Abnormal request detection method and device and nonvolatile storage medium

Abstract

The invention discloses an abnormal request detection method and device and a nonvolatile storage medium. The method comprises the steps that a real-time request sequence in a target network system is acquired, and the real-time request sequence comprises a plurality of requests arranged according to a preset sequence; a state transition matrix corresponding to the target network system is determined, the state transition matrix comprises transition probabilities among different types of requests, and one type of request represents the request matched with the service function; and based on the state transition matrix, judging whether transition between any two adjacent requests in the real-time request sequence is abnormal or not, and obtaining an anomaly detection result of the real-time request sequence. According to the invention, the technical problem that a conventional detection method based on a static rule or a fixed state machine has limitations in the aspects of adaptability and false alarm rate at present is solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to an abnormal request detection method and device and a nonvolatile storage medium. BACKGROUND

[0002] Under the background of rapidly developing Internet technology, Web systems are facing increasingly complex business process challenges. These processes are usually composed of a series of ordered request steps, each of which performs specific functions such as identity verification, permission checking, session initialization, etc., aiming to ensure the legality and security of business operations. However, with the continuous evolution of attack means, process bypass attacks have become a prominent problem threatening the integrity of Web systems. In such attacks, attackers exploit technical vulnerabilities or insecure configurations to tamper with request sequences, attempting to bypass critical security checks or business logic (such as bypassing permission checks to directly access sensitive data), posing a significant risk to system functionality and data security.

[0003] Current process bypass detection techniques mainly rely on rule-based engines or static finite state machine models. The former predefines a series of business compliance rules, requiring all user request sequences to strictly follow the predefined path, and any deviation from the predefined path will be considered as a potential attack. The latter uses the concept of finite state machine to define a state transition graph of each operation in the business process, with each state representing a business step and the transition between states being determined based on predefined rules. Although these two methods can detect process bypass attempts to some extent, they are limited by the rigidity of static rules and are difficult to cope with dynamic and variable business logic in modern Web systems, as well as the highly flexible request processing mechanism under microservice architecture.

[0004] To address the above problems, no effective solutions have been proposed so far. SUMMARY

[0005] The embodiments of the present application provide an abnormal request detection method, device and nonvolatile storage medium to at least solve the technical problem of the limitations of current traditional detection methods based on static rules or fixed state machines in adaptability and false positive rate.

[0006] According to an aspect of an embodiment of the present application, an abnormal request detection method is provided, including: obtaining a real-time request sequence in a target network system, wherein the real-time request sequence includes a plurality of requests arranged in a preset order; determining a state transition matrix corresponding to the target network system, wherein the state transition matrix includes transition probabilities between different categories of requests, and a category of requests represents requests matching a business function; and determining whether a transition between any two adjacent requests in the real-time request sequence is abnormal based on the state transition matrix to obtain an abnormal detection result of the real-time request sequence.

[0007] Optionally, determining the state transition matrix corresponding to the target network system includes: obtaining a plurality of historical request sequences in the target network system; determining frequent request sequences in the plurality of historical request sequences with a frequency greater than a preset frequency threshold; and constructing the state transition matrix based on transition probabilities between any two adjacent requests in the frequent request sequences.

[0008] Optionally, obtaining a plurality of historical request sequences corresponding to the target network system includes: obtaining a plurality of requests included in the target network system; extracting respective features of the plurality of requests, wherein the features include a request URL, a session identifier, a timestamp, a request message structure, and a return message structure; classifying the plurality of requests based on the features to obtain a plurality of request categories; and obtaining a plurality of historical sessions in the target network system, and converting the plurality of historical sessions into the plurality of historical request sequences based on the plurality of request categories.

[0009] Optionally, classifying the plurality of requests based on the features to obtain a plurality of request categories includes: mapping the plurality of requests to a preset coordinate system to obtain a plurality of data points; determining core points, boundary points, and noise points in the plurality of data points; removing the noise points, and dividing the boundary points with the core points as the center to obtain an initial classification result, wherein the initial classification result includes a plurality of initial clusters and cluster centers corresponding to the initial clusters; re-dividing the cluster centers based on a total sum of intra-cluster squared errors of the initial clusters; repeating the step of re-dividing the cluster centers until the cluster centers no longer change or a preset number of repetitions reaches a preset number threshold to obtain a target classification result; and determining the plurality of request categories based on the target classification result.

[0010] Optionally, determining whether a transition between any two adjacent requests in the real-time request sequence is abnormal based on the state transition matrix to obtain an abnormal detection result of the real-time request sequence includes: determining a transition probability between any two adjacent requests in the state transition matrix; determining whether the transition probability exceeds a preset probability threshold; and determining that the real-time request sequence is abnormal in a case where the transition probability between any two adjacent requests in the real-time request sequence does not exceed the probability threshold.

[0011] Optionally, the state transition matrix is ​​updated based on the real-time request sequence to obtain the updated state transition matrix.

[0012] According to another aspect of the present invention, an abnormal request detection device is also provided, comprising: an acquisition module, configured to acquire a real-time request sequence in a target network system, wherein the real-time request sequence includes multiple requests arranged in a preset order; a determination module, configured to determine a state transition matrix corresponding to the target network system, wherein the state transition matrix includes transition probabilities between different categories of requests, and a category of requests represents requests that match the business function; and a judgment module, configured to determine, based on the state transition matrix, whether there is an abnormality in the transition between any two adjacent requests in the real-time request sequence, and obtain an abnormality detection result of the real-time request sequence.

[0013] According to another aspect of the present invention, a non-volatile storage medium is also provided, the non-volatile storage medium including a stored program, wherein, when the program is running, the device where the non-volatile storage medium is located is controlled to execute any of the above-described abnormal request detection methods.

[0014] According to another aspect of the present invention, a computer device is also provided, the computer device including a processor, the processor being configured to run a program, wherein the program executes any of the above-described abnormal request detection methods during runtime.

[0015] According to another aspect of the present invention, a computer program product is also provided, including a computer program that, when executed by a processor, implements any of the above-described abnormal request detection methods.

[0016] In this embodiment of the invention, an abnormal request detection method is employed. This method acquires a real-time request sequence from a target network system, where the real-time request sequence includes multiple requests arranged in a preset order. A state transition matrix corresponding to the target network system is determined, where the state transition matrix includes the transition probabilities between different categories of requests, with each category representing a request matching a business function. Based on the state transition matrix, it is determined whether there is an anomaly in the transition between any two adjacent requests in the real-time request sequence, thus obtaining the anomaly detection result for the real-time request sequence. This achieves the goal of rapidly responding to new attack patterns and automatically adapting to changes in business logic, thereby significantly improving the accuracy and efficiency of abnormal request detection. Furthermore, it solves the technical problem that traditional detection methods based on static rules or fixed state machines have limitations in adaptability and false positive rates. Attached Figure Description

[0017] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0018] Figure 1 A hardware structure block diagram of a computer terminal for implementing an abnormal request detection method is shown.

[0019] Figure 2 This is a flowchart illustrating the abnormal request detection method provided in an embodiment of the present invention;

[0020] Figure 3 This is a logical schematic diagram of a data-driven unsupervised request classification module provided by an optional embodiment of the present invention;

[0021] Figure 4 This is a logical diagram of a multi-dimensional dependency mining module based on session context provided by an optional embodiment of the present invention;

[0022] Figure 5 This is a logical schematic diagram of a dynamic finite state machine real-time detection and online learning module provided by an optional embodiment of the present invention;

[0023] Figure 6 This is a structural block diagram of an abnormal request detection device provided according to an embodiment of the present invention. Detailed Implementation

[0024] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0025] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0026] First, some nouns or terms that appear in the description of the embodiments of this application shall be interpreted as follows:

[0027] Process bypass refers to the act of an attacker skipping key business steps or violating the logic of a pre-defined business process through a series of operations.

[0028] A state transition matrix is ​​a data model that describes the rules and probability distribution of state transitions between requests in a business scenario.

[0029] A finite state machine is a mathematical model that represents a finite number of states and the transitions and actions between these states. It consists of a set of states, an initial state, inputs, and transition functions that transform the current state into the next state. It can determine whether the next request of the current request satisfies the transition function, and thus determine whether there is a process bypass.

[0030] According to an embodiment of the present invention, an embodiment of an abnormal request detection method is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0031] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal for implementing an abnormal request detection method is shown. Figure 1 As shown, the computer terminal 10 may include one or more processors (shown as 102a, 102b, ..., 102n in the figure) (the processor may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0032] It should be noted that the aforementioned one or more processors and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10. As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0033] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the abnormal request detection method in this embodiment of the invention. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby implementing the above-mentioned abnormal request detection method for the application. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0034] The display can be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10.

[0035] Figure 2 This is a flowchart illustrating the abnormal request detection method provided in an embodiment of the present invention, as shown below. Figure 2 As shown, the method includes the following steps:

[0036] Step S201: Obtain the real-time request sequence in the target network system, wherein the real-time request sequence includes multiple requests arranged in a preset order.

[0037] In this step, within the target web network system, the real-time request sequence refers to a series of requests received by the web system in chronological order during user interaction. These requests encompass various user operations on the web system, such as logging in, browsing products, adding items to the cart, making payments, and confirming orders; they constitute the sequence of steps a user takes to complete a specific business process. Acquiring the real-time request sequence typically involves real-time monitoring and parsing of web system logs, as well as listening to and extracting network communication packets to ensure that request information is captured at every moment of the user session. This sequence not only contains metadata for each request (such as URL, timestamp, and session ID) but also reflects the logical relationships and temporal order between requests, making it a crucial data source for analyzing user behavior patterns and detecting process bypass attacks.

[0038] Step S202: Determine the state transition matrix corresponding to the target network system. The state transition matrix includes the transition probabilities between different categories of requests. A category of request represents a request that matches the business function.

[0039] In this step, the state transition matrix depicts a dynamic behavioral map of user operations in the target network system by quantifying the transition probabilities between different categories of requests. A request category, automatically identified and categorized by a data-driven unsupervised request classification module, represents a set of requests with similar business functions within the web system, such as user authentication and product browsing. The generation and maintenance of the state transition matrix are based on deep learning from a large amount of user request data; it can self-evolve and adapt to new business logic and user behavior patterns. This data-driven dynamic modeling approach is more flexible and accurate than traditional static rules or predefined state machines, effectively identifying subtle differences between normal operations and potential bypass behaviors, thereby improving detection accuracy and system adaptability.

[0040] Step S203: Based on the state transition matrix, determine whether there is an anomaly in the transition between any two adjacent requests in the real-time request sequence, and obtain the anomaly detection result of the real-time request sequence.

[0041] In this step, when a real-time request sequence is captured, the requests in the sequence are matched with the request categories in the state transition matrix. For each pair of adjacent requests in the sequence, the transition probability between the corresponding request categories in the matrix can be queried. If the transition probability of a request pair is significantly lower than a preset threshold, it means that the transition behavior rarely occurs in historical data or is completely inconsistent with the expected business process. This transition will then be regarded as a potential abnormal operation, thereby triggering further anomaly detection results.

[0042] Through the above steps, the goal of quickly responding to new attack patterns and automatically adapting to changes in business logic is achieved, thereby significantly improving the accuracy and efficiency of abnormal request detection. This solves the technical problem that traditional detection methods based on static rules or fixed state machines have limitations in terms of adaptability and false alarm rate.

[0043] As an optional embodiment, determining the state transition matrix corresponding to the target network system includes: obtaining multiple historical request sequences in the target network system; identifying frequent request sequences among the multiple historical request sequences whose frequency is greater than a preset frequency threshold; and constructing a state transition matrix based on the transition probability between any two adjacent requests in the frequent request sequence.

[0044] Optionally, constructing the state transition matrix corresponding to the target network system involves in-depth analysis of its historical request data. First, a large number of past user request sequences can be collected. These sequences contain the complete historical record of user interactions with the web system, grouped by session and sorted according to request order. Next, data mining techniques, especially frequent sequence mining algorithms (such as PrefixSpan, Prefix-Projected Sequential Patternmining), can be used to filter out request sequence combinations that occur more frequently than a preset threshold; these are frequent request sequences. These sequences represent the most common behavioral paths users take when using the web system, covering legitimate business processes and operational habits.

[0045] Based on the mined frequent request sequences, the transition probability between any two adjacent requests can be quantitatively evaluated, and the preceding request cluster X can be statistically analyzed. i To the successor cluster X j The conditional probability P(X) j |X i This involves quantifying the probability of one operation immediately following another. For example, P(C|B)=0.98 represents the transition probability of B→C being 0.98. In e-commerce, this could refer to the probability of "adding to cart" immediately following "browsing a product." These probability values ​​are organized into a state transition matrix, where rows and columns correspond to request categories, and each element in the matrix represents the probability of transitioning from one request category to another. This generates a sparse state transition matrix M, where the matrix elements M... ij =P(X j |X i This matrix vividly depicts the logical structure of business processes and user behavior patterns within a web system, providing a dynamic and data-driven benchmark for anomaly detection in real-time request sequences.

[0046] By leveraging data mining techniques, complex dependencies (including branching, rollback, and parallelism) in business processes can be automatically and quantitatively extracted from real user behavior, generating dynamic and probabilistic state transition models. This replaces the cumbersome, error-prone, and rigid manual rule definition process of traditional solutions, enabling the automated construction and continuous updating of business process models.

[0047] As an optional embodiment, obtaining multiple historical request sequences corresponding to the target network system includes: obtaining multiple requests included in the target network system; extracting features of each of the multiple requests, wherein the features include request URL, session identifier, timestamp, request message structure, and return message structure; classifying the multiple requests based on the features to obtain multiple request categories; obtaining multiple historical sessions in the target network system; and converting the multiple historical sessions into multiple historical request sequences based on the multiple request categories.

[0048] Optionally, to construct the state transition matrix corresponding to the target network system, it is first necessary to comprehensively understand the historical request data of the system. This process begins with collecting all request instances in the system, covering different business functions and operations, such as user login, product browsing, and payment confirmation. Subsequently, key features can be extracted from each request, including the request URL, unique session ID, timestamp, specific structure of the request message, and format of the response message. Next, using data-driven unsupervised clustering technology, requests are automatically classified according to the extracted features, forming a series of request categories, each representing a specific business function or operational nature. For example, all requests involving user authentication may be grouped into one category, while payment-related operations may be grouped into another, such as login requests being classified as category A and payment requests as category B. This classification does not require manual pre-setting and relies entirely on machine learning algorithms to understand and identify the inherent patterns in the request data. Finally, by parsing historical sessions, they are reconstructed into a series of historical request sequences according to the above classification. Each sequence is a series of requests arranged in chronological or logical order, reflecting the user's actual operation process during the session.

[0049] As an optional embodiment, multiple requests are classified based on features to obtain multiple request categories, including: mapping multiple requests to a preset coordinate system to obtain multiple data points; identifying core points, boundary points, and noise points among the multiple data points; removing noise points and dividing boundary points with the core points as the center to obtain an initial classification result, wherein the initial classification result includes multiple initial clusters and the cluster centers corresponding to the initial clusters; re-dividing the cluster centers based on the sum of the intra-cluster squared errors of the initial clusters; repeating the above steps of re-dividing the cluster centers until the cluster centers no longer change or the number of repetitions reaches a preset threshold to obtain a target classification result; and determining multiple request categories based on the target classification result.

[0050] Optionally, firstly, each request can be mapped to a point in a coordinate system based on request characteristics such as request URL, session ID, and timestamp. Then, using the density clustering properties of the DBSCAN algorithm, core and boundary points among these data points are identified, while isolated points considered noise are removed, thus initially determining the dense regions of requests for different business functions. In this stage, DBSCAN automatically discovers the natural cluster structure in the request data by setting appropriate distance radii and minimum neighboring points.

[0051] However, DBSCAN has certain limitations in handling high-dimensional spaces and determining cluster centers. The K-Means clustering algorithm can compensate for this. It uses the noise-free, initial classification data output by DBSCAN as a foundation to further refine the classification. By iteratively calculating the centroid of each cluster, K-Means optimizes the cluster boundaries, ensuring that requests within a cluster are as similar as possible, and the differences between clusters are as large as possible. This process continues until the cluster centers stabilize or a predetermined maximum number of iterations is reached, ultimately yielding clear and stable request classification results, i.e., multiple request categories.

[0052] This hybrid clustering strategy leverages DBSCAN's strengths in handling complex data shapes and automatically identifying cluster numbers, while also utilizing K-Means' expertise in finding dense cluster centers on high-dimensional datasets. This results in a highly efficient classification framework that can both handle data noise interference and capture the inherent business logic characteristics of requests, providing a solid data foundation for the subsequent construction of state transition matrices and process bypass detection.

[0053] As an optional embodiment, based on the state transition matrix, it is determined whether there is an anomaly in the transition between any two adjacent requests in the real-time request sequence, and an anomaly detection result of the real-time request sequence is obtained, including: determining the transition probability between any two adjacent requests in the state transition matrix; determining whether the transition probability exceeds a preset probability threshold; and determining that there is an anomaly in the real-time request sequence if the transition probability between any two adjacent requests in the real-time request sequence does not exceed the probability threshold.

[0054] Optionally, based on a dynamically constructed state transition matrix, user request sequences can be monitored in real time to assess whether the transition between any two consecutive requests is abnormal. Specifically, when a new request sequence arrives, the state transition matrix can be quickly consulted to find the recorded transition probabilities between any two adjacent requests in the sequence. If this probability is lower than a preset security threshold, it means that the current request transition does not conform to typical historical patterns, thus indicating that there may be bypass behavior in the request sequence, i.e., an anomaly. This mechanism, through quantitative analysis, can detect operations that may violate business process logic in the first instance, effectively ensuring the security of network applications and the integrity of data.

[0055] As an optional embodiment, the state transition matrix is ​​updated based on the real-time request sequence to obtain the updated state transition matrix.

[0056] Optionally, upon capturing a new real-time request sequence, this data is not simply discarded or used only for immediate analysis. Instead, an online learning mechanism feeds the information from the new request sequence back into the state transition matrix, enabling continuous updating and optimization of the matrix. Specifically, the transition patterns between requests in the real-time request sequence can be analyzed, compared with the existing state transition matrix, new transition probabilities can be calculated, and the corresponding elements in the matrix can be adjusted based on these probabilities. This process is often performed asynchronously in the background without affecting the main detection process, ensuring real-time evolution of the model without interrupting business operations. In this way, the state transition matrix can gradually incorporate the latest user behavior patterns, continuously enhancing its ability to identify emerging bypass attacks and achieving adaptive improvement.

[0057] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to the present invention.

[0058] Through the above description of the embodiments, those skilled in the art can clearly understand that the abnormal request detection method according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platform. Of course, it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0059] As an optional embodiment, a closed-loop system for detecting abnormal requests is also provided. This system may include a data-driven unsupervised request classification module, a session context-based multi-dimensional dependency mining module, and a dynamic finite state machine real-time detection and online learning module.

[0060] Optionally, Figure 3 This is a logical diagram of a data-driven unsupervised request classification module provided by an optional embodiment of the present invention, such as... Figure 3 As shown, the system first collects massive amounts of user request logs, abandoning the traditional method of manually defining request types. Instead, it uses hybrid clustering to automatically classify request features (such as authentication and payment operations). This dynamic classification mechanism is the basis for the adaptive capability of the closed-loop system, which differs from static rule systems. It can automatically identify and classify new request patterns without manual intervention, enabling the system to automatically adapt to new request types and business scenarios. This lays an automated and data-driven foundation for subsequent dependency mining.

[0061] Figure 4 This is a logical diagram of a multi-dimensional dependency mining module based on session context provided by an optional embodiment of the present invention, such as... Figure 4 As shown, this module breaks through the limitations of traditional static rules or simple sequence matching. Based on the classified request data, it uses a frequent sequence mining algorithm to deeply analyze the contextual dependencies of request sequences within a session and quantifies the strength of these dependencies. It dynamically generates and maintains a state transition matrix that reflects the complex dependencies of real business processes. This matrix is ​​not a simple sequential list, but rather captures the potential, non-linear, multi-branch path probability distribution that conforms to the regulations in the business process.

[0062] Figure 5 This is a logical diagram of a dynamic finite state machine real-time detection and online learning module provided by an optional embodiment of the present invention, such as... Figure 5As shown, this module, serving as the core detection engine, is not a predefined static state machine, but rather a finite state machine dynamically constructed and updated based on a real-time learned state transition matrix. This module innovatively employs a double-buffering mechanism: the main thread continuously matches user request sequences to determine if they conform to the normal probability path defined by the current state transition matrix; the secondary thread asynchronously and incrementally updates the state transition matrix parameters, absorbing new user behavior data to achieve adaptive evolution of the model. An alarm is triggered when an abnormal transition is detected (e.g., a transition probability far below a threshold).

[0063] Through the deep collaboration and closed-loop feedback of the three modules mentioned above, an adaptive security protection system capable of automatically learning, dynamically modeling, detecting in real time, and continuously evolving from massive amounts of user behavior data has been constructed. It effectively addresses the fundamental shortcomings of traditional solutions in terms of dynamic adaptability, maintenance costs, and false positive rates.

[0064] According to embodiments of the present invention, an apparatus for implementing the above-described abnormal request detection method is also provided. Figure 6 This is a structural block diagram of an anomaly request detection device provided according to an embodiment of the present invention, such as... Figure 6 As shown, the device includes: an acquisition module 61, a determination module 62, and a judgment module 63. The device will be described below.

[0065] The acquisition module 61 is used to acquire a real-time request sequence in the target network system, wherein the real-time request sequence includes multiple requests arranged in a preset order.

[0066] The determination module 62, connected to the acquisition module 61, is used to determine the state transition matrix corresponding to the target network system. The state transition matrix includes the transition probabilities between different categories of requests, and a category of request represents a request that matches the business function.

[0067] The judgment module 63, connected to the determination module 62, is used to determine whether there is an anomaly in the transition between any two adjacent requests in the real-time request sequence based on the state transition matrix, and to obtain the anomaly detection result of the real-time request sequence.

[0068] It should be noted that the acquisition module 61, determination module 62, and judgment module 63 mentioned above correspond to steps S201 to S203 in the embodiments. Multiple modules and their corresponding steps implement the same instances and application scenarios, but are not limited to the content disclosed in the above embodiments. It should also be noted that the above modules, as part of the device, can run on the computer terminal 10 provided in the embodiments.

[0069] Embodiments of the present invention may provide a computer device. Optionally, in this embodiment, the computer device may be located in at least one of a plurality of network devices in a computer network. The computer device includes a memory and a processor.

[0070] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the abnormal request detection method and apparatus in this embodiment of the invention. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby realizing the above-mentioned abnormal request detection method. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to a computer terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0071] The processor can invoke information and application programs stored in the memory through the transmission device to perform the following steps: acquiring a real-time request sequence in the target network system, wherein the real-time request sequence includes multiple requests arranged in a preset order; determining the state transition matrix corresponding to the target network system, wherein the state transition matrix includes the transition probabilities between different categories of requests, and a category of request represents a request that matches the business function; based on the state transition matrix, determining whether there is an anomaly in the transition between any two adjacent requests in the real-time request sequence, and obtaining the anomaly detection result of the real-time request sequence.

[0072] Optionally, the processor may also execute program code for the following steps: determining the state transition matrix corresponding to the target network system, including: acquiring multiple historical request sequences in the target network system; identifying frequent request sequences among the multiple historical request sequences whose frequency is greater than a preset frequency threshold; and constructing a state transition matrix based on the transition probability between any two adjacent requests in the frequent request sequence.

[0073] Optionally, the processor may also execute program code that performs the following steps: obtaining multiple historical request sequences corresponding to the target network system, including: obtaining multiple requests included in the target network system; extracting features of each of the multiple requests, wherein the features include request URL, session identifier, timestamp, request message structure, and return message structure; classifying the multiple requests based on the features to obtain multiple request categories; obtaining multiple historical sessions in the target network system; and converting the multiple historical sessions into multiple historical request sequences based on the multiple request categories.

[0074] Optionally, the processor may also execute program code for the following steps: classifying multiple requests based on features to obtain multiple request categories, including: mapping multiple requests to a preset coordinate system to obtain multiple data points; determining core points, boundary points, and noise points among the multiple data points; removing noise points, dividing boundary points with the core points as the center, and obtaining an initial classification result, wherein the initial classification result includes multiple initial clusters and the cluster centers corresponding to the initial clusters; re-dividing the cluster centers based on the sum of the intra-cluster squared errors of the initial clusters; repeating the above steps of re-dividing the cluster centers until the cluster centers no longer change or the number of repetitions reaches a preset threshold, to obtain a target classification result; and determining multiple request categories based on the target classification result.

[0075] Optionally, the processor may also execute program code that performs the following steps: based on the state transition matrix, determine whether there is an anomaly in the transition between any two adjacent requests in the real-time request sequence, and obtain the anomaly detection result of the real-time request sequence, including: determining the transition probability between any two adjacent requests in the state transition matrix; determining whether the transition probability exceeds a preset probability threshold; and determining that there is an anomaly in the real-time request sequence if the transition probability between any two adjacent requests in the real-time request sequence does not exceed the probability threshold.

[0076] Optionally, the processor may also execute program code that updates the state transition matrix based on the real-time request sequence to obtain the updated state transition matrix.

[0077] This invention provides an abnormal request detection method. By acquiring a real-time request sequence from a target network system, where the real-time request sequence includes multiple requests arranged in a preset order; determining the state transition matrix corresponding to the target network system, where the state transition matrix includes transition probabilities between different categories of requests, with each category representing a request matching a business function; and based on the state transition matrix, determining whether there is an anomaly in the transition between any two adjacent requests in the real-time request sequence, thus obtaining the anomaly detection result of the real-time request sequence. This achieves the goal of rapidly responding to new attack patterns and automatically adapting to changes in business logic, thereby significantly improving the accuracy and efficiency of abnormal request detection. Furthermore, it solves the technical problem that traditional detection methods based on static rules or fixed state machines have limitations in adaptability and false positive rates.

[0078] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a non-volatile storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0079] Embodiments of the present invention also provide a non-volatile storage medium. Optionally, in this embodiment, the aforementioned non-volatile storage medium can be used to store the program code executed by the abnormal request detection method provided in the above embodiments.

[0080] Optionally, in this embodiment, the non-volatile storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0081] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: obtaining a real-time request sequence in the target network system, wherein the real-time request sequence includes multiple requests arranged in a preset order; determining the state transition matrix corresponding to the target network system, wherein the state transition matrix includes the transition probabilities between different categories of requests, and a category of request represents a request that matches the business function; based on the state transition matrix, determining whether there is an anomaly in the transition between any two adjacent requests in the real-time request sequence, and obtaining the anomaly detection result of the real-time request sequence.

[0082] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: determining the state transition matrix corresponding to the target network system, including: acquiring multiple historical request sequences in the target network system; determining frequent request sequences among the multiple historical request sequences whose frequency is greater than a preset frequency threshold; and constructing a state transition matrix based on the transition probability between any two adjacent requests in the frequent request sequence.

[0083] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: obtaining multiple historical request sequences corresponding to the target network system, including: obtaining multiple requests included in the target network system; extracting features of each of the multiple requests, wherein the features include request URL, session identifier, timestamp, request message structure, and return message structure; classifying the multiple requests based on the features to obtain multiple request categories; obtaining multiple historical sessions in the target network system; and converting the multiple historical sessions into multiple historical request sequences based on the multiple request categories.

[0084] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: classifying multiple requests based on features to obtain multiple request categories, including: mapping multiple requests to a preset coordinate system to obtain multiple data points; determining core points, boundary points, and noise points among the multiple data points; removing noise points, dividing boundary points with the core points as the center, to obtain an initial classification result, wherein the initial classification result includes multiple initial clusters and the cluster centers corresponding to the initial clusters; re-dividing the cluster centers based on the sum of the intra-cluster squared errors of the initial clusters; repeating the above steps of re-dividing the cluster centers until the cluster centers no longer change or the number of repetitions reaches a preset threshold number to obtain a target classification result; and determining multiple request categories based on the target classification result.

[0085] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: based on the state transition matrix, determining whether there is an anomaly in the transition between any two adjacent requests in the real-time request sequence, and obtaining an anomaly detection result of the real-time request sequence, including: determining the transition probability between any two adjacent requests in the state transition matrix; determining whether the transition probability exceeds a preset probability threshold; and determining that there is an anomaly in the real-time request sequence if the transition probability between any two adjacent requests in the real-time request sequence does not exceed the probability threshold.

[0086] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: updating the state transition matrix based on the real-time request sequence to obtain the updated state transition matrix.

[0087] Embodiments of the present invention also provide a computer program product, including a computer program. Optionally, in this embodiment, when the computer program is executed by a processor, it can: acquire a real-time request sequence in a target network system, wherein the real-time request sequence includes multiple requests arranged in a preset order; determine a state transition matrix corresponding to the target network system, wherein the state transition matrix includes transition probabilities between different categories of requests, and a category of requests represents requests that match the business function; based on the state transition matrix, determine whether there is an anomaly in the transition between any two adjacent requests in the real-time request sequence, and obtain an anomaly detection result for the real-time request sequence.

[0088] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0089] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0090] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0091] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0092] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0093] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a non-volatile storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0094] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. An abnormal request detection method characterized by comprising: The method comprises the following steps: acquiring a real-time request sequence in a target network system, wherein the real-time request sequence comprises a plurality of requests arranged in a preset order; determining a state transition matrix corresponding to the target network system, wherein the state transition matrix comprises transition probabilities between different categories of requests, and a category of requests represents requests matching a business function; judging whether there is an abnormal transition between any two adjacent requests in the real-time request sequence based on the state transition matrix, to obtain an abnormality detection result of the real-time request sequence.

2. The method of claim 1, wherein, The determination of the state transition matrix corresponding to the target network system comprises: acquiring a plurality of historical request sequences in the target network system; determining frequent request sequences in the plurality of historical request sequences with a frequency greater than a preset frequency threshold; constructing the state transition matrix based on transition probabilities between any two adjacent requests in the frequent request sequences.

3. The method of claim 2, wherein, The acquisition of the plurality of historical request sequences corresponding to the target network system comprises: acquiring a plurality of requests included in the target network system; extracting respective features of the plurality of requests, wherein the features comprise request URLs, session identifiers, timestamps, request message structures, and return message structures; classifying the plurality of requests based on the features to obtain a plurality of request categories; acquiring a plurality of historical sessions in the target network system; converting the plurality of historical sessions into a plurality of historical request sequences based on the plurality of request categories.

4. The method of claim 3, wherein, The classification of the plurality of requests based on the features to obtain a plurality of request categories comprises: mapping the plurality of requests to a preset coordinate system to obtain a plurality of data points; determining core points, boundary points, and noise points in the plurality of data points; removing the noise points, and dividing the boundary points with the core points as the center to obtain an initial classification result, wherein the initial classification result comprises a plurality of initial clusters and cluster centers corresponding to the initial clusters; re-dividing the cluster centers based on a sum of intra-cluster squared errors of the initial clusters; repeating the step of re-dividing the cluster centers until the cluster centers no longer change or the number of repetitions reaches a preset number threshold, to obtain a target classification result; determining the plurality of request categories based on the target classification result.

5. The method of claim 1, wherein, The judgment of whether there is an abnormal transition between any two adjacent requests in the real-time request sequence based on the state transition matrix to obtain an abnormality detection result of the real-time request sequence comprises: determining a transition probability between the any two adjacent requests in the state transition matrix; judging whether the transition probability exceeds a preset probability threshold; in a case where the transition probability between any two adjacent requests in the real-time request sequence does not exceed the probability threshold, determining that the real-time request sequence is abnormal.

6. The method according to any one of claims 1 to 5, characterized in that, The method further comprises: updating the state transition matrix based on the real-time request sequence to obtain an updated state transition matrix.

7. An abnormal request detection apparatus characterized by comprising: The method comprises the following steps: acquiring a real-time request sequence in a target network system, wherein the real-time request sequence comprises a plurality of requests arranged in a preset order; The determining module is configured to determine a state transition matrix corresponding to the target network system, wherein the state transition matrix comprises transition probabilities between different categories of requests, and a category of requests represents requests matching a business function; The determining module is configured to determine a state transition matrix corresponding to the target network system, wherein the state transition matrix comprises transition probabilities between different categories of requests, and a category of requests represents requests matching a business function; 8. A non-volatile storage medium, comprising: The non-volatile storage medium comprises a stored program, wherein the program, when executed, controls a device in which the non-volatile storage medium is located to perform the abnormal request detection method of any one of claims 1 to 6.

9. A computer device, comprising: Comprise: A memory and a processor, The memory stores a computer program; The processor is configured to execute the computer program stored in the memory, and the computer program, when executed, causes the processor to perform the abnormal request detection method of any one of claims 1 to 6.

10. A computer program product comprising a computer program, characterized in that, The computer program, when executed by the processor, implements the abnormal request detection method of any one of claims 1 to 6.

Images