Network security defense monitoring system based on service granularity

Abstract

The invention provides a network security defense monitoring system based on service granularity, which belongs to the technical field of computer networks, and comprises the following steps: a gateway configuration module configures a gateway route for a Web service initiated by a user through user side equipment, and generates a user service request; the service identification module identifies the detection identifier in the user service request, and calls the defense monitoring module to detect the user service request when identifying that the user service request contains the detection identifier; when the working mode is an interception mode, the defense monitoring module detects that the user service request has a security risk, and prohibits the transmission of the user service request; and when the working mode is an observation mode, executing operation according to the user service request, and generating a monitoring log to monitor execution of the user service request. According to the system, security risk detection based on service granularity is realized, fine processing of a single service request is realized through an interception mode and an observation mode, and the flexibility of security defense strategy configuration is improved.

Description

Technical Field

[0001] This invention relates to the field of computer network technology, and in particular to a network security defense and monitoring system based on service granularity. Background Technology

[0002] Web services are a service-oriented architecture technology that provides services through standard web protocols. When a user device initiates a web service request, the business server typically uses a Web Application Firewall (WAF) to perform security checks on the service request.

[0003] Traditional web application protection systems process service requests based on global traffic, but cannot detect and defend against individual service requests. This global-mode approach not only slows down the processing of web service requests but also prevents fine-grained configuration of individual service requests. This lack of flexibility in security defense strategy configuration further hinders the timely processing of specific service requests, thus posing security risks to server data.

[0004] Therefore, a network security defense and monitoring system based on service granularity is proposed. Summary of the Invention

[0005] To address the aforementioned technical problems, this invention provides a service-granularity-based network security defense and monitoring system, which solves the problem that traditional technologies cannot configure defense and monitoring strategies for individual service requests.

[0006] This invention provides a service-granularity-based network security defense and monitoring system, comprising:

[0007] The gateway configuration module is used to configure gateway routes for web services initiated by users through user terminal devices, generate user service requests, and set up a defense monitoring module in the gateway routes.

[0008] The service identification module is used to acquire user service requests and identify detection identifiers in the user service requests. When the detection identifier is detected in the user service request, the defense monitoring module is invoked to detect the user service request.

[0009] The mode setting module is used to set the working mode of the defense monitoring module;

[0010] The defense monitoring module is used to detect whether the user service request has any security risks. When the defense monitoring module is in the interception mode, if it detects that the user service request has security risks, it will prohibit the transmission of the user service request and return an error status code to the user terminal device. When the defense monitoring module is in the observation mode, if it detects that the user service request has security risks, it will perform corresponding operations according to the user service request and generate monitoring logs to monitor the execution of the user service request.

[0011] Preferably, the present invention provides a service-granularity-based network security defense and monitoring system, wherein the gateway configuration module includes:

[0012] The service request acquisition unit is used to acquire web service requests initiated by users through user-end devices.

[0013] The service request parsing unit is used to parse the Web service request. When the Web service request is an intranet service request, it performs corresponding operations on the intranet access request according to the intranet access rules. When the Web service request is a public network service request, it adds a detection identifier to the public network service request based on the service monitoring rules, configures a gateway route for the public network service request, and generates a user service request.

[0014] Preferably, the present invention provides a service-granularity-based network security defense and monitoring system, the system comprising:

[0015] The service operation and maintenance platform is used by backend administrators to set the service monitoring rules and synchronize them to the gateway configuration module;

[0016] The service operation and maintenance platform is also used by the backend administrator to configure request whitelists and key monitoring lists in the defense monitoring module based on service resource information;

[0017] The defense monitoring module is used to stop detecting the user service request and perform corresponding operations according to the user service request when it detects that the service identifier information in the user service request is the same as the service resource information in the request whitelist; and to perform full-process monitoring of the user service request when the service identifier information in the user service request is the same as the service resource information in the key monitoring list.

[0018] Preferably, the present invention provides a service-granularity-based network security defense and monitoring system, the system comprising: a log collection module;

[0019] The log collection module is used by the defense monitoring module to collect user service requests and obtain a set of risky service requests when the defense monitoring module detects that the user service request has a security risk.

[0020] The service operation and maintenance platform is further configured to perform log analysis based on the risk service request set, obtain user access information of users who initiated user service requests in the risk service request set, detect the user's network access status based on the user access information, and identify the user's identity; optionally, it includes:

[0021] Obtain the user access service request associated with the aforementioned user access information;

[0022] Obtain the model of the user's terminal device that initiated the user's service access request, and assess the device anomaly of the user's service access request; optionally, this includes:

[0023] Suppose that the user access information initiates a total of m user access service requests;

[0024]

[0025] Among them, V j The j-th user access service request is represented by the user's terminal device model. Device is a user device database based on the user access information, which stores the user's terminal device model V. j At that time, the device field value C j The value is 0, indicating that the user terminal equipment model V is not stored in the user equipment library. j At that time, the device field value C j Set it to 1, and set the user terminal device model V j Add to the user device library Device, where Div represents the diversity of device types;

[0026] Obtain the access time information of the user who initiated the service access request, construct the access time series, convert it to the frequency domain through Fourier transform for analysis, and calculate the corresponding access average power spectral density.

[0027] Obtain the access content information of the user's service access request and calculate the access information entropy;

[0028] Based on the device anomalies, the average power spectral density of access, and the access information entropy, an access feature vector is constructed.

[0029] The user type assessment model is trained based on the sample feature vector and the corresponding sample label to construct the user type assessment space and optimize the classification interface; the assessment region of the access feature vector in the user type assessment space is calculated by the user type assessment model, and the user identity identifier corresponding to the assessment region is obtained as the user identity of the user access information.

[0030] The gateway configuration module is also used to prevent the configuration of gateway routes for user service requests associated with the user identity when the service operation and maintenance platform detects that the user identity is an illegal user, and to return a malicious access prompt code to the user terminal device.

[0031] Preferably, the present invention provides a service-granularity-based network security defense and monitoring system, wherein the mode setting module includes:

[0032] The intelligent mode setting unit is used to obtain the access source address of the user service request, detect the access record initiated by the access source address through the gateway routing, and set the working mode of the defense monitoring module to observation mode when the access source address is initiating the user service request for the first time.

[0033] When the access source address is not the first time initiating the user service request, the system obtains historical service requests initiated by the access source address and the processing operations of the defense monitoring module on the historical service requests, and analyzes the access security of the access source address; optionally, this includes:

[0034] The historical request information of the historical service requests, the historical working mode corresponding to the defense monitoring module, and the historical operation information corresponding to the defense monitoring module are used as evaluation indicators.

[0035] Obtain the security assessment value of the access source address;

[0036] Suppose that the source address initiated a total of s historical service requests;

[0037]

[0038] Where f(s) is the security assessment value of s historical service requests based on the access source address, f(s-1) is the security assessment value of s-1 historical service requests based on the access source address, and w s1 w is the weight of the information influence of historical request information in the s-th historical service request based on the access source address on the security assessment value. s2 The weight of w is the influence of the historical operating mode of the defense monitoring module on the security assessment value in the s-th historical service request based on the access source address. s3 The weight of the impact of historical operation information of the defense monitoring module on the security assessment value based on the s-th historical service request of the access source address; w i1 w is the weight of the information influence of historical request information in the i-th historical service request based on the access source address on the security assessment value. i2 w is the weight of the influence of the historical operating mode of the defense monitoring module on the security assessment value in the i-th historical service request based on the access source address.i3 μ is the weight of the impact of historical operation information of the defense monitoring module on the security assessment value in the i-th historical service request based on the access source address. s1 The influence weight w of the information s1 The first balance regulator, μ s2 The influence weight w of the mode s2 The second balance regulator, μ s3 The influence weight w of the information s3 The third balance adjustment factor, σ, is a constant; the first balance factor μ s1 The second balance adjustment factor is set by the information entropy of historical request information in the s-th historical service request, and is determined by μ. s2 The third balance factor μ is determined by the way the historical working mode is set in the s-th historical service request. s3 Determined by the operation content of the historical operation information in the s-th historical service request;

[0039] Set a security assessment threshold. When the security assessment value of the access source address is higher than the security assessment threshold, the access source address will be detected as a high-risk address.

[0040] When the access source address is a high-risk address, the working mode of the defense monitoring module is set to interception mode.

[0041] Preferably, the present invention provides a service-granularity-based network security defense and monitoring system, wherein the mode setting module includes:

[0042] The manual mode setting unit is used by the backend administrator to set the working mode of the defense monitoring module.

[0043] The manual mode setting unit has a higher priority than the intelligent mode setting unit. When the background administrator does not set the working mode of the defense monitoring module through the manual mode setting unit, the working mode of the defense monitoring module is set through the intelligent mode setting unit.

[0044] Preferably, the present invention provides a service-granularity-based network security defense and monitoring system, wherein the defense and monitoring module includes:

[0045] The detection and identification unit is used to detect whether the user service request has a security risk, and when the user service request has a security risk, it identifies the risk information of the user service request.

[0046] The working mode acquisition unit is used to acquire the current working mode of the defense monitoring module;

[0047] The defense execution unit is used to perform corresponding operations on the user service request based on the working mode and the risk information.

[0048] Preferably, the present invention provides a service-granularity-based network security defense and monitoring system, wherein the defense and monitoring module includes:

[0049] The detection and identification unit includes: a resource malicious consumption detection subunit; the resource malicious consumption detection subunit is used to detect the access interval time, access quantity and access resource usage of the user service request according to the access type of the user service request, determine whether the user service request has a security risk according to the built-in triggering rules, and add a malicious resource consumption identifier to the user service request when it is determined that the user service request has a security risk of malicious resource consumption.

[0050] The defense execution unit includes: a resource malicious consumption defense subunit; the resource malicious consumption defense subunit is used to perform corresponding processing on user service requests with malicious resource consumption identifiers added according to the working mode; optionally, it includes:

[0051] When the operating mode is interception mode, the access of the user service request is blocked;

[0052] When the working mode is observation mode, a verification code is sent to the user terminal device for verification according to the user service request, and a monitoring log is generated to monitor the execution of the user service request;

[0053] The resource malicious consumption detection subunit and the resource malicious consumption defense subunit process the user service request as follows:

[0054] {AppID IntervalSeconds Count statBytype trirule IsEnable ActionUserSever}

[0055] Wherein, AppID is the identifier for malicious resource consumption, IntervalSeconds is the access interval of the user service request, Count is the number of accesses, statBytype is the access type, trirule is the security risk defense trigger rule, IsEnable is the execution identifier of the resource malicious consumption defense subunit, Action is the execution action of the resource malicious consumption defense subunit, and UserServer is the user service request.

[0056] Preferably, the present invention provides a service-granularity-based network security defense and monitoring system, wherein the detection and identification unit further includes: a signature detection subunit;

[0057] The signature detection subunit is used to obtain a vulnerability information table, construct corresponding vulnerability detection signature rules, and perform vulnerability detection on the user service request based on the vulnerability detection signature rules and preset detection points. When a vulnerability security risk is detected in the user service request, a vulnerability risk identifier is added to the user service request.

[0058] The defense execution unit includes: a vulnerability defense subunit; the vulnerability defense subunit is used to perform corresponding processing on user service requests with added vulnerability risk identifiers according to the working mode; optionally, it includes:

[0059] When the operating mode is interception mode, the access of the user service request is blocked;

[0060] When the working mode is observation mode, monitoring logs are generated by acquiring the vulnerability risk identifier, request time, user terminal device IP, request method, request path, request content, and the operations performed by the vulnerability defense subunit in the user service request.

[0061] Preferably, the present invention provides a service-granularity-based network security defense and monitoring system, wherein the detection and identification unit further includes: an anomaly detection subunit;

[0062] The anomaly detection subunit is configured to build several anomaly assessment models based on the access attributes of the user service request, and the anomaly assessment models perform anomaly assessment on the user service request to obtain an anomaly probability value; optionally, it includes:

[0063] The anomaly assessment model includes a request length anomaly assessment model for detecting the request length of the user service request; the request length anomaly assessment model is used to obtain sample request lengths l1,…,l from normal service requests in a sample database. m Calculate the corresponding sample mean μ and sample variance σ. 2 ;

[0064] The abnormal probability value of the request length of the user service request is detected by the request length anomaly evaluation model.

[0065]

[0066] Where, l is the request length of the user service request, l s Let p(l) be the standard service request length, and p(l) be the anomaly probability value obtained by the request length anomaly assessment model for detecting the user service request.

[0067] The anomaly detection subunit is also used to perform weighted calculations on several anomaly probability values ​​obtained through several anomaly evaluation models to obtain an anomaly evaluation value, and to determine that there is an anomaly risk in the user service request when the anomaly evaluation value exceeds the detection threshold.

[0068]

[0069] Where V is the anomaly assessment value, and the user service request is assessed for anomalies using n anomaly assessment models, ω i p represents the evaluation weight of the i-th anomaly evaluation model. i Let be the probability value of the anomaly obtained by the i-th anomaly evaluation model, and Models be the set of anomaly evaluation models.

[0070] Compared to traditional technologies, the service-granularity-based network security defense and monitoring system only performs detection when user service requests contain detection identifiers. This avoids the problems of wasting resources and affecting service request processing speed by detecting service requests in global traffic. By calling the defense monitoring module to detect user service requests containing detection identifiers, it achieves service-granularity-based security risk detection. Through interception and observation modes, the system achieves fine-grained processing of individual service requests, improves the flexibility of security defense strategy configuration, and enables the system to configure and process specific service requests, further improving the security of server data and the stability of network access requests.

[0071] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings.

[0072] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0073] Figure 1 This is a schematic diagram of the network security defense and monitoring system based on service granularity provided by the present invention. Detailed Implementation

[0074] The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0075] Example 1:

[0076] This invention provides a service-granularity-based network security defense and monitoring system, referencing... Figure 1 ,include:

[0077] The gateway configuration module is used to configure gateway routes for web services initiated by users through user-end devices, generate user service requests, and set up defense monitoring modules in the gateway routes.

[0078] The service identification module is used to obtain user service requests and identify the detection identifiers in the user service requests. When the detection identifiers are detected in the user service requests, the defense monitoring module is called to detect the user service requests.

[0079] The mode setting module is used to set the working mode of the defense monitoring module;

[0080] The defense monitoring module is used to detect whether there are security risks in user service requests. When the defense monitoring module is in the interception mode, if a security risk is detected in a user service request, the transmission of the user service request will be prohibited, and an error status code will be returned to the user terminal device. When the defense monitoring module is in the observation mode, if a security risk is detected in a user service request, corresponding operations will be performed according to the user service request, and monitoring logs will be generated to monitor the execution of the user service request.

[0081] In the above embodiments, the service-granularity-based network security defense and monitoring system configures gateway routes for web services initiated by users through user terminal devices through the gateway configuration module, generates user service requests, and the service identification module identifies the detection identifier in the user service request. When the detection identifier is found in the user service request, the defense and monitoring module is called to detect the user service request.

[0082] The defense monitoring module detects whether there are security risks in user service requests. When the defense monitoring module is in the interception mode, if it detects that there are security risks in user service requests, it will prohibit the transmission of user service requests and return an error status code to the user terminal device.

[0083] When the defense monitoring module is in observation mode, it detects that a user service request has a security risk, performs corresponding operations based on the user service request, and generates monitoring logs to monitor the execution of the user service request.

[0084] In the above embodiments, the defense monitoring module is configured in the gateway route through the gateway configuration module.

[0085] In the above embodiments, the working mode of the defense monitoring module is set through the mode setting module.

[0086] In the above embodiments, the service-granularity-based network security defense and monitoring system allows the project development team to set the working mode through the mode setting module, enabling the system to maintain user service requests automatically and detect and fix security issues in advance.

[0087] The beneficial effects of the above technologies are as follows: The gateway configuration module configures the gateway route for web services initiated by user devices, generating user service requests; when the service identification module detects a detection identifier in the user service request, it calls the defense monitoring module to detect the user service request, achieving security risk detection of the user service request and executing corresponding operations according to the working mode; compared with traditional technologies, the above system only performs detection when the user service request contains a detection identifier, avoiding the problem of wasting resources and affecting the service request processing speed by detecting service requests in global traffic. Furthermore, by calling the defense monitoring module to detect user service requests containing detection identifiers, it achieves service-level security risk detection. Through interception and observation modes, it achieves fine-grained processing of individual service requests, improving the flexibility of security defense strategy configuration, enabling the system to configure and process specific service requests, and further improving the security of server data and the stability of network access requests.

[0088] Example 2:

[0089] This invention provides a service-granularity-based network security defense and monitoring system, including a gateway configuration module:

[0090] The service request acquisition unit is used to acquire web service requests initiated by users through user-end devices.

[0091] The service request parsing unit is used to parse Web service requests. When the Web service request is an intranet service request, it performs corresponding operations on the intranet access request according to the intranet access rules. When the Web service request is a public network service request, it adds a detection identifier to the public network service request based on the service monitoring rules, configures a gateway route for the public network service request, and generates a user service request.

[0092] In the above embodiments, the service request acquisition unit acquires the web service request initiated by the user through the user terminal device, the service request parsing unit parses the web service request, and when the web service request is a public network service request, it adds a detection identifier to the public network service request based on the service monitoring rules, configures a gateway route for the public network service request, and generates a user service request.

[0093] In the above embodiments, when the service request parsing unit parses a Web service request into an intranet service request, it performs corresponding operations on the intranet access request according to the intranet access rules.

[0094] The beneficial effects of the above technologies are as follows: the service request acquisition unit enables the acquisition of Web service requests initiated by user terminal devices; the service request parsing unit enables the addition of detection identifiers to Web service requests for public network service requests, making it easier for the service identification module to call the defense monitoring module to detect the generated user service requests.

[0095] Example 3:

[0096] This invention provides a service-granularity-based network security defense and monitoring system, the system comprising:

[0097] The service operation and maintenance platform is used by backend administrators to set service monitoring rules and synchronize them to the gateway configuration module;

[0098] The service operation and maintenance platform is also used by backend administrators to configure request whitelists and key monitoring lists in the defense monitoring module based on service resource information;

[0099] The defense monitoring module is used to stop monitoring user service requests when the service identifier information in a user service request is the same as the service resource information in the request whitelist, and to perform corresponding operations based on the user service request; when the service identifier information in a user service request is the same as the service resource information in the key monitoring list, the module performs full-process monitoring of the user service request.

[0100] In the above embodiments, the service operation and maintenance platform is used by backend administrators to set service monitoring rules and synchronize them to the gateway configuration module and the defense monitoring module, so as to enable backend administrators to configure rules for user service requests based on service granularity.

[0101] In the above embodiments, the service operation and maintenance platform is also used by the backend administrator to configure a request whitelist in the defense monitoring module based on the service resource information; when the defense monitoring module detects that the service identifier information in the user service request is the same as the service resource information in the request whitelist, it stops detecting the user service request and performs corresponding operations according to the user service request.

[0102] In the above embodiments, the project R&D team can configure a request whitelist through the service operation and maintenance platform, which improves the flexibility and personalization of security defense strategies, further enhances the security and controllability of the system, and can meet various application scenarios of the system.

[0103] In the above embodiments, the service operation and maintenance platform is also used by the backend administrator to select a key monitoring list in the defense monitoring module based on the service resource information; when the service identifier information in the user service request is the same as the service resource information in the key monitoring list, the defense monitoring module performs full-process monitoring of the user service request.

[0104] In the above embodiments, the service operation and maintenance platform can be implemented as a DevOps platform.

[0105] In the above embodiments, the service-granularity-based network security defense and monitoring system is built according to the DevSecOps theory. DevSecOps is a methodology that integrates security into the DevOps process, improving the security and efficiency of the software development process by integrating security best practices and automated security tools.

[0106] The beneficial effects of the above technologies are as follows: Through the service operation and maintenance platform, backend administrators can set service monitoring rules for the gateway configuration module and the defense monitoring module; through the service operation and maintenance platform, backend administrators can set request whitelists and key monitoring lists, enabling them to control and process user service requests at the service granularity, thereby achieving refined management of user service requests by the system.

[0107] Example 4:

[0108] This invention provides a service-granularity-based network security defense and monitoring system, the system comprising: a log collection module;

[0109] The log collection module is used by the defense monitoring module to collect user service requests and obtain a set of risky service requests when the monitoring module detects that there is a security risk in the user service requests.

[0110] The service operation and maintenance platform is also used to perform log analysis based on the risk service request set, obtain user access information of users who initiated user service requests in the risk service request set, detect users' network access based on user access information, and identify user identities; optionally, it includes:

[0111] User access service requests that retrieve associated user access information;

[0112] Obtain the device model of the user who initiated the service access request, and assess the device anomaly of the user's service access request; optionally, this includes:

[0113] Suppose that the user access information initiates a total of m user access service requests;

[0114]

[0115]

[0116] Among them, V j Let V be the user device model for the j-th user access service request. Device is a user device database based on user access information, which stores the user device model V. j At that time, the device field value C jThe value is 0, indicating that the user terminal device model V is not stored in the user device library. j At that time, the device field value C j Set it to 1, and set the user terminal device model V j Add to the user device library Device, Div represents the diversity of device types;

[0117] Obtain the access time information of the user who initiated the service access request, construct the access time series, convert it to the frequency domain through Fourier transform for analysis, and calculate the corresponding access average power spectral density.

[0118] Obtain the access content information of the user's service access request and calculate the access information entropy;

[0119] Based on device anomalies, average access power spectral density, and access information entropy, an access feature vector is constructed.

[0120] The user type assessment model is trained based on the sample feature vector and the corresponding sample label to construct the user type assessment space and optimize the classification interface. The assessment region of the access feature vector in the user type assessment space is calculated through the user type assessment model, and the user identity identifier corresponding to the assessment region is obtained as the user identity of the user access information.

[0121] The gateway configuration module is also used to prevent the configuration of gateway routes for user service requests associated with the user identity when the service operation and maintenance platform detects that the user identity is an illegal user, and to return a malicious access warning code to the user terminal device.

[0122] In the above embodiments, the log collection module collects user service requests that the defense monitoring module detects as having security risks, and obtains a set of risky service requests. The service operation and maintenance platform performs log analysis based on the risky service request set to obtain user access information of the users who initiated the user service requests in the risky service request set. Based on the user access information, it detects the user's network access status and identifies the user's identity. When the service operation and maintenance platform detects that the user's identity is an illegal user, the gateway configuration module prohibits the configuration of gateway routes for user service requests associated with the user's identity and returns a malicious access prompt code to the user's terminal device.

[0123] The above embodiment describes how, by obtaining user access service requests related to user access information, the device anomaly, average power spectral density, and access information entropy of the user access service requests are calculated, converted into access feature vectors, and input into the user type evaluation model for user identification.

[0124] In the above embodiments, the device anomaly of user access service requests is obtained by statistically analyzing the user terminal device model that initiated the user access service request.

[0125] In the above embodiments, the average power spectral density of a user's access service request is calculated by obtaining the access time information of the user who initiated the access service request, constructing an access time series, converting it to the frequency domain through Fourier transform for analysis, and then calculating it using the average power spectral density function.

[0126] In the above embodiments, the user type evaluation model is trained based on the sample feature vector and the corresponding sample label to construct the user type evaluation space and optimize the classification interface; when the access feature vector is input into the user type evaluation model, the evaluation region of the access feature vector in the user type evaluation space is obtained, and the user identity identifier corresponding to the evaluation region is used as the user identity corresponding to the user access information.

[0127] In the above embodiments, the user type evaluation model can be implemented as the SV4M model.

[0128] In the above embodiments, by initially adopting an observation mode in the early stages of project development, analyzing the security issues identified in the risky service request sets collected by the log collection module, and then switching to an interception mode for actual interception, the security strategy can be gradually improved and optimized without affecting normal business operations, thus enhancing the flexibility of the security defense strategy.

[0129] The beneficial effects of the above technologies are as follows: Based on the risk service request set obtained by the log collection module, the service operation and maintenance platform realizes the identification of the user identity of the user who initiates the user service request, and performs operations on unauthorized users through the gateway configuration module, thereby preventing unauthorized users from occupying gateway routing resources. While realizing user identification, the system security is improved.

[0130] Example 5:

[0131] This invention provides a service-granularity-based network security defense and monitoring system, including a mode setting module:

[0132] The intelligent mode setting unit is used to obtain the access source address of the user service request, detect the access record initiated by the access source address through the gateway route, and set the working mode of the defense monitoring module to observation mode when the access source address is the first time initiating the user service request.

[0133] When the source address is not the first time a user service request has been initiated, the system obtains historical service requests initiated from the source address and the processing operations of the defense monitoring module on these historical service requests to analyze the access security of the source address; optionally, this includes:

[0134] The historical request information of historical service requests, the historical working mode of the defense monitoring module, and the historical operation information of the defense monitoring module are used as evaluation indicators.

[0135] Obtain the security assessment value of the access source address;

[0136] Suppose that the source address initiated a total of s historical service requests;

[0137]

[0138] Where f(s) is the security assessment value of s historical service requests based on the access source address, f(s-1) is the security assessment value of s-1 historical service requests based on the access source address, and w s1 w represents the information influence weight of historical request information in the s-th historical service request based on the access source address on the security assessment value. s2 The weight of w is the influence of the historical operating mode of the defense monitoring module on the security assessment value in the s-th historical service request based on the access source address. s3 The weight of the impact of historical operation information of the defense monitoring module on the security assessment value in the s-th historical service request based on the access source address; w i1 w represents the informational weight of historical request information in the i-th historical service request based on the access source address on the security assessment value. i2 w represents the weight of the influence of the historical operating mode of the defense monitoring module on the security assessment value in the i-th historical service request based on the access source address. i3 μ represents the weight of the impact of historical operation information of the defense monitoring module on the security assessment value in the i-th historical service request based on the access source address. s1 Weight w for the impact of information s1 The first balance regulator, μ s2 Weight w for the influence of the pattern s2 The second balance regulator, μ s3 Weight w for the impact of information s3 The third balance adjustment factor, σ, is a constant; the first balance factor μ s1 The second balance adjustment factor is set by the information entropy of historical request information in the s-th historical service request, and is determined by μ. s2 The third balance factor μ is determined by the way the historical working mode is set in the s-th historical service request. s3 Determined by the operation content of the historical operation information in the s-th historical service request;

[0139] Set a security assessment threshold. When the security assessment value of the access source address is higher than the security assessment threshold, the access source address will be detected as a high-risk address.

[0140] When accessing a high-risk source address, set the working mode of the defense monitoring module to interception mode.

[0141] In the above embodiments, the intelligent mode setting unit obtains the access source address of the user service request, detects the access record initiated by the access source address through the gateway routing, and sets the working mode of the defense monitoring module to observation mode when the access source address is initiating the user service request for the first time.

[0142] In the above embodiments, when the access source address is not the first time a user service request has been initiated, the intelligent mode setting unit obtains the historical service requests initiated by the access source address and the processing operations of the defense monitoring module on the historical service requests, analyzes the access security of the access source address, and sets the working mode of the defense monitoring module to the interception mode when the access source address is a high-risk address.

[0143] In the above embodiments, the intelligent mode setting unit uses historical request information of the access source address, historical working mode of the defense monitoring module, and historical operation information of the defense monitoring module as evaluation indicators to calculate the security assessment value of the access source address.

[0144] In the above embodiments, the security assessment value is calculated by iterating the security assessment value of each historical service request to the access source address, setting corresponding influence weights based on historical request information, historical working mode, and historical operation information, and adjusting the proportion of influence weights in all historical service requests according to the historical service situation through a balancing factor to obtain the security assessment value of the access source address.

[0145] In the above embodiments, when the information entropy of historical request information is low, the first balance factor is dynamically reduced; when the historical working mode is observation mode, the second balance factor is dynamically reduced; when the historical operation information does not operate on the historical service request, the third balance factor is dynamically reduced; the constant setting avoids the influence weight of a certain historical service request being zero in proportion to the influence weight of all historical service requests, resulting in a lack of security assessment for that historical service.

[0146] The beneficial effects of the above technologies are as follows: through the intelligent mode setting unit, the security assessment value is calculated based on the historical service requests of the access source address, and the working mode of the access monitoring module is set based on the security assessment threshold; and when the access source address initiates a user access request for the first time, it is automatically set to observation mode, thereby realizing the intelligent setting of the working mode of the defense monitoring module through the intelligent mode setting unit.

[0147] Example 6:

[0148] This invention provides a service-granularity-based network security defense and monitoring system, including a mode setting module:

[0149] The manual mode setting unit is used by the backend administrator to set the working mode of the defense monitoring module;

[0150] The manual mode setting unit has a higher priority than the intelligent mode setting unit. When the backend administrator does not set the working mode of the defense monitoring module through the manual mode setting unit, the working mode of the defense monitoring module is set through the intelligent mode setting unit.

[0151] In the above embodiments, the backend administrator sets the working mode of the defense monitoring module through the manual mode setting unit.

[0152] In the above embodiments, the manual mode setting unit has a higher priority than the intelligent mode setting unit. When the background administrator does not set the working mode of the defense monitoring module through the manual mode setting unit, the working mode of the defense monitoring module is set through the intelligent mode setting unit.

[0153] The beneficial effects of the above technology are as follows: through the manual mode setting unit, the backend administrator can set the working mode of the defense monitoring module, and the manual mode setting unit has a higher priority than the intelligent mode setting unit. The defense monitoring module will preferentially execute the working mode set by the backend administrator, thus realizing the priority level setting of the working mode of the defense monitoring module by the backend administrator.

[0154] Example 7:

[0155] This invention provides a service-granularity-based network security defense and monitoring system, including a defense and monitoring module comprising:

[0156] The detection and identification unit is used to detect whether there is a security risk in a user service request, and when a security risk is detected in a user service request, it identifies the risk information of the user service request.

[0157] The working mode acquisition unit is used to acquire the current working mode of the defense monitoring module;

[0158] The defense execution unit is used to perform corresponding operations on user service requests based on the working mode and risk information.

[0159] In the above embodiments, the detection and identification unit detects whether there is a security risk in the user service request and obtains the risk information. The working mode acquisition unit obtains the current working mode of the defense monitoring module. The defense execution unit performs operations on the user service request according to the working mode and the risk information.

[0160] The beneficial effects of the above technologies are as follows: the detection and identification unit detects security risks in user service requests, and the defense execution unit operates on user service requests according to the working mode, thereby avoiding the impact of virus data in user service requests on server resources and improving the security of request processing.

[0161] Example 8:

[0162] This invention provides a service-granularity-based network security defense and monitoring system, including a defense and monitoring module comprising:

[0163] The detection and identification unit includes: a resource malicious consumption detection subunit; the resource malicious consumption detection subunit is used to detect the access interval time, access quantity and access resource usage of user service requests according to the access type of user service requests, determine whether there is a security risk in user service requests according to built-in triggering rules, and add a malicious resource consumption identifier to user service requests when it is determined that there is a security risk of malicious resource consumption in user service requests.

[0164] The defense execution unit includes: a resource malicious consumption defense subunit; the resource malicious consumption defense subunit is used to perform corresponding processing on user service requests with malicious resource consumption identifiers added according to the working mode; optionally, it includes:

[0165] When the working mode is interception mode, it blocks access to user service requests;

[0166] When the working mode is observation mode, a verification code is sent to the user terminal device for verification based on the user service request, and a monitoring log is generated to monitor the execution of the user service request;

[0167] The resource malicious consumption detection subunit and the resource malicious consumption defense subunit handle user service requests as follows:

[0168] {AppID IntervalSeconds Count statBytype trirule IsEnable ActionUserSever}

[0169] Among them, AppID is the identifier for malicious resource consumption, IntervalSeconds is the access interval for user service requests, Count is the number of accesses, statBytype is the access type, trirule is the security risk defense trigger rule, IsEnable is the execution identifier of the resource malicious consumption defense subunit, Action is the execution action of the resource malicious consumption defense subunit, and UserServer is the user service request.

[0170] In the above embodiments, the detection and identification unit detects whether there is a risk of malicious resource consumption in user service requests through the resource malicious consumption detection subunit. When a user service request is detected to have a security risk of malicious resource consumption, a malicious resource consumption identifier is added to the user service request. The resource malicious consumption defense subunit performs corresponding processing on the user service request with the malicious resource consumption identifier added according to the working mode.

[0171] In the above embodiments, the resource malicious consumption subunit detects the access interval, access quantity, and access resource usage of user service requests based on the access type of the user access request, and determines whether there is a risk of malicious resource consumption in the user service request based on the built-in triggering rules.

[0172] In the above embodiments, when the resource malicious consumption defense subunit is in the interception mode, it blocks user service requests that have been marked with a malicious resource consumption identifier.

[0173] In the above embodiments, when the resource malicious consumption defense subunit is in observation mode, it prevents the user terminal device that sends the user service request from performing CAPTCHA verification. After successful verification, it generates monitoring logs to monitor the execution of the user service request.

[0174] In the above embodiments, the access type statBytype includes HTTP URL, HTTP User-Agent, and Cookie.

[0175] The beneficial effects of the above technologies are as follows: the resource malicious consumption detection subunit realizes the detection of the risk of malicious resource consumption in user service requests based on the access type, and the resource malicious consumption defense subunit executes corresponding operations according to the working mode. The above technical solution realizes the detection and defense of the risk of malicious resource consumption in user service requests, thereby avoiding the malicious occupation and consumption of resources by virus data in user service requests, which would affect the normal operation of the server.

[0176] Example 9:

[0177] This invention provides a service-granularity-based network security defense and monitoring system, including a detection and identification unit, and further comprising a signature detection subunit;

[0178] The signature detection subunit is used to obtain the vulnerability information table, construct the corresponding vulnerability detection signature rules, and perform vulnerability detection on user service requests based on the vulnerability detection signature rules and preset detection points. When a vulnerability security risk is detected in a user service request, a vulnerability risk label is added to the user service request.

[0179] The defense execution unit includes: a vulnerability defense subunit; the vulnerability defense subunit is used to perform corresponding processing on user service requests with added vulnerability risk identifiers according to the working mode; optionally, it includes:

[0180] When the working mode is interception mode, it blocks access to user service requests;

[0181] When the working mode is observation mode, monitoring logs are generated by acquiring the vulnerability risk identifier, request time, user terminal device IP, request method, request path, request content, and operations performed by the vulnerability defense subunit for user service requests.

[0182] In the above embodiments, when the detection and identification unit analyzes the vulnerability security risks in the user service request through the signature detection subunit, and when a vulnerability security risk is detected in the user service request, a vulnerability risk identifier is added to the user service request; the defense execution unit performs corresponding processing on the user service request with the added vulnerability risk identifier through the vulnerability defense subunit according to the working mode.

[0183] In the above embodiments, the signature detection subunit obtains the vulnerability information table, constructs corresponding vulnerability detection signature rules, and performs vulnerability risk detection on user service requests based on preset detection points.

[0184] In the above embodiments, when the vulnerability defense subunit is in interception mode, it blocks user service requests with added vulnerability risk identifiers.

[0185] In the above embodiments, when the vulnerability defense subunit is in observation mode, it generates monitoring logs by acquiring the vulnerability risk identifier, request time, user terminal device IP, request method, request path, request content, and operations performed by the vulnerability defense subunit in the user service request.

[0186] The beneficial effects of the above technologies are as follows: the signature detection subunit enables vulnerability detection of user service requests, and the vulnerability defense subunit performs corresponding processing according to the working mode. While realizing the detection of vulnerability risks in user service requests, the above technical solutions set up corresponding processing methods to block or monitor user service requests with added vulnerability risk indicators, thereby improving the security of the system in processing user service requests.

[0187] Example 10:

[0188] This invention provides a service-granularity-based network security defense and monitoring system, including a detection and identification unit, and further comprising an anomaly detection subunit;

[0189] An anomaly detection subunit is used to build several anomaly assessment models based on the access attributes of user service requests. These models assess the user service requests for anomalies and obtain anomaly probability values. Optional models include:

[0190] The anomaly assessment model includes a request length anomaly assessment model that detects the request length of user service requests; and a request length anomaly assessment model used to obtain sample request lengths l1,…,l from a sample database of normal service requests. mCalculate the corresponding sample mean μ and sample variance σ. 2 ;

[0191] The abnormal probability value of the request length of user service requests is detected by the request length anomaly assessment model;

[0192]

[0193] Where l is the length of the user service request, l s Let p(l) be the standard service request length, and let p(l) be the anomaly probability value obtained by the request length anomaly assessment model for detecting user service requests.

[0194] The anomaly detection subunit is also used to perform weighted calculations on several anomaly probability values ​​obtained through several anomaly evaluation models to obtain an anomaly evaluation value. When the anomaly evaluation value exceeds the detection threshold, the user service request is judged to have an anomaly risk.

[0195]

[0196] Where V is the anomaly assessment value, and user service requests are assessed for anomalies using n anomaly assessment models, ω i p represents the evaluation weight of the i-th anomaly evaluation model. i Let be the probability value of the anomaly obtained by the i-th anomaly evaluation model, and Models be the set of anomaly evaluation models.

[0197] In the above embodiments, the anomaly detection subunit in the detection and identification unit enables anomaly detection of the request length, request frequency, and request content attributes of user service requests.

[0198] In the above embodiments, the anomaly detection subunit calculates the anomaly probability value of user service requests through several anomaly evaluation models, obtains the anomaly evaluation value through the evaluation weights corresponding to the anomaly evaluation models, and determines whether there is an anomaly risk in the user service request based on the detection threshold.

[0199] In the above embodiments, the anomaly assessment model includes a request length anomaly assessment model, which is used to detect the anomaly probability value of the request length of user service requests. The request length anomaly assessment model is constructed based on an improvement of Chebyshev's inequality according to the sample request length, and calculates the anomaly probability value by evaluating the distribution of the request length attribute of user service requests.

[0200] The beneficial effects of the above technology are as follows: through several anomaly evaluation models in the anomaly detection subunit, anomaly evaluation of user service request access attributes is realized, and based on the corresponding evaluation weights, the anomaly evaluation value of the user service request is obtained, thereby enabling the judgment of whether there is anomaly risk in the user service request.

[0201] In traditional technologies, security monitoring of user service requests is often only prioritized in the later stages of development or after system deployment. This frequently leads to extensive security patching efforts, and the system may be vulnerable to attacks during the time window between problem discovery and resolution. Service-level network security defense and monitoring systems integrate the detection and defense of user service requests into the development phase, allowing developers to maintain security features and events themselves, thereby proactively identifying and fixing security issues.

[0202] In summary, the service-granularity-based network security defense and monitoring system proposed in this invention achieves more flexible, efficient, and personalized security protection measures based on observation and interception modes. It helps improve the security, controllability, and stability of the system, reduces enterprise security operation and maintenance costs, improves overall operation and maintenance efficiency, solves the problems existing in traditional security protection solutions, simplifies the operation process of security protection, and improves R&D efficiency, demonstrating significant advantages and innovation.

[0203] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A service-granularity-based network security defense and monitoring system, characterized in that, include: The gateway configuration module is used to configure gateway routes for web services initiated by users through user terminal devices, generate user service requests, and set up a defense monitoring module in the gateway routes. The service identification module is used to acquire user service requests and identify detection identifiers in the user service requests. When the detection identifier is detected in the user service request, the defense monitoring module is invoked to detect the user service request. The mode setting module is used to set the working mode of the defense monitoring module; The defense monitoring module is used to detect whether the user service request has any security risks. When the defense monitoring module is in the interception mode, if it detects that the user service request has any security risks, it will prohibit the transmission of the user service request and return an error status code to the user terminal device. When the defense monitoring module is in observation mode, it detects that the user service request has a security risk, performs corresponding operations based on the user service request, and generates monitoring logs to monitor the execution of the user service request.

2. The network security defense and monitoring system based on service granularity according to claim 1, characterized in that, The gateway configuration module includes: The service request acquisition unit is used to acquire web service requests initiated by users through user-end devices. The service request parsing unit is used to parse the Web service request. When the Web service request is an intranet service request, it performs corresponding operations on the intranet access request according to the intranet access rules. When the Web service request is a public network service request, it adds a detection identifier to the public network service request based on the service monitoring rules, configures a gateway route for the public network service request, and generates a user service request.

3. The network security defense and monitoring system based on service granularity according to claim 2, characterized in that, The system includes: The service operation and maintenance platform is used by backend administrators to set the service monitoring rules and synchronize them to the gateway configuration module; The service operation and maintenance platform is also used by the backend administrator to configure request whitelists and key monitoring lists in the defense monitoring module based on service resource information; The defense monitoring module is used to stop detecting the user service request and perform corresponding operations according to the user service request when it detects that the service identifier information in the user service request is the same as the service resource information in the request whitelist; and to perform full-process monitoring of the user service request when the service identifier information in the user service request is the same as the service resource information in the key monitoring list.

4. The network security defense and monitoring system based on service granularity according to claim 3, characterized in that, The system includes: a log collection module; The log collection module is used by the defense monitoring module to collect user service requests and obtain a set of risky service requests when the defense monitoring module detects that the user service request has a security risk. The service operation and maintenance platform is further configured to perform log analysis based on the risk service request set, obtain user access information of users who initiated user service requests in the risk service request set, detect the user's network access status based on the user access information, and identify the user's identity; optionally, it includes: Obtain the user access service request associated with the aforementioned user access information; Obtain the model of the user's terminal device that initiated the user's service access request, and assess the device anomaly of the user's service access request; optionally, this includes: Suppose that the user access information initiates a total of m user access service requests; Among them, V j The j-th user access service request is represented by the user's terminal device model. Device is a user device database based on the user access information, which stores the user's terminal device model V. j At that time, the device field value C j The value is 0, indicating that the user terminal equipment model V is not stored in the user equipment library. j At that time, the device field value C j Set it to 1, and set the user terminal device model V j Add to the user device library Device, where Div represents the diversity of device types; Obtain the access time information of the user who initiated the service access request, construct the access time series, convert it to the frequency domain through Fourier transform for analysis, and calculate the corresponding access average power spectral density. Obtain the access content information of the user's service access request and calculate the access information entropy; Based on the device anomalies, the average power spectral density of access, and the access information entropy, an access feature vector is constructed. The user type assessment model is trained based on the sample feature vector and the corresponding sample label to construct the user type assessment space and optimize the classification interface; the assessment region of the access feature vector in the user type assessment space is calculated by the user type assessment model, and the user identity identifier corresponding to the assessment region is obtained as the user identity of the user access information. The gateway configuration module is also used to prevent the configuration of gateway routes for user service requests associated with the user identity when the service operation and maintenance platform detects that the user identity is an illegal user, and to return a malicious access prompt code to the user terminal device.

5. A service-granularity-based network security defense and monitoring system according to claim 1, characterized in that, The mode setting module includes: The intelligent mode setting unit is used to obtain the access source address of the user service request, detect the access record initiated by the access source address through the gateway routing, and set the working mode of the defense monitoring module to observation mode when the access source address is initiating the user service request for the first time. When the access source address is not the first time initiating the user service request, the system obtains historical service requests initiated by the access source address and the processing operations of the defense monitoring module on the historical service requests, and analyzes the access security of the access source address; optionally, this includes: The historical request information of the historical service requests, the historical working mode corresponding to the defense monitoring module, and the historical operation information corresponding to the defense monitoring module are used as evaluation indicators. Obtain the security assessment value of the access source address; Suppose that the source address initiated a total of s historical service requests; Where f(s) is the security assessment value of s historical service requests based on the access source address, f(s-1) is the security assessment value of s-1 historical service requests based on the access source address, and w s1 w is the weight of the information influence of historical request information in the s-th historical service request based on the access source address on the security assessment value. s2 The weight of w is the influence of the historical operating mode of the defense monitoring module on the security assessment value in the s-th historical service request based on the access source address. s3 The weight of the impact of historical operation information of the defense monitoring module on the security assessment value based on the s-th historical service request of the access source address; w i1 w is the weight of the information influence of historical request information in the i-th historical service request based on the access source address on the security assessment value. i2 w is the weight of the influence of the historical operating mode of the defense monitoring module on the security assessment value in the i-th historical service request based on the access source address. i3 μ is the weight of the impact of historical operation information of the defense monitoring module on the security assessment value in the i-th historical service request based on the access source address. s1 The influence weight w of the information s1 The first balance regulator, μ s2 The influence weight w of the mode s2 The second balance regulator, μ s3 The influence weight w of the information s3 The third balance adjustment factor, σ, is a constant; the first balance factor μ s1 The second balance adjustment factor is set by the information entropy of historical request information in the s-th historical service request, and is determined by μ. s2 The third balance factor μ is determined by the way the historical working mode is set in the s-th historical service request. s3 Determined by the operation content of the historical operation information in the s-th historical service request; Set a security assessment threshold. When the security assessment value of the access source address is higher than the security assessment threshold, the access source address will be detected as a high-risk address. When the access source address is a high-risk address, the working mode of the defense monitoring module is set to interception mode.

6. The network security defense and monitoring system based on service granularity according to claim 5, characterized in that, The mode setting module includes: The manual mode setting unit is used by the backend administrator to set the working mode of the defense monitoring module. The manual mode setting unit has a higher priority than the intelligent mode setting unit. When the background administrator does not set the working mode of the defense monitoring module through the manual mode setting unit, the working mode of the defense monitoring module is set through the intelligent mode setting unit.

7. A service-granularity-based network security defense and monitoring system according to claim 1, characterized in that, The defense monitoring module includes: The detection and identification unit is used to detect whether the user service request has a security risk, and when the user service request has a security risk, it identifies the risk information of the user service request. The working mode acquisition unit is used to acquire the current working mode of the defense monitoring module; The defense execution unit is used to perform corresponding operations on the user service request based on the working mode and the risk information.

8. A service-granularity-based network security defense and monitoring system according to claim 7, characterized in that, The defense monitoring module includes: The detection and identification unit includes: a resource malicious consumption detection subunit; the resource malicious consumption detection subunit is used to detect the access interval time, access quantity and access resource usage of the user service request according to the access type of the user service request, determine whether the user service request has a security risk according to the built-in triggering rules, and add a malicious resource consumption identifier to the user service request when it is determined that the user service request has a security risk of malicious resource consumption. The defense execution unit includes: a resource malicious consumption defense subunit; the resource malicious consumption defense subunit is used to perform corresponding processing on user service requests with malicious resource consumption identifiers added according to the working mode; optionally, it includes: When the operating mode is interception mode, the access of the user service request is blocked; When the working mode is observation mode, a verification code is sent to the user terminal device for verification according to the user service request, and a monitoring log is generated to monitor the execution of the user service request; The resource malicious consumption detection subunit and the resource malicious consumption defense subunit process the user service request as follows: {AppID IntervalSeconds Count statBytype trirule IsEnable ActionUserSever} where AppID is the identifier for malicious resource consumption, IntervalSeconds is the access interval of the user service request, Count is the number of accesses, statBytype is the access type, trirule is the security risk defense trigger rule, IsEnable is the execution identifier of the resource malicious consumption defense subunit, Action is the execution action of the resource malicious consumption defense subunit, and UserSever is the user service request.

9. A service-granularity-based network security defense and monitoring system according to claim 7, characterized in that, The detection and identification unit further includes: a signature detection subunit; The signature detection subunit is used to obtain a vulnerability information table, construct corresponding vulnerability detection signature rules, and perform vulnerability detection on the user service request based on the vulnerability detection signature rules and preset detection points. When a vulnerability security risk is detected in the user service request, a vulnerability risk identifier is added to the user service request. The defense execution unit includes: a vulnerability defense subunit; the vulnerability defense subunit is used to perform corresponding processing on user service requests with added vulnerability risk identifiers according to the working mode; optionally, it includes: When the operating mode is interception mode, the access of the user service request is blocked; When the working mode is observation mode, monitoring logs are generated by acquiring the vulnerability risk identifier, request time, user terminal device IP, request method, request path, request content, and the operations performed by the vulnerability defense subunit in the user service request.

10. A service-granularity-based network security defense and monitoring system according to claim 7, characterized in that, The detection and identification unit further includes: an anomaly detection subunit; The anomaly detection subunit is configured to build several anomaly assessment models based on the access attributes of the user service request, and the anomaly assessment models perform anomaly assessment on the user service request to obtain an anomaly probability value; optionally, it includes: The anomaly assessment model includes a request length anomaly assessment model for detecting the request length of the user service request; the request length anomaly assessment model is used to obtain sample request lengths l1,…,l from normal service requests in a sample database. m Calculate the corresponding sample mean μ and sample variance σ. 2 ; The abnormal probability value of the request length of the user service request is detected by the request length anomaly evaluation model. Where, l is the request length of the user service request, l s Let p(l) be the standard service request length, and p(l) be the anomaly probability value obtained by the request length anomaly assessment model for detecting the user service request. The anomaly detection subunit is also used to perform weighted calculations on several anomaly probability values ​​obtained through several anomaly evaluation models to obtain an anomaly evaluation value, and to determine that there is an anomaly risk in the user service request when the anomaly evaluation value exceeds the detection threshold. Where V is the anomaly assessment value, and the user service request is assessed for anomalies using n anomaly assessment models, ω i p represents the evaluation weight of the i-th anomaly evaluation model. i Let be the probability value of the anomaly obtained by the i-th anomaly evaluation model, and Models be the set of anomaly evaluation models.

Images