A method, device and medium for detecting abnormal website behavior through multi-source data fusion

Abstract

This application discloses a method, device, and medium for detecting abnormal website behavior through multi-source data fusion, belonging to the field of website anomaly detection technology. It addresses the problem that existing technologies struggle to accurately detect highly concealed and logically complex abnormal website behaviors in a timely manner. The method includes: extracting behavioral data from acquired multi-source website interaction data and aggregating the behavioral data into a website interaction intent chain; performing conditional independence testing and high-risk malicious pattern detection on the website interaction intent chain based on a pre-set initial causal graph, and constructing a cross-layer temporal causal graph of website interactions based on the detection results; performing counterfactual reasoning on the cross-layer temporal causal graph of website interactions, and simulating and correcting the cross-layer temporal causal graph of website interactions based on the reasoning results; determining the minimum correction intervention cost corresponding to the cross-layer temporal causal graph of website interactions conforming to a pre-set business reference logic; and determining that if the minimum correction intervention cost is greater than a preset threshold, the website exhibits abnormal behavior.

Description

Technical Field

[0001] This application relates to the field of website anomaly detection technology, and in particular to a method, device and medium for detecting abnormal website behavior by multi-source data fusion. Background Technology

[0002] With the profound development of internet technology, websites have become the core carriers of social operation and business activities. However, their openness and complexity have also made them a primary target of cyberattacks. Various web application attacks, such as data scraping, credential stuffing, exploiting business logic vulnerabilities, and fraudulent transactions, are becoming increasingly rampant, posing serious security risks and economic losses to enterprises and users.

[0003] In existing technologies, security experts typically rely on predefined rules to detect abnormal website behavior, such as matching specific IP blacklists and abnormal access frequency thresholds. While this method is intuitive, it cannot adapt to new and variant attack patterns and is easily bypassed by attackers.

[0004] Based on this, a method using machine learning models to detect anomalies based on single-point features such as request parameters, access frequency, and session duration has been proposed. However, this method obtains a snapshot of individual behavior in an instant. For example, an attacker might first log in at a normal frequency, browse multiple product pages to disguise their behavior, and finally launch an attack at a specific point in time. Machine learning models can only obtain single-point features at each point in time, making it difficult to accurately detect highly concealed and logically complex website anomalies after the attacker has disguised themselves. Summary of the Invention

[0005] This application provides a method, device, and medium for detecting abnormal website behavior through multi-source data fusion, which addresses the following technical problem: existing technologies can only acquire single-point features at each time point, making it difficult to accurately detect highly concealed and logically complex abnormal website behaviors in a timely manner.

[0006] The embodiments of this application adopt the following technical solutions: This application provides a method for detecting abnormal website behavior through multi-source data fusion. The method includes: extracting behavioral data representing user interactions on the website from acquired multi-source website interaction data; aggregating the behavioral data into a website interaction intent chain based on website interaction business logic and the adjacency of interaction time; wherein the website interaction data includes at least one of the following: user-side front-end interaction data, network layer communication data, and business layer application log data; performing conditional independence testing and high-risk malicious pattern detection on the website interaction intent chain based on a preset initial causal graph, and constructing a cross-layer temporal causal graph of website interaction based on the detection results; performing counterfactual reasoning on the cross-layer temporal causal graph of website interaction based on preset business reference logic, and simulating correction of the cross-layer temporal causal graph of website interaction based on the reasoning results; determining the minimum correction intervention cost corresponding to the cross-layer temporal causal graph of website interaction conforming to the preset business reference logic; comparing the minimum correction intervention cost with a preset threshold; if the minimum correction intervention cost is greater than the preset threshold, it is determined that the website exhibits abnormal behavior.

[0007] In one implementation of this application, behavioral data representing user website interactions is extracted from the acquired multi-source website interaction data. Based on the website interaction business logic and the adjacency relationship of interaction time, the behavioral data is aggregated into a website interaction intent chain. Specifically, this includes: extracting behavioral data from the multi-source website interaction data; wherein the behavioral data includes at least user interaction actions and website interaction response data; aligning and associating behavioral data from different sources on a unified timeline based on timestamps and event logic to generate a multi-source behavioral data sequence; matching the multi-source behavioral data sequence with a pre-set normal business process state model and a pre-set abnormal business process state model, respectively, and obtaining a comprehensive matching score based on the normal fit and abnormal deviation obtained from the matching; aggregating multi-source behavioral data sequences that meet pre-set matching conditions into intent nodes based on the comprehensive matching score; constructing a temporal intent chain of user website interactions according to the chronological order of the intent nodes, and matching the temporal intent chain with a pre-set website attack pattern knowledge base to generate a website interaction intent chain.

[0008] In one implementation of this application, based on a pre-set initial causal graph, conditional independence testing and high-risk malicious pattern detection are performed on the website interaction intent chain, and a cross-layer temporal causal graph of website interaction is constructed based on the detection results. Specifically, this includes: mapping each intent node in the website interaction intent chain to the initial causal graph; performing conditional independence testing on adjacent intent nodes in the initial causal graph based on a progressively increasing set of pre-set conditional variables, and removing the edges between independent node pairs to obtain a first sparse causal graph; determining the website interaction collision substructure in the first sparse causal graph, and determining the matching degree between the website interaction collision substructure and the pre-set high-risk malicious pattern based on the business security semantics between the nodes corresponding to the website interaction collision substructure; when the matching degree reaches a preset matching degree condition, selecting a set of conditionally independent candidate variables in the first sparse causal graph based on the website interaction collision substructure, and performing conditional independence testing on the candidate variable set again based on the extended set of conditional variables to obtain a second sparse causal graph; and assigning direction to the website interaction causal relationship between adjacent node pairs in the second sparse causal graph based on causal temporal rules to obtain a cross-layer temporal causal graph of website interaction.

[0009] In one implementation of this application, after obtaining the second sparse causal graph, the method further includes: identifying multiple potential initial attack entry nodes in the second sparse causal graph based on historical website abnormal behavior data; using each initial attack entry node as a starting point, performing penetration deduction of website attacks in the second sparse causal graph according to the corresponding topology and conditional dependencies between nodes to obtain website attack paths; determining the attack success probability from the initial attack entry node to the end node of each deduced website attack path; and determining the potential impact level on the website after attacking through each website attack path; identifying high-risk causal relationship edges in the second sparse causal graph based on the attack success probability and potential impact level corresponding to each website attack path, as key defense edges; and integrating the initial attack entry nodes, website attack paths, key defense edges, and their related risk quantification information into the second sparse causal graph to perform risk semantic enhancement on the second sparse causal graph.

[0010] In one implementation of this application, counterfactual reasoning is performed on the cross-layer temporal causal graph of website interactions based on pre-defined business reference logic, and the cross-layer temporal causal graph of website interactions is simulated and corrected based on the reasoning results. Specifically, this includes: using the pre-defined business reference logic as a constraint condition, performing a consistency comparison with the cross-layer temporal causal graph of website interactions, and determining a set of website interaction causal conflicts that conflict with the pre-defined business reference logic; wherein, the pre-defined business reference logic includes at least one of the following: the correspondence between users and website resources, website resource access path rules, and the causal relationship of access business operations; based on the set of website interaction causal conflicts, counterfactual reasoning is performed on the cross-layer temporal causal graph of website interactions, and the cross-layer temporal causal graph is simulated and corrected through causal graph correction operations.

[0011] In one implementation of this application, counterfactual reasoning is performed on the cross-layer temporal causal graph of website interactions based on a set of causal conflicts in website interactions. The cross-layer temporal causal graph is then simulated and corrected through causal graph correction operations. Specifically, this includes: for causal conflicts in the set of causal conflicts in website interactions, tracing the causal path in reverse to determine the root intention node that caused the website interaction conflict; aggregating multiple related conflicts corresponding to the same root intention node to construct a conflict causal chain cluster; wherein the conflict causal chain cluster is used to represent the abnormal behavior sequence of the website; based on the business security semantics and chain cluster structure characteristics corresponding to the conflict causal chain cluster, multiple candidate causal graph correction operations are selected from a pre-set correction operation library; wherein the candidate causal graph correction operations include at least one of deleting conflict edges, adding compliant edges, reversing edge direction, and injecting virtual security verification nodes; and combining the candidate causal graph correction operations corresponding to different conflict causal chain clusters to form a global simulation correction scheme to simulate and correct the cross-layer temporal causal graph of website interactions.

[0012] In one implementation of this application, determining the minimum correction intervention cost when the cross-layer temporal causal graph of website interaction conforms to the pre-defined business reference logic specifically includes: determining multiple global simulation correction schemes that make the cross-layer temporal causal graph of website interaction conform to the pre-defined business reference logic; determining the inherent correction cost based on the inherent strength of the causal edges corresponding to the candidate causal graph correction operations in each global simulation correction scheme, and determining the correction credibility decay factor based on the consistency between the website interaction data corresponding to each candidate causal graph correction operation; determining a dynamic baseline cost for each candidate causal graph correction operation based on its inherent operation cost and correction credibility decay factor; weighting the dynamic baseline cost based on the real-time business context of user website interaction to generate a contextualized intervention cost; wherein the real-time business context includes at least one of the sensitivity level of the current website accessed resources and the degree of deviation of the current user behavior from its historical baseline; correcting the contextualized intervention cost based on the potential impact of the global simulation correction scheme on website security defense to obtain the final intervention cost corresponding to different global simulation correction schemes; and comparing the final intervention costs corresponding to each global simulation correction scheme to obtain the minimum correction intervention cost.

[0013] In one implementation of this application, the minimum corrective intervention cost is compared with a preset threshold. If the minimum corrective intervention cost is greater than the preset threshold, it is determined that the website has abnormal behavior. Specifically, this includes: determining the preset threshold based on the historical baseline of normal website behavior, real-time security situation information, and the sensitivity level of the business involved in the current website interaction; comparing the minimum corrective intervention cost with the preset threshold, and determining that there is abnormal website behavior when the minimum corrective intervention cost is greater than the preset threshold; determining an anomaly confidence score based on the difference between the minimum corrective intervention cost and the preset threshold, and triggering different levels of security response actions based on the anomaly confidence score.

[0014] This application provides a website abnormal behavior detection device based on multi-source data fusion, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, which, when executed by the at least one processor, enable the at least one processor to: extract behavioral data representing user website interactions from acquired multi-source website interaction data, and aggregate the behavioral data into a website interaction intent chain based on website interaction business logic and the adjacency relationship of interaction time; wherein the website interaction data includes at least one of the following: user-side front-end interaction data, network layer communication data, and business layer application log data; perform conditional independence testing and high-risk malicious pattern detection on the website interaction intent chain based on a preset initial causal graph, and construct a website interaction cross-layer temporal causal graph based on the detection results; perform counterfactual reasoning on the website interaction cross-layer temporal causal graph based on a preset business reference logic, and simulate and correct the website interaction cross-layer temporal causal graph based on the reasoning results; determine the minimum correction intervention cost corresponding to the website interaction cross-layer temporal causal graph conforming to the preset business reference logic; compare the minimum correction intervention cost with a preset threshold, and if the minimum correction intervention cost is greater than the preset threshold, determine that the website exhibits abnormal behavior.

[0015] This application provides a non-volatile computer storage medium storing computer-executable instructions. These instructions are configured to: extract behavioral data representing user website interactions from acquired multi-source website interaction data; aggregate the behavioral data into a website interaction intent chain based on website interaction business logic and the adjacency of interaction time; wherein the website interaction data includes at least one of the following: user-side front-end interaction data, network layer communication data, and business layer application log data; perform conditional independence testing and high-risk malicious pattern detection on the website interaction intent chain based on a preset initial causal graph, and construct a cross-layer temporal causal graph of website interaction based on the detection results; perform counterfactual reasoning on the cross-layer temporal causal graph of website interaction based on a preset business reference logic, and simulate and correct the cross-layer temporal causal graph of website interaction based on the reasoning results; determine the minimum correction intervention cost corresponding to the cross-layer temporal causal graph of website interaction conforming to the preset business reference logic; compare the minimum correction intervention cost with a preset threshold, and if the minimum correction intervention cost is greater than the preset threshold, determine that the website exhibits abnormal behavior.

[0016] The above-mentioned technical solutions adopted in this application embodiment can achieve the following beneficial effects: Firstly, by constructing a website interaction intent chain and integrating multi-dimensional data, this application embodiment achieves accurate aggregation of behavioral data by combining business logic and time correlation, thereby improving detection efficiency. Secondly, by constructing a cross-layer temporal causal graph of website interaction, and through pre-set initial causal graphs and conditional independence tests, it mines hidden cross-layer causal relationships in the intent chain. Simultaneously, by detecting high-risk malicious patterns, it locks suspicious clues in advance, accurately reflecting the inherent logical relationships of interactive behaviors, identifying hidden abnormal relationship patterns, and improving the accuracy of anomaly detection. Furthermore, this application embodiment effectively eliminates interference from normal business fluctuations through counterfactual reasoning simulation correction, accurately locates abnormal nodes that deviate from business logic, and avoids misjudgment by simulating and correcting the root cause of anomalies, thus improving the reliability of detection results. Thirdly, by determining anomalies through cost thresholds, it achieves accurate screening of abnormal behaviors. Anomalies are only determined when the minimum correction cost exceeds the threshold, which can effectively identify high-risk abnormal behaviors while avoiding excessive alarms and reducing the operational burden. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings: Figure 1 A flowchart of a website abnormal behavior detection method based on multi-source data fusion provided in this application embodiment; Figure 2 This is a schematic diagram of the structure of a website abnormal behavior detection device that integrates multi-source data, as provided in an embodiment of this application. Attached image description: 200: Website abnormal behavior detection device with multi-source data fusion; 201: Processor; 202: Memory. Detailed Implementation

[0019] This application provides a method, device, and medium for detecting abnormal website behavior through multi-source data fusion.

[0020] To enable those skilled in the art to better understand the technical solutions in this application, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this application.

[0021] Figure 1 A flowchart of a website abnormal behavior detection method based on multi-source data fusion provided in this application embodiment is shown below. Figure 1 As shown, the website abnormal behavior detection method based on multi-source data fusion includes the following steps: S101. From the acquired multi-source website interaction data, extract the behavioral data representing the user's website interaction, and aggregate the behavioral data into a website interaction intent chain based on the website interaction business logic and the adjacency relationship of interaction time.

[0022] In one implementation of this application, behavioral data is extracted from multi-source website interaction data. This behavioral data includes at least user interactions with the website and website interaction responses. Based on timestamps and event logic, behavioral data from different sources are aligned and correlated on a unified timeline to generate a multi-source behavioral data sequence. This multi-source behavioral data sequence is then matched against a pre-defined normal business process state model and a pre-defined abnormal business process state model. A comprehensive matching score is obtained based on the normal fit and abnormal deviation obtained from the matching. Based on the comprehensive matching score, multi-source behavioral data sequences that meet pre-defined matching conditions are aggregated into intent nodes. A temporal intent chain representing user website interactions is constructed according to the chronological order of the intent nodes. This temporal intent chain is then matched against a pre-defined website attack pattern knowledge base to generate a website interaction intent chain. The website interaction data includes at least one of the following: user-side front-end interaction data, network layer communication data, and business layer application log data.

[0023] Specifically, probe scripts deployed on the user's browser capture front-end interactions such as mouse clicks, movement trajectories, form field modifications, and page redirects, recording timestamps. Simultaneously, at the network layer, all HTTP / HTTPS requests and responses are captured through traffic mirroring or gateway proxy, with detailed records of URLs, header information, payload content, and response status. At the backend business layer, user operation logs are collected from application server and database logs. Then, the smallest, indivisible behavioral data is extracted from these three data sources, such as: entering a username on the login page at second T, or clicking the login button at second T+1.

[0024] All behavioral data is grouped based on session identifiers, forming independent data streams based on a single complete website visit. Within each session, behavioral data from the front-end, network, and back-end are sorted and aligned on a unified timeline based on timestamps, generating a multi-source behavioral data sequence that integrates multi-dimensional evidence.

[0025] This application embodiment includes a pre-set normal business process model and a pre-set abnormal business process model. The normal business process model is trained based on historical normal user behavior, while the abnormal behavior pattern model is trained based on known attack cases and threat intelligence. Multi-source behavioral data sequences are simultaneously input into these two models for evaluation. The normal model provides a score indicating the sequence's fit with conventional operating patterns, while the abnormal model provides a score indicating its match with malicious patterns. A comprehensive matching score is obtained based on a preset fusion strategy, such as weighted calculation. When this score exceeds a specific threshold, a continuous behavioral sequence corresponding to that score is aggregated into an intent node, such as completing login, browsing a product details page, or initiating a payment request, and an initial risk label is assigned to this node.

[0026] Furthermore, all intent nodes generated within the same session are connected in chronological order to form a temporal intent chain, which displays the sequence of goals a user attempts to achieve in a single session. This temporal intent chain is then compared with a pre-defined website attack pattern knowledge base. This knowledge base includes typical attack step templates such as credential stuffing, data crawling, and business logic abuse. Through global pattern matching, hidden threats are identified where individual nodes appear normal but their combination conforms to a specific attack script. The entire intent chain is then labeled with the most suspicious attack pattern tag and its confidence level, ultimately outputting a website interaction intent chain.

[0027] S102. Based on the pre-set initial cause-effect graph, perform conditional independence testing and high-risk malicious pattern detection on the website interaction intent chain, and construct a cross-layer temporal cause-effect graph of website interaction based on the detection results.

[0028] In one implementation of this application, each intent node in the website interaction intent chain is mapped to an initial causal graph; wherein the initial causal graph contains multiple preset maximum causal delay nodes. Based on a progressively increasing set of preset condition variables, conditional independence checks are performed on adjacent intent nodes in the initial causal graph, and edges between independent node pairs are removed to obtain a first sparse causal graph. In the first sparse causal graph, a website interaction collision substructure is determined, and based on the business security semantics between nodes corresponding to the website interaction collision substructure, the matching degree between the website interaction collision substructure and a preset high-risk malicious pattern is determined. When the matching degree reaches a preset matching degree condition, based on the website interaction collision substructure, a set of conditionally independent candidate variables is selected from the first sparse causal graph, and conditional independence checks are performed again on the candidate variable set based on an extended set of condition variables to obtain a second sparse causal graph. Based on causal temporal rules, the website interaction causal relationship between adjacent node pairs in the second sparse causal graph is assigned a direction to obtain a website interaction cross-layer temporal causal graph.

[0029] Specifically, each intent node in the website interaction intent chain is mapped to a node in an initial causal graph. This initial causal graph pre-inserts multiple virtual maximum causal time-delay nodes, representing potential but unobserved intermediate states or hidden events. Their purpose is to allow the model to consider possible indirect causal relationships with a certain time delay between attack behaviors. For example, between the intent nodes of brute-force attack and successful login, intermediate nodes such as password dictionary generation and proxy IP switching, which are not directly observed but conform to the attack logic, are reserved. This initial causal graph is a highly connected mesh structure that contains all possible causal relationship assumptions.

[0030] This application employs a progressively increasing set of conditional variables to test conditional independence. Specifically, it uses a small, core set of conditional variables to test the independence between adjacent nodes in the graph. If two nodes remain correlated given the minimum set of variables, their edge is retained. Then, the set of conditional variables is gradually expanded to include broader contextual information, such as user historical behavior baselines and session environment characteristics, and the test is repeated. Each test adds new control variables to detect whether the association between two nodes is a spurious correlation caused by a common factor. Through this layered screening from simple to complex, spurious edges caused by confounding factors are gradually removed, ultimately resulting in a simpler, more reliable first sparse causal graph.

[0031] Furthermore, collision substructures with specific topological patterns are identified in the first sparse causal graph, i.e., a node with two or more independent parent nodes. For example, a sensitive data download node, if simultaneously pointed to by a login node from an unfamiliar geographical location and an abnormally short-lived session node, constitutes a collision substructure. The business security semantics between nodes in this structure are analyzed to determine whether it conforms to a high-risk malicious pattern. The matching degree of this collision substructure with various pre-set malicious patterns in the knowledge base is calculated. When the matching degree exceeds a threshold, evidence of a coordinated attack where multiple factors jointly lead to the same consequence is identified, thus marking the collision substructure as high-risk and using it as the center for further in-depth investigation.

[0032] Furthermore, focusing on the identified high-risk collider substructures, the first sparse causal graph filters out node pairs that require further verification, forming a candidate variable set. Subsequently, an extended condition variable set is constructed, which includes not only basic attributes but also threat context, such as: the reputation score of the initiating IP, entropy changes in user behavior sequences, whether it is during a high-incidence attack period, and whether specific attack tool fingerprints were used. In this enhanced context, the candidate variable set undergoes a second conditional independence test to determine whether the two nodes are still related after eliminating all potential confounding factors. This second conditional independence test further eliminates spurious associations that are not detected under simple conditions but reveal themselves in complex threat contexts, ultimately resulting in a second sparse causal graph with more robust causal claims.

[0033] Furthermore, the direction of all edges that pass the test in the second sparse causal graph is determined based on causal temporal rules. The event timestamps between adjacent node pairs are determined using causal temporal rules, ensuring that the directions of all edges satisfy the temporal order. For relationships that are completely synchronous in time or whose order is difficult to distinguish, the inherent order of business logic can be used for judgment. Finally, a cross-layer temporal causal graph of website interactions with clear node relationships and causal directions is generated.

[0034] In one implementation of this application, after obtaining the second sparse causal graph, the method further includes: identifying multiple potential initial attack entry points in the second sparse causal graph based on historical website abnormal behavior data. Starting from each initial attack entry point, and based on the topology and conditional dependencies between nodes in the second sparse causal graph, performing penetration analysis of website attacks to obtain website attack paths. For each deduced website attack path, determining the probability of successful attack from the initial attack entry point to the end node of the path, and determining the potential impact level on the website after attacking through each website attack path. Based on the attack success probability and potential impact level corresponding to each website attack path, identifying high-risk causal relationship edges in the second sparse causal graph as key defense edges. Integrating the initial attack entry points, website attack paths, key defense edges, and their related risk quantification information into the second sparse causal graph to enhance the risk semantics of the second sparse causal graph.

[0035] Specifically, this application embodiment includes a historical website abnormal behavior database, which records the starting point characteristics of various confirmed attack cases. Each node in the second sparse causal graph is scanned, and its characteristics are matched with the characteristic patterns of historical attack entry nodes. These characteristics can be the intent type represented by the node or the historical reputation of the IP address associated with the node. Nodes with high matching scores are identified as potential initial attack entry nodes.

[0036] After identifying the initial attack entry point, the simulation model follows the subsequent attack paths an attacker might take once they breach the entry point. Specifically, the simulation engine uses each identified initial attack entry point as a starting point and, based on the conditional dependencies between nodes in the second sparse causal graph, simulates the penetration process. First, the engine analyzes all downstream nodes directly connected by causal edges from the entry point to determine the next stage target that the attack might immediately affect. Then, the simulation continues along the causal chain deeper, analyzing second-, third-, and even further downstream nodes to determine a complete potential attack path from the initial intrusion to the final target. By traversing all possible path branches, a set of attack paths covering various possible attack scenarios is derived. For each attack path, the probability of success is assessed by analyzing the strength of each causal edge along the path and the security status of the environment in which the path nodes are located, ultimately yielding the overall probability of the attack successfully penetrating from the entry point to the end of the path. Secondly, the potential impact level is assessed, determined by the criticality of the business assets represented by the endpoints of the path. For example, the potential impact levels of one path endpoint being the theft of user phone numbers are drastically different from those of another endpoint being the tampering with core databases or initiating large-scale fraudulent transactions. Impact levels are typically graded based on factors such as business value, data sensitivity, and compliance requirements.

[0037] Furthermore, the attack success probability and potential impact level of each attack path are combined. For example, the quantitative values ​​corresponding to the attack success probability and potential impact level are weighted and calculated to obtain the comprehensive risk value for each path. Subsequently, for multiple paths with high comprehensive risk, the causal relationship edges that these paths commonly depend on are extracted and marked as key defense edges. Finally, the initial attack entry node, high-risk website attack paths, key defense edges, and their respective attack success probabilities and potential impact levels are used as risk semantic information and fused into the second sparse causal graph.

[0038] S103. Perform counterfactual reasoning on the cross-layer temporal cause-effect graph of website interaction based on the pre-set business reference logic, and simulate and correct the cross-layer temporal cause-effect graph of website interaction based on the reasoning results.

[0039] In one implementation of this application, a pre-defined business reference logic is used as a constraint condition and compared with the website interaction cross-layer temporal causal graph for consistency. This identifies a set of website interaction causal conflicts that conflict with the pre-defined business reference logic. The pre-defined business reference logic includes at least one of the following: the correspondence between users and website resources, website resource access path rules, and the causal relationship of access business operations. Based on the set of website interaction causal conflicts, counterfactual reasoning is performed on the website interaction cross-layer temporal causal graph, and the cross-layer temporal causal graph is simulated and corrected through causal graph correction operations.

[0040] Specifically, this application embodiment sets up pre-defined business reference logic. First, the correspondence between users and website resources is specified as a role-permission matrix, the website resource access path rules are specified as a state jump sequence, and the causal relationship of access business operations is specified as a normal causal sequence. Each rule is assigned a unique identifier and severity level. Second, this application embodiment predefines the conflict modes corresponding to various rule violations. For example, violating the role-permission correspondence may correspond to an unauthorized access conflict mode, and violating the access path rules may correspond to a step bypass conflict mode. Third, the website interaction cross-layer temporal causal graph is automatically reviewed, and each rule and each graph element is detected. For example, it checks whether there are edges in the graph where ordinary user nodes directly point to core management function nodes, and whether there is a payment request submission node before the order payment success node. Once a rule-violating edge or path is found, it is immediately captured, and the specific rule ID, conflict type, involved nodes, and conflict context information are recorded. All these instances of rule violations are collected together to form a website interaction causal conflict set.

[0041] In one implementation of this application, for causal conflicts in a set of website interaction causal conflicts, the root intention node that caused the website interaction conflict is determined by tracing the causal path in reverse. Multiple related conflicts corresponding to the same root intention node are grouped together to construct a conflict causal chain cluster; wherein, the conflict causal chain cluster is used to represent the sequence of abnormal website behavior. Based on the business security semantics and chain cluster structure characteristics corresponding to the conflict causal chain cluster, multiple candidate causal graph correction operations are selected from a pre-built correction operation library; wherein, the candidate causal graph correction operations include at least one of deleting conflict edges, adding compliant edges, reversing edge direction, and injecting virtual security verification nodes. The candidate causal graph correction operations corresponding to different conflict causal chain clusters are combined to form a global simulation correction scheme to simulate and correct the cross-layer temporal causal graph.

[0042] Specifically, for each causal conflict recorded in the website interaction causal conflict set, a reverse traversal is performed in the website interaction cross-layer temporal causal graph. During the traversal, each hop is checked in the opposite direction of the causal edge to find the upstream node that caused the current conflict. All causal conflicts originating from the same root intent node are merged and aggregated. For example, all conflict paths tracing back to the abnormal login node R, including R to A, R to C, and R to D, are aggregated together to form a conflict causal chain cluster. This conflict causal chain cluster demonstrates the various malicious operation sequences attempted by the attacker starting from the same intrusion point.

[0043] Furthermore, this application embodiment includes a pre-built correction operation library containing various causal graph correction operations. For each constructed conflicting causal chain cluster, its business security semantics and cluster structure characteristics are analyzed, and multiple candidate causal graph correction operations are selected from the library. For example, for a cluster with reversed causality, operations to reverse edge direction are selected from the pre-built correction operation library. Candidate correction operations from different conflicting causal chain clusters are combined to form multiple possible global simulation correction schemes. Each scheme is a specific set of operation instructions; for example, a scheme may include deleting edge E1 and inserting node N into path P2. These schemes are simulated and executed on the causal graph, and the effect of each scheme after execution is evaluated. Through simulation and deduction, the optimal correction strategy is determined.

[0044] S104. Determine the minimum correction intervention cost when the cross-layer temporal cause-effect graph of website interaction conforms to the pre-set business reference logic.

[0045] In one implementation of this application, multiple global simulation correction schemes are identified to ensure that the cross-layer temporal causal graph of website interactions conforms to pre-defined business reference logic. Based on the inherent strength of the causal edges corresponding to the candidate causal graph correction operations in each global simulation correction scheme, an inherent correction cost is determined. Furthermore, based on the consistency between the website interaction data corresponding to each candidate causal graph correction operation, a correction reliability decay factor is determined. For each candidate causal graph correction operation, a dynamic baseline cost is determined based on the corresponding inherent operation cost and correction reliability decay factor. Based on the real-time business context of user website interactions, the dynamic baseline cost is weighted and adjusted to generate a contextualized intervention cost; wherein the real-time business context includes at least one of the sensitivity level of the currently accessed website resources and the degree of deviation of the current user behavior from its historical baseline. Based on the potential impact of the global simulation correction schemes on website security defense, the contextualized intervention cost is corrected to obtain the final intervention cost corresponding to each different global simulation correction scheme. The final intervention costs corresponding to each global simulation correction scheme are compared to obtain the minimum correction intervention cost.

[0046] Specifically, all identified conflict causal chain clusters are analyzed to determine different corrective actions that can be taken to eliminate each conflict. Then, these action options for different conflicts are combined to generate all possible global simulation correction schemes. Further, the inherent cost of the operation in this embodiment is determined based on the inherent strength of the causal edge being operated on in the original causal graph. For example, deleting a strong edge supported by a large amount of historical normal data means denying a strong statistical regularity, and its inherent cost is very high. Conversely, deleting a weak edge based on sporadic data has a lower cost. Secondly, the correction credibility decay factor in this embodiment assesses the consistency between the multi-source website interaction data on which the correction operation relies. For example, if an edge deletion decision is mainly based on potentially noisy client logs, and the network layer and server logs do not provide strong evidence of consistency, then the decision credibility of this operation is low, introducing a high decay factor and thus increasing its correction cost. This ensures that corrections cannot be made hastily based on a single, unreliable piece of evidence.

[0047] Furthermore, the two are combined to calculate the dynamic baseline cost of the operation based on business logic. For example, for a conflict edge with high inherent strength but poor consistency of supporting evidence, the dynamic baseline cost of its deletion operation will be set very high to warn the operator that denying a strong pattern is based on insufficient evidence and carries a high risk. Conversely, for an edge with weak strength and consistent multi-source data indicating an anomalous association, the dynamic baseline cost of its deletion will be very low. The total dynamic baseline cost of each global simulation correction scheme is the weighted sum of the dynamic baseline costs of all operations it contains.

[0048] Furthermore, real-time business context is introduced to dynamically weight the costs, making them more closely reflect the current actual risk situation. This context includes the sensitivity level of the currently accessed resource and the degree of deviation of the current user behavior from its historical baseline. Higher weights are assigned to highly sensitive resources or contexts with high deviation. The potential side effects of each global simulation remediation scheme on the overall security posture are analyzed while fixing the current conflict. For example, does it mask coherent attack patterns or introduce new security blind spots? After completing all assessments, a list of all global simulation remediation schemes and their corresponding final intervention costs is presented. Through numerical comparison, the scheme with the lowest cost and its cost can be determined; this is the minimum remediation intervention cost.

[0049] The minimum intervention cost obtained in this application embodiment quantifies the lowest and most reasonable comprehensive cost required to correct the currently observed abnormal behavior pattern to normal. If this minimum cost is still very high, it indicates that the currently observed causal pattern is highly unlikely to be caused by normal behavioral variation, but is more likely to be a real and complex malicious attack, thus providing an interpretable quantitative basis for the final anomaly determination.

[0050] S105. Compare the minimum correction intervention cost with the preset threshold. If the minimum correction intervention cost is greater than the preset threshold, then it is determined that the website has abnormal behavior.

[0051] In one implementation of this application, a preset threshold is determined based on historical website normal behavior baselines, real-time security posture information, and the sensitivity level of the business involved in the current website interaction. The minimum corrective intervention cost is compared with the preset threshold, and when the minimum corrective intervention cost is greater than the preset threshold, abnormal website behavior is determined. An anomaly confidence score is determined based on the difference between the minimum corrective intervention cost and the preset threshold, and different levels of security response actions are triggered according to the anomaly confidence score.

[0052] Specifically, firstly, based on historical normal user session data, the statistical distribution of the minimum cost of corrective intervention is calculated, and its mean plus a certain number of standard deviations is taken as the base threshold. Real-time security situation information is incorporated, such as whether there is a current surge in credential stuffing attacks targeting similar websites, or whether threat intelligence indicates new vulnerabilities. If the situation is tense, this threshold is temporarily lowered using a dynamic coefficient to improve detection sensitivity. Finally, a final adjustment is made based on the sensitivity level of the business operations involved in the current causal graph. For example, if the current session's causal path mainly involves ordinary browsing, the threshold can be maintained or slightly increased to reduce false positives; however, if the path involves payment, core data access, or the management backend, the threshold will be significantly lowered to enforce stricter standards. The final preset threshold is a dynamic value that integrates historical norms, the current threat environment, and business value considerations.

[0053] After obtaining the dynamic threshold and the minimum corrective intervention cost for the current session, the calculated minimum corrective intervention cost is directly compared with the obtained dynamic preset threshold. If the minimum corrective intervention cost is greater than the preset threshold, an anomaly determination is triggered. Simultaneously with the anomaly determination, a score between 0 and 1 is generated based on the relative magnitude of the cost exceeding the threshold. For example, when the minimum corrective intervention cost just exceeds the threshold, the confidence score might be 0.6; while when the cost far exceeds the threshold, reaching several times its value, the confidence score will approach 1.0. Based on the preset response strategy matrix, different levels and degrees of automation of security actions are triggered. For example, when the confidence score is higher than 0.9, the system immediately triggers the highest-level response: automatically blocking the user session, freezing associated accounts, sending an emergency alert to the security operations team and creating a highest-priority event ticket, while simultaneously initiating deep forensic analysis of the attack chain. When the confidence score is between 0.7 and 0.9, a medium-level response is triggered: implementing enhanced authentication, restricting access to some sensitive functions, and sending a high-priority alert requiring manual review to the security console. When the confidence score is below 0.7 but above the threshold trigger point, a low-level monitoring response is triggered, which only involves session marking and recording detailed logs.

[0054] Figure 2 This is a schematic diagram of the structure of a website abnormal behavior detection device based on multi-source data fusion, provided in an embodiment of this application. Figure 2 As shown, the multi-source data fusion website abnormal behavior detection device 200 includes: at least one processor 201; and a memory 202 communicatively connected to the at least one processor 201; wherein the memory 202 stores instructions executable by the at least one processor 201, the instructions being executed by the at least one processor 201 to enable the at least one processor 201 to: extract behavioral data representing user website interactions from the acquired multi-source website interaction data, and aggregate the behavioral data into a website interaction intent chain based on the website interaction business logic and the adjacency relationship of interaction time; wherein the website interaction data includes at least the user-side front-end interaction data corresponding to the website, One of the following: network layer communication data and business layer application log data; based on a pre-set initial causal graph, perform conditional independence testing and high-risk malicious pattern detection on the website interaction intent chain, and construct a cross-layer temporal causal graph of website interaction based on the detection results; perform counterfactual reasoning on the cross-layer temporal causal graph of website interaction based on pre-set business reference logic, and simulate and correct the cross-layer temporal causal graph of website interaction based on the reasoning results; determine the minimum correction intervention cost corresponding to the cross-layer temporal causal graph of website interaction conforming to the pre-set business reference logic; compare the minimum correction intervention cost with a preset threshold, and if the minimum correction intervention cost is greater than the preset threshold, it is determined that there is abnormal behavior on the website.

[0055] This application provides a non-volatile computer storage medium storing computer-executable instructions. These instructions are configured to: extract behavioral data representing user website interactions from acquired multi-source website interaction data; aggregate the behavioral data into a website interaction intent chain based on website interaction business logic and the adjacency of interaction time; wherein the website interaction data includes at least one of the following: user-side front-end interaction data, network layer communication data, and business layer application log data; perform conditional independence testing and high-risk malicious pattern detection on the website interaction intent chain based on a preset initial causal graph, and construct a cross-layer temporal causal graph of website interaction based on the detection results; perform counterfactual reasoning on the cross-layer temporal causal graph of website interaction based on a preset business reference logic, and simulate and correct the cross-layer temporal causal graph of website interaction based on the reasoning results; determine the minimum correction intervention cost corresponding to the cross-layer temporal causal graph of website interaction conforming to the preset business reference logic; compare the minimum correction intervention cost with a preset threshold, and if the minimum correction intervention cost is greater than the preset threshold, determine that the website exhibits abnormal behavior.

[0056] The various embodiments in this application are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments of apparatus, devices, and non-volatile computer storage media are basically similar to the method embodiments, so the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0057] The above descriptions are merely embodiments of this application and are not intended to limit the scope of this application. For those skilled in the art, various modifications and variations can be made to the embodiments of this application. These modifications or substitutions do not cause the essence of the corresponding technical solutions to depart from the spirit and scope of the technical solutions in the embodiments of this application.

Claims

1. A multi-source data fusion website abnormal behavior detection method, characterized in that, The method includes: In the acquired multi-source website interaction data, behavioral data representing user website interactions is extracted, and the behavioral data is aggregated into a website interaction intent chain based on the website interaction business logic and the adjacency relationship of interaction time; wherein, the website interaction data includes at least one of the following: user-side front-end interaction data corresponding to the website, network layer communication data, and business layer application log data; Based on a pre-set initial causal graph, conditional independence testing and high-risk malicious pattern detection are performed on the website interaction intent chain. A cross-layer temporal causal graph of website interaction is constructed based on the detection results. Specifically, this includes mapping each intent node in the website interaction intent chain to the initial causal graph; performing conditional independence testing on adjacent intent nodes in the initial causal graph based on a progressively increasing set of pre-set conditional variables, and removing edges between independent node pairs to obtain a first sparse causal graph; determining a website interaction collision substructure in the first sparse causal graph, and determining the matching degree between the website interaction collision substructure and the pre-set high-risk malicious pattern based on the business security semantics between nodes corresponding to the website interaction collision substructure; when the matching degree reaches a preset matching degree condition, selecting a set of conditionally independent candidate variables in the first sparse causal graph based on the website interaction collision substructure, and performing conditional independence testing on the candidate variable set again based on an extended set of conditional variables to obtain a second sparse causal graph; and assigning direction to the website interaction causal relationship between adjacent node pairs in the second sparse causal graph based on causal temporal rules to obtain the cross-layer temporal causal graph of website interaction. Based on pre-defined business reference logic, counterfactual reasoning is performed on the cross-layer temporal causal graph of website interactions. Based on the reasoning results, the cross-layer temporal causal graph of website interactions is then simulated and corrected. Specifically, this includes using the pre-defined business reference logic as a constraint condition and comparing its consistency with the cross-layer temporal causal graph of website interactions to determine a set of website interaction causal conflicts that conflict with the pre-defined business reference logic. The pre-defined business reference logic includes at least one of the following: the correspondence between users and website resources, website resource access path rules, and the causal relationship of access business operations. Based on the set of website interaction causal conflicts, counterfactual reasoning is performed on the cross-layer temporal causal graph of website interactions, and the cross-layer temporal causal graph is simulated and corrected through causal graph correction operations. The step of performing counterfactual reasoning on the cross-layer temporal causal graph of website interactions based on the set of causal conflicts, and then simulating and correcting the cross-layer temporal causal graph through a causal graph correction operation, specifically includes: For the causal conflicts in the set of website interaction causal conflicts, the root intention node that caused the website interaction conflict is determined by tracing the causal path in reverse. Multiple associated conflicts corresponding to the same root intent node are grouped together to construct a conflict causal chain cluster; wherein, the conflict causal chain cluster is used to characterize the abnormal behavior sequence of the website; Based on the business security semantics and cluster structure features corresponding to the conflict causal chain cluster, multiple candidate causal graph correction operations are selected from the pre-set correction operation library; wherein, the candidate causal graph correction operation includes at least one of deleting conflicting edges, adding compliant edges, reversing edge direction, and injecting virtual security verification nodes; The candidate causal graph correction operations corresponding to different conflict causal chain clusters are combined to form a global simulation correction scheme to simulate and correct the cross-layer temporal causal graph of the website interaction. Determine the minimum correction intervention cost when the cross-layer temporal cause-effect graph of the website interaction conforms to the preset business reference logic; The minimum cost of corrective intervention is compared with a preset threshold. If the minimum cost of corrective intervention is greater than the preset threshold, it is determined that the website has abnormal behavior.

2. The website abnormal behavior detection method based on multi-source data fusion according to claim 1, characterized in that, The step involves extracting behavioral data representing user website interactions from the acquired multi-source website interaction data, and aggregating this behavioral data into a website interaction intent chain based on the website interaction business logic and the adjacency relationship of interaction time. Specifically, this includes: The behavioral data is extracted from multi-source website interaction data; wherein the behavioral data includes at least user interaction actions with the website and website interaction response data. Based on timestamps and event logic associations, the behavioral data from different sources are aligned and associated on a unified timeline to generate a multi-source behavioral data sequence. The multi-source behavioral data sequence is matched with a pre-set normal state model and a pre-set abnormal state model of a business process, respectively. Based on the normal fit and abnormal deviation obtained from the matching, a comprehensive matching score is obtained. Based on the comprehensive matching score, the multi-source behavioral data sequences that meet the preset matching conditions are aggregated into intent nodes; Based on the chronological order of the intent nodes, a temporal intent chain for user website interaction is constructed, and the temporal intent chain is matched with a pre-set website attack pattern knowledge base to generate the website interaction intent chain.

3. The website abnormal behavior detection method based on multi-source data fusion according to claim 1, characterized in that, After obtaining the second sparse causal graph, the method further includes: Based on historical website abnormal behavior data, multiple potential initial attack entry points are identified in the second sparse causal graph. Starting from each of the initial attack entry nodes, based on the topology and conditional dependencies between nodes corresponding to the second sparse causal graph, the website attack penetration is deduced in the second sparse causal graph to obtain the website attack path. For each of the deduced website attack paths, determine the probability of a successful attack that penetrates from the initial attack entry node to the end node of the path; In addition, the potential impact level on the website after an attack is carried out through each of the aforementioned website attack paths is determined; Based on the attack success probability and potential impact level corresponding to each of the website attack paths, high-risk causal relationship edges are identified in the second sparse causal graph as key defense edges. The initial attack entry node, website attack path, key defense edges and their related risk quantification information are fused into the second sparse causal graph to enhance the risk semantics of the second sparse causal graph.

4. The website abnormal behavior detection method based on multi-source data fusion according to claim 1, characterized in that, The determination of the minimum correction intervention cost corresponding to the website interaction cross-layer temporal cause-effect graph conforming to the preset business reference logic specifically includes: Several global simulation correction schemes were identified to make the cross-layer temporal cause-effect graph of the website interaction conform to the preset business reference logic; Based on the inherent strength of the causal edges corresponding to the candidate causal graph correction operations in each of the global simulation correction schemes, the inherent cost of correction is determined; and based on the consistency between the website interaction data corresponding to each of the candidate causal graph correction operations, the correction credibility decay factor is determined. For each of the candidate causal graph correction operations, a dynamic baseline cost is determined based on the inherent cost of the operation and the correction confidence decay factor. Based on the real-time business context of user website interactions, the dynamic baseline cost is weighted and adjusted to generate a contextualized intervention cost; wherein, the real-time business context includes at least one of the sensitivity level of the current website accessed resources and the degree of deviation of the current user behavior from its historical baseline. Based on the potential impact of the global simulation correction scheme on website security defense, the contextualized intervention cost is corrected to obtain the final intervention cost corresponding to different global simulation correction schemes. The final intervention cost corresponding to each of the global simulation correction schemes is compared to obtain the minimum correction intervention cost.

5. The website abnormal behavior detection method based on multi-source data fusion according to claim 1, characterized in that, The step of comparing the minimum corrective intervention cost with a preset threshold, and determining that the website exhibits abnormal behavior if the minimum corrective intervention cost is greater than the preset threshold, specifically includes: Based on the historical baseline of normal website behavior, real-time security situation information, and the sensitivity level of the business involved in the current website interaction, the preset threshold is determined; The minimum corrective intervention cost is compared with the preset threshold, and when the minimum corrective intervention cost is greater than the preset threshold, it is determined that there is abnormal website behavior; An anomaly confidence score is determined based on the difference between the minimum correction intervention cost and the preset threshold, and different levels of security response actions are triggered based on the anomaly confidence score.

6. A website abnormal behavior detection device based on multi-source data fusion, characterized in that, The device includes a memory for storing computer program instructions and a processor for executing the program instructions, wherein when the computer program instructions are executed by the processor, the device is triggered to perform the method described in any one of claims 1-5.

7. A non-volatile computer storage medium storing computer-executable instructions, characterized in that, The computer-executable instructions can be executed by a processor to cause the processor to perform the method according to any one of claims 1-5.

Images