Network system intrusion detection method, device, equipment, medium and program product

Abstract

The invention provides a network system intrusion detection method, device and equipment, a medium and a program product, which can be applied to the field of network security and financial science and technology. The method comprises the following steps: in response to a received access request for a target network system, obtaining a source network protocol address initiating the access request; according to the source network protocol address, querying a mapping relationship between a preset network protocol address and a physical address to obtain a physical address corresponding to the source network protocol address; acquiring environment state data corresponding to the physical address, the environment state data including a physical existence state of a person located at the physical address, biological characteristic information and an operation interface of the target terminal device; and based on the physical address and the corresponding environment state data, performing intrusion detection analysis on the access request through a preset intrusion detection rule, and outputting an intrusion detection result.

Description

Technical Field

[0001] This application relates to the fields of cybersecurity and fintech, and more specifically to a method, apparatus, device, medium, and program product for network system intrusion detection. Background Technology

[0002] With the rapid development of information technology, network attack and defense technologies are evolving rapidly. Although network defense technologies have become increasingly mature over the years, the methods and techniques of unauthorized user attacks are also iterating and upgrading in parallel, making the security situation in cyberspace increasingly severe and the difficulty of prevention increasing exponentially.

[0003] Currently, mainstream network defense technologies mainly rely on mechanisms such as network traffic analysis, endpoint detection, and user behavior analysis. However, these existing technologies generally have the following limitations: when attackers successfully infiltrate application systems by exploiting system or business logic vulnerabilities, the attack traffic is often disguised as normal business request traffic. Because these malicious behaviors are highly similar to the operations of legitimate users in terms of data packet characteristics, traditional defense methods based on rule matching or anomaly detection are difficult to effectively distinguish, resulting in attacks not being detected and blocked in a timely manner, posing a significant threat to the security of information systems. Summary of the Invention

[0004] In view of the above problems, embodiments of this application provide a network system intrusion detection method, apparatus, device, medium, and program product.

[0005] According to a first aspect of this application, a network system intrusion detection method is provided, comprising: in response to receiving an access request for a target network system, obtaining the source network protocol address of the initiating access request; querying a preset mapping relationship between network protocol addresses and physical addresses based on the source network protocol address to obtain the physical address corresponding to the source network protocol address; obtaining environmental status data corresponding to the physical address, wherein the environmental status data includes the physical presence status of the personnel located at the physical address, biometric information, and the operating interface of the target terminal device; and performing intrusion detection analysis on the access request based on the physical address and the corresponding environmental status data through preset intrusion detection rules, and outputting intrusion detection results.

[0006] According to embodiments of this application, based on the physical address and corresponding environmental state data, intrusion detection analysis is performed on the access request using preset intrusion detection rules. The output intrusion detection result includes determining that the access request is an intrusion access request based on at least one of the following: the physical address does not belong to a preset set of physical addresses, wherein the preset set of physical addresses is a set of physical addresses that are allowed to access the target network system; the physical presence status of the person indicates that no person exists at the physical address when the access request is initiated, wherein the physical presence status is used to indicate the presence of the person at the physical address; the biometric information of the person indicates that the person located at the physical address when the access request is initiated is not the target person, wherein the target person is the expected legitimate person associated with the physical address; the operating interface of the target terminal device indicates that the system that issued the access request is in an unopened state when the access request is initiated.

[0007] According to an embodiment of this application, determining that an access request is an intrusion access request further includes: obtaining the attendance data of the target personnel located at the physical address; determining the time range of the target personnel's accessible status based on the attendance data; comparing the initiation time of the access request with the time range of the accessible status to determine whether the initiation time of the access request falls within the time range of the accessible status, and generating a fifth determination result; in response to the fifth determination result being a negative result, determining that the access request is an intrusion access request.

[0008] According to an embodiment of this application, obtaining the source network protocol address of the access request includes: obtaining the network protocol address corresponding to the network node that initiated the access request, as the source network protocol address; wherein, the access request is initiated and forwarded through N network nodes in the network, and when the i-th network node forwards the access request, it sets the target network address in the access request to the network protocol address of the (i+1)-th network node, where N is a positive integer greater than or equal to 1, and i is a positive integer greater than or equal to 1 and less than N.

[0009] According to an embodiment of this application, obtaining environmental status data corresponding to a physical address includes: collecting image information within the monitoring area corresponding to the physical address through a video surveillance device; performing personnel identification on the image information to determine the physical presence status of personnel within the monitoring area, wherein the physical presence status includes presence status and non-presence status; in response to the physical presence status being determined to be presence status, extracting the biometric information of personnel from the image information; and based on the image information, identifying the operating interface content of the display screen of the target terminal device installed at the physical address.

[0010] According to an embodiment of this application, the method further includes: acquiring historical behavior data of a target person on a target network system within a preset historical period, wherein the target person is an expected legitimate person associated with a physical address; constructing access behavior benchmark data to characterize the normal access pattern of the person based on the historical behavior data; and performing intrusion detection analysis on the access behavior in response to an access request that does not conform to the access behavior benchmark data, and outputting intrusion detection results.

[0011] According to an embodiment of this application, the method further includes: acquiring historical behavior data of a target person on a target network system within a preset historical period, wherein the target person is an expected legitimate person associated with a physical address; inputting the historical behavior data into a preset access behavior prediction model to generate access behavior prediction data of the person in a future time window, wherein the access behavior prediction model is a model trained based on a long short-term memory network algorithm; and in response to an access request not conforming to the access behavior prediction data, performing intrusion detection analysis on the access behavior and outputting intrusion detection results.

[0012] According to a second aspect of this application, a network system intrusion detection device is provided, comprising: a source network protocol address acquisition module, configured to acquire the source network protocol address initiating the access request in response to receiving an access request for a target network system; a physical address acquisition module, configured to query a preset mapping relationship between network protocol addresses and physical addresses based on the source network protocol address to obtain the physical address corresponding to the source network protocol address; an environmental status data acquisition module, configured to acquire environmental status data corresponding to the physical address, wherein the environmental status data includes the physical presence status of the personnel located at the physical address, biometric information, and the operating interface of the target terminal device; and an intrusion detection module, configured to perform intrusion detection analysis on the access request based on the physical address and the corresponding environmental status data, and output the intrusion detection result.

[0013] According to a third aspect of this application, an electronic device is provided, comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0014] According to a fourth aspect of this application, a computer-readable storage medium is also provided, on which a computer program or instructions are stored, wherein the computer program or instructions, when executed by a processor, implement the steps of the above-described method.

[0015] According to a fifth aspect of this application, a computer program product is also provided, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method. Attached Figure Description

[0016] The above-mentioned contents, other objects, features and advantages of this application will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0017] Figure 1 The illustration shows an application scenario of a network system intrusion detection method, apparatus, device, medium, and program product according to embodiments of this application.

[0018] Figure 2 A flowchart illustrating a network system intrusion detection method according to an embodiment of this application is shown schematically.

[0019] Figure 3 A flowchart illustrating the determination of an intrusion access request according to an embodiment of this application is shown schematically.

[0020] Figure 4 This illustration shows a flowchart illustrating the determination of intrusion access requests based on attendance data according to an embodiment of this application.

[0021] Figure 5 This illustration schematically shows another flowchart of a network system intrusion detection method according to an embodiment of this application;

[0022] Figure 6 A flowchart illustrating component interactions according to embodiments of this application is shown schematically.

[0023] Figure 7 This schematic diagram illustrates a structural block diagram of a network system intrusion detection device according to an embodiment of this application;

[0024] Figure 8 A block diagram schematically illustrates an electronic device suitable for implementing a network system intrusion detection method according to an embodiment of this application. Detailed Implementation

[0025] The embodiments of this application will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of this application. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of this application for ease of explanation. However, it will be apparent that one or more embodiments may be implemented without these specific details. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concepts of this application.

[0026] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0027] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0028] It should be noted that the network system intrusion detection methods, devices, equipment, media, and program products determined in the embodiments of this application can be used in the field of network security, and can also be applied to the field of fintech or any field other than fintech. The application fields of the network system intrusion detection methods, devices, equipment, storage media, and program products of this application are not limited.

[0029] In the technical solution of this application, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, and displayed data) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse.

[0030] In scenarios where personal information is used for automated decision-making, the methods, devices, and systems provided in this application all provide users with corresponding operation entry points for users to choose to agree to or reject the automated decision results; if the user chooses to reject, the process enters the expert decision-making process.

[0031] Figure 1 The illustration schematically depicts application scenarios of network system intrusion detection methods, apparatuses, devices, media, and program products according to embodiments of this application. For example... Figure 1 As shown, application scenario 100 according to an embodiment of this application may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links or fiber optic cables. For example, a user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send information, etc.

[0032] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be electronic devices such as smartphones, wearable devices, personal computers, intelligent voice interaction devices, smart home appliances, intelligent vehicles, in-vehicle terminals, aircraft, unmanned vending terminals, and extended reality devices. Extended reality devices can include virtual reality devices, augmented reality devices, and mixed reality devices. A client application for the target application can be installed and run on the terminal devices. This target application can include, but is not limited to, financial transaction applications, payment applications, shopping applications, web browser applications, search applications, instant messaging tools, email clients, and social media platform software (these are just examples). Furthermore, this application embodiment does not limit the form of the target application, and it can include, but is not limited to, applications, mini-programs, etc., installed on the terminal devices, and can also be in the form of web pages.

[0033] Server 105 can be a server providing various services, such as a backend management server supporting websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process received user requests and other data, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices. The server can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services such as cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks, and basic cloud computing services such as big data. The server can be the backend server of the aforementioned target application, used to provide backend services to the clients of the target application.

[0034] It should be noted that the network system intrusion detection method provided in this application embodiment can generally be executed by server 105 and / or terminal devices 101-103. Accordingly, the network system intrusion detection device provided in this application embodiment can generally be installed in server 105 and / or terminal devices 101-103.

[0035] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0036] Figure 2 A flowchart illustrating a network system intrusion detection method according to an embodiment of this application is shown. Figure 2 As shown, the network system intrusion detection method 200 according to the embodiments of this application may include steps S210 to S240.

[0037] In step S210, in response to receiving an access request for the target network system, the source network protocol address that initiated the access request is obtained.

[0038] In the embodiments of this application, the target network system can be a network system that requires intrusion detection. An access request is an interactive instruction initiated by the source (i.e., the client, such as a browser, mobile application, IoT device, or third-party system) to the target (i.e., the target network system). This instruction is encapsulated according to network protocol specifications and transmitted in the network in the form of structured messages. The access request includes a source network protocol address (Internet Protocol, or IP address) and a destination network protocol address. The destination IP address is the address the access request seeks to access; the source IP address is the address that issued the access request, used to identify the initial network location of the request initiator. Together, they constitute the basic addressing logic of network communication, ensuring that the access request can be accurately routed from the source to the target.

[0039] In the embodiments of this application, when an access request for a target network system is received, the source IP address that initiated the access request can be parsed from the message corresponding to the access request.

[0040] In step S220, based on the source network protocol address, a preset mapping relationship between network protocol address and physical address is queried to obtain the physical address corresponding to the source network protocol address.

[0041] In the embodiments of this application, a physical address can refer to the actual physical location where the device capable of initiating a network access request is deployed (such as workstation 01 on the 2nd floor of office building A). Each source IP address uniquely corresponds to a physical address, and the mapping relationship between IP addresses and physical addresses can be recorded and managed through a pre-set mapping table. Based on this mapping relationship, network access behavior can be associated with and located in a specific physical space, thereby achieving traceability from IP address to physical location.

[0042] Furthermore, by uniquely binding a specific person to a physical address, that person is established as the expected legitimate person for that physical address. This binding relationship means that the person is the responsible person and user of that physical address. For example, in an office scenario, a workstation is a physical address. When an employee establishes an affiliation binding with that workstation, that employee becomes the expected legitimate person bound to that workstation's physical address. Based on a pre-defined mapping table, an association relationship can be established with the target person's information, forming a tuple structure of (IP address, physical address, target person information). The target person information can include attributes such as unique identifiers, job titles, and physiological characteristics. Through this mapping mechanism, network access behavior can be simultaneously mapped to a specific physical space and the corresponding target person.

[0043] It should be noted that the actual content stored in the preset mapping table can be determined according to actual needs and is not restricted here. For example, it can also include media access control addresses.

[0044] In step S230, environmental status data corresponding to the physical address is acquired. This environmental status data includes the physical presence status of the person located at the physical address, their biometric information, and the operating interface of the target terminal device.

[0045] In the embodiments of this application, the environmental state data corresponding to the physical address can refer to the comprehensive information of the environmental area within a preset range corresponding to the physical address. For example, in an office scenario, when the physical address corresponds to a specific workstation, the preset range may be set as a circular area with a radius of a certain distance (e.g., 1 to 2 meters) centered on that workstation. The environmental state data can include the physical presence status of the person located at the physical address, biometric information, and the operating interface of the target terminal device. The physical presence status of the person can refer to whether there is a person actually present at that physical address. The biometric information of the person can refer to inherent human characteristic data used for identity verification, such as facial information covering facial contours, the position and shape of facial features, complex and essentially unchanging iris information, and voiceprint information with individual differences (e.g., frequency, timbre). It is understood that access requests are usually issued by various terminal devices with communication and data processing capabilities; therefore, the target terminal device issuing the access request may exist at the physical address. The operating interface of the target terminal device can refer to the current display screen of the device, such as the currently opened software.

[0046] In step S240, based on the physical address and the corresponding environmental status data, the access request is analyzed for intrusion detection using preset intrusion detection rules, and the intrusion detection result is output.

[0047] In the embodiments of this application, the intrusion detection result can refer to the determination result of whether an access request is an intrusion access request. Intrusion detection analysis can be performed based on the physical address and its associated environmental state data (i.e., the physical presence of personnel, biometric information, and the operating interface of the target terminal device). Specifically, corresponding thresholds and anomaly judgment modes can be set for different types of environmental data. Specifically, for the physical address, the legitimacy of the access request can be determined by judging whether it is located in a specific location. For the physical presence of personnel, the legitimacy of the access request can be determined by detecting whether the personnel are within a preset range corresponding to the physical address. For the biometric information of personnel, the matching degree between it and the preset biometric information of the target personnel can be calculated, and a threshold can be set. If the matching degree is lower than the threshold, it is regarded as an intrusion access request, which may involve security threats such as identity impersonation. For the operating interface of the terminal device, a characteristic pattern of the system issuing the access request at startup can be defined. Once it is detected that no situation matching the characteristic pattern appears in the operating interface, the access request is determined to be an intrusion access request.

[0048] According to embodiments of this application, by integrating physical location verification, determination of the physical presence of personnel, identification of personnel's biometric information, and monitoring of terminal behavior, it is possible to effectively identify attack traffic disguised as normal business request traffic, thereby accurately detecting and defending against malicious attacks against the target network system.

[0049] In the embodiments of this application, obtaining the source network protocol address of the access request includes: obtaining the network protocol address corresponding to the network node that initiated the access request, as the source network protocol address; wherein, the access request is initiated and forwarded through N network nodes in the network, and when the i-th network node forwards the access request, it sets the target network address in the access request to the network protocol address of the (i+1)-th network node, where N is a positive integer greater than or equal to 1, and i is a positive integer greater than or equal to 1 and less than N.

[0050] In the embodiments of this application, it is necessary to determine the initial source address of the access request, i.e., the source IP address. Specifically, given that access requests often traverse multiple intermediate network nodes or complex path jumps during actual network transmission, in order to obtain the source IP address, it is necessary to trace back along the transmission trajectory of the access request (i.e., the network access path) until the first hop address that initially initiated the access request is determined. The network access path refers to the sequence of network nodes that the access request passes through in the network from the source network node (e.g., the client) to the destination network node (e.g., the server).

[0051] For example, an access request is initiated by client A and forwarded sequentially through system B and system C to the target network system (i.e., the network system to be subjected to intrusion detection). Client A, system B, system C, and the target network system can all be considered network nodes, and the transmission flow in this process constitutes the network access path. During each forwarding, the source IP address of the request is updated to the IP address of the current sending system, and the destination IP address is the IP address of the next-hop receiving system. Upon receiving the access request, the target network system needs to trace back along the network access path. When it reaches client A, which initially initiated the request, the network access path can no longer be traced forward. At this point, the IP address of client A is the final source IP address of the access request.

[0052] It should be noted that, to ensure the traceability of IP addresses throughout the entire transmission process, each network node can record key metadata for each forwarded access request in its logs, including but not limited to the service number of the access request, the source IP address, the destination IP address, the operator's identity, and the operation timestamp. For example, the logs of system B can clearly record that it received a request from system A and the corresponding record of forwarding it to system C. By performing chain and correlation analysis on the above log information, a complete chain of access evidence can be constructed, ensuring that the IP address that first initiated the access request can be traced back when needed.

[0053] In the embodiments of this application, by using the IP address of the first network node on the access path as the source IP address, the access request initiation point can be located based on the source IP address, and subsequent intrusion detection can be performed.

[0054] In the embodiments of this application, obtaining environmental status data corresponding to a physical address includes: acquiring image information within the monitoring area corresponding to the physical address through video surveillance equipment; performing personnel identification on the image information to determine the physical presence status of personnel within the monitoring area, wherein the physical presence status includes presence and absence; in response to the physical presence status being determined to be presence, extracting the personnel's biometric information from the image information; and based on the image information, identifying the operating interface content of the display screen of the target terminal device installed at the physical address. Each physical address corresponds to a dedicated monitoring area.

[0055] In the embodiments of this application, for each physical address mapped according to the source IP address, video surveillance equipment can be deployed to collect on-site image information of the monitoring area corresponding to the physical address, and can support human body detection and screen content recognition.

[0056] It should be noted that, since each physical address is associated with a target person, explicit consent or legal authorization from that person is required before initiating image acquisition. For example, before acquisition, a request can be sent to the specific target person to obtain image information at their physical address. Subsequent data acquisition operations can only be performed with their consent or authorization.

[0057] In embodiments of this application, a corresponding operation entry point can be provided to users accessing the target network system, allowing them to choose to agree to or refuse the automated decision-making result. That is, before acquiring user image information, the user can provide an instruction to agree or refuse to acquire the image information through the corresponding operation entry point. If the user agrees to acquire the image information, the acquisition step can be executed. If the user refuses, the expert decision-making process begins.

[0058] For example, the environmental area within a preset range corresponding to the physical address can be used as the monitoring area corresponding to that physical address. After obtaining the physical address corresponding to the access request, the video surveillance equipment deployed at that location can be linked to retrieve and collect image information covering the monitoring area corresponding to that physical address. The time range of the image information can be locked within a specific preset time window before and after the access request is initiated. For example, if the access request is initiated at 09:15:00 and the preset time window is set to 30 seconds, image information within one minute from 09:14:30 to 09:15:30 can be collected. After obtaining the image information, the image information can be analyzed based on computer vision algorithms to determine whether there are any people present at the physical address, i.e., the physical presence status of the people. If it is confirmed that there are people present, the biometric information (such as facial feature information) of the people can be further extracted and identified from the image information. Simultaneously, image information of the terminal device screen installed at the physical address can be extracted from the image information, and the screen image can be captured from the image information. Using computer vision algorithms (such as template matching and feature point detection) or optical character recognition technology, visual features and text information in the image can be extracted, thereby determining the current display content of the terminal device's operating interface.

[0059] In the embodiments of this application, based on the physical address and the corresponding environmental state data, intrusion detection analysis is performed on the access request using preset intrusion detection rules. The output intrusion detection result includes determining that the access request is an intrusion access request based on at least one of the following: the physical address does not belong to a preset set of physical addresses, wherein the preset set of physical addresses is a set of physical addresses that are allowed to access the target network system; the physical presence status of the person indicates that no person exists at the physical address when the access request is initiated, wherein the physical presence status is used to indicate the presence of the person at the physical address; the biometric information of the person indicates that the person at the physical address when the access request is initiated is not the target person, wherein the target person is the expected legitimate person associated with the physical address; the operating interface of the target terminal device indicates that the system that issued the access request is in an inactive state when the access request is initiated.

[0060] Figure 3 A flowchart illustrating the determination of an intrusion access request according to an embodiment of this application is shown. Figure 3 As shown, the process for determining an intrusion access request according to an embodiment of this application may include steps S310 to S350.

[0061] In step S310, it is determined whether the physical address belongs to a preset set of physical addresses.

[0062] In the embodiments of this application, the preset physical address set is a set of physical addresses that are allowed to access the target network system. If the obtained physical address does not belong to the addresses that are allowed to access the target network system, then step S360 is executed; otherwise, step S320 is executed.

[0063] For example, if the target network system is an internal operations and maintenance system of a company, access to this system is restricted to the company's physical address range. If the obtained physical address is not within the preset range of the company's physical addresses, the current access request is determined to be an intrusion request. For instance, if an unauthorized user successfully intrudes into the company's internal operations and maintenance system through the company's external network, and the system's backend log records the internal gateway's source IP address, and the detection reveals that the initial source of the request was not an employee's computer terminal within the company, but rather an external network service device, then the corresponding request is determined to be an intrusion request.

[0064] In another embodiment, if the target network system is a sensitive data storage system, access to the system is restricted to the physical address range of the security control zone. If the obtained physical address is not within the preset physical address range of the security control zone, the current access request is determined to be an intrusion access request.

[0065] In step S320, it is determined whether the person exists when the access request is initiated.

[0066] In the embodiments of this application, when the target network system is accessed, if there are no personnel at the physical address corresponding to the source IP address, step S360 is executed; otherwise, step S330 is executed. If the physical address is unoccupied when the access request is initiated, it indicates that the operation was not performed by personnel located at that physical address, and is very likely an intrusion remotely triggered by an unauthorized user.

[0067] For example, if an unauthorized user intrudes into an employee's computer terminal and accesses the company system, the system's backend logs will record the source IP address of this access. Analysis of this logs will reveal the corresponding physical address. Simultaneously, based on video surveillance footage, it will be determined that no one was present at the physical address of the terminal when the access request was initiated; therefore, the request is classified as an intrusion request.

[0068] In step S330, the legitimacy of the person's identity is checked.

[0069] In the embodiments of this application, when an access request is initiated, if the person located at the physical address is not the target user, step S360 is executed; otherwise, step S340 is executed. Due to the strict control over user identity and permissions, the target network system can be configured to allow only the account holder to access it. When an access request is initiated, if the person located at the physical address is not the legitimate user, the unauthorized operation will be considered an invalid and high-risk intrusion.

[0070] For example, an unauthorized user, lacking access to the company system, logs in by occupying a company computer terminal and using an employee account with access rights associated with that physical address. However, when biometric verification is performed based on video surveillance footage, if the biometric information of the person accessing the company system does not match the biometric information of the expected legitimate person associated with that physical address recorded in a pre-set mapping table, the request is determined to be an intrusion request.

[0071] Optionally, the biometric information of the expected legitimate person can be pre-stored in a database. For example, the biometric information can be facial features. During comparison and judgment, a facial matching degree is calculated. If the facial matching degree is less than a preset facial matching degree, the person located at the physical address is determined not to be the expected legitimate person.

[0072] In step S340, when an access request is initiated, is the system that issued the access request started?

[0073] In the embodiments of this application, when an access request is initiated, if the terminal device's interface indicates that the system issuing the access request is not in an active state, then step S360 is executed; otherwise, step S350 is executed. If the terminal device's interface indicates that the system issuing the access request is not in an active state when the access request is initiated, it indicates that the request is not from the normal operating interface of the target system, but may be a malicious program silently executing in the background, or a non-interactive access attempt by an attacker exploiting a protocol vulnerability; therefore, it is determined to be an intrusion access request.

[0074] For example, an unauthorized user intrudes into a company computer terminal that is currently in use, accesses the company system using an employee account on that terminal, and the employee is currently using that terminal. The system can obtain image information of the terminal screen installed at that physical address, capture a screenshot from the image information, and further extract relevant visual features and text information from the image. It can also define the characteristic pattern of the system issuing the access request at startup. These two sets of characteristic information are compared and matched; if no match for the characteristic pattern is detected in the screen image, the access request is determined to be an intrusion request.

[0075] In step S350, a normal access request is made.

[0076] In the embodiments of this application, normal access requests can be allowed.

[0077] In step S360, an intrusion access request is made.

[0078] In the embodiments of this application, intrusion access requests can be intercepted, and warnings can be issued to system administrators of the target network through multiple means such as telephone, SMS, and system alarms.

[0079] In the embodiments of this application, by integrating multi-dimensional data such as physical address location, physical presence of personnel, personnel matching, and terminal operation interface analysis, potential intrusion behaviors can be accurately identified. This multi-verification mechanism effectively compensates for the shortcomings of a single authentication method and significantly improves the security of the target network system.

[0080] Figure 4 A flowchart illustrating the determination of intrusion access requests based on attendance data according to an embodiment of this application is shown. Figure 4 As shown, the process of determining an intrusion access request based on attendance data according to an embodiment of this application may include steps S410 to S440.

[0081] In step S410, the attendance data of the target personnel located at the physical address is obtained.

[0082] In step S420, the time range of the target person's accessibility status is determined based on the attendance data.

[0083] In step S430, the time when the access request was initiated is compared with the time range of the accessible state to determine whether the time when the access request was initiated falls within the time range of the accessible state, and a fifth determination result is generated.

[0084] In step S440, in response to the fifth judgment result being negative, the access request is determined to be an intrusion request.

[0085] In embodiments of this application, when the person located at the physical address is an expected legitimate person, their attendance data can also be obtained to determine the compliance of the access request. The attendance data can be used to determine the time range of their accessibility status. The time range of accessibility status can refer to the valid period during which a person is allowed to access the target network system.

[0086] If analysis of attendance data shows that an employee has no attendance record or is in a frozen state due to resignation, but the terminal device corresponding to the physical address associated with that employee initiates an access request to the target network system, this abnormal state of "person not at work" and "device online" presents a clear temporal and logical conflict. Therefore, this access behavior can be identified as an intrusion.

[0087] For example, the target person is a company employee. The company can obtain the employee's work hours (e.g., 9:00 AM to 5:00 PM). The time period between work hours and off-get off work hours is considered the employee's on-duty time (i.e., the accessibility period). During this time period, the employee has access rights to the target network system (i.e., accessibility status). If the time of an access request (e.g., 10:00 PM) is detected to be outside the employee's accessibility period, the corresponding request is determined to be an intrusion access request.

[0088] For example, no unauthorized intrusion occurred, but an employee, during their leave, bypassed the access control system by taking advantage of a colleague's card-swiping interval to log into their own terminal and access the company's internal computer terminal, triggering a system alert. That is, during the employee's leave, their access request to the target network system was directly identified as abnormal.

[0089] In the embodiments of this application, most automated script attacks and illegal intrusions often occur outside of working hours (weak periods in defense). By verifying the reasonableness of access request times through attendance data, such requests can be directly intercepted, greatly improving the security of the system outside of working hours. On the other hand, it can effectively prevent employees from logging into the system privately and performing unauthorized operations outside of working hours.

[0090] In the embodiments of this application, historical behavioral data of a target person on a target network system within a preset historical period can be obtained, wherein the target person is an expected legitimate person associated with a physical address; based on the historical behavioral data, access behavior benchmark data is constructed to characterize the normal access pattern of the person; in response to an access request that does not conform to the access behavior benchmark data, intrusion detection analysis is performed on the access behavior, and intrusion detection results are output.

[0091] For example, firstly, multi-dimensional historical behavioral data of the target user on the target network system within a preset historical period (e.g., consecutive 30 days, 90 days, or one year) can be obtained, including but not limited to basic data such as login time, logout time, session duration, access frequency, accessed resource type, requested data volume, and operation time patterns. Next, this historical behavioral data can be cleaned and feature extracted, and combined with unsupervised learning algorithms (such as the Isolation Forest algorithm) or supervised models, the underlying patterns can be mined to construct dynamic evolutionary access behavior benchmark data. This benchmark data can be used to characterize the target user's access patterns, behavioral habits, and risk thresholds under normal conditions. Simultaneously, the benchmark can be periodically updated using the latest normal behavioral data of the target user. When the target network system receives a new access request from the target user, its corresponding access behavior characteristics can be compared and analyzed with the established access behavior benchmark data. Once a significant deviation from the benchmark data is detected, it can be determined as a suspicious access request, triggering the execution of the network system intrusion detection method of this embodiment. For example, the obtained baseline access behavior data is as follows: (Access time period: 9:00 to 15:00 on weekdays; Access frequency: 10 times per day on average; Common terminal type: PC client; Average session duration: 30 minutes). The current access request was sent at 22:00, and the terminal type of the access request was a mobile terminal. By comparison, it was found that the characteristics of this access request deviate significantly from the baseline access behavior data. Therefore, it can be identified as a suspicious access request and trigger subsequent intrusion behavior detection.

[0092] In the embodiments of this application, by statistically analyzing the historical access behavior of target personnel located at physical addresses, baseline data on their access behavior can be constructed. Subsequent intrusion detection processes are only triggered when the actual access requests deviate significantly from this baseline, which can effectively filter normal traffic and thus significantly reduce the frequency of invalid detections.

[0093] In other embodiments of this application, historical behavioral data of a target person on a target network system within a preset historical period can be obtained, wherein the target person is an expected legitimate person associated with a physical address; the historical behavioral data is input into a preset access behavior prediction model to generate access behavior prediction data of the person in a future time window, wherein the access behavior prediction model is a model trained based on a long short-term memory network algorithm; in response to an access request not conforming to the access behavior prediction data, intrusion detection analysis is performed on the access behavior, and intrusion detection results are output.

[0094] For example, firstly, multi-dimensional historical behavioral data of the target personnel on the target network system within a preset historical period can be obtained. Then, a Long Short-Term Memory (LSTM) network algorithm can be used to generate an access behavior prediction model. By learning from the historical behavioral data sequence, the model can predict the target personnel's expected access behavior in the next future time window (the following hour, the next working day), thus generating access behavior prediction data. When the target personnel initiate a new access request, the behavioral feature vector of the request can be extracted and compared in real-time with the access behavior prediction data generated by the access behavior prediction model for that time, and similarity calculations can be performed. If the access behavior significantly deviates from the access behavior prediction data, it can be determined as a suspicious access request, triggering the execution of the network system intrusion detection method of this application embodiment. For example, access behavior prediction data shows that the target personnel typically only use a computer terminal for low-frequency query operations during the inactive period of 10 PM; however, the currently detected access request occurs at 10 PM, and the source terminal is a mobile phone, accompanied by a large amount of sensitive data download operations. Therefore, the access behavior characteristics deviate significantly from the access behavior prediction data, and it can be determined as a suspicious access request, triggering subsequent intrusion behavior detection.

[0095] In the embodiments of this application, the access behavior characteristics of target personnel located at a physical address can be predicted within a future time window. Subsequent intrusion detection processes are only triggered when the actual access request deviates from these predicted characteristics. This prediction-based filtering strategy effectively filters normal traffic, thereby significantly reducing the frequency of invalid detections.

[0096] Figure 5 Another flowchart of a network system intrusion detection method according to an embodiment of this application is illustrated.

[0097] like Figure 5As shown, when an access request for a target network system is received, the source network protocol address that initiated the access request can be obtained. Based on the source network protocol address, its corresponding physical address can be queried through a preset mapping table. At the same time, the status data corresponding to the physical address can be obtained, including: physical presence, biometric features, terminal operation screen, and attendance data. Based on the above four-dimensional data, intrusion behavior detection is carried out. After fusion decision analysis, if the access request is determined to be an intrusion access request, an early warning is immediately triggered.

[0098] Figure 6 A flowchart illustrating component interactions according to an embodiment of this application is shown.

[0099] like Figure 6 As shown, the network system intrusion detection method of this application embodiment can be implemented by multiple components. The target business system can receive access requests and record data such as the access source IP, personnel information, and operation timestamps through logs; the video surveillance system can collect image information of the area corresponding to the physical address and can support human detection and screen content recognition; the human resources system, as the basic data source, can store employee biometric information, attendance data, and the mapping relationship between IP address and physical address; the intrusion detection engine can perform real-time analysis and blocking of access requests; and the early warning and handling platform can trigger alarms through telephone, SMS, and other means.

[0100] For example, when the target business system receives an access request, the intrusion detection engine will obtain the source IP address of the access request and its corresponding physical address, obtain the image information of the monitoring area corresponding to the physical address from the video surveillance system, and obtain the identity information and attendance information of the expected legitimate personnel bound to the physical address from the human resources system. Based on this information, the intrusion behavior detection of the access request will be performed. When it is determined that the access request is an intrusion access request, an early warning will be issued through the early warning and handling platform.

[0101] Based on the above-described network system intrusion detection method, embodiments of this application also provide a network system intrusion detection device. The following will be combined with... Figure 7 The device is described in detail.

[0102] Figure 7 A schematic block diagram of a network system intrusion detection device according to an embodiment of this application is shown.

[0103] like Figure 7 As shown, the network system intrusion detection device 700 of this embodiment includes a source network protocol address acquisition module 710, a physical address acquisition module 720, an environmental status data acquisition module 730, and an intrusion detection module 740.

[0104] The source network protocol address acquisition module 710 is used to acquire the source network protocol address that initiated the access request in response to receiving an access request for the target network system. In one embodiment, the source network protocol address acquisition module 710 can be used to perform step S210 described above, which will not be repeated here.

[0105] The physical address acquisition module 720 is used to query a preset mapping relationship between network protocol addresses and physical addresses based on the source network protocol address, and obtain the physical address corresponding to the source network protocol address. In one embodiment, the physical address acquisition module 720 can be used to execute step S220 described above, which will not be repeated here.

[0106] The environmental status data acquisition module 730 is used to acquire environmental status data corresponding to the physical address. The environmental status data includes the physical presence status of the person located at the physical address, biometric information, and the operating interface of the target terminal device. In one embodiment, the environmental status data acquisition module 730 can be used to execute step S230 described above, which will not be repeated here.

[0107] The intrusion detection module 740 is used to perform intrusion detection analysis on access requests based on physical addresses and corresponding environmental status data, and to output intrusion detection results according to preset intrusion detection rules. In one embodiment, the intrusion detection module 740 can be used to execute step S240 described above, which will not be repeated here.

[0108] In the embodiments of this application, the source network protocol address acquisition module 710 specifically includes: acquiring the network protocol address corresponding to the network node that initiates the access request, as the source network protocol address; wherein, the access request is initiated and forwarded through N network nodes in the network, and when the i-th network node forwards the access request, it sets the target network address in the access request to the network protocol address of the (i+1)-th network node, where N is a positive integer greater than or equal to 1, and i is a positive integer greater than or equal to 1 and less than N.

[0109] In the embodiments of this application, the environmental status data acquisition module 730 specifically includes: acquiring image information of the monitoring area corresponding to the physical address through video surveillance equipment; performing personnel identification on the image information to determine the physical presence status of personnel in the monitoring area, wherein the physical presence status includes presence status and non-presence status; in response to the physical presence status being determined to be presence status, extracting the biometric information of personnel from the image information; and identifying the running interface content of the display screen of the target terminal device installed at the physical address based on the image information.

[0110] In the embodiments of this application, the network system intrusion detection device 700 may further include a first intrusion access request determination module, a second intrusion access request determination module, and an access request determination module.

[0111] The first intrusion access request determination module is used to determine that an access request is an intrusion access request based on at least one of the following: the physical address does not belong to a preset set of physical addresses, wherein the preset set of physical addresses is a set of physical addresses that are allowed to access the target network system; the physical presence status of the person indicates that no person exists at the physical address when the access request is initiated, wherein the physical presence status is used to indicate the presence of the person at the physical address; the biometric information of the person indicates that the person located at the physical address when the access request is initiated is not the target person, wherein the target person is the expected legitimate person associated with the physical address; the operating interface of the target terminal device indicates that the system that issued the access request is in an inactive state when the access request is initiated.

[0112] The second intrusion access request determination module is used to obtain the attendance data of the target personnel located at the physical address; based on the attendance data, determine the time range of the target personnel's accessible status; compare the initiation time of the access request with the time range of the accessible status to determine whether the initiation time of the access request falls within the time range of the accessible status, and generate a fifth determination result; in response to the fifth determination result being a negative result, determine the access request as an intrusion access request.

[0113] In some embodiments, the access request determination module is used to obtain historical behavior data of the target personnel on the target network system within a preset historical period, wherein the target personnel are expected legitimate personnel associated with physical addresses; based on the historical behavior data, construct access behavior benchmark data to characterize the normal access pattern of personnel; in response to access requests not conforming to the access behavior benchmark data, perform intrusion detection analysis on the access behavior and output intrusion detection results.

[0114] In other embodiments, the access request determination module is used to obtain historical behavior data of the target personnel on the target network system within a preset historical period, wherein the target personnel are expected legitimate personnel associated with physical addresses; input the historical behavior data into a preset access behavior prediction model to generate access behavior prediction data of the personnel in a future time window, wherein the access behavior prediction model is a model trained based on a long short-term memory network algorithm; in response to access requests not conforming to the access behavior prediction data, perform intrusion detection analysis on the access behavior and output intrusion detection results.

[0115] According to embodiments of this application, by integrating network access logs, physical location verification, biometric identification, and terminal behavior monitoring, attack traffic disguised as normal business request traffic can be effectively identified, thereby accurately detecting and defending against malicious attacks against the target network system.

[0116] According to embodiments of this application, any multiple modules among the source network protocol address acquisition module 710, physical address acquisition module 720, environmental status data acquisition module 730, and intrusion detection module 740 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least some of the functions of one or more of these modules can be combined with at least some of the functions of other modules and implemented in one module. According to embodiments of this application, at least one of the source network protocol address acquisition module 710, physical address acquisition module 720, environmental status data acquisition module 730, and intrusion detection module 740 can be at least partially implemented as hardware circuitry, such as field-programmable gate arrays, programmable logic arrays, systems-on-a-chip, systems-on-a-substrate, systems-on-package, application-specific integrated circuits, or implemented in hardware or firmware by any other reasonable means of integrating or packaging circuitry, or implemented in software, hardware, and firmware, or in any appropriate combination of any of these three implementation methods. Alternatively, at least one of the source network protocol address acquisition module 710, physical address acquisition module 720, environmental status data acquisition module 730, and intrusion detection module 740 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0117] Figure 8 A block diagram schematically illustrates an electronic device suitable for implementing a network system intrusion detection method according to an embodiment of this application.

[0118] like Figure 8 As shown, an electronic device 800 according to an embodiment of this application includes a processor 801, which can perform various appropriate actions and processes according to a program stored in a read-only memory 802 or a program loaded from a storage portion 808 into a random access memory 803. The processor 801 may include, for example, a general-purpose microprocessor, an instruction set processor and / or an associated chipset and / or a dedicated microprocessor. The processor 801 may also include onboard memory for caching purposes. The processor 801 may include a single processing unit or multiple processing units for executing different steps of the method flow according to an embodiment of this application.

[0119] Random access memory 803 stores various programs and data required for the operation of electronic device 800. Processor 801, read-only memory 802, and random access memory 803 are interconnected via bus 804. Processor 801 executes various steps of the method flow according to embodiments of this application by executing programs stored in read-only memory 802 and / or random access memory 803. It should be noted that the programs may also be stored in one or more memories other than read-only memory 802 and random access memory 803. Processor 801 may also execute various steps of the method flow according to embodiments of this application by executing programs stored in said one or more memories.

[0120] According to embodiments of this application, the electronic device 800 may further include an input / output interface 805, which is also connected to a bus 804. The electronic device 800 may also include one or more of the following components connected to the input / output interface 805: an input section 806 including a keyboard, mouse, etc.; an output section 807 including a cathode ray tube, liquid crystal display, etc., and a speaker, etc.; a storage section 808 including a hard disk, etc.; and a communication section 809 including a network interface card, such as a local area network card, modem, etc. The communication section 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to the input / output interface 805 as needed. A removable medium 811, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 810 as needed so that computer programs read from it can be installed into the storage section 808 as needed.

[0121] Embodiments of this application also provide a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of this application.

[0122] According to embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including but not limited to: portable computer disks, hard disks, random access memory, read-only memory, erasable programmable read-only memory, portable compact disk read-only memory, optical storage devices, magnetic storage devices, or any suitable combination thereof. In embodiments of this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this application, the computer-readable storage medium may include the read-only memory 802 described above, and / or random access memory 803, and / or one or more memories other than read-only memory 802 and random access memory 803.

[0123] Embodiments of this application also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to cause the computer system to implement the methods provided in the embodiments of this application.

[0124] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 809, and / or installed from a removable medium 811. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0125] In embodiments of this application, the computer program can be downloaded and installed from a network via communication section 809, and / or installed from removable medium 811. When the computer program is executed by processor 801, it performs the functions defined in the system of embodiments of this application. According to embodiments of this application, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0126] According to embodiments of this application, program code for executing the computer programs provided in the embodiments of this application can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0127] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0128] Those skilled in the art will understand that the features described in the various embodiments of this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, the features described in the various embodiments of this application can be combined and / or combined in various ways without departing from the spirit and teachings of this application. All such combinations and / or combinations fall within the scope of this application.

Claims

1. A network system intrusion detection method characterized by comprising: The method includes: In response to receiving an access request for a target network system, the source network protocol address that initiated the access request is obtained; Based on the source network protocol address, query the preset mapping relationship between network protocol address and physical address to obtain the physical address corresponding to the source network protocol address; Obtain environmental status data corresponding to the physical address, wherein the environmental status data includes the physical presence status of the person located at the physical address, biometric information, and the operating interface of the target terminal device; Based on the physical address and the corresponding environmental status data, the access request is analyzed for intrusion detection using preset intrusion detection rules, and the intrusion detection result is output.

2. The method according to claim 1, characterized in that, Based on the physical address and the corresponding environmental state data, the access request is analyzed for intrusion detection using preset intrusion detection rules. The output intrusion detection result includes determining that the access request is an intrusion access request based on at least one of the following: The physical address does not belong to a preset set of physical addresses, wherein the preset set of physical addresses is a set of physical addresses that are allowed to access the target network system; The physical presence status of the person indicates that the person does not exist at the physical address when the access request is initiated, wherein the physical presence status is used to indicate the presence of the person at the physical address; The biometric information of the person indicates that the person located at the physical address when the access request is initiated is not the target person, wherein the target person is the expected legitimate person associated with the physical address; The target terminal device's interface indicates that the system that issued the access request was not running when the access request was initiated.

3. The method according to claim 2, characterized in that, The determination that the access request is an intrusion access request also includes: Obtain the attendance data of the target personnel located at the physical address; Based on the attendance data, determine the time range of the target person's accessibility status; The time of initiation of the access request is compared with the time range of the accessible state to determine whether the time of initiation of the access request falls within the time range of the accessible state, and a fifth determination result is generated. If the fifth judgment result is negative, the access request is determined to be an intrusion access request.

4. The method according to claim 1, characterized in that, The step of obtaining the source network protocol address that initiated the access request includes: Obtain the network protocol address corresponding to the network node that initiated the access request, and use it as the source network protocol address; In this process, the access request is initiated and forwarded by N network nodes in the network. When forwarding the access request, the i-th network node in the N network nodes sets the target network address in the access request to the network protocol address of the (i+1)-th network node. N is a positive integer greater than or equal to 1, and i is a positive integer greater than or equal to 1 and less than N.

5. The method according to claim 1, characterized in that, The process of obtaining the environmental status data corresponding to the physical address includes: The video surveillance equipment is used to collect image information within the monitoring area corresponding to the physical address; Personnel identification is performed on the image information to determine the physical presence status of personnel within the monitored area, wherein the physical presence status includes both presence and absence status; In response to the physical state being determined to be present, the biometric information of the person is extracted from the image information; Based on image information, identify the operating interface content of the display screen of the target terminal device installed at the physical address.

6. The method according to claim 1, characterized in that, The method further includes: Obtain historical behavioral data of a target person on the target network system within a preset historical period, wherein the target person is an expected legitimate person associated with the physical address; Based on the historical behavior data, access behavior benchmark data is constructed to characterize the normal access patterns of the personnel; In response to the access request not conforming to the access behavior baseline data, intrusion detection analysis is performed on the access behavior, and intrusion detection results are output.

7. The method according to claim 1, characterized in that, The method further includes: Obtain historical behavioral data of a target person on the target network system within a preset historical period, wherein the target person is an expected legitimate person associated with the physical address; The historical behavior data is input into a preset access behavior prediction model to generate access behavior prediction data for the person in a future time window, wherein the access behavior prediction model is a model trained based on a long short-term memory network algorithm. In response to the access request not conforming to the access behavior prediction data, intrusion detection analysis is performed on the access behavior, and intrusion detection results are output.

8. A network system intrusion detection device, characterized in that, The device includes: The source network protocol address acquisition module is used to acquire the source network protocol address that initiated the access request in response to receiving an access request for the target network system. The physical address acquisition module is used to query a preset mapping relationship between network protocol addresses and physical addresses based on the source network protocol address, and obtain the physical address corresponding to the source network protocol address. An environmental status data acquisition module is used to acquire environmental status data corresponding to the physical address, wherein the environmental status data includes the physical presence status of the person located at the physical address, biometric information, and the operating interface of the target terminal device; and The intrusion detection module is used to perform intrusion detection analysis on the access request based on the physical address and the corresponding environmental status data, and to output the intrusion detection result.

9. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 7.

Images