching information between each single-page operation tree structure. In this embodiment, because page information is added in the parallel operation page scenario, the user's cross-page operations are monitored. By analyzing the user's operation patterns and switching behavior across multiple pages, more complex attack patterns can be identified.

[0086] S770. Find the corresponding current operation node in the associated operation tree of the corresponding page, update the position of the original token to the current operation node, and mark the position of the new token to update the latest operation position.

[0087] In this embodiment, the corresponding current operation node is found in the associated operation tree of the corresponding page, the position of the original token is updated to the current operation node, and the position of the new token is marked to update the latest operation position. This ensures that the system can fully track the user's operation path in a multi-page environment and provides a comprehensive basis for anomaly detection in complex scenarios.

[0088] S780. In the scenario of serial operation page, obtain the first operation tree structure and the corresponding new token position.

[0089] In this embodiment, in the serial operation page scenario, the received user login client request is verified by token. If the verification is successful, the process proceeds to obtain the first operation tree structure and the corresponding new token position for token anomaly detection. If the verification fails, the request is rejected and the process ends.

[0090] S790. Calculate the executable nodes based on the first operation tree structure and the position of the new token to form an executable node set.

[0091] In this embodiment, after the token is successfully verified, the executable nodes are calculated based on the first operation tree structure and the position of the new token to form an executable node set, wherein each executable node represents an operation.

[0092] S7100: Determine whether each executable node is executable. If yes, execute S7110; otherwise, execute S7120.

[0093] In this embodiment, determining whether each executable node is executable is equivalent to checking whether the operation is executable. If it is not executable, an exception is marked, an alert is issued, and the process ends. If it is executable, the operation corresponding to the executable node is executed, and the token position is updated again.

[0094] S7110: Execute the operation corresponding to the executable node and update the token position again.

[0095] S7120: Mark the executable node as abnormal and issue a warning.

[0096] For example, to better understand the process of anomaly detection of the token in a serial operation page scenario, Figure 8 This is a flowchart illustrating an anomaly detection process for a token in a serial operation page scenario, as provided in an embodiment of the present invention. Figure 8 As shown, the specific steps are as follows:

[0097] c1. Receive user requests.

[0098] c2. Verify the token. If the verification is successful, proceed to c3; if the verification fails, proceed to c8.

[0099] c3. Obtain the first operation tree structure and the corresponding new token position.

[0100] c4. Calculate the executable nodes to form an executable node set.

[0101] c5. Determine whether each executable node is executable. If yes, execute c6; otherwise, execute c7.

[0102] c6. Perform the operation and update the token.

[0103] c7. Mark the anomaly and issue a warning.

[0104] c8. Request denied.

[0105] S7130. In the scenario of parallel operation of the page, obtain the associated operation tree of the corresponding page and the position of the corresponding new token, and obtain the main operation tree and page state.

[0106] In this embodiment, in the scenario of parallel operation of the page, the received user login client request is verified by the token. If the verification is successful, the process proceeds to obtain the associated operation tree of the corresponding page and the corresponding new token position for token anomaly detection. If the verification fails, the request is rejected and the process ends.

[0107] S7140. Determine the possibility of page redirection based on the main operation tree and page status.

[0108] In this embodiment, the likelihood of page transitions is determined based on the main operation tree and page state. The state of other active pages is analyzed to assess the rationality of parallel operations. The number of simultaneously active pages is monitored to ensure it does not exceed a normal threshold. The time intervals between page operations are analyzed to detect any rapid switching that cannot be performed manually.

[0109] S7150: Calculate executable nodes and form an executable node set based on the associated operation tree of the corresponding page, the position of the corresponding new token, and the possibility of page redirection.

[0110] In this embodiment, executable nodes are calculated and an executable node set is formed based on the associated operation tree of the corresponding page, the position of the corresponding new token, and the possibility of page redirection.

[0111] S7160. Determine whether each executable node is executable. If yes, execute S7170; otherwise, execute S7180.

[0112] In this embodiment, determining whether each executable node is executable is equivalent to checking whether the operation is executable. If it is not executable, an exception is marked, an alert is issued, and the process ends. If it is executable, the operation corresponding to the executable node is executed, and the token position is updated again.

[0113] S7170: Execute the operation corresponding to the executable node and update the token position again.

[0114] S7180: Mark the executable node as abnormal and issue a warning.

[0115] For example, to better understand the process of anomaly detection of tokens in a scenario of parallel page operations, Figure 9 This is a flowchart illustrating an anomaly detection process for a token in a serial operation page scenario, as provided in an embodiment of the present invention. Figure 9 As shown, the specific steps are as follows:

[0116] d1. Receive user requests.

[0117] d2. Verify the token. If the verification is successful, proceed to d3; if the verification fails, proceed to d10.

[0118] d3. Obtain the operation tree structure of the corresponding page and the position of the corresponding new token.

[0119] d4. Obtain the created main operation tree and page state.

[0120] d5. Determine the probability of page jumps in the main operation tree based on the main operation tree and page states. This probability of page jumps represents the likelihood of jumps between pages.

[0121] d6. Calculate the executable nodes and form an executable node set based on the operation tree structure of the corresponding page, the position of the corresponding new token, and the possibility of page jump.

[0122] d7. Determine whether each executable node is executable. If yes, execute d8; otherwise, execute d9.

[0123] d8. Perform the operation and update the token.

[0124] d9. Mark the anomaly and issue a warning.

[0125] d10. Request denied.

[0126] In this embodiment, the above technical solution, for the current page scenario, upon receiving the user's current execution operation triggering a preset tracking point, records the operation log information corresponding to the current execution operation. In the case of a serial operation page scenario, it searches for the user's corresponding first operation tree structure based on the operation log information and finds the corresponding current operation node within the first operation tree structure; it updates the position of the original token to the current operation node; it marks the new token position in the current operation node to update the latest operation position; and it calculates executable nodes based on the first operation tree structure and the new token position to form an executable node set, thereby performing anomaly detection for serial operation pages. In the case of parallel operation page scenarios, the operation log information is used to find the user's associated operation tree on the corresponding page; the corresponding current operation node is found in the associated operation tree of the corresponding page, and the position of the original token is updated to the current operation node, and the position of the new token is marked to update the latest operation position. Thus, based on the associated operation tree of the corresponding page, the corresponding new token position, and the possibility of page jump, executable nodes are calculated to form an executable node set, and anomaly detection of parallel operation pages is performed. The above technical solution records the position of the token on the operation tree through the instrumentation method, and performs anomaly detection and early warning through the dual protection mechanism of operation tree detection and dynamic token.

[0127] In one embodiment, Figure 10 This is a structural block diagram of a token anomaly detection device according to an embodiment of the present invention. The system is suitable for detecting anomalies in token behavior and can be implemented in hardware or software. It can be configured in a computer device to implement a token anomaly detection method according to an embodiment of the present invention.

[0128] like Figure 10 As shown, the device includes: a generation module 1010, a location update module 1020, and an anomaly detection module 1030;

[0129] The generation module 1010 is used to determine the original token generated when the user logs into the client in the current page scenario; wherein the current page scenario includes: serial operation page scenario and parallel operation page scenario;

[0130] The location update module 1020 is used to record the operation log information corresponding to the current operation when the user's current operation triggers the preset tracking point for the current page scenario, and dynamically update the position of the original token based on the operation log information and the pre-built operation tree structure to generate a new token position.

[0131] The anomaly detection module 1030 is used to determine the executable node corresponding to the currently executed operation based on the new token position, and to perform anomaly detection on the token based on the executable node.

[0132] In this embodiment of the invention, the location update module records the operation log information corresponding to the current operation when it receives the user's current operation triggering a preset tracking point. Based on this, the anomaly detection module dynamically updates the position of the original token according to the operation log information and the pre-built operation tree structure. Based on the new token position, it determines the executable node corresponding to the current operation and performs anomaly detection on the token according to the executable node. This enables timely and accurate detection of abnormal token behavior, thereby issuing early warning prompts and improving the security of system login.

[0133] In one embodiment, the operation tree structure includes a first operation tree structure corresponding to the serial operation page scenario and a second operation tree structure corresponding to the parallel operation page scenario; correspondingly, the construction of the first operation tree structure includes:

[0134] For the serial operation page scenario, the first historical operation log sequence corresponding to the user is obtained respectively; wherein, the first historical operation log sequence includes at least: user identifier, operation identifier, timestamp and context information;

[0135] The corresponding first operation tree structure is determined based on the first historical operation log sequence and the preset frequent sequence mining algorithm.

[0136] The construction of the second operation tree structure includes:

[0137] For the parallel operation page scenario, the second historical operation log sequence corresponding to the user is obtained respectively; wherein, the second historical operation log sequence includes at least: user identifier, operation identifier, timestamp, page ID identifier and context information;

[0138] The corresponding second operation tree structure is determined based on the second historical operation log sequence and the preset frequent sequence mining algorithm.

[0139] In one embodiment, determining the corresponding first operation tree structure based on the first historical operation log sequence and a preset frequent sequence mining algorithm includes:

[0140] Extract user operation log sequences that satisfy a pre-defined time window from each of the first historical operation log sequences;

[0141] Find the frequent items in the user operation log sequence, and select one frequent item from each frequent item as the current prefix;

[0142] Construct the corresponding current projection database based on the current prefix;

[0143] Select the next frequent item from the current projection database as the next prefix, and use the next prefix as the current prefix. Return to the step of constructing the corresponding current projection database based on the current prefix, until all frequent sequences that satisfy the preset minimum support threshold are obtained.

[0144] A first operation tree structure is constructed based on the frequent sequence; wherein the first operation tree structure includes a root node and child nodes corresponding to the root node; wherein each node represents an operation, and each operation includes an operation identifier, a node list and a frequency counter.

[0145] In one embodiment, determining the corresponding second operation tree structure based on the second historical operation log sequence and a preset frequent sequence mining algorithm includes:

[0146] The second historical operation log sequence is grouped according to the page ID to obtain a grouped single-page operation log sequence.

[0147] For each single-page operation log sequence, the preset frequent sequence mining algorithm is used to analyze and obtain the single-page operation tree structure corresponding to each single page.

[0148] Identify frequent page switching operations;

[0149] Create a main operation tree for each page; wherein the main operation tree represents the switching relationship between the pages;

[0150] The second operation tree structure is constructed based on the single-page operation tree structure, the frequent switching operation situation, and the main operation tree; wherein, the second operation tree structure includes a root node and multiple page nodes connected to the root node, and each page node corresponds to a corresponding page switching probability and switching frequency; each page node is connected to a corresponding candidate operation sequence, and each candidate operation sequence corresponds to a corresponding operation probability.

[0151] In one embodiment, the first operation tree structure and the second operation tree structure are updated according to a preset period, and the update method includes:

[0152] Obtain the new first operation log sequence and the new second operation log sequence corresponding to the serial operation page scenario and the parallel operation page scenario, respectively;

[0153] Reconstruct the new first operation tree structure and the new second operation tree structure for different page scenarios using the new first operation log sequence and the new second operation log sequence respectively;

[0154] The first operation tree structure and the second operation tree structure are updated according to the new first operation tree structure and the new second operation tree structure, respectively.

[0155] In one embodiment, when the current page scenario is a serial operation page scenario, the position update module 1120 includes:

[0156] The search unit is used to search for the first operation tree structure corresponding to the user based on the operation log information, and to search for the corresponding current operation node in the first operation tree structure.

[0157] An update unit is used to update the position of the original token to the current operation node; wherein the position of the original token is located at the root node in the first operation tree structure;

[0158] The new token location determination unit is used to mark the new token location in the current operation node to update the latest operation location.

[0159] In one embodiment, the updating unit includes:

[0160] An update subunit is used to move the position of the original token from the root node of the first operation tree structure along the path matched by the current operation, so as to update the position of the original token to the current operation node.

[0161] In one embodiment, when the current page scenario is a parallel operation page scenario, the position update module 1020 includes:

[0162] The associated operation tree determination unit is used to find the user's associated operation tree on the corresponding page based on the operation log information; wherein, the associated operation tree includes a single-page operation tree structure and the page switching information between each single-page operation tree structure;

[0163] The new token location marking unit is used to find the corresponding current operation node in the associated operation tree of the corresponding page, update the position of the original token to the current operation node, and mark the new token location to update the latest operation position.

[0164] In one embodiment, in the serial operation page scenario, the anomaly detection module 1030 includes:

[0165] The new token position acquisition unit is used to obtain the first operation tree structure and the corresponding new token position.

[0166] An executable node determination unit is used to calculate executable nodes and form an executable node set based on the first operation tree structure and the position of the new token; wherein each executable node represents an operation;

[0167] The judgment unit is used to determine whether each of the executable nodes is executable.

[0168] The first result determination unit is used to execute the operation corresponding to the executable node and update the token position if the result is yes.

[0169] The second result determination unit is used to mark the executable node as abnormal and issue an early warning if the result is not found.

[0170] In one embodiment, in the parallel operation page scenario, the anomaly detection module 1030 includes:

[0171] The information acquisition unit is used to acquire the associated operation tree of the corresponding page and the position of the corresponding new token, as well as the main operation tree and page status;

[0172] A page redirection determination unit is used to determine the possibility of page redirection based on the main operation tree and the page state.

[0173] An executable node determination unit is used to calculate executable nodes and form an executable node set based on the associated operation tree of the corresponding page, the position of the corresponding new token, and the probability of page jump.

[0174] The judgment unit is used to determine whether each of the executable nodes is executable.

[0175] The first result determination unit is used to execute the operation corresponding to the executable node and update the token position if the result is yes.

[0176] The second result determination unit is used to mark the executable node as abnormal and issue an early warning if the result is not found.

[0177] The token anomaly detection device provided in this embodiment of the invention can execute the token anomaly detection method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the method execution.

[0178] In one embodiment, Figure 11This is a schematic diagram of a computer device provided for an embodiment of the present invention. The computer device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. Electronic devices may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0179] like Figure 11 As shown, the computer device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer programs stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0180] Multiple components in computer device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of monitors, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0181] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as token anomaly detection methods.

[0182] In some embodiments, the token anomaly detection method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the token anomaly detection method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to execute the token anomaly detection method by any other suitable means (e.g., by means of firmware).

[0183] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0184] Computer programs used to implement the methods of the present invention can be written in any combination of one or more programming languages. These computer programs can be provided to the processor of a general-purpose computer, a special-purpose computer, or other programmable token anomaly detection device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The computer programs can be executed entirely on the machine, partially on the machine, as a standalone software package partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0185] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0186] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0187] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0188] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through a communication network. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0189] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0190] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for detecting token anomalies, characterized in that, The method includes: Determine the original token generated when the user logs into the client in the current page scenario; wherein, the current page scenario includes: serial operation page scenario and parallel operation page scenario; For the current page scenario, when the user's current execution operation triggers the preset tracking point, the operation log information corresponding to the current execution operation is recorded, and the position of the original token is dynamically updated based on the operation log information and the pre-built operation tree structure to generate a new token position; Based on the location of the new token, determine the executable node corresponding to the currently executed operation, and perform anomaly detection on the token based on the executable node.

2. The method according to claim 1, characterized in that, The operation tree structure includes a first operation tree structure corresponding to the serial operation page scenario and a second operation tree structure corresponding to the parallel operation page scenario; correspondingly, the construction of the first operation tree structure includes: For the serial operation page scenario, the first historical operation log sequence corresponding to the user is obtained respectively; wherein, the first historical operation log sequence includes at least: user identifier, operation identifier, timestamp and context information; The corresponding first operation tree structure is determined based on the first historical operation log sequence and the preset frequent sequence mining algorithm. The construction of the second operation tree structure includes: For the parallel operation page scenario, the second historical operation log sequence corresponding to the user is obtained respectively; wherein, the second historical operation log sequence includes at least: user identifier, operation identifier, timestamp, page ID identifier and context information; The corresponding second operation tree structure is determined based on the second historical operation log sequence and the preset frequent sequence mining algorithm.

3. The method according to claim 2, characterized in that, The step of determining the corresponding first operation tree structure based on the first historical operation log sequence and the preset frequent sequence mining algorithm includes: Extract user operation log sequences that satisfy a pre-defined time window from each of the first historical operation log sequences; Find the frequent items in the user operation log sequence, and select one frequent item from each frequent item as the current prefix; Construct the corresponding current projection database based on the current prefix; Select the next frequent item from the current projection database as the next prefix, and use the next prefix as the current prefix. Return to the step of constructing the corresponding current projection database based on the current prefix, until all frequent sequences that satisfy the preset minimum support threshold are obtained. A first operation tree structure is constructed based on the frequent sequence; wherein the first operation tree structure includes a root node and child nodes corresponding to the root node; wherein each node represents an operation, and each operation includes an operation identifier, a node list and a frequency counter.

4. The method according to claim 2, characterized in that, The step of determining the corresponding second operation tree structure based on the second historical operation log sequence and the preset frequent sequence mining algorithm includes: The second historical operation log sequence is grouped according to the page ID to obtain a grouped single-page operation log sequence. For each single-page operation log sequence, the preset frequent sequence mining algorithm is used to analyze and obtain the single-page operation tree structure corresponding to each single page. Identify frequent page switching operations; Create a main operation tree for each page; wherein the main operation tree represents the switching relationship between the pages; The second operation tree structure is constructed based on the single-page operation tree structure, the frequent switching operation situation, and the main operation tree; wherein, the second operation tree structure includes a root node and multiple page nodes connected to the root node, and each page node corresponds to a corresponding page switching probability and switching frequency; each page node is connected to a corresponding candidate operation sequence, and each candidate operation sequence corresponds to a corresponding operation probability.

5. The method according to any one of claims 3 or 4, characterized in that, The first operation tree structure and the second operation tree structure are updated according to a preset period, and the update method includes: Obtain the new first operation log sequence and the new second operation log sequence corresponding to the serial operation page scenario and the parallel operation page scenario, respectively; Reconstruct the new first operation tree structure and the new second operation tree structure for different page scenarios using the new first operation log sequence and the new second operation log sequence respectively; The first operation tree structure and the second operation tree structure are updated according to the new first operation tree structure and the new second operation tree structure, respectively.

6. The method according to claim 1, characterized in that, In the case where the current page scenario is a serial operation page scenario, the step of dynamically updating the position of the original token based on the operation log information and the pre-built operation tree structure to generate a new token position for the current page scenario includes: Based on the operation log information, find the first operation tree structure corresponding to the user, and find the corresponding current operation node in the first operation tree structure; Update the position of the original token to the current operation node; wherein the position of the original token is located at the root node in the first operation tree structure; Mark the new token position in the current operation node to update the latest operation position.

7. The method according to claim 6, characterized in that, The step of updating the position of the original token to the current operating node includes: The position of the original token is moved from the root node of the first operation tree structure along the path that matches the current operation, so as to update the position of the original token to the current operation node.

8. The method according to claim 1, characterized in that, In the case that the current page scenario is a parallel operation page scenario, the step of dynamically updating the position of the original token based on the operation log information and the pre-built operation tree structure to generate a new token position for the current page scenario includes: Based on the operation log information, find the user's associated operation tree on the corresponding page; wherein, the associated operation tree includes a single-page operation tree structure, and the page switching information between each single-page operation tree structure; Find the corresponding current operation node in the associated operation tree of the corresponding page, update the position of the original token to the current operation node, and mark the position of the new token to update the latest operation position.

9. The method according to claim 1, characterized in that, In the scenario of the serial operation page, the step of determining the executable node corresponding to the currently executed operation based on the position of the new token, and performing anomaly detection on the token based on the executable node, includes: Obtain the first operation tree structure and the corresponding new token position; Based on the first operation tree structure and the position of the new token, executable nodes are calculated to form an executable node set; wherein each executable node represents an operation; Determine whether each of the executable nodes is executable; If so, execute the operation corresponding to the executable node and update the token position again; If not, mark the executable node as abnormal and issue a warning.

10. The method according to claim 1, characterized in that, In the parallel operation page scenario, determining the executable node corresponding to the currently executed operation based on the new token position, and performing anomaly detection on the token based on the executable node, includes: Get the associated operation tree of the corresponding page and the position of the corresponding new token, and get the main operation tree and page state created; The likelihood of page redirection is determined based on the main operation tree and page state. Based on the associated operation tree of the corresponding page, the position of the corresponding new token, and the possibility of page redirection, the executable nodes are calculated to form an executable node set; Determine whether each of the executable nodes is executable; If so, execute the operation corresponding to the executable node and update the token position again; If not, mark the executable node as abnormal and issue a warning.

11. A token anomaly detection device, characterized in that, The device includes: The generation module is used to determine the original token generated when a user logs into the client in the current page scenario; wherein, the current page scenario includes: serial operation page scenario and parallel operation page scenario; The location update module is used to record the operation log information corresponding to the current operation when the user's current operation triggers the preset tracking point, and dynamically update the position of the original token based on the operation log information and the pre-built operation tree structure to generate a new token position. An anomaly detection module is used to determine the executable node corresponding to the currently executed operation based on the location of the new token, and to perform anomaly detection on the token based on the executable node.

12. A computer device, characterized in that, The computer device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the token anomaly detection method according to any one of claims 1-10.

13. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that are used to cause a processor to execute the token anomaly detection method according to any one of claims 1-10.

14. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the token anomaly detection method according to any one of claims 1-10.

Images