A network access anomaly detection method, device, equipment and storage medium

Abstract

The present disclosure provides a network access anomaly detection method, device and equipment and storage medium to improve the detection accuracy and interpretability of network access anomaly detection. A network access anomaly detection method provided includes: obtaining network access logs in a target detection period; determining access intensity features in a plurality of candidate windows under multiple scales based on the network access logs, and determining abnormal time windows and time sequence risk scores of each abnormal time window according to the access intensity features; constructing an access relationship graph according to the network access logs in the abnormal time windows, extracting abnormal behavior features based on the access relationship graph, and generating graph correlation risk scores of the abnormal time windows according to the abnormal behavior features; performing fusion processing on the time sequence risk scores and the graph correlation risk scores to determine window comprehensive risk scores; and determining a network access anomaly detection result according to the window comprehensive risk scores.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to a method, apparatus, device, and storage medium for detecting abnormal network access. Background Technology

[0002] In the field of network traffic monitoring and business access risk control, timely and accurate identification of users' high-frequency concentrated access behaviors (such as malicious crawlers, distributed denial-of-service attacks (DDoS), credential stuffing attacks, etc.) is the key to ensuring service security.

[0003] In related technologies, the monitoring period is generally divided into fixed windows of equal length, and a preset static threshold is used to determine whether the window access volume is abnormal. However, this method is difficult to capture attack patterns with varying durations. Instantaneous attacks are easily diluted and missed, while continuous attacks are easily segmented, causing fragmented alerts. In addition, this method has a single judgment dimension, relying only on the criterion of total volume exceeding the threshold, lacking a quantitative explanation of the degree of abnormal clustering, and thus has weak interpretability.

[0004] Therefore, improving the detection accuracy and interpretability of network access anomaly detection has become a pressing technical problem to be solved in this field. Summary of the Invention

[0005] In view of this, the present disclosure provides a method, apparatus, device and storage medium for detecting network access anomalies, so as to improve the detection accuracy and interpretability of network access anomaly detection.

[0006] In a first aspect, a method for detecting network access anomalies is provided, comprising: acquiring network access logs within a target detection period; determining access intensity features within multiple candidate windows at multiple scales based on the network access logs, and determining anomaly time windows and a temporal risk score for each anomaly time window based on the access intensity features; constructing an access relationship graph based on the network access logs within the anomaly time window, extracting abnormal behavior features based on the access relationship graph, and generating a graph association risk score for the anomaly time window based on the abnormal behavior features; fusing the temporal risk score and the graph association risk score to determine a window comprehensive risk score; and determining a network access anomaly detection result based on the window comprehensive risk score.

[0007] This method employs a multi-scale candidate window filtering mechanism to simultaneously capture both short-term, transient attacks and long-term, sustained attacks. For example, a small-scale window can capture short-term spikes, preventing transient attacks from being diluted and missed, while a large-scale window can fully cover sustained attacks, avoiding fragmented alerts. By determining the abnormal time window and its temporal risk score, the degree of anomaly clustering can be quantified. Furthermore, by performing graph association risk assessment on the determined abnormal time windows, entity collaborative behavior patterns can be revealed. Integrating these two aspects in the judgment allows the detection results to possess both temporal and association evidence, significantly improving the interpretability of the detection results. Moreover, by comprehensively judging anomaly detection results by fusing temporal clustering features and graph association features, the limitations of relying solely on a single-dimensional criterion can be overcome, enabling a more accurate distinction between malicious collaborative attacks and normal business peaks.

[0008] In one implementation, determining access intensity characteristics within multiple candidate windows at multiple scales based on the network access logs includes: grouping the network access logs according to a preset time unit to obtain log sets for multiple time periods; calculating access volume indicators for each log set of the time period to obtain time-series access data; and determining access intensity characteristics within multiple candidate windows at multiple scales based on the time-series access data.

[0009] This method transforms the original logs into time-series access data by grouping and statistically analyzing the network access logs according to a preset time unit. Then, based on the time-series access data, it determines the access intensity characteristics within a multi-scale window, enabling key indicators such as total access volume and average access intensity within the window to be quantified and calculated.

[0010] In one implementation, multiple candidate windows under the multi-scale can be determined according to the following steps: obtaining multiple preset window lengths; and determining multiple candidate windows under each preset window length based on each preset window length and a preset sliding step size.

[0011] This method obtains multiple preset window lengths and determines candidate windows at multiple scales based on each window length and a preset sliding step size. Window lengths of different sizes can simultaneously adapt to the detection requirements of short-term instantaneous attacks and long-term continuous attacks, while the sliding step size ensures that the window moves continuously on the time axis, thereby more accurately determining the possible starting point of abnormal access and significantly improving the comprehensiveness of detection.

[0012] In one implementation, the access intensity feature includes in-window access intensity and global average access intensity. Determining the in-window access intensity based on the network access logs includes: for each candidate window, obtaining the access intensity value within each time unit covered by the candidate window; calculating the total access volume of the candidate window within the covered time period based on the access intensity values ​​within each time unit; calculating the average access intensity of the candidate window within the window length based on the total access volume and the window length of the candidate window, as the in-window access intensity. Determining the global average access intensity based on the network access logs includes: obtaining the access intensity value for all time units within the target detection period; calculating the total access volume within the target detection period based on the access intensity values ​​for all time units; calculating the average access intensity within the target detection period based on the total access volume and the number of time units within the target detection period, as the global average access intensity.

[0013] In one implementation, determining the abnormal time window among the plurality of candidate windows based on the access intensity characteristics includes: determining candidate abnormal windows among the plurality of candidate windows based on the access intensity characteristics; and merging temporally overlapping or adjacent candidate abnormal windows using non-maximum suppression to determine the abnormal time window.

[0014] This method first filters out windows that may be abnormal from a large number of candidate windows, merges candidate abnormal windows that overlap or are adjacent in time, avoids the same abnormal event being divided into multiple fragmented windows and causing repeated alarms, and finally outputs a set of independent abnormal time windows.

[0015] In one implementation, the access intensity feature includes the average access intensity within the candidate window and the global average access intensity within the target detection period; determining the candidate anomalous window among the plurality of candidate windows based on the access intensity feature includes: calculating a dynamic baseline value for each time unit corresponding to the candidate window based on historical data from the same period; generating a dynamic absolute intensity threshold based on the dynamic baseline value and a preset or dynamically adjusted sensitivity coefficient; determining whether the average access intensity within the candidate window is greater than the dynamic absolute intensity threshold; calculating the improvement factor of the average access intensity within the candidate window relative to the global average access intensity; comparing the improvement factor with a dynamic relative improvement threshold to determine whether the improvement factor is greater than the dynamic relative improvement threshold; when the candidate window simultaneously satisfies that the average access intensity within the window is greater than the dynamic absolute intensity threshold and the improvement factor is greater than the dynamic relative improvement threshold, the candidate window is determined as a candidate anomalous window.

[0016] Here, absolute intensity discrimination is used to calculate a dynamic baseline value based on historical data from the same period and to generate a dynamic absolute intensity threshold. This allows the discrimination criteria to adapt to the periodic changes in business traffic, avoiding false alarms during off-peak periods and missed alarms during peak periods. Relative enhancement discrimination is used to calculate the enhancement factor of the window's average intensity relative to the global average intensity, measuring the window's prominence relative to the global picture and effectively identifying local anomaly clusters. When both conditions are met simultaneously, the window is identified as a candidate anomaly window, ensuring both the window's own activity and its significance relative to the global picture, significantly improving the accuracy of the screening.

[0017] In one implementation, a dynamic baseline value is calculated for each time unit corresponding to the candidate window based on historical data from the same period, including: calculating an exponentially weighted moving average or quantile statistic for each time unit based on the historical data from the same period, to obtain the dynamic baseline value.

[0018] This implementation uses an exponentially weighted moving average to assign higher weights to recent data, enabling the baseline to quickly respond to recent trends in business traffic and improving the timeliness of dynamic thresholds. Quantile statistics select appropriate quantiles based on historical data distribution, making the baseline insensitive to extreme values ​​and enhancing robustness. Multiple baseline calculation methods are provided, which can be flexibly selected according to business characteristics, improving the universality of the methods.

[0019] In one implementation, non-maximum suppression is used to merge temporally overlapping or adjacent candidate anomaly windows to determine the anomaly time window. This includes: sorting each candidate anomaly window in descending order based on its temporal risk score to obtain a sorted candidate window list; selecting the candidate window with the highest current temporal risk score from the sorted candidate window list and identifying it as a retained anomaly time window; calculating the temporal overlap between the retained anomaly time window and all other unprocessed candidate windows in the candidate window list; removing other candidate windows from the candidate window list whose temporal overlap with the retained anomaly time window exceeds a preset overlap threshold; and returning to the process of selecting the candidate window with the highest current temporal risk score from the sorted candidate window list until the candidate window list is empty or the preset maximum number of anomaly time windows has been reached.

[0020] This implementation first sorts the candidate anomaly windows in descending order according to their temporal risk scores to ensure that high-risk windows are retained first; then, it selects the window with the highest current risk score as the retained window to ensure that the final output window has the highest anomaly significance; by calculating the degree of temporal overlap, it removes other windows that highly overlap with the retained window, thereby avoiding the repeated output of the same anomaly event.

[0021] In one implementation, the temporal risk score of the candidate anomaly window can be determined according to the following steps: calculating a base risk score based on the enhancement factor of the candidate anomaly window; weighting the base risk score by introducing a semantic enhancement factor to obtain the temporal risk score; the semantic enhancement factor includes a time period enhancement factor and / or a historical baseline enhancement factor.

[0022] Here, the base risk score is calculated based on an enhancement factor, reflecting the statistical significance of window anomalies. Time-based enhancement factors assign different weights to anomalies occurring in different time periods; for example, anomalies occurring during off-peak periods are given higher weight because they are typically more threatening than those occurring during peak periods. Historical baseline enhancement factors assign higher weight to anomaly windows with low historical probability of occurrence, as rare patterns are often more aggressive. Thus, by introducing semantic enhancement factors, time-series risk scores can incorporate prior business knowledge, thereby improving the accuracy and interpretability of risk quantification.

[0023] In one implementation, constructing the access relationship graph includes: extracting access logs within the abnormal time window, parsing entity information in the logs, the entity information including source IP address, target URL, and user identifier; constructing the access relationship graph by using the source IP address, target URL, and user identifier as nodes and the access relationships between nodes as edges; the edges include access edges from source IP address to target URL, request edges from user identifier to target URL, or association edges from source IP address to user identifier, and each edge carries edge attribute information, the edge attribute information including access count, access time distribution, or request parameter similarity.

[0024] This method constructs an access relationship graph containing three types of nodes: source Internet Protocol Address (IP), target Uniform Resource Locator (URL), and user identifier. By incorporating multiple types of entities into the same graph, it comprehensively depicts the entire landscape of access behavior during abnormal periods. Through various edge types, such as IP accessing URL, user requesting URL, and IP-user association, it captures multiple interaction relationships between entities. Each edge carries attribute information such as access frequency, time distribution, and parameter similarity, enabling the graph model to learn abnormal characteristics of behavior in multiple dimensions such as frequency, time sequence, and content. This provides rich structural and attribute information for subsequent graph feature extraction.

[0025] In one implementation, the step of extracting abnormal behavior features based on the access relationship graph and generating a graph association risk score for the abnormal time window based on the abnormal behavior features includes: using a graph neural network to learn features from nodes based on the access relationship graph, and extracting graph feature vectors representing collaborative abnormal behavior features; the collaborative abnormal behavior features include community clustering and / or behavioral consistency; and inputting the graph feature vectors into a preset scoring function or neural network layer to generate the graph association risk score.

[0026] This implementation uses graph neural networks to perform end-to-end feature learning on the access relationship graph, automatically extracting high-order collaborative features such as community clustering and behavioral consistency without requiring manual definition of complex rules. Community clustering can identify whether a group of users from the same IP address collectively accesses a specific URL within a short period, detecting collaborative patterns of malicious crawlers or Distributed Denial of Service (DDoS) attacks. Behavioral consistency can detect whether request parameters and intervals exhibit automated script characteristics, identifying automated attacks such as credential stuffing. By mapping graph feature vectors to risk scores through neural network layers, a quantitative assessment of abnormal collaborative behavior is achieved.

[0027] In one implementation, the step of fusing the temporal risk score and the graph association risk score to determine the window comprehensive risk score includes: weighting and summing the temporal risk score and the graph association risk score based on adaptive fusion weights to obtain the window comprehensive risk score.

[0028] This implementation method uses adaptive fusion weights to weight and sum the temporal risk score and the graph association risk score, achieving dynamic fusion of the two risk scores. The fusion weights can be dynamically adjusted according to the actual business scenario, thus adapting to the characteristics of different periods and different attack types. The final risk score simultaneously incorporates information from both the time and association dimensions, making the judgment results more comprehensive and accurate.

[0029] In one implementation, the adaptive fusion weights can be dynamically determined according to the following steps: setting a sliding time window, collecting historical alarm data and their manually confirmed accuracy labels within the sliding time window; determining the false alarm rate corresponding to the time-series risk score and the missed alarm rate corresponding to the graph association risk score within the sliding time window; and gradually adjusting the values ​​of the adaptive fusion weights according to the false alarm rate of the time-series risk score and the missed alarm rate of the graph association risk score, according to a preset adjustment step size, until a balance state or a preset upper limit of the number of iterations is reached.

[0030] This implementation collects historical alarm data and its manual confirmation results through a sliding time window, using manual feedback as an optimization signal. The performance of the two risk scores is evaluated by statistically analyzing the false alarm rate corresponding to the time-series risk score and the false negative rate corresponding to the graph association risk score. Based on the false alarm rate and false negative rate, the fusion weights are gradually adjusted according to a preset step size, allowing the weights to continuously converge to the optimal balance point.

[0031] In one implementation, determining the network access anomaly detection result based on the window comprehensive risk score includes: obtaining a dynamically adjusted decision threshold; comparing the window comprehensive risk score of the abnormal time window with the decision threshold; if the window comprehensive risk score is greater than or equal to the decision threshold, then determining that the access behavior within the abnormal time window is abnormal; if the window comprehensive risk score is less than the decision threshold, then determining that the access behavior within the abnormal time window is normal.

[0032] This implementation compares a window's overall risk score with a dynamically adjusted decision threshold. This decision threshold can be dynamically adjusted based on business tolerance, thus flexibly adapting to security policy requirements in different periods and scenarios.

[0033] Secondly, a network access anomaly detection device is provided, comprising: The acquisition module is used to acquire network access logs within the target detection period; The time-series risk assessment module is used to determine the access intensity characteristics within multiple candidate windows based on the network access logs, and to determine the abnormal time windows and the time-series risk score of each abnormal time window based on the access intensity characteristics. The graph association risk assessment module is used to construct an access relationship graph based on network access logs within the abnormal time window, extract abnormal behavior features based on the access relationship graph, and generate a graph association risk score for the abnormal time window based on the abnormal behavior features. The risk fusion module is used to fuse the temporal risk score and the graph association risk score to determine the window comprehensive risk score; The anomaly detection result determination module is used to determine the network access anomaly detection result based on the comprehensive risk score of the window.

[0034] Thirdly, an electronic device is provided, including a processor and a memory, wherein the memory stores machine-readable instructions executable by the processor, and the processor is used to execute the machine-readable instructions stored in the memory. When the machine-readable instructions are executed by the processor, the processor performs the steps of the network access anomaly detection method described in any of the above embodiments.

[0035] Fourthly, a computer-readable storage medium is provided, including instructions stored thereon, wherein, when the instructions are executed by a processor, the network access anomaly detection method described in any of the above embodiments is executed.

[0036] The implementation effects of the network access anomaly detection device, electronic device, and computer-readable storage medium provided in the embodiments of this disclosure can be found in the effect description of the aforementioned network access anomaly detection method, and will not be repeated here. Attached Figure Description

[0037] Figure 1 This is a flowchart illustrating an exemplary embodiment of a network access anomaly detection method disclosed herein; Figure 2 A schematic diagram of a network access anomaly detection method is shown in another exemplary embodiment of this disclosure; Figure 3 This disclosure illustrates a schematic diagram of a network access anomaly detection device according to an exemplary embodiment. Figure 4 This is a schematic diagram of an electronic device illustrated in an exemplary embodiment of the present disclosure. Detailed Implementation

[0038] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure as detailed in the appended claims.

[0039] The terminology used in this disclosure is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosure. The singular forms “a,” “the,” and “the” as used in this disclosure and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any and all possible combinations of one or more of the associated listed items.

[0040] It should be understood that although the terms first, second, third, etc., may be used in this disclosure to describe various information, such information should not be limited to these terms. These terms are used only to distinguish information of the same type from one another. For example, without departing from the scope of this disclosure, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0041] Furthermore, the symbol “ / ” in this disclosure indicates that there is an “or” relationship between the related objects before and after the symbol, or that the related objects have an exemplary relationship that can coexist.

[0042] like Figure 1 The diagram shown is a flowchart of a network access anomaly detection method provided in this embodiment of the disclosure, including: S101: Obtain network access logs within the target detection period.

[0043] For example, all network access logs within a target time period can be obtained from various network devices or servers through which traffic passes. This target detection period can be set according to business needs, such as 24 hours or 48 hours. Network access logs typically include at least the following fields: timestamp, 5-tuple, user information, access URL, and method.

[0044] In one implementation, after obtaining network access logs within the target detection period, the logs can be preprocessed, including data cleaning (such as handling missing or null values, filtering invalid or redundant requests, deduplication, etc.) and format unification (such as converting logs from different sources into a unified structured format (such as JSON)) to ensure the accuracy and efficiency of subsequent processing.

[0045] S102: Based on the network access logs, determine the access intensity characteristics within multiple candidate windows under multiple scales, and determine the abnormal time windows and the temporal risk score of each abnormal time window according to the access intensity characteristics.

[0046] Here, a multi-scale window scanning mechanism is used to identify potentially abnormal access periods from a temporal perspective. First, temporal access data is generated based on network access logs. Then, a sliding scan of the temporal data is performed using windows of various scales to calculate the access intensity characteristics within each window. Subsequently, an abnormal time windows are filtered out through a discrimination mechanism, and each window is assigned a temporal risk score reflecting the significance of the anomaly. This process can effectively capture attack patterns with varying durations, providing candidate targets for subsequent in-depth analysis.

[0047] In one implementation, determining access intensity characteristics within multiple candidate windows at multiple scales based on the network access logs may include: grouping the network access logs according to a preset time unit to obtain log sets for multiple time periods; statistically analyzing access volume indicators for each log set of the time period to obtain time-series access data; and determining access intensity characteristics within multiple candidate windows at multiple scales based on the time-series access data.

[0048] Through the above steps, unstructured raw logs are transformed into structured time-series access data, thus providing a data foundation for multi-scale analysis. For example, the preset time unit could be 1 minute, 5 minutes, or 1 hour, depending on the required detection accuracy. Then, access volume indicators, such as the number of visits, are statistically analyzed according to the preset time units, resulting in a time-series set of access data. For instance, the raw logs are aggregated according to a fixed time unit (e.g., 1 hour), and the total number of visits within each time unit is calculated to generate a time-series access intensity sequence. ,in This represents the access intensity (number of visits) at the t-th time unit, where t is the sequence length.

[0049] Here, the access intensity feature can include in-window access intensity and global average access intensity. Specifically, determining the in-window access intensity based on the network access logs includes: for each candidate window, obtaining the access intensity value within each time unit covered by the candidate window; calculating the total access volume of the candidate window within the covered time period based on the access intensity values ​​within each time unit; and calculating the average access intensity of the candidate window within the window length based on the total access volume and the window length of the candidate window, as the in-window access intensity. Determining the global average access intensity based on the network access logs includes: obtaining the access intensity value for all time units within the target detection period; calculating the total access volume within the target detection period based on the access intensity values ​​for all time units; and calculating the average access intensity within the target detection period based on the total access volume and the number of time units within the target detection period, as the global average access intensity.

[0050] For example, for any window length (Using time units as representation), it slides on the time series with a fixed step size (e.g., 1 hour), for each starting time point corresponding to a window Calculate the total number of visits within this window. Then the access strength within the window Total number of visits within the target detection period T (represented by the number of time units). Then the global average access strength .

[0051] The access intensity within a window reflects the level of access activity during a specific time period, while the global average access intensity reflects the baseline level of traffic throughout the entire detection period. These two types of features provide a quantitative basis for subsequent absolute intensity discrimination and relative improvement discrimination.

[0052] In one implementation, the multiple candidate windows under the multi-scale can be determined according to the following steps: Obtain multiple preset window lengths; based on each preset window length and a preset sliding step, determine multiple candidate windows for each preset window length.

[0053] Here, a preset window length set can be set according to the characteristics of the attack mode. For example, {2 hours, 4 hours, 6 hours}. Short windows are used to capture instantaneous attacks, while long windows are used to cover persistent attacks. For each preset window length, a sliding step size can be set. The sliding step size can be the same or different for different preset window lengths; for example, a longer window length can have a relatively longer sliding step size. For instance, the sliding step size can be set to a uniform 1 hour to ensure the window moves continuously on the timeline, covering as many possible starting points as possible.

[0054] In one implementation, determining the abnormal time window among the plurality of candidate windows based on the access intensity characteristics may include: determining candidate abnormal windows among the plurality of candidate windows based on the access intensity characteristics; and merging temporally overlapping or adjacent candidate abnormal windows using non-maximum suppression to determine the abnormal time window.

[0055] The above mechanism first filters out potentially abnormal windows from a massive pool of candidate windows, such as those with an average access intensity greater than a target threshold, thus significantly narrowing the analysis scope. Then, it merges overlapping windows using non-maximum suppression (retaining the highest local score and suppressing low-score overlaps) to prevent the same abnormal event from being divided into multiple fragmented windows and causing duplicate alarms, ultimately outputting a set of independent abnormal time windows.

[0056] In one implementation, the access intensity feature includes the average access intensity within the candidate window and the global average access intensity within the target detection period; determining the candidate anomalous window among the plurality of candidate windows based on the access intensity feature includes: calculating a dynamic baseline value for each time unit corresponding to the candidate window based on historical data from the same period; generating a dynamic absolute intensity threshold based on the dynamic baseline value and a preset or dynamically adjusted sensitivity coefficient; determining whether the average access intensity within the candidate window is greater than the dynamic absolute intensity threshold; calculating the improvement factor of the average access intensity within the candidate window relative to the global average access intensity; comparing the improvement factor with a dynamic relative improvement threshold to determine whether the improvement factor is greater than the dynamic relative improvement threshold; when the candidate window simultaneously satisfies that the average access intensity within the window is greater than the dynamic absolute intensity threshold and the improvement factor is greater than the dynamic relative improvement threshold, the candidate window is determined as a candidate anomalous window.

[0057] The above implementation provides a two-layer dynamic discrimination mechanism. The absolute intensity discrimination is used to generate dynamic thresholds based on historical data from the same period, which can adapt to the periodic changes in business traffic and avoid false alarms during off-peak periods and false alarms during peak periods. The relative enhancement of the discrimination measurement window relative to the global context can effectively identify local anomaly clusters. For example, for the absolute intensity discrimination, an exponentially weighted moving average (EWMA) baseline is calculated for each time point t based on historical data from the same period. And generate dynamic absolute intensity threshold. , where k is an adjustable sensitivity coefficient. The discrimination condition is: (Ensure the window's own activity level). For relative improvement discrimination, calculate the improvement factor of the window's average intensity relative to the global evaluation intensity. and with dynamic relative increase threshold (The initial value can be set to 2, or you can refer to the historical improvement factor distribution to set it.) The comparison and judgment criteria are as follows: (Measures the degree of protrusion of a local area relative to the global area).

[0058] In one implementation, a dynamic baseline value is calculated for each time unit corresponding to the candidate window based on historical data from the same period, including: calculating an exponentially weighted moving average or quantile statistic for each time unit based on the historical data from the same period, to obtain the dynamic baseline value.

[0059] Here, the exponentially weighted moving average assigns higher weight to recent data, enabling the baseline to quickly respond to recent trends in business traffic. For example, , As a smoothing factor, its typical value range is [value range missing]. Used to balance the weights of recent and historical data. This represents the exponentially weighted moving average (i.e., the dynamic baseline value) at the t-th time unit. This represents the actual observation value at the t-th time unit; This represents the exponentially weighted moving average of the previous time unit.

[0060] Quantile statistics select appropriate quantiles based on the distribution of historical data, making the baseline insensitive to extreme values. For example, quantile statistics are used to select an appropriate quantile (such as the 90th quantile) as the baseline, indicating that under normal circumstances, 90% of historical data are below this value.

[0061] In practice, the above-mentioned index-weighted moving average or quantile statistics can be flexibly selected or combined according to the characteristics of the business.

[0062] In one implementation, non-maximum suppression is used to merge temporally overlapping or adjacent candidate anomaly windows to determine the anomaly time window. This includes: sorting each candidate anomaly window in descending order based on its temporal risk score to obtain a sorted candidate window list; selecting the candidate window with the highest current temporal risk score from the sorted candidate window list and identifying it as a retained anomaly time window; calculating the temporal overlap between the retained anomaly time window and all other unprocessed candidate windows in the candidate window list; removing other candidate windows from the candidate window list whose temporal overlap with the retained anomaly time window exceeds a preset overlap threshold; and returning to the process of selecting the candidate window with the highest current temporal risk score from the sorted candidate window list until the candidate window list is empty or the preset maximum number of anomaly time windows has been reached.

[0063] This iterative mechanism ensures that high-risk windows are prioritized and retained, while windows that highly overlap with them are removed to avoid duplicate alerts. The overlap threshold can be set to, for example, 50%, and the maximum number of outputs can be set according to business needs, such as 10.

[0064] In one implementation, the temporal risk score of the candidate anomaly window can be determined according to the following steps: calculating a base risk score based on the enhancement factor of the candidate anomaly window; weighting the base risk score by introducing a semantic enhancement factor to obtain the temporal risk score; the semantic enhancement factor includes a time period enhancement factor and / or a historical baseline enhancement factor.

[0065] Here, the introduction of semantic enhancement factors allows risk scores to incorporate prior business knowledge. Time-based enhancement factors assign higher weight to anomalies occurring during off-peak hours (e.g., early morning), as such anomalies are typically more threatening. Historical baseline enhancement factors assign higher weight to candidate anomaly windows with low historical probability of occurrence, as rare patterns tend to be more aggressive. Baseline risk score S corebase It can be calculated using a power function of the multiplier, for example... , where α>1, is used to amplify abnormal differences; L represents the factor by which the access intensity within the window is increased relative to the global average access intensity.

[0066] Subsequently, a semantic enhancement factor is introduced to weight the basic risk score. For example, for the time-period enhancement factor... If the window covers a service period that falls within a preset off-peak period (such as early morning), then >1, otherwise = 1; Enhancement factor for historical baseline Based on historical data distribution, if the probability of the access intensity occurring during the specified window period is lower than a preset probability threshold, then... >1, otherwise = 1. Calculate the time series risk score. .

[0067] As mentioned above, since the sliding window generates overlapping candidate anomaly windows, after obtaining the aforementioned temporal risk scores, a non-maximum suppression algorithm can be used to process them, merging temporally overlapping or adjacent candidate anomaly windows and retaining the candidate anomaly window with the highest risk score. For example, all candidate anomaly windows can be sorted in descending order of S_t, and the candidate anomaly window with the highest score can be selected, suppressing all candidate anomaly windows that overlap with it temporally, for example, by more than 50%. Then, the highest-scoring candidate anomaly window can be selected from the remaining candidate anomaly windows, and this process is repeated until all candidate anomaly windows have been processed or the preset maximum output number Top-K (e.g., K = 10) is reached. Finally, a set of independent anomaly time window lists is output. } and its corresponding temporal risk score {S_t, i}.

[0068] S103: Based on the network access logs within the abnormal time window, construct an access relationship graph, extract abnormal behavior features based on the access relationship graph, and generate a graph association risk score for the abnormal time window based on the abnormal behavior features.

[0069] For example, by constructing an access relationship graph containing multiple entities such as source IP, target URL, and user identifier, a graph neural network is used to extract collaborative anomaly features such as community clustering and behavioral consistency, and a quantified graph association risk score is generated. This process can reveal the group behavior patterns of malicious collaborative attacks and effectively distinguish organized attacks from normal business peaks.

[0070] In one implementation, constructing an access relationship graph may include: extracting access logs within the abnormal time window, parsing entity information in the access logs, the entity information including source IP address, target URL, and user identifier; constructing the access relationship graph by using the source IP address, target URL, and user identifier as nodes and the access relationships between nodes as edges; the edges include access edges from source IP address to target URL, request edges from user identifier to target URL, or association edges from source IP address to user identifier, and each edge carries edge attribute information, the edge attribute information including access count, access time distribution, or request parameter similarity.

[0071] This implementation constructs multiple types of entities and various edge relationships, enabling the access relationship graph to comprehensively depict access behavior during abnormal periods. Edge attribute information allows the graph model to learn abnormal characteristics of access behavior across multiple dimensions, such as frequency, timing, and content, thus providing rich structural and attribute information for subsequent graph feature extraction. For example, an access edge from source IP address to target URL represents an IP address accessing a webpage or interface, which can be used to detect whether the same IP address accesses a large number of different URLs in a short period (possibly scanning the website structure) or whether a large number of different IP addresses are concentratedly accessing the same URL (possibly engaging in API manipulation, such as ticket grabbing or order boosting). Correspondingly, a request edge from user identifier to target URL represents a logged-in user (account) accessing a resource; an association edge from source IP address to user identifier represents which accounts an IP address used, or which IP addresses an account came from. The access count in the above edge attributes records the total number of times the edge appears within the abnormal window; the access time distribution describes the degree of time concentration or time pattern of the edge's occurrence; the request parameter similarity describes the similarity between the request parameters of the multiple requests corresponding to this edge.

[0072] In one implementation, extracting abnormal behavior features based on the access relationship graph and generating a graph association risk score for the abnormal time window based on the abnormal behavior features includes: using a graph neural network to learn features from nodes based on the access relationship graph, and extracting graph feature vectors representing collaborative abnormal behavior features; the collaborative abnormal behavior features include community clustering and / or behavioral consistency; and inputting the graph feature vectors into a preset scoring function or neural network layer to generate the graph association risk score.

[0073] Here, graph neural networks can automatically learn high-order collaborative features in graph structures. Community clustering is used to identify whether a group of the same IP addresses accesses a specific URL in a short period, thus detecting collaborative patterns of malicious crawlers or DDoS attacks. Behavioral consistency is used to detect whether request parameters and access intervals exhibit automated script characteristics, identifying automated attacks such as credential stuffing. The learned feature vectors are mapped to risk scores through neural network layers, achieving a quantitative assessment of abnormal collaborative behavior. For example, feature learning can be performed using graph neural network (GNN) algorithms to extract graph feature vectors representing abnormal collaborative behavior, including community clustering (whether URLs accessed by non-adjacent but identical IP addresses are abnormally concentrated in a short period) and behavioral consistency (whether the parameters and intervals of requests from the same user exhibit automated script characteristics). These graph feature vectors are then input into a fully connected neural network layer to generate a graph association risk score (S_g).

[0074] S104: The temporal risk score and the graph association risk score are fused to determine the window comprehensive risk score.

[0075] Here, the statistically based time-series anomaly score and the correlation-based graph anomaly score can be weighted and fused to obtain a final score that comprehensively reflects the risk in both time and correlation dimensions.

[0076] In one implementation, the step of fusing the temporal risk score and the graph association risk score to determine the window comprehensive risk score includes: weighting and summing the temporal risk score and the graph association risk score based on adaptive fusion weights to obtain the window comprehensive risk score.

[0077] Here, the temporal risk score and graph association risk score are weighted and summed using adaptive fusion weights, ensuring that the final comprehensive risk score incorporates information from both the time and association dimensions, resulting in a more comprehensive and accurate assessment. Furthermore, the adaptive fusion weights can be dynamically adjusted based on actual business scenarios, adapting to the characteristics of different periods and attack types. For example, if frequent false positives are detected by temporal detection (e.g., normal promotional traffic is misjudged as an attack), it indicates that the temporal features at the current stage are unreliable. The temporal weight (γ value) can be automatically reduced, allowing the more accurate graph association analysis results to dominate the comprehensive risk score, thereby reducing false positives. Conversely, if graph association analysis misses new types of attacks (e.g., DDoS) while temporal detection effectively captures them, the temporal weight can be increased. Through this dynamic adjustment mechanism, the fusion weights can adapt to changes in different attack types and business stages, ensuring that the comprehensive risk score is always based on the most reliable information source, ultimately achieving more accurate and robust anomaly detection.

[0078] For example, the temporal risk score S_t and the graph association risk score S_g are weighted and fused to obtain the window comprehensive risk score. Among them, the fusion weight It is an adaptive parameter. Through an online learning module, it automatically analyzes the accuracy of historical alarms and can automatically adjust... Value, of which The initial value can be set to 0.6. For example, if the false alarm rate of the time series component is found to be high, while the accuracy of the graph association analysis component is high, then the time series weight can be reduced. Increase graph association weight The effect; conversely, it increases. .

[0079] In one implementation, the adaptive fusion weights can be dynamically determined according to the following steps: setting a sliding time window, collecting historical alarm data and their manually confirmed accuracy labels within the sliding time window; determining the false alarm rate corresponding to the time-series risk score and the missed alarm rate corresponding to the graph association risk score within the sliding time window; and gradually adjusting the values ​​of the adaptive fusion weights according to the false alarm rate of the time-series risk score and the missed alarm rate of the graph association risk score, according to a preset adjustment step size, until a balance state or a preset upper limit of the number of iterations is reached.

[0080] Here, the performance of the time-series component and the graph association component is evaluated separately by collecting manual confirmation results as feedback signals: if the false positive rate of the time-series component is high, the time-series weight is reduced; if the false negative rate of the graph association component is high, the graph association weight is increased. Through iterative adjustments, the fusion weights converge to the optimal balance point, avoiding the blindness of manual parameter tuning, and thus adapting to changes in business and the evolution of attack methods.

[0081] For example, the adaptive fusion weights are updated iteratively across consecutive sliding time windows. Specifically, at the end of each sliding window (e.g., the past 7 days), the performance of the time-series risk score and the graph association risk score (e.g., the false positive rate of the time-series component and the false negative rate of the graph association component) is evaluated based on the historical alerts collected within that window and their manual confirmation results. Then, based on these two evaluation metrics, the fusion weights are dynamically adjusted for the next sliding window: if the false positive rate of the time-series component is high, indicating low current credibility, its weight is appropriately reduced; if the false negative rate of the graph association component is high, its weight is appropriately increased. Through this cross-window iterative cycle, the fusion weights can continuously evolve with the changes in the business environment and attack methods, thus remaining near the optimal balance point.

[0082] S105: Determine the network access anomaly detection result based on the comprehensive risk score of the window.

[0083] In this step, the overall risk score of a window is compared with a decision threshold. If the threshold is reached or exceeded, network access anomaly detection is considered necessary. For example, alarms or blocking actions are triggered for abnormal windows that reach or exceed the decision threshold, enabling differentiated risk handling. The decision threshold can be dynamically adjusted based on business tolerance, thus flexibly adapting to security policy requirements in different periods and scenarios.

[0084] In one implementation, determining the network access anomaly detection result based on the window comprehensive risk score includes: obtaining a dynamically adjusted decision threshold; comparing the window comprehensive risk score of the abnormal time window with the decision threshold; if the window comprehensive risk score is greater than or equal to the decision threshold, then determining that the access behavior within the abnormal time window is abnormal; if the window comprehensive risk score is less than the decision threshold, then determining that the access behavior within the abnormal time window is normal.

[0085] For example, the initial value of the decision threshold θ can be set empirically, such as 0.7. Preferably, the decision threshold can be dynamically adjusted through an online learning module. For instance, if the recent false alarm rate is high, the threshold can be appropriately increased to reduce sensitivity; if the false negative rate is high, the threshold can be appropriately decreased to increase the detection rate.

[0086] In practice, risks can be categorized into different levels (e.g., low, medium, and high), and corresponding handling strategies can be preset for each level. For example, for a low-risk window that has just exceeded the threshold, only an alarm might be triggered and logs might be recorded for security personnel to conduct subsequent tracking and analysis. For medium-risk behaviors with a higher risk level, restrictive measures can be implemented, such as requiring users to perform secondary verification (e.g., SMS verification codes) or limiting the rate of the current operation. Once a high-risk threshold is reached (e.g., typical vulnerability scans or attack characteristics), blocking should be implemented immediately, intercepting the request and blocking the source IP for a period of time. Through this tiered risk control strategy, real threats can be blocked in a timely manner while minimizing the impact on normal business operations.

[0087] In some embodiments, after determining whether the access behavior within an abnormal time window is normal or abnormal based on the window's comprehensive risk score, the judgment results of multiple abnormal time windows can be aggregated to comprehensively determine whether the overall situation is abnormal. For example, if there are abnormal access behaviors within a target number of abnormal time windows, the overall situation is considered abnormal, and subsequent alarm or blocking processing is initiated.

[0088] In some embodiments, after executing risk anomaly handling decisions, multi-dimensional feedback data, including real anomalies, false positives, false negatives, and novel attack patterns, can be continuously collected. Based on multi-dimensional feedback processing, reinforcement learning algorithms based on policy gradients are employed to dynamically update the core parameter set, covering key indicators such as traffic baseline, two-layer dynamic discrimination threshold, weight γ, and decision threshold θ. Simultaneously, the statistical characteristics of business traffic distribution and access patterns are monitored in real time. When concept drift caused by reasons such as the launch of new services is detected, a smooth reset of the time-series baseline model (such as EWMA) or rapid reinitialization based on recent data will be automatically triggered. The optimized parameters are immediately synchronized to the detection process, forming an adaptive loop of continuous iteration of detection-decision-feedback-optimization.

[0089] The following describes a specific implementation of the network access anomaly detection method according to the present disclosure, with reference to the accompanying drawings.

[0090] Figure 2 This is a schematic flowchart of a network access anomaly detection method provided for an exemplary embodiment of this disclosure. First, in the multi-scale temporal feature detection module, a sliding window mechanism is used to scan windows of different scales, such as 2 hours, 4 hours, and 6 hours, in parallel to capture anomaly patterns across different time spans. After dynamic hierarchical discrimination (absolute strength discrimination + relative enhancement discrimination), a corresponding temporal risk score is generated. The nonmaximum suppression algorithm was used to select the Top-K most likely abnormal time windows.

[0091] Subsequently, the analysis module constructs an entity association heterogeneous graph based on detailed access logs within the candidate window and performs deep graph feature extraction to calculate multi-dimensional graph association risk scores. These graph association risk scores and time-series risk scores are input into the risk aggregation and decision output module, where weighted fusion generates a comprehensive window risk score for each abnormal time window. This comprehensive window risk score is compared with a dynamic threshold, and differentiated response actions such as alerts, verification, or blocking are executed based on the risk level. Finally, the process proceeds to the online learning and optimization module. This module collects human feedback and actual operational data after decision execution and continuously updates core parameters such as detection thresholds and fusion weights using reinforcement learning and other methods. The optimized parameters are immediately applied to the next round of detection, forming a dynamic protection system capable of resisting concept drift and continuously adapting.

[0092] like Figure 3 As shown, this embodiment of the disclosure provides a network access anomaly detection device 300, including: Module 31 is used to acquire network access logs during the target detection period; The time-series risk assessment module 32 is used to determine the access intensity characteristics within multiple candidate windows based on the network access logs, and to determine the abnormal time windows and the time-series risk score of each abnormal time window based on the access intensity characteristics. The graph association risk judgment module 33 is used to construct an access relationship graph based on the network access logs within the abnormal time window, extract abnormal behavior features based on the access relationship graph, and generate a graph association risk score for the abnormal time window based on the abnormal behavior features. Risk fusion module 34 is used to fuse the time-series risk score and the graph-related risk score to determine the window comprehensive risk score; The anomaly detection result determination module 35 is used to determine the network access anomaly detection result based on the comprehensive risk score of the window.

[0093] The specific implementation process of the functions and roles of each unit in the above-mentioned device can be found in the implementation process of the corresponding steps in the above-mentioned network access anomaly detection method, and will not be repeated here.

[0094] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this disclosure according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0095] Based on the same technical concept, this disclosure also provides an electronic device 400, referring to... Figure 4 The diagram shown is a schematic representation of the structure of an electronic device according to an exemplary embodiment of this disclosure, comprising: The processor 410, memory 420, and bus 430 are included. The memory 420 is used to store execution instructions and includes main memory 421 and external memory 422. The main memory 421, also known as internal memory, is used to temporarily store the operation data in the processor 410 and the data exchanged with external memory 422 such as hard disk. The processor 410 exchanges data with external memory 422 through main memory 421.

[0096] In this embodiment, the memory 420 is specifically used to store application code that executes the scheme of this disclosure, and its execution is controlled by the processor 410. That is, when the electronic device 400 is running, the processor 410 communicates with the memory 420 through the bus 430, or the processor 410 communicates with the memory 420 through other means, so that the processor 410 executes the application code stored in the memory 420, and then executes the steps of the network access anomaly detection method described in any of the foregoing embodiments.

[0097] The memory 420 may be, but is not limited to, random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), etc.

[0098] Processor 410 may be an integrated circuit chip with signal processing capabilities. The aforementioned processor can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this invention. The general-purpose processor can be a microprocessor or any conventional processor.

[0099] It is understood that the structures illustrated in the embodiments of this disclosure do not constitute a specific limitation on the electronic device 400. In other embodiments of this disclosure, the electronic device 400 may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0100] This disclosure also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the network access anomaly detection method described in the above-described method embodiments. The storage medium can be a volatile or non-volatile computer-readable storage medium.

[0101] This disclosure also provides a computer program product, on which a computer program is stored. When the computer program is run by a processor, it executes the steps of the network access anomaly detection method provided in any of the above embodiments of this disclosure. For details, please refer to the above method embodiments, which will not be repeated here.

[0102] The aforementioned computer program product can be implemented through hardware, software, or a combination thereof. In one optional embodiment, the computer program product is specifically embodied in a computer storage medium, which can be a volatile or non-volatile computer-readable storage medium. In another optional embodiment, the computer program product is specifically embodied in a software product, such as a software development kit (SDK), etc.

[0103] Furthermore, embodiments of the subject matter and functional operation described in this specification can be implemented in the following ways: digital electronic circuits, tangibly embodied computer software or firmware, computer hardware including the structures disclosed in this specification and their structural equivalents, or combinations thereof. Embodiments of the subject matter described in this specification can be implemented as one or more computer programs, i.e., one or more modules of computer program instructions encoded on a tangible, non-transitory program carrier for execution by a data processing apparatus or for controlling the operation of a data processing apparatus. Alternatively or additionally, program instructions may be encoded on artificially generated propagation signals, such as machine-generated electrical, optical, or electromagnetic signals, which are generated to encode information and transmit it to a suitable receiving device for execution by the data processing apparatus. The computer storage medium may be a machine-readable storage device, a machine-readable storage substrate, a random or serial access memory device, or combinations thereof.

[0104] The processing and logic flows described in this specification can be executed by one or more programmable computers that execute one or more computer programs to perform corresponding functions by operating on input data and generating output. The processing and logic flows can also be executed by dedicated logic circuits—such as field-programmable gate arrays (FPGAs) or application-specific integrated circuits (ASICs), and the device can also be implemented as dedicated logic circuits.

[0105] Suitable computers for executing computer programs include, for example, general-purpose and / or special-purpose microprocessors, or any other type of central processing unit. Typically, the central processing unit receives instructions and data from read-only memory and / or random access memory. The basic components of a computer include a central processing unit for implementing or executing instructions and one or more memory devices for storing instructions and data. Typically, a computer will also include one or more mass storage devices for storing data, such as disks, magneto-optical disks, or optical disks, or the computer will be operatively coupled to such mass storage devices to receive data from or transfer data to them, or both. However, a computer is not required to have such devices. Furthermore, a computer can be embedded in another device, such as a mobile phone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a Global Positioning System (GPS) receiver, or a portable storage device such as a Universal Serial Bus (USB) flash drive, to name a few.

[0106] Computer-readable media suitable for storing computer program instructions and data include all forms of non-volatile memory, media, and memory devices, such as semiconductor memory devices (e.g., EPROM, EEPROM, and flash memory devices), magnetic disks (e.g., internal hard disks or removable disks), magneto-optical disks, and CD-ROM and DVD-ROM disks. Processors and memory may be supplemented by or incorporated into dedicated logic circuitry.

[0107] While this specification contains numerous specific implementation details, these should not be construed as limiting the scope of any invention or the scope of the claims, but rather are primarily intended to describe features of specific embodiments of a particular invention. Certain features described in the various embodiments herein may also be implemented in combination in a single embodiment. Conversely, various features described in a single embodiment may also be implemented separately in various embodiments or in any suitable sub-combination. Furthermore, while features may function in certain combinations as described above and even initially claimed in this way, one or more features from a claimed combination may be removed from that combination in some cases, and a claimed combination may refer to a sub-combination or a variation thereof.

[0108] Similarly, although the operations are depicted in a specific order in the accompanying drawings, this should not be construed as requiring these operations to be performed in the specific order shown or sequentially, or requiring all illustrated operations to be performed to achieve the desired result. In some cases, multitasking and parallel processing may be advantageous. Furthermore, the separation of various system modules and components in the above embodiments should not be construed as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged into multiple software products.

[0109] Thus, specific embodiments of the subject matter have been described. Other embodiments are within the scope of the appended claims. In some cases, the actions recited in the claims may be performed in a different order and still achieve the desired result. Furthermore, the processes depicted in the drawings are not necessarily shown in a specific order or sequence to achieve the desired result. In some implementations, multitasking and parallel processing may be advantageous.

[0110] The above description is merely a preferred embodiment of this disclosure and is not intended to limit this disclosure. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A method for detecting network access anomalies, characterized in that, include: Obtain network access logs within the target detection period; Based on the network access logs, access intensity characteristics within multiple candidate windows at multiple scales are determined, and based on the access intensity characteristics, abnormal time windows and the temporal risk score of each abnormal time window are determined. Based on the network access logs within the abnormal time window, an access relationship graph is constructed, abnormal behavior features are extracted based on the access relationship graph, and a graph association risk score for the abnormal time window is generated based on the abnormal behavior features. The temporal risk score and the graph association risk score are fused to determine the window comprehensive risk score; Based on the comprehensive risk score of the window, the network access anomaly detection result is determined.

2. The method according to claim 1, characterized in that, Based on the network access logs, access intensity features within multiple candidate windows at multiple scales are determined, including: The network access logs are grouped according to a preset time unit to obtain log sets for multiple time periods; For each time period, the access volume metric is calculated from the log set to obtain time-series access data; Based on the time-series access data, access intensity features within multiple candidate windows at multiple scales are determined.

3. The method according to claim 1 or 2, characterized in that, The following steps are used to determine multiple candidate windows under the multi-scale approach: Get multiple preset window lengths; Based on each preset window length and the preset sliding step size, multiple candidate windows are determined for each preset window length.

4. The method according to claim 2, characterized in that, The access intensity characteristics include in-window access intensity and global average access intensity; Determining the access intensity within the window based on the network access logs includes: for each candidate window, obtaining the access intensity value within each time unit covered by the candidate window; calculating the total access volume of the candidate window within the covered time period based on the access intensity value within each time unit; and calculating the average access intensity of the candidate window within the window length based on the total access volume and the window length of the candidate window, as the access intensity within the window. Determining the global average access intensity based on the network access logs includes: obtaining the access intensity value for all time units within the target detection period; calculating the total access volume within the target detection period based on the access intensity value for all time units; and calculating the average access intensity within the target detection period based on the total access volume and the number of time units within the target detection period, which is used as the global average access intensity.

5. The method according to claim 1, characterized in that, The step of determining the abnormal time window among the multiple candidate windows based on the access intensity characteristics includes: Based on the access intensity characteristics, candidate abnormal windows are determined among the multiple candidate windows; Non-maximum suppression is used to merge candidate anomaly windows that overlap or are adjacent in time to determine the anomaly time window.

6. The method according to claim 5, characterized in that, The access intensity feature includes the average access intensity within the candidate window and the global average access intensity within the target detection period; The step of determining the candidate abnormal window among the plurality of candidate windows based on the access intensity characteristics includes: Based on historical data from the same period, a dynamic baseline value is calculated for each time unit corresponding to the candidate window; a dynamic absolute intensity threshold is generated based on the dynamic baseline value and a preset or dynamically adjusted sensitivity coefficient; and it is determined whether the average access intensity within the candidate window is greater than the dynamic absolute intensity threshold. Calculate the improvement factor of the average access intensity within the candidate window relative to the global average access intensity; compare the improvement factor with a dynamic relative improvement threshold to determine whether the improvement factor is greater than the dynamic relative improvement threshold; When a candidate window simultaneously satisfies that the average access intensity within the window is greater than the dynamic absolute intensity threshold and the boost factor is greater than the dynamic relative boost threshold, the candidate window is determined as a candidate abnormal window.

7. The method according to claim 6, characterized in that, Based on historical data from the same period, a dynamic baseline value is calculated for each time unit corresponding to the candidate window, including: Based on the historical data from the same period, an index-weighted moving average or quantile statistic is calculated for each time unit to obtain the dynamic baseline value.

8. The method according to claim 5, characterized in that, Non-maximum suppression is employed to merge temporally overlapping or adjacent candidate anomaly windows to determine the anomaly time window, including: Based on the temporal risk score of each candidate anomaly window, the candidate anomaly windows are sorted in descending order to obtain a sorted list of candidate windows. From the sorted list of candidate windows, select the candidate window with the highest current time-series risk score and determine it as the retained abnormal time window; Calculate the time overlap between the retained abnormal time window and all other unprocessed candidate windows in the candidate window list; remove other candidate windows in the candidate window list whose time overlap with the retained abnormal time window exceeds a preset overlap threshold from the candidate window list; Return to the sorted candidate window list and select the candidate window with the highest current time-series risk score until the candidate window list is empty or the preset maximum number of abnormal time windows has been reached.

9. The method according to claim 8, characterized in that, The temporal risk score of the candidate anomaly window is determined according to the following steps: The basic risk score is calculated based on the enhancement factor of the candidate anomaly window; The temporal risk score is obtained by weighting the basic risk score by introducing a semantic enhancement factor; The semantic enhancement factors include time-period enhancement factors and / or historical baseline enhancement factors.

10. The method according to claim 1, characterized in that, The construction of the access relationship graph includes: Extract the access logs within the abnormal time window, and parse the entity information in the access logs, including the source IP address, target URL, and user identifier; The source IP address, target URL, and user identifier are used as nodes, and the access relationships between nodes are used as edges to construct the access relationship graph. The edges include access edges from the source IP address to the target URL, request edges from the user identifier to the target URL, or association edges from the source IP address to the user identifier. Each edge carries edge attribute information, including access count, access time distribution, or request parameter similarity.

11. The method according to claim 1, characterized in that, The step of extracting abnormal behavior features based on the access relationship graph and generating a graph association risk score for the abnormal time window based on the abnormal behavior features includes: Based on the access relationship graph, a graph neural network is used to learn the features of the nodes and extract graph feature vectors that represent the characteristics of abnormal collaborative behavior; the characteristics of abnormal collaborative behavior include community clustering and / or behavioral consistency. The graph feature vector is input into a preset scoring function or neural network layer to generate the graph association risk score; The community clustering degree is used to identify whether a group of people from the same IP address access a specific URL in a short period of time, and to discover the collaborative patterns of malicious crawlers or DDoS attacks; the behavioral consistency is used to detect whether the request parameters and access intervals exhibit automated script characteristics, and to identify automated credential stuffing attacks.

12. The method according to claim 1, characterized in that, The process of fusing the temporal risk score and the graph association risk score to determine the window comprehensive risk score includes: Based on adaptive fusion weights, the temporal risk score and the graph association risk score are weighted and summed to obtain the window comprehensive risk score.

13. The method according to claim 12, characterized in that, The adaptive fusion weights are dynamically determined according to the following steps: Set a sliding time window to collect historical alarm data and their manually confirmed accuracy labels within the sliding time window; Determine the false alarm rate corresponding to the time series risk score and the false negative rate corresponding to the graph association risk score within the sliding time window; Based on the false alarm rate of the time-series risk score and the false negative rate of the graph association risk score, the values ​​of the adaptive fusion weights are gradually adjusted according to a preset adjustment step size until a balance is reached or a preset maximum number of iterations is reached.

14. The method according to claim 1, characterized in that, The determination of network access anomaly detection results based on the comprehensive risk score of the window includes: Obtain dynamically adjusted decision thresholds; The window comprehensive risk score of the abnormal time window is compared with the decision threshold; If the overall risk score of the window is greater than or equal to the decision threshold, the access behavior within the abnormal time window is determined to be abnormal. If the overall risk score of the window is less than the decision threshold, the access behavior within the abnormal time window is determined to be normal.

15. A network access anomaly detection device, characterized in that, include: The acquisition module is used to acquire network access logs within the target detection period; The time-series risk assessment module is used to determine the access intensity characteristics within multiple candidate windows based on the network access logs, and to determine the abnormal time windows and the time-series risk score of each abnormal time window based on the access intensity characteristics. The graph association risk assessment module is used to construct an access relationship graph based on network access logs within the abnormal time window, extract abnormal behavior features based on the access relationship graph, and generate a graph association risk score for the abnormal time window based on the abnormal behavior features. The risk fusion module is used to fuse the temporal risk score and the graph association risk score to determine the window comprehensive risk score; The anomaly detection result determination module is used to determine the network access anomaly detection result based on the comprehensive risk score of the window.

16. An electronic device, characterized in that, The method includes a processor and a memory, the memory storing machine-readable instructions executable by the processor, the processor executing the machine-readable instructions stored in the memory, and when the machine-readable instructions are executed by the processor, the processor performs the steps of the network access anomaly detection method as described in any one of claims 1 to 14.

17. A computer-readable storage medium, characterized in that, Includes instructions stored thereon, wherein, when the instructions are executed by a processor, the network access anomaly detection method as described in any one of claims 1-14 is executed.

Images