Risk behavior identification method and device, storage medium, program product and computer equipment

Abstract

The invention discloses a risk behavior identification method and device, a storage medium, a program product and computer equipment, and the method comprises the steps: obtaining a circulation data package corresponding to a data circulation process, and determining a first circulation feature of the circulation data package, so that the first circulation feature of the circulation data package is obtained from the data circulation process; performing analysis to obtain circulation characteristics which can more comprehensively and accurately reflect related characteristics of a data circulation process; at least based on the first circulation feature, an abnormal behavior identification result is obtained through identification, so that the abnormal behavior in the data circulation process is accurately and comprehensively identified on the basis of the circulation feature; and determining a risk behavior recognition result corresponding to the data flow process based on the abnormal behavior recognition result, thereby improving the accuracy and comprehensiveness of risk behavior recognition in the data flow process through a more comprehensive and accurate abnormal behavior recognition result.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security, and particularly relates to a risk behavior identification method and device, a storage medium, a program product and computer equipment. BACKGROUND

[0002] Abnormal behavior in data flow refers to behavior that does not conform to normal patterns and / or security policies in the process of data collection, transmission, storage, use, sharing and / or destruction. These abnormal behaviors indicate that data security may be threatened and need to be identified and responded to in a timely manner.

[0003] In related technologies, when data flows to a node, a corresponding user can use the data through the node, so that the behavior data of the user can be analyzed to identify whether there is a risk of the data on the node.

[0004] However, this scheme is limited to user behavior data on a single node when identifying risks, resulting in low risk identification accuracy and limited identification results. SUMMARY

[0005] To solve the above technical problems, the embodiments of the present application provide a risk behavior identification method, device, storage medium, program product and computer equipment, which can improve the accuracy and comprehensiveness of risk identification.

[0006] In a first aspect, the embodiments of the present application provide a risk behavior identification method, comprising: obtaining flow data packets corresponding to a data flow process; determining a first flow feature of the flow data packets; identifying an abnormal behavior identification result based at least on the first flow feature; determining a risk behavior identification result corresponding to the data flow process based on the abnormal behavior identification result.

[0007] Optionally, the determination of the first flow feature of the flow data packets comprises: performing data extraction on the flow data packets according to a target parameter type to generate network data; extracting first time sequence information in the network data, and converting the first time sequence information into trajectory information; converting the trajectory information into a flow graph; performing feature extraction on the flow graph to obtain the first flow feature of the flow data packets.

[0008] Optionally, the conversion of the first time sequence information into trajectory information comprises: determining delay information corresponding to the first timing information; converting the first timing information into a target space based on the delay information and a mapping dimension of the target space, to obtain a state matrix of the network data, wherein the state matrix is used to indicate the trajectory information.

[0009] Optionally, the first flow transition feature includes at least one of: a flow transition periodicity of the flow transition graph, wherein the flow transition periodicity of the flow transition graph is determined according to information corresponding to each node of the flow transition graph in the trajectory information and a number of nodes of the flow transition graph; a propagation directionality of the flow transition graph, wherein the propagation directionality of the flow transition graph is determined according to the flow transition periodicity of the flow transition graph and lengths of the nodes of the flow transition graph.

[0010] Optionally, the identifying the abnormal behavior recognition result based on at least the first flow transition feature includes: calling an abnormal behavior recognition model based on the first flow transition feature and the flow transition data packet to perform identification, to obtain the abnormal behavior recognition result.

[0011] Optionally, the abnormal behavior recognition model includes a timing extraction layer, a flow transition feature extraction layer, a flow transition feature enhancement layer, and a feature fusion layer. The timing extraction layer is configured to extract second timing information of the flow transition data packet. The flow transition feature extraction layer is configured to perform feature extraction on the second timing information to generate forward flow transition features and reverse flow transition features. The flow transition feature enhancement layer is configured to perform feature enhancement processing on the second timing information to obtain forward enhanced features and reverse enhanced features. The feature fusion layer is configured to perform fusion processing based on the forward enhanced features, the reverse enhanced features, the forward flow transition features, and the reverse flow transition features, to obtain second flow transition features. The abnormal behavior recognition model is configured to determine the abnormal behavior recognition result based on the first flow transition feature and the second flow transition feature. wherein the forward propagation is adapted to indicate a process from a previous flow transition node to a current flow transition node in the data flow transition process, and the backward propagation is adapted to indicate a process from the current flow transition node to a next flow transition node in the data flow transition process.

[0012] Optionally, the fusion processing based on the forward enhanced features, the reverse enhanced features, the forward flow transition features, and the reverse flow transition features to obtain the second flow transition features includes: The positive enhancement feature and the reverse enhancement feature are fused to obtain a fused enhancement feature. The fused enhancement feature, the positive flow feature and the reverse flow feature are combined to generate the second flow feature.

[0013] Optionally, the obtaining of the flow data packet corresponding to the data flow process comprises: obtaining an initial flow data packet corresponding to the data flow process; performing privacy processing on the privacy information in the initial flow data packet to obtain the flow data packet, wherein the privacy processing is used to realize the privacy of the privacy information.

[0014] In a second aspect, an embodiment of the present application provides a risk behavior identification device, comprising: a data packet obtaining module configured to obtain a flow data packet corresponding to a data flow process; a first flow feature determining module configured to determine a first flow feature of the flow data packet; an anomaly identification module configured to identify an abnormal behavior identification result based at least on the first flow feature; a risk identification module configured to determine a risk behavior identification result corresponding to the data flow process based on the abnormal behavior identification result.

[0015] In a third aspect, an embodiment of the present application provides a non-transitory computer readable storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to implement the steps of the method of any one of the above aspects.

[0016] In a fourth aspect, an embodiment of the present application provides a computer program product comprising computer instructions, wherein the computer instructions are executed by a processor to implement the steps of the method of any one of the above aspects.

[0017] In a fifth aspect, an embodiment of the present application provides a computer device comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement the steps of the method of any one of the above aspects.

[0018] In summary, the embodiments of the present application have at least the following beneficial effects: By adopting the embodiment of the present application, the flow data packet corresponding to the data flow process is obtained, and the first flow feature of the flow data packet is determined. In this way, the flow feature that can more comprehensively and accurately reflect the relevant characteristics of the data flow process is analyzed and obtained from the data flow process. At least based on the first flow feature, the abnormal behavior recognition result is recognized, so as to accurately and comprehensively recognize the abnormal behavior in the data flow process based on the flow feature. Based on the abnormal behavior recognition result, the risk behavior recognition result corresponding to the data flow process is determined, and then the accuracy and comprehensiveness of the risk behavior recognition in the data flow process are improved through the more comprehensive and accurate abnormal behavior recognition result. BRIEF DESCRIPTION OF DRAWINGS

[0019] Figure 1 is a flow diagram of a risk behavior recognition method provided by an embodiment of the present application; Figure 2 is a structural diagram of a risk behavior recognition device provided by an embodiment of the present application; Figure 3 is a schematic diagram of a computer device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0020] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments / examples are only a part of the embodiments / examples of the present application, but not all the embodiments / examples. Based on the embodiments / examples in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0021] In the description of the present application, the terms "first", "second", "third" and the like are only used for description purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features limited by "first", "second", "third" and the like can explicitly or implicitly include one or more of the features. In the description of the present application, unless otherwise specified, the meaning of "multiple" is two or more. In the description of the present application, the term "includes" and its variants are open inclusion, i.e. "includes but is not limited to". The term "based on" is "at least partially based on". The term "according to" is "at least partially according to". The term "one embodiment / example" means "at least one embodiment / example"; the term "another embodiment / example" means "at least one other embodiment / example"; the term "some embodiments / examples" means "at least some embodiments / examples".

[0022] In the description of the application, it is necessary to point out that, unless otherwise explicitly specified and limited, the terms "mount", "connect", "connect" should be understood broadly, for example, it can be fixedly connected, or it can be detachably connected, or integrally connected; it can be mechanically connected, or it can be electrically connected; it can be directly connected, or it can be indirectly connected through an intermediate medium, or it can be connected inside two elements. For those skilled in the art, the specific meaning of the above terms in the application can be understood according to the specific circumstances.

[0023] In the description of the application, it is necessary to point out that, unless otherwise defined, all technical and scientific terms used in the application are the same as those commonly understood by those skilled in the art. The terms used in the specification of the application are only for the purpose of describing the specific embodiments and are not intended to limit the application. For those skilled in the art, the specific meaning of the above terms in the application can be understood according to the specific circumstances.

[0024] In the related art, when the data flow to a certain node, the corresponding user can use the data through the node, so that the behavior data of the user can be analyzed to identify whether there is a risk of data on the node.

[0025] In some exemplary cases, when analyzing the behavior data of the user, behavior features can be extracted from the behavior data (for example, the behavior features can include the corresponding call duration, the number of short messages, and / or the frequency and / or duration of accessing websites of the user on the node), so as to judge whether there is an abnormal behavior (such as frequent login, out-of-place login, high-risk transaction, etc.) by classifying and counting the behavior features, and then identifying whether there is a risk of data on the node.

[0026] However, data is transmitted between multiple nodes in the network, and the mode of risk behavior on different nodes may change over time, which causes the form of risk behavior in the data flow process to change. In the above case, the risk behavior of the user is not considered in the process of data flow between multiple nodes, which leads to the fact that the user risk behavior recognition method at this time is difficult to cope with the new threats and risks caused by the change of risk behavior mode in the data flow process.

[0027] Therefore, the risk behavior identification scheme provided by the embodiments of the present application obtains the flow data packet corresponding to the data flow process, and determines the first flow feature of the flow data packet. Thus, the flow feature that can more comprehensively and accurately reflect the characteristics related to the data flow process is obtained by analyzing the data flow process. At least based on the first flow feature, the abnormal behavior identification result is identified, so as to accurately and comprehensively identify the abnormal behavior in the data flow process based on the flow feature. Based on the abnormal behavior identification result, the risk behavior identification result corresponding to the data flow process is determined, and thus the accuracy and comprehensiveness of the risk behavior identification in the data flow process are improved by the more comprehensive and accurate abnormal behavior identification result.

[0028] In a first aspect, referring to Figure 1 A flow diagram of a risk behavior identification method provided by the embodiments of the present application is shown, which can be applied to a computer device with data processing capability. The method includes S101-S104, and specifically as follows: S101, obtaining a flow data packet corresponding to a data flow process.

[0029] In some examples, the data flow process can refer to the data flowing through multiple flow nodes in the data flow process, so that the flow data packet can be determined according to the data generated in the process of flowing through multiple flow nodes, for example, the flow data packet can include the generated data and / or a flow path, which can be used to indicate the sequential route of the data flowing through multiple flow nodes. Wherein, the same data can flow through at least part of the multiple flow nodes, and the same data can flow through one or more times in one flow node. For example, the multiple times can be understood as the same data flowing through a certain flow node and then flowing through the certain flow node again in the subsequent flow process. Here, the flow data packet can be used to indicate the behavior pattern of the user in the data flow.

[0030] S102, determining the first flow feature of the flow data packet. Thus, the first flow feature can be used to indicate the interaction feature between the flow nodes.

[0031] In some examples, assuming that the flow data packet is a piece of data or a set of multiple pieces of data, the first flow feature can be obtained by performing feature extraction on the flow data packet. The feature extraction can be used to extract the first flow feature from the flow data packet, which is suitable for indicating the flow characteristics in the data flow process. The flow characteristics can include one or more of the following: data characteristics generated by the flow data in the process of flowing through multiple flow nodes, and the sequential route of the flow data on the multiple flow nodes. The feature extraction can be a feature extraction method provided by related technologies, such as feature extraction implemented by an encoder, and the embodiments of the present application are not limited herein.

[0032] In S103, an abnormal behavior recognition result is identified based on the first flow feature.

[0033] In some examples, assuming that the first flow feature is a data feature extracted by an encoder, the abnormal behavior recognition result can be generated by decoding the first flow feature using a decoder adapted to the encoder. In addition, the abnormal behavior recognition result can also be obtained by classifying the first flow feature using a pre-trained classification network, and the embodiments of the present application are not limited herein.

[0034] In S104, a risk behavior recognition result corresponding to the data flow process is determined based on the abnormal behavior recognition result.

[0035] In some examples, baseline analysis and rule analysis can be used to determine the risk of each abnormal behavior indicated / contained in the abnormal behavior recognition result, to obtain a risk determination result of each abnormal behavior. When the risk determination result represents a threat abnormal behavior, a fluorescent marking algorithm can be used to mark the flow path in the flow data packet that matches the threat abnormal behavior, so as to better present the information related to the threat abnormal behavior in the flow data packet. In addition, the marked flow data packet can also be used to train a subsequent abnormal behavior recognition model.

[0036] In other examples, the abnormal behavior recognition result can be directly determined as the risk behavior recognition result corresponding to the data flow process, or a confidence neural network and / or a general confidence estimation algorithm can be used to analyze the abnormal probability of each abnormal behavior in the abnormal behavior recognition result, and the abnormal behaviors with an abnormal probability higher than a preset probability threshold are combined to generate the risk behavior recognition result.

[0037] In an optional implementation, the determination of the first flow feature of the flow data packet includes: extracting data from the flow data packet according to a target parameter type to generate network data; extracting first time sequence information from the network data, and converting the first time sequence information into trajectory information; converting the trajectory information into a flow graph; extracting a first flow feature of the flow data packet from the flow graph.

[0038] In the embodiment, the data extraction according to the target parameter type can help focus on key information and avoid processing redundant fields, thereby improving the efficiency of subsequent processing. In the process of data flow, the flow data packet is affected by time, space, etc. and presents different features at different times and spaces. When identifying abnormal behavior, the first flow feature can be identified by analyzing the flow data packet in time sequence and space sequence, which can help characterize the user behavior in the flow process, thereby improving the accuracy and comprehensiveness of subsequent abnormal behavior identification.

[0039] In some examples, the target parameter type can include at least one of the following: source IP, destination IP, source port, destination port, and transmission layer protocol. Thus, the data extracted from the flow data packet can include at least one of the following: source IP information, destination IP information, source port information, destination port information, and transmission layer protocol information, and the generated network data can be generated by combining the extracted data. Exemplarily, the network data can be a network flow. In the embodiment, the source IP, destination IP, source port, destination port, and transmission layer protocol are analyzed as data, which is beneficial to characterize the user behavior in time and space.

[0040] In some examples, the first time sequence information can be obtained by extracting time sequence from the network data.

[0041] In some examples, the first time sequence information can be mapped to a high-dimensional space to generate trajectory information (e.g., flow trajectory).

[0042] In some examples, the flow graph can be generated by mapping the trajectory information to a two-dimensional plane. Exemplarily, the flow graph can be a graph structure including a plurality of nodes and edges between the nodes, wherein the plurality of nodes can correspond to the plurality of flow nodes one by one.

[0043] In some examples, the first flow feature of the flow data packet can be extracted from the flow graph by using the above feature extraction process.

[0044] In an optional implementation, the converting the first time sequence information into trajectory information includes: determining delay information corresponding to the first time sequence information; converting the first time sequence information into a target space based on the delay information and a mapping dimension of the target space, to obtain a state matrix of the network data, wherein the state matrix is used to indicate the trajectory information.

[0045] In some examples, the delay time of the first time sequence information can be calculated based on the sequence nonlinear feature, and the corresponding delay information is generated according to the delay time.

[0046] In some examples, the target space can include a high-dimensional space, and the first time sequence information can be mapped into the target space based on the delay time of the first time sequence information and the mapping dimension of the target space, to obtain a state matrix of the network data (for example, a network flow) In this way, the state matrix can be used as a discrete representation of the trajectory information, in other words, the discrete representation of the trajectory information can be converted into a matrix form to obtain the state matrix.

[0047] In an optional implementation, the first flow transition feature includes at least one of: a flow transition periodicity of the flow transition graph, wherein the flow transition periodicity of the flow transition graph is determined according to information corresponding to each node of the flow transition graph in the trajectory information and the number of nodes of the flow transition graph; a propagation directionality of the flow transition graph, wherein the propagation directionality of the flow transition graph is determined according to the flow transition periodicity of the flow transition graph and the length of each node of the flow transition graph.

[0048] In some examples, the flow transition periodicity of the flow transition graph can be represented as and the formulaic representation is as follows:

[0049] wherein, is the number of nodes of the flow transition graph, is the Heaviside function, is a preset distance threshold, is a state matrix corresponding to the i th node of the flow transition graph in the trajectory information, is a state matrix corresponding to the j th node of the flow transition graph in the trajectory information.

[0050] In some examples, the propagation directionality of the flow transition graph can be represented as and the formulaic representation is as follows:

[0051] wherein, represents the length of the node of the flow transition graph, a frequency distribution of nodes with lengths of The minimum length value and the maximum length value of the lengths of the nodes in the flow graph are sequentially the minimum length value and the maximum length value of the lengths of the nodes in the flow graph, respectively.

[0052] In an optional implementation, the identifying of the abnormal behavior identification result based on at least the first flow feature includes: The abnormal behavior identification model is called based on the first flow feature and the flow data packet to identify the abnormal behavior identification result.

[0053] In this embodiment, compared with the abnormal behavior identification using only the first flow feature or the flow data packet, the first flow feature and the flow data packet are comprehensively used to more comprehensively and accurately complete the abnormal behavior identification, for example, the first flow feature can be used as an auxiliary / prompt to identify the abnormal behavior of the flow data packet.

[0054] In some examples, the abnormal behavior identification result can be determined based on the first flow feature and the flow data packet by using a pre-trained abnormal behavior identification model. The abnormal behavior identification model can be a model trained to have the ability to use the first flow feature and the flow data packet as model inputs and use the abnormal behavior identification result as model outputs. In the specific training, the first sample flow feature and the sample flow data packet can be used as sample data (the sample data also carries an expected corresponding abnormal label, which represents the corresponding expected abnormal behavior identification result). The model generates a predicted abnormal behavior identification result based on the sample data. Based on the difference between the predicted abnormal behavior identification result and the expected abnormal behavior identification result represented by the label, a general loss function is used to calculate a loss value, and a general training algorithm (such as gradient descent) is used to train the model according to the loss value, so that the trained model can have the above-mentioned ability.

[0055] In an optional implementation, the abnormal behavior identification model includes a time sequence extraction layer, a flow feature extraction layer, a flow feature enhancement layer, and a feature fusion layer. The time sequence extraction layer is configured to extract second time sequence information of the flow data packet. The flow feature extraction layer is configured to perform feature extraction on the second time sequence information to generate forward flow features and reverse flow features. The flow feature enhancement layer is configured to perform feature enhancement processing on the second time sequence information to obtain forward enhanced features and reverse enhanced features. ​​The feature fusion layer is used to perform fusion processing based on the positive enhancement feature, the negative enhancement feature, the positive flow feature, and the negative flow feature to obtain a second flow feature; The abnormal behavior recognition model is used to determine the abnormal behavior recognition result based on the first flow feature and the second flow feature; Here, forward propagation corresponds to forward flow, which is adapted to indicate the process from the previous flow node to the current flow node in the data flow process, and backward propagation corresponds to backward propagation, which is adapted to indicate the process from the current flow node to the next flow node in the data flow process.

[0056] In some examples, data flow can generally be divided into forward propagation and backward propagation. Forward propagation refers to the flow behavior of the current flow node receiving data packets from the previous flow node. Features can be extracted from the information corresponding to this flow behavior in the second time-series information to obtain forward flow features. Backward propagation refers to the flow behavior from the current flow node to the next flow node. Features can be extracted from the information corresponding to this flow behavior in the second time-series information to obtain reverse flow features. Similarly, feature enhancement processing refers to the process of enhancing certain specific features of the corresponding information. In this way, forward enhancement features, reverse enhancement features, forward flow features, and reverse flow features can be fused to obtain the second flow features of the entire flow process. Using the fused second flow features for subsequent abnormal behavior analysis can address new threats and risks arising from changes in risk behavior patterns during data flow, thereby obtaining more comprehensive and accurate abnormal behavior identification results.

[0057] In some examples, the abnormal behavior recognition model may also include a result generation sub-model. This result generation sub-model can be used to perform decoding processing based on the first and second flow features to obtain the abnormal behavior recognition result. In specific implementation, the first and second flow features can be fused to enrich the information content of the fused features, and the fused features can be decoded or classified to obtain a more comprehensive and accurate abnormal behavior recognition result. Alternatively, one of the first and second flow features can be used as a strengthening basis to strengthen the other feature to enrich the information content of the strengthened feature, and the strengthened feature can be decoded or classified to obtain a more comprehensive and accurate abnormal behavior recognition result.

[0058] In some examples, the extraction of forward flow features and reverse flow features can be achieved using the following formulas:

[0059] in, a forward flow turnover periodicity on the kth time sequence, a propagation directionality of the forward flow turnover on the kth time sequence, a forward flow turnover weight, a privacy turnover data packet of the forward flow turnover, a forward flow turnover adjustment weight, a bias matrix of the forward flow turnover, a reverse flow turnover periodicity on the kth time sequence, a propagation directionality of the reverse flow turnover on the kth time sequence, a reverse flow turnover weight, a privacy turnover data packet of the reverse flow turnover, a reverse flow turnover adjustment weight, a bias matrix of the reverse flow turnover.

[0060] In some examples, the obtaining of the forward enhancement feature and the reverse enhancement feature can be implemented by the following formula:

[0061] wherein, the forward enhancement feature, the reverse enhancement feature, an activation function.

[0062] In an optional implementation, the fusion processing based on the forward enhancement feature, the reverse enhancement feature, the forward flow turnover feature and the reverse flow turnover feature to obtain a second flow turnover feature comprises: fusing the forward enhancement feature and the reverse enhancement feature to obtain a fused enhancement feature; combining the fused enhancement feature, the forward flow turnover feature and the reverse flow turnover feature to generate the second flow turnover feature.

[0063] In some examples, the fused enhancement feature can be combined with the forward flow turnover feature, and the fused enhancement feature can be combined with the reverse flow turnover feature, so as to generate the second flow turnover feature by combining the two combinations (for example, the second flow turnover feature can include the two combinations).

[0064] In an optional implementation, the obtaining of the flow turnover data packet corresponding to the data flow turnover process comprises: obtaining an initial flow turnover data packet corresponding to the data flow turnover process; performing privacy processing on privacy information in the initial flow turnover data packet to obtain the flow turnover data packet, wherein the privacy processing is used to realize the privacy of the privacy information.

[0065] In this embodiment, the leakage of core information during the data processing of the data transfer nodes can be avoided, thereby strengthening data security and data privacy protection.

[0066] In some examples, an input information processing unit can be pre-built, which can be configured with a privacy function. This privacy function can be used to implement the above-mentioned privacy processing. In this way, the initial flow data packet can be input into the input information processing unit and the privacy function can be used to privacy process the privacy information in the initial flow data packet. Alternatively, privacy information can be extracted from the initial flow data packet and input into the input information processing unit to privacy process the privacy information using the privacy function.

[0067] In some examples, the privacy processing in any embodiment of this application can be implemented using the following privacy function:

[0068] in, This represents the privatized data transmission data. For the initial flow of data packets The i-th field in for Field length, For privacy functions, This refers to the field information corresponding to the i-th field. for The weight, In order to be in The i-th field corresponding to the addition of encrypted information (e.g., noise) to the input. for Field length, This is the bias value.

[0069] In some examples, the privacy processing in any embodiment of this application may also include at least one of the following: obfuscation processing, encryption processing implemented by an encryption algorithm.

[0070] In some examples, the aforementioned privacy information may include at least some of the fields in the flowing data packet, excluding the source IP field, destination IP field, source port field, destination port field, and transport layer protocol field. Here, the privacy processing for the fields in this embodiment does not include processing of the source IP, destination IP, source port, destination port, and transport layer protocol fields, so that these five fields can be better analyzed during abnormal behavior analysis, thereby improving the accuracy and comprehensiveness of abnormal behavior identification.

[0071] In a second aspect, correspondingly, the embodiments of the present application also provide a risk behavior identification device, which can implement all processes of the risk behavior identification method provided by the above embodiments.

[0072] Referring to Figure 2 FIG. 2 shows a structural schematic diagram of a risk behavior identification device provided by the embodiments of the present application. The risk behavior identification device 200 comprises: a data packet acquisition module 201 configured to acquire flow data packets corresponding to a data flow process; a first flow feature determination module 202 configured to determine a first flow feature of the flow data packets; an anomaly identification module 203 configured to identify an abnormal behavior identification result based at least on the first flow feature; a risk identification module 204 configured to determine a risk behavior identification result corresponding to the data flow process based on the abnormal behavior identification result.

[0073] In an optional implementation, the determination of the first flow feature of the flow data packets comprises: data extraction is performed on the flow data packets according to a target parameter type to generate network data; first time sequence information in the network data is extracted, and the first time sequence information is converted into trajectory information; the trajectory information is converted into a flow graph; feature extraction is performed on the flow graph to obtain the first flow feature of the flow data packets.

[0074] In an optional implementation, the conversion of the first time sequence information into trajectory information comprises: delay information corresponding to the first time sequence information is determined; the first time sequence information is converted into a target space based on the delay information and a mapping dimension of a target space, to obtain a state matrix of the network data, wherein the state matrix is used to indicate the trajectory information.

[0075] In an optional implementation, the first flow feature comprises at least one of the following: flow periodicity of the flow graph, wherein the flow periodicity of the flow graph is determined according to information in the trajectory information corresponding to each node of the flow graph respectively and a node number of the flow graph; propagation directivity of the flow graph, wherein the propagation directivity of the flow graph is determined according to the flow periodicity of the flow graph and lengths of each node in the flow graph.

[0076] In an optional implementation, the identifying the abnormal behavior recognition result based on at least the first flow conversion feature comprises: The abnormal behavior recognition model is called based on the first flow conversion feature and the flow conversion data packet to obtain the abnormal behavior recognition result.

[0077] In an optional implementation, the abnormal behavior recognition model comprises a time sequence extraction layer, a flow conversion feature extraction layer, a flow conversion feature enhancement layer, and a feature fusion layer. The time sequence extraction layer is configured to extract second time sequence information of the flow conversion data packet. The flow conversion feature extraction layer is configured to perform feature extraction on the second time sequence information to generate forward flow conversion features and reverse flow conversion features. The flow conversion feature enhancement layer is configured to perform feature enhancement processing on the second time sequence information to obtain forward enhanced features and reverse enhanced features. The feature fusion layer is configured to perform fusion processing based on the forward enhanced features, the reverse enhanced features, the forward flow conversion features, and the reverse flow conversion features to obtain second flow conversion features. The abnormal behavior recognition model is configured to determine the abnormal behavior recognition result based on the first flow conversion feature and the second flow conversion feature. The forward direction corresponds to the forward propagation, and the forward propagation is suitable for indicating a process from a previous flow conversion node to a current flow conversion node in the data flow conversion process. The reverse direction corresponds to the backward propagation, and the backward propagation is suitable for indicating a process from the current flow conversion node to a next flow conversion node in the data flow conversion process.

[0078] In an optional implementation, the fusion processing based on the forward enhanced features, the reverse enhanced features, the forward flow conversion features, and the reverse flow conversion features to obtain the second flow conversion features comprises: The forward enhanced features and the reverse enhanced features are fused to obtain fused enhanced features. The fused enhanced features, the forward flow conversion features, and the reverse flow conversion features are combined to generate the second flow conversion features.

[0079] In an optional implementation, the obtaining the flow conversion data packet corresponding to the data flow conversion process comprises: An initial flow conversion data packet corresponding to the data flow conversion process is obtained. Privacy information in the initial flow conversion data packet is processed to obtain the flow conversion data packet, wherein the privacy information is processed to achieve privacy of the privacy information.

[0080] In a third aspect, an embodiment of the present application provides a non-transitory computer-readable storage medium having a computer program stored thereon, the computer program, when executed by a processor, implements the steps of any of the methods described above.

[0081] In a fourth aspect, an embodiment of the present application provides a computer program product comprising computer instructions, the computer instructions, when executed by a processor, implement the steps of any of the methods described above.

[0082] In a fifth aspect, an embodiment of the present application provides a computer device comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, the processor, when executing the computer program, implements the steps of any of the methods described above.

[0083] Referring to Figure 3 The computer device of this embodiment comprises a processor 301, a memory 302, and a computer program stored in the memory 302 and executable on the processor 301, such as a risk behavior identification program. The processor 301, when executing the computer program, implements the steps in each of the risk behavior identification method embodiments described above, such as Figure 1 The steps S101-S104 shown.

[0084] For example, the computer program can be divided into one or more modules / units, which are stored in the memory 302 and executed by the processor 301 to complete the present application. The one or more modules / units can be a series of computer program instruction segments capable of completing a specific function, which are used to describe the execution process of the computer program in the computer device.

[0085] The computer device can be a desktop computer, a notebook, a palm computer, and a cloud server, etc. The computer device can include, but is not limited to, the processor 301 and the memory 302. Those skilled in the art can understand that the schematic diagram is only an example of the computer device, and does not limit the computer device, which can include more or fewer components than the diagram, or combine certain components, or different components, for example, the computer device can also include an input / output device, a network access device, a bus, etc.

[0086] The processor 301 can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor 301 can also be any conventional processor. The processor 301 is a control center of the computer device, and connects all parts of the computer device through various interfaces and lines.

[0087] The memory 302 can be used to store computer programs and / or modules, and the processor 301 realizes various functions of the computer device by running or executing computer programs and / or modules stored in the memory 302, and calling data stored in the memory 302. The memory 302 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application program required by a function (such as a sound playing function, an image playing function, etc.), etc.; and the data storage area can store data created according to use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory 302 can include a high-speed random access memory, and can also include a nonvolatile memory, for example, a hard disk, a memory, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, at least one disk storage device, a flash storage device, or other volatile solid-state storage devices.

[0088] The modules / units integrated in the computer device, if realized in the form of software function units and sold or used as independent products, can be stored in a computer readable storage medium. Based on such understanding, all or part of the processes in the above-mentioned embodiment methods can also be completed by a computer program instructing related hardware, and the computer program can be stored in a non-transitory computer readable storage medium. When the computer program is executed by the processor 301, the steps of the above-mentioned various method embodiments can be implemented. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or some intermediate forms, etc. The computer readable medium can include any entity or device, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal, and software distribution medium, etc. that can carry the computer program code.

[0089] In summary, the embodiments of the present application have at least the following beneficial effects: By adopting the embodiments of the present application, the flow data packet corresponding to the data flow process is obtained, and the first flow feature of the flow data packet is determined. In this way, the flow feature that can more comprehensively and accurately reflect the relevant characteristics of the data flow process is analyzed from the process of data flow. At least based on the first flow feature, the abnormal behavior recognition result is recognized, so as to accurately and comprehensively recognize the abnormal behavior in the data flow process based on the flow feature. Based on the abnormal behavior recognition result, the risk behavior recognition result corresponding to the data flow process is determined, and then the accuracy and comprehensiveness of the risk behavior recognition in the data flow process are improved through the more comprehensive and accurate abnormal behavior recognition result.

[0090] Through the description of the above embodiments, those skilled in the art can clearly understand that the present application can be realized by means of software and necessary hardware platform, and of course can be implemented by hardware. Based on such understanding, all or part of the technical solutions of the present application that contribute to the background art can be embodied in the form of a software product. The computer software product can be stored in a storage medium, such as a ROM (Read-Only Memory), a RAM (Random Access Memory), a magnetic disk, an optical disk, etc., and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0091] The above are preferred embodiments of the present application, it should be pointed out that, for those skilled in the technical field, without departing from the principles of the present application, can make several improvements and refinements, these improvements and refinements also considered the scope of protection of the present application.

Claims

1. A method of risk behavior identification, the method comprising: The method comprises: obtaining a flow data packet corresponding to a data flow process; determining a first flow feature of the flow data packet; based on at least the first flow feature, identifying an abnormal behavior identification result; based on the abnormal behavior identification result, determining a risk behavior identification result corresponding to the data flow process.

2. The method of claim 1, wherein, The determination of the first flow feature of the flow data packet comprises: performing data extraction on the flow data packet according to a target parameter type to generate network data; extracting first time sequence information in the network data, and converting the first time sequence information into trajectory information; converting the trajectory information into a flow graph; performing feature extraction on the flow graph to obtain the first flow feature of the flow data packet.

3. The method of claim 2, wherein, The conversion of the first time sequence information into trajectory information comprises: determining delay information corresponding to the first time sequence information; based on the delay information and the mapping dimension of a target space, converting the first time sequence information into the target space to obtain a state matrix of the network data, wherein the state matrix is used to indicate the trajectory information.

4. The method of claim 2, wherein the first flow feature comprises at least one of: a flow periodicity of the flow graph, wherein the flow periodicity of the flow graph is determined according to information corresponding to each node of the flow graph in the trajectory information and the number of nodes of the flow graph; a propagation directionality of the flow graph, wherein the propagation directionality of the flow graph is determined according to the flow periodicity of the flow graph and the length of each node in the flow graph.

5. The method of claim 1, wherein, The identification of the abnormal behavior identification result based on at least the first flow feature comprises: based on the first flow feature and the flow data packet, calling an abnormal behavior identification model for identification to obtain the abnormal behavior identification result.

6. The method of claim 5, wherein, The abnormal behavior identification model comprises a time sequence extraction layer, a flow feature extraction layer, a flow feature enhancement layer, and a feature fusion layer; the time sequence extraction layer is configured to extract second time sequence information of the flow data packet; the flow feature extraction layer is configured to perform feature extraction on the second time sequence information to generate forward flow features and reverse flow features; the flow feature enhancement layer is configured to perform feature enhancement processing on the second time sequence information to obtain forward enhancement features and reverse enhancement features; the feature fusion layer is configured to perform fusion processing based on the forward enhancement features, the reverse enhancement features, the forward flow features, and the reverse flow features to obtain second flow features; the abnormal behavior identification model is configured to determine the abnormal behavior identification result based on the first flow feature and the second flow feature; wherein forward corresponds to forward propagation, and the forward propagation is suitable for indicating a process from a previous flow node to a current flow node in the data flow process, and reverse corresponds to backward propagation, and the backward propagation is suitable for indicating a process from the current flow node to a next flow node in the data flow process.

7. The method of claim 6, wherein, The fusion processing is performed based on the forward enhancement feature, the reverse enhancement feature, the forward flow feature and the reverse flow feature to obtain a second flow feature, including: The forward enhancement feature and the reverse enhancement feature are fused to obtain a fused enhancement feature; The fused enhancement feature, the forward flow feature and the reverse flow feature are combined to generate the second flow feature.

8. The method according to any one of claims 1 to 7, characterized in that, The flow data packet corresponding to the data flow process is obtained, including: An initial flow data packet corresponding to the data flow process is obtained; Privacy information in the initial flow data packet is processed to obtain the flow data packet, wherein the privacy processing is used to realize the privacy of the privacy information.

9. A risk behavior recognition apparatus characterized by comprising: It includes: A data packet acquisition module is configured to acquire a flow data packet corresponding to a data flow process; A first flow feature determination module is configured to determine a first flow feature of the flow data packet; An anomaly identification module is configured to identify an abnormal behavior identification result based on at least the first flow feature; A risk identification module is configured to determine a risk behavior identification result corresponding to the data flow process based on the abnormal behavior identification result.

10. A non-transitory computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the method of any one of claims 1-8.

11. A computer program product comprising computer instructions, characterized in that, The computer program is executed by the processor to implement the method of any one of claims 1-8.

12. A computer device, comprising: It includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and the processor executes the computer program to implement the method of any one of claims 1-8.

Images