Network abnormal operation identification and handling method and device and storage equipment

Abstract

The invention relates to a network abnormal operation identification and disposal method and device and storage equipment, and belongs to the technical field of computer network security and data intelligent analysis. According to the scheme, business basic data is generated through offline data processing such as data selection, cleaning, time sequence modeling, peak interval, key path and request feature recognition; real-time data processing is combined with the basic data and the configuration data, and abnormity is studied and judged through multi-dimensional detection; intelligent treatment is performed according to non-inductive human-machine verification and inductive human-machine verification, hierarchical execution is directly forbidden, and a large model assists in interpretation and gives an alarm. The problems of inaccurate identification, poor adaptability and single disposal in the prior art are solved, accurate identification and intelligent management and control of abnormal operation are realized, and business fairness and user experience are guaranteed.

Description

Technical Field

[0001] This invention relates to the field of intelligent defect detection and repair technology, and in particular to a method, apparatus and storage device for identifying and handling abnormal network operations. Background Technology

[0002] In the operation of various websites providing online services to the public, abnormal network operations are frequently encountered. These operations are highly concealed, manifest in various forms, and seriously undermine the fairness and impartiality of online services. Taking ticket booking websites as an example, abnormal pre-ordering operations can prevent legitimate users from booking tickets, causing serious fairness and impartiality issues. Current technologies lack an intelligent means to accurately identify and efficiently handle these hidden and variable abnormal network operations. They cannot comprehensively assess abnormal operations from dimensions such as business data characteristics and real-time behavioral analysis, nor can they achieve tiered and intelligent protection against abnormal operations. Therefore, there is an urgent need for a solution for identifying and handling abnormal network operations that can address the aforementioned problems. Summary of the Invention

[0003] To address the aforementioned technical problems, embodiments of the present invention provide a method, apparatus, and storage device for identifying and handling abnormal network operations. By conducting offline intelligent analysis of historical website business data, normal behavioral characteristics of website services are mined. Combined with multi-dimensional behavioral detection of real-time data, accurate judgment of abnormal network operations is achieved. A tiered intelligent protection strategy is used to efficiently handle abnormal operations. Simultaneously, a large model is used to achieve intelligent interpretation of data and intelligent generation of alarm information, improving the efficiency and interpretability of identifying and handling abnormal network operations. This method is applicable to various websites providing online services to the public and can accurately identify and handle abnormal network operations on websites.

[0004] In a first aspect, embodiments of the present invention provide a method for identifying and handling abnormal network operations, the method comprising:

[0005] Perform offline data processing, conduct multi-dimensional analysis and mining of website historical log data, extract normal behavioral characteristics of website business, form basic data of website behavior, and intelligently interpret the processing results through a general large language model;

[0006] Perform real-time data processing, based on the website behavior data obtained from offline data processing, filter and multi-dimensionally detect the website's real-time requests, and determine whether there are any abnormal network operations in the current real-time requests;

[0007] For network anomalies identified during real-time data processing, intelligent protective actions are executed, and the anomaly-related data is intelligently summarized and alerted.

[0008] Optionally, offline data processing includes data selection, data cleaning, time series modeling, business peak interval identification, critical path identification, and request feature identification, ultimately generating basic website behavior data.

[0009] Optionally, the time-series modeling includes taking each minute as an independent time-series point, performing point-based statistics on the cleaned valid data, calculating the total request volume for each minute point every day, and then calculating the average request volume for each minute point for the selected multi-day log data to form standardized time-series request data.

[0010] Optionally, the peak traffic interval identification includes using a sliding window-based local statistical change detection method to identify peak traffic periods for website services.

[0011] Optionally, the intelligent interpretation includes inputting the current peak business time interval, the request statistics per minute, and the identified critical business paths, along with built-in prompts and output templates, into a general large model for intelligent summary and output.

[0012] Optionally, the real-time processing includes two sub-steps: data selection and behavior analysis.

[0013] In the data selection sub-step, the peak business time interval in the website behavior basic data is used as the filtering condition to filter the real-time requests of the website, and only real-time requests within this time range are retained.

[0014] In the behavior analysis sub-step, multi-dimensional behavior detection is performed on the filtered real-time requests, and the behavior judgment is finally completed before the target business API interface forwards to the origin server.

[0015] Optionally, multi-dimensional behavior detection is performed, specifically including: classifying and counting the number of real-time request interfaces and non-interfaces for each requesting IP; determining the interface request sequence of each requesting IP within the time window; using the configured target business API interface or the last node of the request sequence obtained from offline mining as the target business API, recording the time when each IP first initiates a target business request; and counting the number of target business requests for each IP within the session.

[0016] Optionally, the behavior analysis process includes three judgment conditions; if any one of these conditions is met, the request from that IP address is determined to have engaged in abnormal network operations.

[0017] Condition 1: During the current session, the request sequence of this IP does not completely match the business critical path sequence obtained from offline data processing, that is, the normal critical sequence does not appear in the current session.

[0018] Condition 2: During the current session, the request characteristics of this IP are abnormal. By calculating the proportion of interface requests during the current session and comparing it with the proportion of normal session interface requests in the website behavior basic data, if the ratio of the proportion of interface requests in the current session to the proportion of normal session interface requests in the past reaches 2 times or more, it is determined that the request characteristics are abnormal.

[0019] Condition 3: During the current session, there are instances of rapid submission of target service requests for this IP. If the first target service request of this IP is initiated before the service start time or within a specified threshold time after the service start time, it is considered abnormal.

[0020] Secondly, embodiments of the present invention provide a device for identifying and handling abnormal network operations. The device is used to implement the above-mentioned method for identifying and handling abnormal network operations. The device includes an offline data processing module, a real-time data processing module, an intelligent handling module, and a large model interpretation module. The modules are connected in communication to work together to complete the identification and handling of abnormal network operations.

[0021] The offline data processing module performs multi-dimensional analysis and mining of the website's historical log data, extracts the normal behavioral characteristics of the website's business, and forms the basic data of website behavior.

[0022] The real-time data processing module communicates with the offline data processing module. Based on the website behavior data obtained from the offline data processing, it filters and performs multi-dimensional behavior detection on the website's real-time requests to determine whether there are any abnormal network operations in the current real-time requests.

[0023] The intelligent handling module communicates with the real-time data processing module, receives the network abnormal operation identification results from the real-time data processing module, and for the identified network abnormal operation, first determines whether there is a configured protection action, and then executes protection according to the configured or preset gradient protection strategy.

[0024] The large model interpretation module communicates with the offline data processing module and the intelligent handling module respectively. Based on the processing results of the offline data processing module, it intelligently summarizes and outputs the results by combining built-in prompts and templates, providing analysis results for operation and maintenance personnel.

[0025] Thirdly, embodiments of the present invention provide a storage device, including: a memory and a processor, wherein the processor includes multiple cores, and the memory stores a computer program, which, when executed by the processor, implements the aforementioned method for identifying and handling abnormal network operations.

[0026] This invention provides a method, apparatus, and storage device for identifying and handling abnormal network operations. The technical solutions provided by the embodiments of this invention bring at least the following beneficial effects:

[0027] (1) Achieve accurate and intelligent identification of abnormal operations. By analyzing historical data offline in multiple dimensions, the website’s normal business behavior characteristics are mined out. Combined with real-time multi-dimensional behavior detection, the website makes judgments from multiple dimensions such as request sequence, features, and submission time. This solves the problem of hidden and variable abnormal operations that are difficult to identify, and adapts to the identification needs of scenarios such as ticket purchase.

[0028] (2) Realize the gradient intelligent handling of abnormal operations. Adopt a progressive protection strategy from seamless human-machine verification to direct blocking to reduce interference to normal users. At the same time, combine with a large model to realize data interpretation and alarm information generation, improve the handling efficiency and the interpretability of the results. Furthermore, it is deployed in a cloud WAF, adaptable to peak traffic, and has low access costs.

[0029] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0030] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0031] Figure 1 A flowchart illustrating the methods for identifying and handling abnormal network operations;

[0032] Figure 2 This is a schematic diagram illustrating the composition and working principle of a device for identifying and handling abnormal network operations. Detailed Implementation

[0033] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0034] Before describing the technical solution of the present invention in detail, the technical background and technical terms involved in the technical solution will be explained first:

[0035] Cloud WAF (Cloud Web Application Firewall): A web application security product deployed in the cloud, it is a core protection measure against web application layer attacks within a network security protection system. Unlike traditional hardware / software WAFs, it does not require local hardware deployment or software installation by enterprises. It provides security protection for web applications such as websites, API interfaces, and mini-programs through a cloud service model. In the intelligent identification and handling scheme of this invention, the cloud WAF is the core deployment carrier and traffic processing hub of the entire system.

[0036] Figure 1 This is a flowchart illustrating the method for identifying and handling network anomalies. The method comprises three core steps: offline data processing, real-time data processing, and intelligent handling. Deployed in a cloud-based Web Application Firewall (WAF), this method enables intelligent identification and handling of network anomalies throughout the entire process. The following provides a detailed explanation of each step:

[0037] Step S101: Perform offline data processing, conduct multi-dimensional analysis and mining of website historical log data, extract normal behavioral characteristics of website business, form basic website behavior data, and intelligently interpret the processing results through a general large language model.

[0038] The above steps form the foundational data for website behavior, providing a basis for subsequent real-time data processing. Simultaneously, a large-scale model is used to intelligently interpret the processing results, improving their interpretability. Offline data processing sequentially includes data selection, data cleaning, time-series modeling, business peak interval identification, critical path identification, and request feature identification, ultimately generating the foundational data for website behavior. It also includes a data intelligent interpretation step, the specific process of which is as follows:

[0039] (1) Data selection: Considering that the peak of business requests on the website will be more obvious in the early stage of holidays, log data is selected according to the preset priority. The priority from high to low is the data of the week before October 1, the data of the week before May 1, and the data of the summer vacation from July 25 to July 31. If none of the above data exists, the log data of the most recent week will be selected.

[0040] (2) Data cleaning: The selected log data is filtered to remove invalid requests, illegal requests, protection-blocked requests and other worthless data, and only the request log data forwarded to the origin server is retained to ensure the validity of the data for subsequent analysis.

[0041] (3) Time series modeling: Taking each minute as an independent time series point, the effective data after cleaning is statistically analyzed to calculate the total number of requests at each minute point every day. Then, for the selected multi-day log data, the average number of requests at each minute point is calculated to form standardized time series request data.

[0042] (4) Peak traffic interval identification: The peak traffic periods of the website are identified using a sliding window-based local statistical change detection method, which consists of three steps:

[0043] The first step is to calculate the sliding window features. First, set a fixed-length time window of 10-15 minutes. Starting from the beginning of the time series data, slide forward one minute and count the statistics within the current window.

[0044] The second step is peak detection, which determines whether abrupt changes have occurred by comparing the statistical characteristics of the current window and the previous window, and then marks the peak window. The criteria for determining the peak window are as follows:

[0045] w_current>(w_previous+k*IQR_previous)

[0046] Where w_current is the median of the current window; w_previous is the median of the previous window; k is the sensitivity coefficient and the value of this coefficient is not less than 3. The larger the coefficient, the more severe the surge in request volume can be captured; IQR_previous is the interquartile range of the previous window. The interquartile range is calculated by subtracting the 25th percentile (Q1) from the 75th percentile (Q3); after marking all peak windows, the peak point Tn in each peak window is found, all Tn are compared and the largest peak point is set as the business start time point.

[0047] The third step is to collect end-point data. Starting from the identified business start time, the request volume of each subsequent minute node is compared with the request volume at the start time. When the request volume of a certain minute node drops to 50% or less of the request volume at the start time, that node is identified as the business end time. Finally, the start-end time interval of the business peak is obtained.

[0048] (5) Critical path identification: Based on the identified business peak interval, the interface request data within 1 minute before the peak start time to 1 minute after the peak end time is filtered from the historical cleaned data, and the data within this time period is analyzed: all interface requests of each IP are treated as an independent session, and the request sequence of each interface within each session is determined based on the access time order; each request URL is encoded as Sn, and the request sequence within each session is further determined to be in the form of s1->s2->……->sn; for all session request sequences within the time window, the frequent sequence pattern mining algorithm is used and combined with the built-in algorithm parameters to output frequent sequences of all lengths; if business personnel are involved, the business personnel will screen and confirm the final business critical path sequence; if no business personnel are involved, the sequence with the longest sequence length and the most occurrences of the termination node in all sequences will be selected as the business critical path sequence.

[0049] (6) Request feature identification: Based on the identified business peak interval, all request data within 1 minute before the peak start time to 1 minute after the peak end time are filtered from the historical cleaned data. Statistical analysis is performed on the data within this time period: all requests of each IP are treated as an independent session, the number of interface requests and non-interface requests in each session is counted, and the proportion of non-interface requests is calculated; cluster statistics are performed on all sessions within the time window, the number of clusters is set to 2, the category containing the most original data is found, and the cluster center of this category is the proportion of non-interface requests in normal sessions, which is used as the normal request feature of the website.

[0050] (7) Generate basic website behavior data: Integrate the peak business time intervals, the identified critical business path sequences, and the identified normal request feature data obtained in the above steps to form the basic behavior data of the current website, providing data support for subsequent real-time data processing.

[0051] (8) Intelligent data interpretation: The current peak business time interval, the request statistics per minute, and the identified critical business paths are combined with built-in prompts and output templates and input into the general model for intelligent summary and output, generating more interpretable analysis results for operation and maintenance personnel to view and refer to.

[0052] Step S102: Perform real-time data processing. Based on the website behavior data obtained from offline data processing, filter and perform multi-dimensional behavior detection on the website's real-time requests to determine whether there are any abnormal network operations in the current real-time requests.

[0053] The above real-time processing includes two sub-steps: data selection and behavior analysis, as detailed below:

[0054] (1) Data selection: The real-time requests of the website are filtered based on the peak business time interval in the basic data of website behavior. Only the real-time requests within this time range are retained, thereby reducing the amount of invalid data to be analyzed and improving detection efficiency.

[0055] (2) Behavioral analysis: Multi-dimensional behavioral detection is performed on the filtered real-time requests. Finally, behavioral judgment is completed before the target business API interface forwards to the origin station. Specifically, the following basic statistical operations are performed first: Classify and count the number of real-time request interfaces and non-interfaces for each request IP; determine the interface request sequence of each request IP within the time window; based on the configured target business API interface or the last node of the request sequence obtained offline, use it as the target business API and record the time when each IP first initiates the target business request; count the number of target business requests for each IP within the session period.

[0056] After completing the above basic statistics, behavioral analysis is performed. The analysis process includes three judgment conditions. If any one of the conditions is met, it is determined that the IP address's request involves abnormal network operations:

[0057] Condition 1: During the current session, the request sequence of this IP does not completely match the business critical path sequence obtained from offline data processing, that is, the normal critical sequence does not appear in the current session.

[0058] Condition 2: During the current session, the request characteristics of this IP are abnormal. By calculating the proportion of interface requests in the current session and comparing it with the proportion of normal session interface requests in the website behavior basic data, if the ratio of the current session's interface request proportion to the historical normal session interface request proportion is 2 times or more, it is determined that the request characteristics are abnormal.

[0059] Condition 3: During the current session, there are instances of rapid submission of target service requests for this IP. If the first target service request of this IP is initiated before the service start time or within a specified threshold time after the service start time, it is considered abnormal.

[0060] Step S103: For network anomalies identified in real-time data processing, execute intelligent protection actions and intelligently summarize and alarm the anomaly-related data.

[0061] The specific process of the above steps is as follows:

[0062] (1) Execution of protection actions: For the identified abnormal network operations, first determine whether there are configured protection actions. If so, execute the protection according to the configured protection actions; if there are no configured protection actions, execute the preset intelligent gradient protection strategy. This strategy upgrades the protection actions from low to high in the order of non-intrusive human-machine verification - sensible human-machine verification - direct blocking. During the protection process, if the requesting IP passes the initial verification action and the subsequent request behavior returns to normal, the request of the IP is allowed; if the IP passes the initial verification but the subsequent behavior is still abnormal, the protection action continues to be upgraded until it is upgraded to direct blocking.

[0063] (2) Intelligent summary and alarm: The abnormal IP request data, abnormal blocking configuration, protection strategy and other information detected at present are combined with the built-in prompt information and output templates and input into the general model for intelligent summary to generate more interpretable alarm information. The alarm information is then pushed to the operation personnel through the preset alarm channel. At the same time, alarms can be sent to website users to realize timely notification and handling of abnormal operations.

[0064] Based on the above-described method for identifying and handling abnormal network operations, this invention also provides a device for identifying and handling abnormal network operations. Figure 2 This is a schematic diagram illustrating the composition and working principle of a device for identifying and handling network anomalies. Deployed in a cloud-based Web Application Firewall (WAF), the device includes an offline data processing module, a real-time data processing module, an intelligent handling module, and a large-scale model interpretation module. These modules communicate and work together to identify and handle network anomalies. The specific functions of each module are as follows:

[0065] The offline data processing module performs full-process offline analysis and processing of website historical log data. This module further includes a data selection unit, a data cleaning unit, a time-series modeling unit, a peak identification unit, a path identification unit, and a feature identification unit. Specifically, the data selection unit filters log data according to preset priority rules; the data cleaning unit filters invalid and illegal request data from the log data; the time-series modeling unit performs time-series statistics and mean calculation on the cleaned data; the peak identification unit uses a sliding window mutation detection method to identify peak business time intervals; the path identification unit mines and determines the critical path sequence of the website's business; and the feature identification unit statistically determines the normal request characteristics of the website. The offline data processing module integrates the processing results of each unit to generate basic website behavior data containing peak business time intervals, critical business path sequences, and normal request characteristics.

[0066] Real-time data processing module: It communicates with the offline data processing module and can obtain the basic website behavior data generated by the offline data processing module. This module first filters the real-time requests of the website based on the peak business time interval in the basic website behavior data, and then performs multi-dimensional behavior detection on the filtered real-time requests. Through basic statistics and multi-condition behavior analysis, it accurately identifies abnormal network operations.

[0067] Intelligent handling module: It communicates with the real-time data processing module and can receive the anomaly identification results from the real-time data processing module. For the identified abnormal network operations, this module first determines whether there are configured protection actions, and then executes protection according to the configured or preset gradient protection strategy. At the same time, this module also collects abnormal IP request data, abnormal blocking configurations, protection strategies and other related data to provide data support for subsequent alarms.

[0068] Large Model Interpretation Module: This module communicates with both the offline data processing module and the intelligent handling module. Based on the processing results of the offline data processing module, this module intelligently summarizes and outputs the results using built-in prompts and templates, providing interpretable analysis results for operations and maintenance personnel. At the same time, it intelligently summarizes the anomaly-related data collected by the intelligent handling module and generates alarm information, which is then pushed through the alarm channel.

[0069] The above-mentioned device is used to implement the above-mentioned identification and handling methods. Each module / unit included in the device is used to implement the corresponding steps in the above-mentioned identification and handling methods. For details, please refer to the corresponding part of the above-mentioned methods, which will not be repeated here.

[0070] In summary, this invention achieves accurate identification of abnormal network operations. Through offline multi-dimensional analysis of historical website data, it uncovers normal behavioral characteristics of website operations, including peak business time intervals, critical path sequences, and normal request characteristics, forming standardized basic data on website behavior. Based on this basic data, multi-dimensional behavior detection is performed on real-time requests, comprehensively judging from three dimensions: request sequence, request characteristics, and request submission time. This solves the problems of hidden, variable, and difficult-to-identify abnormal operations in existing technologies, achieving accurate and comprehensive identification of abnormal network operations, particularly suitable for identifying abnormal pre-ordering operations in scenarios such as ticket booking. This invention also implements intelligent tiered handling of abnormal operations: it sets up a tiered protection strategy of seamless human-machine verification – sensory human-machine verification – direct blocking. For abnormal operations, a low-level protection verification is first executed, and the protection action is upgraded only when the verification is ineffective and the behavior continues to be abnormal. This effectively intercepts abnormal operations while reducing interference with normal user requests, improving the service experience of network services. Simultaneously, it supports custom protection configurations, which can be flexibly adjusted according to the actual business needs of the website, improving the flexibility of handling. This invention enhances the interpretability of identification and handling results: it introduces a general large model to intelligently summarize and output the results of offline data processing and the anomaly-related data from intelligent handling, transforming professional data analysis results into more interpretable information. This facilitates operations personnel in viewing and analyzing website business behavior, while the generated intelligent alarm information allows operations personnel to quickly grasp abnormal operation situations, improving the efficiency of anomaly handling. The technical solution of this invention is deployed in a cloud WAF, eliminating the need for large-scale modifications to the original website business system and reducing deployment costs. Furthermore, offline data processing pre-processes the mining of basic data, and real-time data processing only filters and analyzes requests during peak periods, reducing the amount of data analyzed in real time and improving the efficiency of anomaly identification and handling. This adapts to the real-time protection needs of peak request scenarios such as ticket booking.

[0071] The following specific example illustrates the identification and handling scheme for abnormal purchases on a ticket booking website.

[0072] This embodiment uses ticket booking websites (such as train ticket, air ticket, and scenic spot ticket booking platforms) as the core application scenario. It addresses abnormal purchasing operations by users using scripts, plug-ins, and other tools during ticket release periods. Through three core stages—offline data processing, real-time data processing, and intelligent handling—combined with the traffic processing and protection capabilities of a cloud WAF, it achieves accurate identification and tiered handling of abnormal purchasing behavior, ensuring the ticketing rights of legitimate users and the fairness of the ticket booking business. The following detailed explanation is based on the business characteristics of the ticketing scenario:

[0073] (1) Overall deployment and core compatibility of the implementation scheme

[0074] This embodiment is deployed entirely within a cloud-based WAF. The ticketing website redirects all access traffic (including historical logs and real-time ticket purchase requests) to the cloud WAF nodes, eliminating the need for large-scale modifications to the website's original ticketing system. The cloud WAF's elastic scaling capabilities perfectly adapt to the surge in traffic during peak ticket release periods. Furthermore, it performs anomaly detection and handling before requests are forwarded to the ticketing website's origin server, preventing abnormal requests from impacting the origin server system and ensuring business stability during ticket release periods.

[0075] (2) Offline data processing: mining normal characteristics of ticket purchase behavior on ticketing websites

[0076] Offline data processing involves analyzing historical access logs from ticketing websites. The core objective is to uncover peak ticket release times, key business paths for ticket purchases, and characteristics of normal purchase requests. This creates proprietary foundational data on website behavior, providing a "normal behavior benchmark" for subsequent real-time monitoring. This process closely aligns with the business patterns of ticket booking. The specific steps are as follows:

[0077] Data selection: Prioritize log data from the week before peak ticket-buying periods such as National Day, May Day, and summer vacation (to match the peak characteristics of ticket purchases during holidays). If no such data is available, select data from the most recent week to ensure the representativeness of the analysis data.

[0078] Data cleaning: Filter invalid ticket purchase requests, illegal interface calls, and abnormal requests that have been blocked by protection, and only retain logs of real and normal ticket purchase requests forwarded to the origin server, such as normal ticket inquiries, ballots, and order submission requests.

[0079] Time-series modeling and peak ticket release interval identification: The request volume is counted on a per-minute basis. The sliding window mutation detection method is used to identify the precise peak ticket release period of the ticketing website (such as 8:00-8:30 am). At the same time, the start time (peak point) and end time (the time when the request volume drops to 50% of the peak) of ticket release are determined, which accurately matches the fixed ticket release business characteristics of the ticketing website.

[0080] Identifying the critical path for ticket purchase: Filter the interface request data within 1 minute before and after the peak of ticket release to find the standard ticket purchase path of normal users (such as "ticket query interface → identity verification interface → ballot interface → order submission interface"). This path is the core basis for judging anomalies. Abnormal ticket-grabbing scripts usually skip some interfaces and directly initiate the order submission request.

[0081] Normal request feature identification: Statistical analysis of the ratio of API / non-API requests in normal ticket purchase sessions (e.g., normal non-API requests account for 30%). Abnormal ticket purchase scripts will frequently call the ticket purchase API, and the proportion of non-API requests will be far lower than the normal level.

[0082] Data intelligence interpretation: Through large models, the analysis results are generated into visual reports, which enable operation and maintenance personnel to understand the ticket release patterns, core ticket purchase interfaces, and normal request characteristics of the ticketing website, facilitating subsequent strategy adjustments.

[0083] (3) Real-time data processing: accurately analyze abnormal purchase requests during ticket release periods.

[0084] During the actual ticket release period on the ticketing website, based on behavioral data obtained from offline data processing, the real-time ticket purchase requests received by the cloud WAF are filtered and subjected to multi-dimensional behavioral detection. Anomaly detection is completed before the request is forwarded to the ticketing source website, accurately identifying abnormal purchase operations initiated by scripts and plug-ins. The specific process is in line with the real-time requirements of ticket purchase:

[0085] Data selection: Only real-time ticket purchase requests during peak ticket release periods (such as 8:00-8:30) are filtered out to reduce invalid data processing, improve detection efficiency, and fit the characteristics of ticket rush purchases being concentrated at the moment of ticket release.

[0086] Basic statistics: Real-time statistics are performed on the filtered requests, including the number of interface / non-interface requests for each IP, the sequence of ticket purchase interface requests, the time of the first order submission request, and the number of order submission requests within the session.

[0087] Multi-dimensional behavioral analysis: Combining abnormal purchase characteristics in ticketing scenarios, we determine whether an operation is abnormal from three dimensions. If any one of these conditions is met, it is determined to be an abnormal purchase.

[0088] Condition 1: Abnormal path. The sequence of ticket purchase requests from the IP address does not completely match the critical path for normal ticket purchase (such as directly calling the "submit order interface" and skipping the authentication and ballot interfaces). This is a typical characteristic of a ticket-grabbing script.

[0089] Condition 2: Abnormal request characteristics. The ratio of IP's interface requests to normal interface requests is ≥ 2 times, that is, high-frequency calls to the ticket purchase interface, with no normal non-interface operations, which is consistent with the high-frequency request characteristics of the plug-in.

[0090] Condition 3: Abnormal submission time. If the IP submits an order request before the official ticket release time or within a very short period (specified threshold) after the ticket release begins, it is considered abnormal behavior of using a script to preemptively submit an order.

[0091] (4) Intelligent handling: intercept abnormal purchase attempts in a tiered manner to minimize the impact on normal users.

[0092] For IP addresses detected as abnormally attempting to purchase tickets in real time, and considering the characteristic of "coexistence of normal and abnormal user requests" in the ticketing scenario, a tiered intelligent protection strategy is adopted. This effectively blocks abnormal purchases while minimizing interference with normal users' ticket purchasing operations, achieving "precise protection without harming normal users." The specific handling process is as follows:

[0093] Handling Procedure 1: Execute protective measures. If the ticketing website does not have custom protection configurations, upgrade protection from low to high in the following order: non-intrusive human-machine verification → intrusive human-machine verification → direct blocking.

[0094] When an anomaly is detected for the first time, a seamless human-machine verification (such as slider verification or CAPTCHA) is performed, which does not interfere with the user experience of normal users and only verifies suspected abnormal IP addresses.

[0095] If the non-intrusive human-machine verification fails, it will be upgraded to an invasive human-machine verification (such as complex image and text verification) to further filter abnormal IPs.

[0096] If the verification still fails, or if an abnormal purchase request is subsequently initiated after verification, the IP address will be directly blocked, prohibiting it from initiating any ticket purchase request during the ticket release period.

[0097] If the IP address is verified and subsequent behavior returns to normal, it will be allowed to proceed directly, ensuring its right to purchase tickets normally.

[0098] Handling Process 2: Intelligent Alarm and Summary. Through a large model, the request data, blocking policies, and protection results of abnormal purchase IPs are generated into easily interpretable alarm information, which is pushed to the ticketing website operators via SMS, background notifications, etc., so that the operators can keep abreast of abnormal situations during the ticket release period and adjust the protection strategy in a timely manner. At the same time, a prompt message can be pushed to the blocked abnormal IPs to inform them that they have been blocked due to abnormal operations.

[0099] (5) Advantages of the solution in the ticketing scenario

[0100] Tailored to the characteristics of the ticketing business: The entire process is designed around the characteristics of ticketing websites, such as "tickets being released during holidays, concentrated purchases during peak periods, abnormal operations often involving scripts / plugins, and high-frequency API calls." Compared to general protection solutions, it is more accurate in identifying abnormal ticket purchases.

[0101] Zero business transformation: Deployed on the cloud WAF, there is no need to modify the original ticketing system of the ticketing website, reducing the implementation cost of the solution, and the elastic scaling capability of the cloud WAF can support high-concurrency requests during the ticket release period;

[0102] Tiered protection avoids collateral damage: The protection strategy, from low to high level, avoids directly banning legitimate users and ensures a smooth ticket purchasing experience for legitimate users during ticket release periods.

[0103] Closed-loop detection and handling: From offline mining of normal features to real-time detection of anomalies, and then to tiered handling, the entire process is completed in the cloud WAF, realizing a closed loop of "detection-handling-alarm". The handling efficiency is high, and abnormal purchase operations can be quickly intercepted the moment tickets are released.

[0104] By implementing the above steps, the problem of abnormal ticket purchases during the ticket release period on ticket booking websites can be effectively solved, abnormal and illegal operations can be combated, the fairness and impartiality of the ticket booking business can be guaranteed, and the stability of the website's business during the ticket release period and the ticket purchase experience of normal users can be improved.

[0105] According to embodiments of the present invention, a storage device is also provided. The storage device may include a processor and a memory, wherein the memory stores a computer program. When the computer program is executed by the processor, it can implement the methods provided in any of the above embodiments, and its execution method and beneficial effects are similar, and will not be described again here. In addition, depending on the specific application, the storage device may also include any other suitable components.

[0106] It should be understood that although the steps in the flowcharts of the accompanying drawings are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the accompanying drawings may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. The same / similar parts between the various embodiments of the methods described above in this specification can be referred to each other. Each embodiment focuses on describing the differences from other embodiments, and relevant parts can be referred to the descriptions of other method embodiments.

[0107] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0108] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A method for identifying and handling abnormal network operations, characterized in that, The method includes: Perform offline data processing, conduct multi-dimensional analysis and mining of website historical log data, extract normal behavioral characteristics of website business, form basic data of website behavior, and intelligently interpret the processing results through a general large language model; Perform real-time data processing, based on the website behavior data obtained from offline data processing, filter and multi-dimensionally detect the website's real-time requests, and determine whether there are any abnormal network operations in the current real-time requests; For network anomalies identified during real-time data processing, intelligent protective actions are executed, and the anomaly-related data is intelligently summarized and alerted.

2. The method for identifying and handling abnormal network operations according to claim 1, characterized in that, Offline data processing includes data selection, data cleaning, time series modeling, business peak interval identification, critical path identification, and request feature identification, ultimately generating basic website behavior data.

3. The method for identifying and handling abnormal network operations according to claim 2, characterized in that, The time-series modeling involves taking each minute as an independent time-series point, statistically analyzing the cleaned and effective data, calculating the total request volume for each minute point every day, and then calculating the average request volume for each minute point for the selected multi-day log data to form standardized time-series request data.

4. The method for identifying and handling abnormal network operations according to claim 2 or 3, characterized in that, The peak traffic interval identification includes using a sliding window-based local statistical change detection method to identify peak traffic periods for website services.

5. The method for identifying and handling abnormal network operations according to claim 1, characterized in that, The intelligent interpretation includes inputting the current peak business time interval, the request statistics per minute, and the identified critical business paths, along with built-in prompts and output templates, into a general large model for intelligent summary and output.

6. The method for identifying and handling abnormal network operations according to claim 1, characterized in that, The real-time processing includes two sub-steps: data selection and behavior analysis. In the data selection sub-step, the peak business time interval in the website behavior basic data is used as the filtering condition to filter the real-time requests of the website, and only real-time requests within this time range are retained. In the behavior analysis sub-step, multi-dimensional behavior detection is performed on the filtered real-time requests, and the behavior judgment is finally completed before the target business API interface forwards to the origin server.

7. The method for identifying and handling abnormal network operations according to claim 6, characterized in that, Multi-dimensional behavior detection is performed, specifically including: classifying and counting the number of real-time request interfaces and non-interfaces for each requesting IP; determining the interface request sequence of each requesting IP within a time window; using the configured target business API interface or the last node of the request sequence obtained from offline mining as the target business API, recording the time when each IP first initiates a target business request; and counting the number of target business requests for each IP within the session.

8. The method for identifying and handling abnormal network operations according to claim 6, characterized in that, The behavior analysis process includes three judgment conditions. If any one of these conditions is met, the request from that IP address is determined to have engaged in abnormal network operations. Condition 1: During the current session, the request sequence of this IP does not completely match the business critical path sequence obtained from offline data processing, that is, the normal critical sequence does not appear in the current session. Condition 2: During the current session, the request characteristics of this IP are abnormal. By calculating the proportion of interface requests during the current session and comparing it with the proportion of normal session interface requests in the website behavior basic data, if the ratio of the proportion of interface requests in the current session to the proportion of normal session interface requests in the past reaches 2 times or more, it is determined that the request characteristics are abnormal. Condition 3: During the current session, there are instances of rapid submission of target service requests for this IP. If the first target service request of this IP is initiated before the service start time or within a specified threshold time after the service start time, it is considered abnormal.

9. A device for identifying and handling abnormal network operations, the device being used to implement the method for identifying and handling abnormal network operations as described in any one of claims 1 to 8, characterized in that, The device includes an offline data processing module, a real-time data processing module, an intelligent handling module, and a large model interpretation module. The modules communicate with each other and work together to identify and handle abnormal network operations. The offline data processing module performs multi-dimensional analysis and mining of the website's historical log data, extracts the normal behavioral characteristics of the website's business, and forms the basic data of website behavior. The real-time data processing module communicates with the offline data processing module. Based on the website behavior data obtained from the offline data processing, it filters and performs multi-dimensional behavior detection on the website's real-time requests to determine whether there are any abnormal network operations in the current real-time requests. The intelligent handling module communicates with the real-time data processing module, receives the network abnormal operation identification results from the real-time data processing module, and for the identified network abnormal operation, first determines whether there is a configured protection action, and then executes protection according to the configured or preset gradient protection strategy. The large model interpretation module communicates with the offline data processing module and the intelligent handling module respectively. Based on the processing results of the offline data processing module, it intelligently summarizes and outputs the results by combining built-in prompts and templates, providing analysis results for operation and maintenance personnel.

10. A storage device, characterized in that, include: The system includes a memory and a processor, the processor comprising multiple cores, wherein the memory stores a computer program that, when executed by the processor, implements a method for identifying and handling abnormal network operations as described in any one of claims 1 to 8.

Images