AI and real person operation recognition method, firewall device, storage medium and program product

Abstract

This application provides a method for identifying AI and human operations, a firewall device, a storage medium, and a program product, relating to the field of computer technology. The firewall device utilizes multi-dimensional quantitative features to perform refined identification of AI and human operations. The entire process requires no front-end cooperation and can accurately distinguish between AI and human operations, effectively reducing the burden on the client and providing effective technical support for server resource protection and network access control.

Description

Technical Field

[0001] This application relates to the field of computer technology, and more specifically, to a method for recognizing AI and human operation, a firewall device, a storage medium, and a program product. Background Technology

[0002] Currently, the technologies that distinguish between AI (Artificial Intelligence) automated operations and human operations are mainly divided into two categories: one is based on front-end CAPTCHA solutions, and the other is based on front-end behavior collection solutions.

[0003] Front-end CAPTCHA-based solutions, such as image CAPTCHA, sliding CAPTCHA, and click CAPTCHA, embed CAPTCHA components in the client-side page, requiring users to complete specific interactive tasks (such as recognizing distorted characters, dragging a slider, clicking a specified object, etc.) to distinguish between humans and machines.

[0004] The front-end behavior acquisition solution collects user action data in real time by embedding JavaScript or SDKs in client-side web pages or applications. This data includes mouse movement trajectories, mouse click positions and precision, keyboard typing rhythm (such as key intervals and press duration), scrolling speed, and touchscreen gestures. The collected behavior data is uploaded to the server, where it is used to distinguish between AI and humans through pre-defined rule models (such as threshold judgments and simple classifiers) or machine learning models (such as random forests and support vector machines).

[0005] However, both of these approaches have significant drawbacks: CAPTCHAs are easily cracked by deep learning and cannot be adapted to API (Application Programming Interface) scenarios without a front-end interface; the front-end behavior collection scripts are exposed on the client side, making them easy to be bypassed by AI tools, and they also rely on client cooperation, making them unsuitable for pure interface requests, and increasing client resource consumption and deployment costs.

[0006] Therefore, these two types of solutions require additional deployment of front-end data collection servers and back-end analysis systems, making them unsuitable for network architectures without front-end support, increasing the burden on the client and resulting in low recognition accuracy. Summary of the Invention

[0007] The purpose of this application is to provide a method, firewall device, storage medium, and program product for recognizing AI and human operation, in order to improve the problems that existing solutions cannot be applied to network architectures without front-end cooperation, and that the client has a heavy burden and low recognition accuracy.

[0008] In a first aspect, embodiments of this application provide a method for recognizing AI and human operation, applied to a firewall device, the method comprising: Acquire the data packets exchanged between the client and the server, and extract relevant data packet information from the data packets. Based on the data packet information, quantitative features of the client's operation behavior under multiple identification dimensions are obtained. The multiple identification dimensions include at least two of the following: time sequence dimension, interaction sequence dimension, message payload dimension, and protocol behavior dimension. The time sequence dimension is used to reflect the temporal regularity of the client's operation behavior, the interaction sequence dimension is used to reflect the request path regularity of the client's operation behavior, the message payload dimension is used to reflect the regularity of the client's operation behavior in terms of data content, and the protocol behavior dimension is used to reflect the regularity of the client's operation behavior at the protocol interaction level. Based on the quantitative features under the multiple recognition dimensions, the type of the client operation behavior is identified, and the type includes AI operation or human operation.

[0009] In the above implementation process, the firewall device uses multi-dimensional quantitative features to perform fine-grained identification of AI operations and human operations. The entire process does not require front-end cooperation and can accurately distinguish between AI operations and human operations, effectively reducing the burden on the client and providing effective technical support for server resource protection and network access control.

[0010] Optionally, the multiple identification dimensions include a time-series dimension, the data packet related information includes a timestamp, and the step of obtaining the quantized features of the client's operation behavior under multiple identification dimensions based on the data packet related information includes: Based on the timestamp in the data packet information, the temporal quantization characteristics of the client's operation behavior under the temporal dimension are obtained. The temporal quantization characteristics include at least one of the following: mean request interval, variance of request interval, coefficient of variation of request interval, first response time interval, and continuous operation duration.

[0011] In the above implementation process, the time-series dimension can be used to achieve preliminary recognition of most AI operations, which has the advantages of simple calculation, high real-time performance, and no need to decrypt data packet content.

[0012] Optionally, the multiple recognition dimensions include an interaction sequence dimension, the data packet related information includes a request path, and obtaining the quantized features of the client's operation behavior under multiple recognition dimensions based on the data packet related information includes: Based on the request path in the data packet information, determine the request path sequence of the client in a single session; Based on the request path sequence, the interaction sequence quantification features of the client's operation behavior under the interaction sequence dimension are obtained. The interaction sequence quantification features include at least one of the following: sequence repetition, proportion of redundant requests, and fixed request order.

[0013] In the above implementation process, the interaction sequence dimension was used to accurately distinguish between AI and human operations. This dimension is suitable for identifying automated tools that execute according to fixed scripts, such as web crawlers, batch registration tools, and automated test scripts.

[0014] Optionally, the multiple identification dimensions include a message payload dimension, the data packet related information includes data packet size and request parameters, and the step of obtaining the quantitative features of the client's operation behavior under multiple identification dimensions based on the data packet related information includes: Based on the data packet size and the request parameters in the data packet information, the message payload quantization characteristics of the client's operation behavior under the message payload dimension are obtained. The message payload quantization characteristics include at least one of the following: mean data packet size, variance of data packet size, and randomness of request parameters.

[0015] In the above implementation process, the message payload dimension enables accurate differentiation between AI and human operations. This dimension is suitable for identifying automated tools that send fixed-size request packets and lack parameter randomness, such as course-brushing tools, batch registration tools, and simple web crawlers.

[0016] Optionally, the multiple identification dimensions include a protocol behavior dimension, and the data packet related information includes a User-Agent field and TCP connection information. The step of obtaining the quantitative features of the client's operational behavior across multiple identification dimensions based on the data packet related information includes: Based on the User-Agent field in the data packet information and the TCP connection information, the protocol behavior quantitative characteristics of the client's operation behavior under the protocol behavior dimension are obtained. The protocol behavior quantitative characteristics include at least one of the following: User-Agent credibility, number of concurrent connections, and response time fluctuation.

[0017] In the above implementation process, the precise distinction between AI and human operation was achieved based on the protocol behavior dimension. This dimension is suitable for identifying automated tools that use non-standard User-Agents, employ high-concurrency connections, and have highly stable request response times.

[0018] Optionally, identifying the type of client operation behavior based on the quantized features under the multiple identification dimensions includes: Based on the quantitative features under the multiple recognition dimensions, calculate the AI ​​confidence level that the client's operation behavior belongs to AI operation; The type of client operation behavior is determined based on the AI ​​confidence level.

[0019] In the above implementation process, multiple dimensions of quantitative features are integrated into an intuitive AI confidence index, and the operation type is automatically determined based on clear threshold rules, thereby achieving rapid type identification.

[0020] Optionally, calculating the AI ​​confidence score that the client's operation behavior belongs to AI operation based on the quantified features under the multiple recognition dimensions includes: The quantitative features of each dimension are compared with the corresponding AI threshold and real human threshold, and the single-dimensional score of each dimension is determined based on the comparison results. The individual scores of each dimension are weighted and summed according to preset rules to obtain the AI ​​confidence score.

[0021] In the above implementation process, by comparing the quantitative features of each dimension with preset thresholds and calculating the AI ​​confidence score by weighted summation, multi-dimensional information can be integrated to avoid the limitations of a single feature and improve the robustness and accuracy of recognition.

[0022] Optionally, determining the type of the client operation behavior based on the AI ​​confidence level includes: The quantified features of each dimension are combined into a feature vector, which is then input into the isolated forest anomaly detection model to obtain anomaly scores. The type of client operation behavior is determined based on the anomaly score and the AI ​​confidence level.

[0023] In the above implementation process, the isolation forest anomaly detection and AI confidence score complement each other, effectively overcoming the limitations of a single discrimination method. The AI ​​confidence score, based on domain knowledge and preset thresholds, has a good recognition effect on known types of AI operations; the isolation forest does not require labels, is sensitive to unknown anomalies, and can capture novel or mutated AI automated behaviors. The combination of the two improves the accuracy of recognition.

[0024] Optionally, determining the type of the client operation behavior based on the anomaly score and the AI ​​confidence level includes: When the abnormal score is greater than or equal to the first preset threshold and the AI ​​confidence is greater than or equal to the second preset threshold, the type of the client operation behavior is determined to be an AI operation. When the abnormal score is less than or equal to the third preset threshold and the AI ​​confidence is less than or equal to the fourth preset threshold, the type of the client operation behavior is determined to be a real person operation. When neither the anomaly score nor the AI ​​confidence level meets the above conditions, the type of the client operation behavior is determined to be a suspected AI operation.

[0025] In the above implementation process, the firewall device uses a joint threshold determination of anomaly score and AI confidence level to achieve a clear and rule-based classification of client operation behavior types.

[0026] Optionally, the type also includes suspected AI operation. After determining that the type of the client operation behavior is a suspected AI operation, it further includes: The client's request path sequence is matched with a preset AI operation sequence template to obtain the sequence similarity. When the sequence similarity is greater than or equal to the first preset similarity threshold, the type of the client operation behavior is redefined as an AI operation; When the sequence similarity is less than or equal to the second preset similarity threshold, the type of the client operation behavior is redefined as a real person operation.

[0027] In the above implementation process, the firewall device uses similarity matching of request path sequences to perform secondary refined discrimination of suspected samples. This mechanism leverages the high degree of fixity in the sequence patterns of AI operations, effectively upgrading suspected samples with obvious script behavior characteristics to AI operations, while downgrading suspected samples with natural randomness to human operations. This reduces the false positive rate in ambiguous areas and improves the accuracy of the overall identification system.

[0028] Optionally, after identifying the type of the client operation behavior, the method further includes: If the type of the client operation is an AI operation, then at least one of the following operations is performed on the client: rate limiting, blocking, and alarm. If the client's operation is a real-person operation, then the client is allowed to access the service normally.

[0029] In the above implementation process, by using differentiated access control strategies, while ensuring the normal access experience of real users, the excessive consumption of server resources by AI operations is effectively suppressed, thus achieving precise and efficient network access control.

[0030] Secondly, embodiments of this application provide a firewall device, including a processor and a memory, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the steps of the method provided in the first aspect above are performed.

[0031] Thirdly, embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the steps of the method provided in the first aspect above.

[0032] Fourthly, embodiments of this application provide a computer program product, including computer program instructions, which, when read and executed by a processor, perform the steps of the method provided in the first aspect above.

[0033] Other features and advantages of this application will be set forth in the following description and will be apparent in part from the description or may be learned by practicing embodiments of this application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0034] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0035] Figure 1 A flowchart illustrating a method for recognizing AI and human operation as provided in an embodiment of this application; Figure 2 A structural block diagram of an AI and human operation recognition device provided in an embodiment of this application; Figure 3 This is a schematic diagram of the structure of a firewall device for performing a recognition method for AI and human operations, provided as an embodiment of this application. Detailed Implementation

[0036] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.

[0037] It should be noted that the terms "system" and "network" in the embodiments of this invention can be used interchangeably. "Multiple" refers to two or more; therefore, in the embodiments of this invention, "multiple" can also be understood as "at least two". "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / ", unless otherwise specified, generally indicates that the preceding and following related objects have an "or" relationship.

[0038] It should also be noted that all actions involving the acquisition of signals, information, or data in this application are carried out in compliance with the relevant data protection laws and policies of the country where the application is located, and with the authorization granted by the owner of the relevant device.

[0039] This application provides a method for identifying AI and human operations. This method is applied to firewall devices. The firewall devices use multi-dimensional quantitative features to perform refined identification of AI operations and human operations. The entire process does not require front-end cooperation and can accurately distinguish between AI operations and human operations, effectively reducing the burden on the client and providing effective technical support for server resource protection and network access control.

[0040] Please refer to Figure 1 , Figure 1 A flowchart illustrating a method for recognizing AI and human operation as provided in this application embodiment. This method is applied to a firewall device and includes the following steps: Step S110: Obtain the interaction data packets between the client and the server, and extract relevant data packet information from the interaction data packets.

[0041] The firewall device in this solution can be deployed at the network boundary, located on the communication link between the client and the server. The firewall device's packet capture module can capture all interactive data packets passing through the firewall device in either bypass or mirror mode, avoiding delays to normal network transmission.

[0042] For each captured data packet, the firewall device can extract relevant packet information for subsequent analysis. This packet information refers to information directly extracted from the network layer header, transport layer header, TLS (Transport Layer Security) handshake protocol fields, and TCP (Transmission Control Protocol) stream state. This includes, but is not limited to: the packet's timestamp (accurate to milliseconds), source IP address, destination IP address, request method (e.g., GET, POST), request path (e.g., URL (Uniform Resource Locator)), packet size (in bytes), response time, User-Agent field, SNI (Server Name Indication) field, and ALPN (Application Layer Protocol Negotiation) field. Extracting this packet information does not involve decrypting the packet payload, thus not infringing on user privacy and requiring no access to the server's private key. During the collection process, the firewall device simultaneously filters invalid data packets, such as TCP retransmission packets, empty packets, and ACK confirmation packets, retaining only valid data packets carrying actual business requests to reduce the amount of data processed later.

[0043] Step S120: Based on data packet information, obtain the quantitative features of the client's operation behavior under multiple recognition dimensions.

[0044] Firewall devices can treat multiple consecutive requests from the same client (uniquely identified by the source IP address, and further subdivided by the User-Agent field if necessary) as a group of analysis samples. Based on the packet information extracted in step S110, the feature extraction module of the firewall device obtains the quantitative features of the client's operation behavior under multiple identification dimensions. These multiple identification dimensions include at least two of the following: time sequence dimension, interaction sequence dimension, packet payload dimension, and protocol behavior dimension, which can be selected according to the application scenario.

[0045] The temporal dimension is used to reflect the temporal regularity of client operations. Firewall devices can obtain the quantitative characteristics of client operations in the temporal dimension based on packet-related information.

[0046] The interaction sequence dimension is used to reflect the regularity of request paths in client operations. Firewall devices can obtain quantitative characteristics of client operations in the interaction sequence dimension based on packet-related information.

[0047] The packet payload dimension reflects the regularity of client operations in the data content. Firewall devices can obtain quantitative characteristics of client operations in the packet payload dimension based on packet information.

[0048] Protocol behavior dimension reflects the regularity of client operations at the protocol interaction layer. Firewall devices can obtain quantitative characteristics of client operations at the protocol behavior dimension based on packet-related information.

[0049] Step S130: Identify the type of client operation behavior based on the quantitative features under multiple identification dimensions.

[0050] The types can include AI operations or human operations, and can also include suspected AI operations.

[0051] During the identification process, the firewall device can input the acquired quantitative features from multiple identification dimensions into the fusion discrimination module. This module uses a fusion algorithm to calculate a comprehensive score, which serves as the AI ​​confidence score. Ultimately, it determines whether the client's actions are AI-driven, human-driven, or suspected AI-driven. This fusion discrimination module can be a neural network model. These quantitative features are input into the neural network model, which then outputs the final AI confidence score based on each quantitative feature.

[0052] The AI ​​confidence score ranges from 0 to 1, with values ​​closer to 1 indicating a higher likelihood of AI intervention. For example, if the AI ​​confidence score is greater than a set threshold, it can be identified as AI intervention; otherwise, it is identified as human intervention. Alternatively, two thresholds can be set: if the AI ​​confidence score is greater than the first threshold, it can be identified as AI intervention; if the AI ​​confidence score is between the first and second thresholds, it is identified as suspected AI intervention; otherwise, it is identified as human intervention.

[0053] In some implementations, to avoid false positives, a sliding window calibration mechanism can be introduced to reduce the impact of a single false positive. This mechanism obtains the identification result for each sliding window based on the data packet information of each request's interaction data packet within that window, and then combines these results to determine the final identification result. For example, a firewall device might use 10 consecutive requests as a sliding window and count the judgment results of three consecutive sliding windows. If at least two of the three consecutive windows are identified as AI operations, the final output client operation is considered an AI operation; if at least two of the three consecutive windows are identified as human operations, the final output client operation is considered a human operation; otherwise, observation continues. Of course, for identification results suspected of being AI operations, a sliding window calibration mechanism can be introduced for further judgment.

[0054] In the above embodiments, the firewall device uses multi-dimensional quantitative features to perform fine-grained identification of AI operations and human operations. The entire process does not require front-end cooperation and can accurately distinguish between AI operations and human operations, effectively reducing the burden on the client and providing effective technical support for server resource protection and network access control.

[0055] In some implementations, after identifying the type of client operation behavior, the firewall device's control module can also execute the corresponding access control policy. If the client operation behavior is an AI operation, at least one of the following operations—rate limiting, blocking, and alarming—is performed on the client. If the client operation behavior is a real-person operation, the client is allowed normal access. Of course, if the client operation behavior is suspected to be an AI operation, mild rate limiting or continuous monitoring can be implemented.

[0056] When the identification result is AI operation, it indicates that the current client's operation behavior conforms to the characteristics of AI operations. Such operations typically exhibit characteristics such as high-frequency requests, fixed sequences, and low randomness, which may excessively consume server resources or indicate malicious intent. The control module, based on preset handling strategies, executes at least one of the following operations: rate limiting, blocking, and alarm. Rate limiting refers to restricting the request rate of clients, reducing their access frequency to an acceptable range, thereby reducing the consumption of server resources. Specific implementation methods for rate limiting include, but are not limited to, token bucket algorithms, leaky bucket algorithms, or fixed window counter algorithms. For example, the control module can be configured with a rate limiting rule of "allowing a maximum of 5 requests per second." When the client request rate exceeds this threshold, the excess requests will be delayed or dropped. Rate limiting is more gentle than complete blocking, limiting the resource consumption of AI operations while avoiding excessive impact on normal users in case of misjudgments.

[0057] Blocking refers to directly denying a client's access request, preventing further communication between the client and the server. Specific implementation methods for blocking include: adding the client's source IP address to the firewall's ACL (Access Control List) to blacklist it; or dropping all packets from the client and returning a denial response to the client. Blocking is suitable for AI operations where malicious behavior is confirmed, such as brute-force login attempts or large-scale data scraping.

[0058] An alert action refers to sending a notification to the network administrator or security operations center, indicating that AI-related behavior has been detected. Specific implementation methods for alert actions include: generating system logs (Syslog), sending emails, pushing instant messages (such as email, chat software, etc.), or centralized display through a security information and event management system. Alert information typically includes key information such as the client's source IP address, identification results, quantitative feature values ​​for various dimensions, AI confidence level, and the time of occurrence, facilitating manual review and subsequent handling by administrators.

[0059] When the identification result indicates a real user operation, it means that the current client's behavior conforms to the characteristics of a real user, such as natural fluctuations in request intervals, redundant behavior in the operation sequence, and protocol behavior conforming to browser specifications. The control module implements a normal access policy for such clients, that is, it does not restrict or interfere with their requests in any way, ensuring that real users have a complete and smooth access experience.

[0060] It's important to note that normal access doesn't mean there's absolutely no monitoring; rather, it means that restrictive operations such as rate limiting and blocking are not implemented. The firewall device can still continuously monitor and identify subsequent requests from the client, allowing for timely adjustments to policies as the client's behavior changes.

[0061] When the identification result is suspected AI operation, it indicates that the current client's behavior characteristics fall between AI operation and human operation, and its type cannot be clearly determined. This situation may occur in the following scenarios: the client's behavior partially matches AI characteristics but partially matches human characteristics; the client's sample size is insufficient, resulting in low statistical confidence; or the client's behavior is in the border area between AI and human thresholds.

[0062] The control module can implement mild rate limiting or continuous monitoring strategies for suspected AI operations: Light rate limiting refers to imposing more lenient rate restrictions on clients. Compared to rate limiting thresholds for AI operations, it is more lenient, aiming to neither excessively impact potential real users nor prevent potential AI operations. For example, a rate limiting threshold of 5 times per second can be applied to AI operations, while a rate limiting threshold of 20 times per second can be set for suspected AI operations, limiting only clearly abnormal bursts of traffic.

[0063] Continuous observation refers to temporarily suspending any restrictive operations but marking the client as an observation target, extending the monitoring period to collect more behavioral data, such as the sliding window calibration mechanism mentioned above. The firewall device continues to analyze subsequent requests from the client. As the sample size increases, the statistical characteristics of its operational behavior will become more stable, and the confidence level of the identification results will also improve. Once sufficient samples have been collected, the firewall device re-evaluates the situation. If subsequent behavior is more consistent with AI characteristics, it is upgraded to AI operation and the corresponding policy is executed; if it is more consistent with human characteristics, it is downgraded to human operation and the observation status is lifted.

[0064] Through the aforementioned differentiated access control strategies, while ensuring a normal access experience for real users, the excessive consumption of server resources by AI operations is effectively suppressed, achieving precise and efficient network access control. Furthermore, the combined application of multiple strategies such as rate limiting, blocking, and alerting provides network administrators with flexible handling methods, which can be configured according to actual business scenarios and security requirements. The prudent handling mechanism for suspected AI operations effectively reduces the impact of false positives on normal users, improving the system's usability and user experience.

[0065] The following section explains the process of obtaining quantized features across several dimensions.

[0066] (1) If multiple identification dimensions include the time sequence dimension and data packet related information includes timestamps, then when obtaining the quantitative features on this dimension, the client's operation behavior in the time sequence dimension can be obtained based on the timestamps in the data packet related information. The time sequence quantitative features include at least one of the following: mean of request interval, variance of request interval, coefficient of variation of request interval, first response time interval, and continuous operation duration.

[0067] In the time-series dimension, accurate differentiation between AI operations and human operations can be achieved by analyzing the time interval patterns of client requests. During the packet capture phase, the firewall device captures the interaction packets between the client and the server and extracts timestamp information from each packet. The timestamps, accurate to the millisecond, record the time the packet arrived at the firewall device, reflecting the point in time when the client initiated a request or the server returned a response.

[0068] The firewall device analyzes the same client as a whole. Each client is uniquely identified by its source IP address. If necessary, the User-Agent field or TLS fingerprint can be used for further segmentation to distinguish different clients behind the same IP. For each client, the firewall device records its consecutively sent request packets in chronological order and calculates the time difference between two adjacent requests, defined as the request interval T. The formula for calculating the request interval is: T = ... i =t i -t i-1, where t i Let t be the timestamp of the i-th request. i-1 Let i be the timestamp of the (i-1)th request, where i ≥ 2. The request interval reflects the waiting time between two client operations.

[0069] For example, a client sends 5 consecutive requests with timestamps of t1=1000ms, t2=1150ms, t3=1300ms, t4=1450ms, and t5=1600ms. The request intervals are then T1=150ms(t2-t1), T2=150ms(t3-t2), T3=150ms(t4-t3), and T4=150ms(t5-t4). This set of request intervals exhibits a completely constant 150ms interval.

[0070] Another client sends five consecutive requests with timestamps of t1=1000ms, t2=1350ms, t3=1800ms, t4=2200ms, and t5=2700ms. The request intervals are T1=350ms, T2=450ms, T3=400ms, and T4=500ms. These request intervals show significant fluctuations and no fixed pattern.

[0071] After calculating the request interval sequence of multiple consecutive requests, the firewall device further calculates various time-series quantization features based on these request intervals to comprehensively characterize the temporal regularity of client operations. The time-series quantization features include at least one of the following: 1) Average request interval (μ): This refers to the average request interval of N consecutive requests from the same client. The calculation formula is: μ=(T1+T2+…+T N-1 ) / (N-1), where N is the number of requests (N≥5), T i Let be the request interval between the i-th request and the (i+1)-th request. The average request interval reflects the average pace of client operations. The average request interval for AI operations is usually small (e.g., 10ms to 200ms) or shows a fixed interval value (e.g., exactly 1000ms), while the average request interval for human operations is usually between 300ms and 5000ms. Taking the first client as an example, the average request interval is: (150+150+150+150) / 4=150ms; the average request interval for the second client is: (350+450+400+500) / 4=425ms.

[0072] 2) Request interval variance (σ²): This refers to the degree of fluctuation in the request interval. The calculation formula is: σ² = Σ(T) i-μ)² / (N-2), where N≥5. The request interval variance reflects the dispersion of the request interval; the smaller the variance, the more stable the time interval. The request interval variance for AI operations is typically extremely small (e.g., ≤100ms²) because the script sends requests at fixed time intervals; while the request interval variance for human operations is larger (e.g., ≥1000ms²) because human operations are affected by factors such as reaction time, thinking time, and external interference, resulting in natural fluctuations in the interval. Taking the first client as an example, the request interval variance is 0; the second client's request interval variance is 6250ms².

[0073] 3) Request interval coefficient of variation (CV): This is the ratio of the standard deviation of the request interval to the mean. The formula is: CV = σ / μ, where σ is the standard deviation of the request interval (…). The coefficient of variation (CV) eliminates the influence of the mean on the degree of fluctuation, and can more accurately reflect the relative stability of the time interval. The smaller the CV, the more stable the time interval. The CV of AI operations is usually ≤0.05, while the CV of human operations is usually ≥0.2. Taking the first client mentioned above as an example, CV=0; the CV of the second client is ≈0.186.

[0074] 4) First Response Time Interval T_first_response: This refers to the time difference between the client sending its first request and receiving the server's first response. The formula is: T_first_response = t_response - t_request, where t_request is the timestamp of the first request and t_response is the timestamp of the corresponding response. The first response time interval reflects the server's initial response speed to the client's request. AI operations are usually initiated by automated scripts, and their first response time intervals are often extremely short (e.g., 10ms to 200ms), far exceeding the limits of human reaction. In contrast, the first response time interval for human operations is affected by network latency and server processing time, typically ranging from 200ms to 3000ms.

[0075] 5) Continuous Operation Duration T_total: This refers to the total duration of multiple consecutive requests from the same client. The calculation formula is: T_total = t_last - t_first, where t_first is the timestamp of the first request and t_last is the timestamp of the last request. Continuous operation duration reflects the continuity of client operations. AI operations can send requests continuously for several hours without any natural pauses; while human operations usually have intermittent pauses, and the continuous operation duration is limited, affected by user physiological limitations and attention cycles.

[0076] After obtaining the aforementioned time-series quantization features, the type of client operation behavior can be directly determined based on these features. For example, the time-series quantization features can be compared with preset AI operation thresholds and human operation thresholds, and the type of client operation behavior can be determined based on the comparison result.

[0077] Taking the average request interval μ as an example, the firewall device's preset AI operation threshold is 100ms ≤ μ ≤ 200ms or μ is a fixed value (such as 1000ms ± 10ms), while the human operation threshold is 300ms ≤ μ ≤ 5000ms. If a client's μ = 150ms, it meets the AI ​​operation threshold; if μ = 2000ms but the coefficient of variation is extremely small (such as CV = 0.02), it may still be judged as an AI operation (such as a scheduled script); if μ = 425ms and the coefficient of variation is large, it is judged as a human operation.

[0078] Taking the request interval variance σ² as an example, the firewall device's preset AI operation threshold is σ²≤100ms. 2 The threshold for real-person operation is σ²≥1000ms 2 If a client's σ² = 80ms 2 If the timing characteristics meet the AI ​​operation threshold, the firewall device determines that the operation is an AI operation; if σ² = 2000ms 2 If the value meets the threshold for real-person operation, it is determined to be a real-person operation; if σ² = 800ms 2 If it falls within the suspected range, it is judged as a suspected AI operation, and a comprehensive judgment needs to be made in combination with other dimensions.

[0079] Taking the coefficient of variation (CV) of request intervals as an example, the firewall device presets the threshold for AI operations to be CV ≤ 0.05 and the threshold for human operations to be CV ≥ 0.2. If a client's CV = 0.03, it meets the AI ​​operation threshold, and the firewall device determines that its timing characteristics indicate an AI operation; if CV = 0.25, it meets the human operation threshold and is determined to be a human operation; if CV = 0.12, it is in the suspected range and is determined to be a suspected AI operation, requiring a comprehensive judgment based on other dimensions.

[0080] Taking the first response time interval as an example, the firewall device presets the AI ​​operation threshold to [10ms, 200ms] and the human operation threshold to [200ms, 3000ms]. If a client's first response time interval is 120ms, the firewall device determines that this characteristic matches the AI ​​operation characteristic, because the human perception cycle from initiating a request to receiving a response is usually more than 200ms.

[0081] Taking continuous operation duration as an example, firewall devices are preset to allow AI operations to continue for hours or even days without natural interruptions, while human operations typically show noticeable pauses or rest intervals within one hour. If a client's continuous operation duration exceeds two hours and the request interval remains stable, the firewall device will determine it to be an AI operation.

[0082] Understandably, the aforementioned time-series quantization features can be combined for judgment. When making a combined judgment, it is determined whether each time-series quantization feature meets the corresponding AI judgment condition or real person judgment condition, and then the final recognition result is determined accordingly.

[0083] The aforementioned approach, based on the time-series dimension, can achieve preliminary recognition of most AI operations, offering advantages such as simple computation, high real-time performance, and no need to decrypt data packet content. In practical applications, the time-series dimension can be integrated with other dimensions (interaction sequence dimension, message payload dimension, protocol behavior dimension) to further improve recognition accuracy.

[0084] (2) Multiple identification dimensions include the interaction sequence dimension, and data packet related information includes the request path. When obtaining the quantitative features on this dimension, the request path sequence of the client in a session is determined according to the request path in the data packet related information. Then, based on the request path sequence, the interaction sequence quantitative features of the client's operation behavior under the interaction sequence dimension are obtained. The interaction sequence quantitative features include at least one of the following: sequence repetition, redundant request ratio and request order fixedness.

[0085] This method accurately distinguishes between AI and human operations by analyzing the request path sequence characteristics of a client within a single session. The interaction sequence dimension reflects the path pattern characteristics of the operation behavior. AI operations typically execute according to a preset, fixed script sequence, with a highly fixed request sequence and a lack of redundant behavior; while human operations are exploratory and random, with a large number of redundant behaviors such as backtracking, refreshing, and repeated clicks in the operation sequence, and significant differences in operation paths between different sessions. This dimension is calculated based on the request path information in the data packet, without the need to decrypt the data packet content.

[0086] During the packet capture phase, the firewall device captures the data packets exchanged between the client and the server, and extracts the request path field from each request packet. The request path refers to the part of the URL after the domain name, used to identify the specific resource requested by the client, such as " / login", " / dashboard", " / api / user / info", etc. For HTTPS encrypted traffic, although the request path is encrypted during transmission, the firewall device can obtain the domain name information through the Server Name Indication (SNI) field in the TLS handshake phase, or obtain the plaintext request path by deploying SSL decryption functionality (if authorized).

[0087] Firewall devices use the establishment and termination of a TCP connection as a session boundary, collecting all request paths initiated by the same client in a single session in chronological order to form a request path sequence. The session begins when the TCP three-way handshake is completed and ends when the TCP four-way handshake is completed or the connection times out. For example, if a client accesses the homepage, login page, dashboard, and settings page in sequence during a session, its request path sequence would be [" / index.html", " / login", " / dashboard", " / settings"].

[0088] Firewall devices can also normalize request paths, removing dynamic parameters (such as user IDs and timestamps) and retaining only the static parts of the path to eliminate the impact of dynamic parameters on sequence similarity calculations. For example, " / user / 12345 / profile" is normalized to " / user / {id} / profile".

[0089] After determining the request path sequence, the firewall device further calculates various interaction sequence quantization features based on this sequence to comprehensively characterize the path pattern of client operation behavior. The interaction sequence quantization features include at least one of the following: 1) Sequence Repetition (R): This refers to the similarity of request path sequences between different sessions of the same client. Firewall devices compare the request path sequences of any two sessions and calculate their edit distance (Levenshtein distance). Edit distance is the minimum number of single-step operations required to transform one sequence into another. Single-step operations include inserting, deleting, or replacing an element. The smaller the edit distance, the more similar the two sequences are. The formula for calculating sequence repetition is: R = 1 - D / L_max, where D is the edit distance between the two sequences, and L_max is the number of requests for the longer sequence. The value of sequence repetition ranges from 0 to 1, with values ​​closer to 1 indicating greater similarity.

[0090] AI operations exhibit highly fixed request sequences, with request path sequences across different sessions being almost identical, and the sequence repetition rate typically R ≥ 0.9. In contrast, human operations involve randomness and diversity in the operation paths across different sessions, with the sequence repetition rate typically R ≤ 0.6.

[0091] 2) Redundant Request Ratio (R1): This refers to the proportion of redundant requests to the total number of requests in a single session for the same client. Redundant requests are requests that are not necessary in the normal operation process and are generated by the user's exploratory behavior, including but not limited to: refresh requests (such as refreshing the current page), back requests (such as returning to the previous page), duplicate requests (such as repeatedly clicking the same link within a short period of time), and invalid requests (such as clicking a non-existent link). The formula for calculating the redundant request ratio is: R1 = N_redundant / N_total, where N_redundant is the number of redundant requests and N_total is the total number of requests in the session.

[0092] AI operations generally follow a strict pre-set script, generating almost no redundant requests; the proportion of redundant requests is typically R1 ≤ 0.01. In contrast, human operations involve users refreshing the page for the latest content, going back to reselect options, or accidentally clicking a link and immediately returning. These actions generate redundant requests, with the proportion typically between 0.05 and 0.3.

[0093] 3) Request Order Consistency (F): This refers to the degree to which the order of request paths remains consistent across multiple sessions of the same client. The firewall device counts the request path sequences of the client over N consecutive sessions (N≥5), and for each group of function-related requests (such as requests corresponding to a group of navigation buttons), checks whether their order of appearance is consistent. The formula for calculating request order consistency is: F = N_same_order / N_total_session, where N_same_order is the number of sessions with consistent request order, and N_total_session is the total number of sessions.

[0094] AI operations execute according to a pre-set script, and the order of function requests within each session is highly fixed, typically with a request order fixity of F ≥ 0.95. For example, when an AI tool accesses a website, it always executes the request in the order of "click button A -> click button B -> click button C," and all sessions follow this order, resulting in a request order fixity of 1.0. In contrast, in human operations, the order of actions performed by the user during each access is random; sometimes button A is clicked before button B, and sometimes button C is clicked before button A, resulting in a request order fixity of F ≤ 0.5.

[0095] After obtaining the aforementioned quantitative features of the interaction sequence, the type of client operation behavior can be directly determined based on these features. For example, the calculated quantitative features of the interaction sequence can be compared with preset AI operation thresholds and human operation thresholds, and the type of client operation behavior can be determined based on the comparison results.

[0096] Taking sequence repetition R as an example, the firewall device presets the AI ​​operation threshold as R≥0.9 and the human operation threshold as R≤0.6. If a client's request path sequence is highly consistent across different sessions, with a sequence repetition R=0.95, it meets the AI ​​operation threshold, and the firewall device determines that its interaction sequence characteristics represent an AI operation. If the sequence repetition R=0.45, it meets the human operation threshold and is determined to be a human operation. If the sequence repetition R=0.75, it is in the suspected range and is determined to be a suspected AI operation, requiring a comprehensive judgment based on other dimensions.

[0097] Taking the proportion of redundant requests R1 as an example, the firewall device has a preset AI operation threshold of R1≤0.01 and a human operation threshold of 0.05≤R1≤0.3. If a client does not perform any redundant operations such as refreshing or rolling back in a session, R1=0, which meets the AI ​​operation threshold; if a client exhibits obvious exploratory behavior in a session, R1=0.15, which meets the human operation threshold; if R1=0.03, it falls within the suspected range and requires further analysis.

[0098] Taking the request order consistency F as an example, the firewall device presets the AI ​​operation threshold as F≥0.95 and the human operation threshold as F≤0.5. If a client has 9 out of 10 consecutive sessions with the request order completely identical, F=0.9. Although slightly lower than 0.95, it is still within the suspected range. The firewall device can make a comprehensive judgment based on other characteristics.

[0099] Understandably, the quantitative features of the above-mentioned interaction sequences can be combined for judgment. When making a combined judgment, it is determined whether each quantitative feature of the interaction sequence meets the corresponding AI judgment condition or real person judgment condition, and then the final recognition result is determined accordingly.

[0100] The above-mentioned interaction sequence dimension enables accurate differentiation between AI and human operations. This dimension is suitable for identifying automated tools that execute according to fixed scripts, such as web crawlers, batch registration tools, and automated test scripts. In practical applications, the interaction sequence dimension can be fused with the timing dimension, message payload dimension, and / or protocol behavior dimension to further improve the recognition accuracy.

[0101] (3) Multiple identification dimensions include message payload dimension. Data packet related information includes data packet size and request parameters. When obtaining the quantization features on this dimension, the message payload quantization features of the client's operation behavior under the message payload dimension are obtained based on the data packet size and request parameters in the data packet related information. The message payload quantization features include at least one of the following: mean data packet size, variance of data packet size, and randomness of request parameters.

[0102] This method accurately distinguishes between AI operations and human operations by analyzing the size distribution characteristics of data packets and the randomness of request parameters. The message payload dimension reflects the structural stability characteristics of the data packet content. AI operations typically send data packets with a fixed structure and consistent size, and the request parameters lack natural randomness. In contrast, human operations exhibit natural fluctuations in data packet size due to differences in user input, the influence of browser plugins, and network fluctuations, and the request parameters contain unpredictable random characters. This dimension is calculated based on the data packet size and request parameters. The data packet size can be directly obtained from the IP header without decryption; request parameters can be directly obtained in HTTP plaintext scenarios, but in HTTPS encrypted scenarios, they need to be obtained through SSL decryption (with authorization).

[0103] During the packet capture phase, the firewall device captures the data packets exchanged between the client and the server. For each packet, the firewall device directly reads the packet size field from the IP header. This field indicates the length of the entire IP packet (in bytes), including the IP header, transport layer header, and application layer payload. Extracting the packet size does not involve any decryption operations, therefore it is applicable to all types of network traffic.

[0104] To extract request parameter information, the firewall device parses the HTTP request data packet and extracts parameter information from the request line and request body. In HTTP plaintext scenarios, the firewall device can directly parse query parameters (such as "?user=alice×tamp=1640995200") from the request path and parse form parameters or JSON parameters from the request body. In HTTPS encrypted scenarios, if the firewall device has deployed SSL decryption functionality, it can obtain the decrypted plaintext HTTP request and then extract the parameter information.

[0105] The firewall device preprocesses the extracted parameter information, classifying the parameter values ​​into two categories: static values ​​and dynamic values. Static values ​​are parameter values ​​that remain unchanged, such as the username field "alice"; dynamic values ​​are parameter values ​​that change with each request, such as the timestamp "1640995200", the random number "a3f2c9", and the session ID.

[0106] After extracting the packet size and request parameters, the firewall device further calculates various packet payload quantization features based on this information to comprehensively characterize the data content stability of client operation behavior. Packet payload quantization features include at least one of the following: 1) Average packet size (μ_s): This refers to the average packet size of N consecutive requests from the same client. The calculation formula is: μ_s = (S1 + S2 + ... + S...) N ) / N, where S iLet N be the data packet size (in bytes) of the i-th request, and N be the number of requests (N≥5). The average data packet size reflects the average load of client requests. The average data packet size may differ for different operation types, but this metric itself has limited discriminative power and is usually used in conjunction with other metrics.

[0107] 2) Data packet size variance (σ_s²): This refers to the degree of fluctuation in data packet size. The calculation formula is: σ_s²=Σ(S i -μ_s)² / (N-1). The variance of packet size reflects the stability of client request load; the smaller the variance, the more consistent the packet size. AI operations typically send requests with a fixed structure, resulting in highly consistent packet sizes and minimal variance (e.g., σ_s²≤20byte²). For example, an AI crawler program might send request packets of 1200 bytes each time, with a variance of 0. In contrast, human operations, due to factors such as accessing different pages, uploading different content, and loading different resources in the browser, result in natural fluctuations in packet size and a larger variance (e.g., σ_s²≥100byte²). For instance, when a user accesses a webpage, sometimes they request an HTML page (approximately 5000 bytes), sometimes an image (approximately 20000 bytes), and sometimes a CSS file (approximately 1000 bytes), resulting in a significantly larger variance in packet size.

[0108] 3) Request Parameter Randomness (R_p): This refers to the proportion of random characters in the request parameters out of all parameter characters. Random characters are unpredictable character content that changes with each request, including but not limited to: timestamps (e.g., "1640995200"), random numbers (e.g., "3847a9f2"), UUIDs (e.g., "550e8400-e29b-41d4-a716-446655440000"), temporary tokens, session IDs, etc. The formula for calculating request parameter randomness is: R_p = L_random / L_total, where L_random is the number of random characters in the parameter value (unit: number of characters), and L_total is the total number of all parameter values ​​(unit: number of characters).

[0109] The request parameters for AI operations are often fixed, or although they contain random characters, the generation pattern of these random characters is predictable (such as simple incrementing numbers), and the randomness of the parameters is usually R_p ≤ 0.05. For example, the request parameters of an automated login script are "username=admin&password=123456×tamp=1640995200", where the timestamp field is updated with each request, but this field accounts for a relatively small proportion of the total parameter length (if the total parameter length is 50 characters and the timestamp occupies 10 characters, then R_p = 0.2), and the timestamp in AI scripts is often a fixed-format timestamp rather than a truly random value. Therefore, by further analyzing the entropy value of the random characters, the difference between AI operations and human operations can be identified.

[0110] In requests made by real users, random characters constituted a significant portion of the parameters and were randomly distributed, with the randomness R_p typically ranging from 0.1 to 0.5. Furthermore, changes in request parameters during real-user interactions were often generated naturally by user behavior and were difficult to predict.

[0111] After obtaining the aforementioned message payload quantization characteristics, the type of client operation behavior can be directly determined based on these characteristics. For example, the calculated message payload quantization characteristics can be compared with preset AI operation thresholds and human operation thresholds, and the type of client operation behavior can be determined based on the comparison results.

[0112] Taking the packet size variance σ_s² as an example, the firewall device presets the AI ​​operation threshold as σ_s² ≤ 20 bytes², and the human operation threshold as σ_s² ≥ 100 bytes². For example, if the packet sizes of 10 consecutive requests from a client are 1200 bytes, 1200 bytes, 1201 bytes, 1200 bytes, and 1199 bytes respectively, the packet size variance σ_s² ≈ 0.5 bytes², which meets the AI ​​operation threshold, and the firewall device determines that its packet payload characteristics represent an AI operation; if the packet sizes are 5000 bytes, 12000 bytes, 3000 bytes, 8000 bytes, and 15000 bytes respectively, the variance σ_s² ≈ 20,000,000 bytes², which meets the human operation threshold, it is determined to be a human operation; if σ_s² = 50 bytes², it is in the suspected range, and is determined to be a suspected AI operation, requiring a comprehensive judgment based on other dimensions.

[0113] Taking the randomness of request parameters R_p as an example, the firewall device's preset threshold for AI operations is R_p ≤ 0.05, and the threshold for human operations is 0.1 ≤ R_p ≤ 0.5. For example, if a client's parameters are exactly the same in every request, R_p = 0, which meets the AI ​​operation threshold; if a client carries a random 32-bit token in every request, and the user input changes randomly, R_p ≈ 0.4, which meets the human operation threshold; if R_p = 0.08, it is in the suspected range and further analysis is required.

[0114] Understandably, the above-mentioned message payload quantization features can be combined for judgment. When combining them for judgment, it is determined whether each message payload quantization feature meets the corresponding AI judgment condition or human judgment condition, and then the final recognition result is determined accordingly.

[0115] The above method achieves accurate differentiation between AI and human operations based on the message payload dimension. This dimension is suitable for identifying automated tools that send fixed-size request packets and lack parameter randomness, such as course-brushing tools, batch registration tools, and simple web crawlers. In practical applications, the message payload dimension can be used as a supplementary criterion, fused with the time sequence dimension, interaction sequence dimension, and protocol behavior dimension to further improve the recognition accuracy.

[0116] (4) Multiple identification dimensions include protocol behavior dimension. Data packet related information includes User-Agent field and TCP connection information. When obtaining the quantitative features in this dimension, the protocol behavior quantitative features of the client's operation behavior in the protocol behavior dimension are obtained according to the User-Agent field in the data packet related information and the TCP connection information. The protocol behavior quantitative features include at least one of the following: User-Agent credibility, number of concurrent connections, and response time fluctuation.

[0117] This method accurately distinguishes between AI operations and human operations by analyzing the client's User-Agent field specifications and concurrent connection characteristics. The protocol behavior dimension reflects the client's behavioral characteristics at the protocol interaction level. AI operations typically use non-standard User-Agent identifiers and employ high-concurrency connection strategies to improve efficiency; server response time fluctuates less due to the strong regularity of requests. Human operations, on the other hand, are usually performed through mainstream browsers, with standardized User-Agent fields, lower concurrent connection counts, and response time naturally fluctuating due to network conditions and user behavior. This dimension is calculated based on the User-Agent field and TCP connection information in the data packets. The User-Agent field can be directly obtained in HTTP plaintext scenarios, but requires SSL decryption (with authorization) in HTTPS encrypted scenarios. TCP connection information can be directly statistically analyzed by tracking TCP connection status without decryption.

[0118] To extract TCP connection information, firewall devices maintain a connection state table for each client by tracking the TCP header information of each data packet. The firewall device uses a five-tuple (source IP, source port, destination IP, destination port, protocol type) as a unique identifier for a TCP connection. When a SYN packet is captured, the firewall device creates a new connection record; when a FIN or RST packet is captured, or when the connection idle timeout occurs, the firewall device closes the connection record. The number of concurrent connections can be obtained by continuously counting the number of active connections from the same client (identified by source IP address).

[0119] In addition, firewall devices need to calculate response time fluctuations, therefore requiring the recording of the time each request is sent and the corresponding response is received. Response time is defined as the time difference, in milliseconds, between the client sending a request data packet and receiving the first response data packet from the server. Firewall devices can calculate the response time for each request by matching the TCP sequence numbers of the request and response, or by associating a 5-tuple with a timestamp.

[0120] After extracting the User-Agent field and TCP connection information, the firewall device further calculates quantitative characteristics of protocol behavior to characterize the client's behavioral patterns at the protocol level. These quantitative characteristics include at least one of the following: 1) User-Agent Trustworthiness (C1): This refers to the score of the authenticity and reliability of the User-Agent field used by the client. The value ranges from 0 to 1, with higher values ​​indicating a more trustworthy User-Agent and a higher likelihood of it being used by a real person. Firewall devices can pre-configure a User-Agent signature database for mainstream browsers. This database contains typical User-Agent string patterns for various versions of current mainstream browsers (such as Chrome, Firefox, Safari, and Edge). After obtaining the client's User-Agent, the firewall device matches it against the signature database using methods including exact matching, regular expression matching, and keyword matching.

[0121] If the User-Agent perfectly matches the standard User-Agent of mainstream browsers, or contains keywords from mainstream browsers such as "Chrome", "Firefox", "Safari", and "Edg" and is formatted correctly, then the User-Agent credibility score is between 0.8 and 1.0.

[0122] If the User-Agent is blank, clearly not a browser identifier (such as "python-requests / 2.28.0" or "curl / 7.68.0"), a custom string (such as "MyScript / 1.0"), or has a severely non-standard format, the credibility score will be between 0 and 0.3.

[0123] If the User-Agent contains keywords from mainstream browsers but the format is abnormal (such as missing version number or extra fields), or it is an older browser version, the credibility score will be between 0.3 and 0.8, which is considered a suspected range.

[0124] Firewall devices can also perform dynamic evaluation based on the update frequency of User-Agent: browsers used by real people usually update automatically with version updates, while AI tools often use a fixed User-Agent string for a long time.

[0125] 2) Concurrent Connections (C): This refers to the number of TCP connections established simultaneously between the same client and the server. Firewall devices maintain a connection state table for each client, continuously counting the number of connections in the ESTABLISHED state. The number of concurrent connections reflects the client's resource acquisition methods and access patterns.

[0126] Human users typically access websites through a browser, which establishes a small number of concurrent connections for each page (usually 2 to 6, used for parallel loading of page resources such as CSS, JavaScript, and images). However, considering that multiple users may be behind the same IP address (e.g., through NAT), other characteristics need to be considered when making statistics. Generally speaking, the number of concurrent connections for a single human client (such as a PC) is usually C≤6, and in most cases C≤3.

[0127] To improve crawling efficiency, AI operations often employ high-concurrency strategies, establishing numerous TCP connections to send requests in parallel. For example, an AI crawler might establish 10, 20, or even hundreds of concurrent connections, each sending requests independently. Therefore, when the number of concurrent connections C ≥ 10, AI operation is highly suspected. Firewall devices can set the threshold for AI operation to C ≥ 8 and the threshold for human operation to C ≤ 4, with the middle range considered a suspected range.

[0128] It should be noted that the number of concurrent connections is affected by the network environment and application type. For example, high concurrent connections may also occur in scenarios such as P2P downloads and video streaming where human users are interacting with the device. Therefore, this feature can be used in conjunction with other features (such as User-Agent credibility) to improve the accuracy of the judgment.

[0129] 3) Response Time Variation (σ_r²): This refers to the variance of the response time across multiple consecutive requests from the same client, reflecting the stability of the response time. Firewall devices can record the response time T_ri for each request and calculate the mean μ_r and variance σ_r² for N consecutive requests. The formulas are: μ_r = (T_r1 + T_r2 + ... + T_rN) / N, σ_r² = Σ(T_ri - μ_r)² / (N-1). Smaller response time variation indicates a higher consistency in server response time. This typically occurs in AI operations because AI script requests are highly predictable, resulting in a relatively stable server load. However, in human operations, user requests for diverse resource types (e.g., dynamic pages, static resources, large files) lead to greater variations in server processing time. Combined with network fluctuations, response time variation is usually larger. Firewall devices can preset the threshold for AI operations to σ_r² ≤ 10ms² and the threshold for human operations to σ_r² ≥ 50ms².

[0130] After obtaining the aforementioned message payload quantization characteristics, the type of client operation behavior can be directly determined based on these characteristics. For example, the protocol behavior quantization characteristics can be compared with preset AI operation thresholds and human operation thresholds, and the type of client operation behavior can be determined based on the comparison result.

[0131] Taking User-Agent trustworthiness C1 as an example, the firewall device defaults to an AI operation threshold of C1 ≤ 0.5 and a human operation threshold of C1 ≥ 0.8. For example, if a client's trustworthiness C1 = 0.2, it meets the AI ​​operation threshold; if the trustworthiness C1 = 0.95, it meets the human operation threshold; if C1 = 0.65, it is in the suspected range, and other dimensions need to be considered for judgment.

[0132] Taking the number of concurrent connections C as an example, the firewall device presets the AI ​​operation threshold as C≥5 and the human operation threshold as C≤3. If a client maintains 8 TCP connections to communicate with the server simultaneously, the firewall device determines that its protocol behavior conforms to the characteristics of AI operation; if the number of concurrent connections is 2, it conforms to the characteristics of human operation; if the number of concurrent connections is 4, it is in the suspected range.

[0133] Taking response time fluctuation σ_r² as an example, the firewall device's preset threshold for AI operations is σ_r² ≤ 10ms², and the threshold for human operations is σ_r² ≥ 50ms². If a client's σ_r² = 0.9ms², it meets the AI ​​operation threshold; if σ_r² = 6000ms², it meets the human operation threshold.

[0134] Understandably, the above-mentioned quantitative features of protocol behavior can be combined for judgment. When making a combined judgment, it is determined whether each quantitative feature of protocol behavior meets the corresponding AI judgment condition or human judgment condition, and then the final recognition result is determined accordingly.

[0135] The above method achieves accurate differentiation between AI and human operations based on the protocol behavior dimension. This dimension is suitable for identifying automated tools that use non-standard User-Agents, employ high-concurrency connections, and have highly stable request response times. In practical applications, the protocol behavior dimension can serve as a supplementary criterion, merging with the time sequence dimension, interaction sequence dimension, and message payload dimension to further improve recognition accuracy. For HTTPS encrypted traffic, TLS fingerprints can be used instead of User-Agents for client type identification, effectively distinguishing between AI and human operations.

[0136] Based on the above embodiments, after obtaining the quantified features of each dimension, the identification of client operation behavior types can be combined. For example, when multiple identification dimensions include time-series and interaction sequence dimensions, for the time-series dimension, at least one time-series quantified feature can be combined to obtain a comparison result; for the interaction sequence dimension, at least one interaction sequence quantified feature can be combined to obtain a comparison result. Then, the two comparison results are combined. If both comparison results are AI operations, the final identification result is an AI operation; if both are quantified operations, the final identification result is a quantified operation; otherwise, it is a suspected AI operation that can be further observed. Of course, the same approach can be used for the combined judgment of other dimensions. The specific judgment strategy can be to use a voting strategy to determine the final identification result.

[0137] In some other implementations, the AI ​​confidence level of the client's operation behavior as belonging to AI operation can be calculated based on the quantitative features under multiple recognition dimensions, and then the type of client operation behavior can be determined based on the AI ​​confidence level.

[0138] This method integrates multiple quantitative features extracted from the aforementioned time-series, interaction sequence, message payload, and protocol behavior dimensions, and calculates a comprehensive quantitative index, namely AI confidence score, through weighted summation. The type of client's operation behavior (AI operation, human operation, or suspected AI operation) is then determined based on the numerical range of this AI confidence score. The AI ​​confidence score is a value ranging from 0 to 1; a value closer to 1 indicates that the client's operation behavior more closely resembles the characteristics of an AI operation, while a value closer to 0 indicates that it more closely resembles the characteristics of a human operation.

[0139] AI confidence score is a quantitative assessment of the probability that a client's action is an AI action. In some implementations, firewall devices can assign a single-dimensional score to each dimension, and then perform a weighted sum according to preset rules to obtain the AI ​​confidence score.

[0140] Specifically, the quantitative features of each dimension can be compared with the corresponding AI threshold and real person threshold. Based on the comparison results, the single-dimensional score of each dimension can be determined. Then, the single-dimensional scores of each dimension are weighted and summed according to preset rules to obtain the AI ​​confidence level.

[0141] For each dimension, the firewall device compares the statistical values ​​of each quantitative feature under that dimension with the preset AI threshold and real person threshold. Based on the comparison results, the type evaluation results of each dimension can be obtained (the specific judgment method can be referred to in the aforementioned implementation method). Then, the single-dimensional score is determined based on the type evaluation results.

[0142] The firewall device first assigns preset weights to features of different dimensions. The preset weights can be determined through training with a large number of samples. For example, in this implementation, the following weight configuration is used: time sequence dimension weight 0.5, interaction sequence dimension weight 0.25, packet payload dimension weight 0.15, and protocol behavior dimension weight 0.1. The weights for each dimension can be dynamically adjusted according to the actual application scenario.

[0143] Specifically, a single-dimensional score for this dimension can be given according to the following rules (value 0, half of the weight value, or the weight value): If the evaluation result of the dimension is determined to be an AI operation based on at least one quantitative feature, then the single-dimensional score is equal to the weight value of that dimension (i.e., the full score). If the evaluation result of this dimension is determined to be a real person's operation based on at least one quantitative feature, then the single dimension score is 0. If, based on at least one quantitative feature, the assessment result for this dimension is determined to be a suspected AI operation, then the single-dimensional score is 0.5 times the weight value of this dimension.

[0144] For example, the preset weight for the time series dimension is 0.5. If the type evaluation result for this dimension is AI operation, then its single-dimensional score is 0.5.

[0145] The scores for other dimensions were obtained in the same way as described above.

[0146] After obtaining the single-dimensional scores for each dimension, the firewall device performs a weighted sum of the single-dimensional scores for all dimensions involved in the judgment according to a preset rule to obtain the AI ​​confidence score Conf_init. The preset rule here can be a direct summation, in which case each weight is 1, indicating that each dimension is equally important. Alternatively, weights can be assigned to each dimension during the weighting process; these weights can be the preset weights for each dimension mentioned above, or they can take different values.

[0147] Taking an example where each weight is 1, if a firewall device uses four dimensions simultaneously—time-sequence, interaction sequence, packet payload, and protocol behavior—then the AI ​​confidence score is calculated as follows: Conf_init = Score_time (time-sequence score) + Score_sequence (interaction sequence score) + Score_payload (packet payload score) + Score_protocol (protocol score). Since the maximum score for each dimension is its preset weight value, and the sum of the weights for the four dimensions is 1 (e.g., time-sequence 0.5, interaction sequence 0.25, packet payload 0.15, protocol behavior 0.10), the value of Conf_init ranges from 0 to 1.

[0148] For example, if a client's individual dimension scores are: time sequence 0.5 (compliant with AI), interaction sequence 0.25 (compliant with AI), message payload 0 (compliant with human behavior), and protocol behavior 0.1 (compliant with AI), then Conf_init = 0.5 + 0.25 + 0 + 0.1 = 0.85. This high value indicates that the client as a whole is closer to AI operation.

[0149] When determining the type of client operation behavior based on AI confidence, the AI ​​confidence can be directly compared with a set threshold. For example, if the AI ​​confidence is greater than or equal to 0.7, it is determined to be an AI operation; if the AI ​​confidence is less than 0.3, it is determined to be a real person operation; and in other cases, it is determined to be a suspected AI operation.

[0150] Through the above implementation methods, multiple dimensions of quantitative features can be integrated into an intuitive AI confidence index, and the operation type can be automatically determined based on clear threshold rules, thereby achieving rapid type identification.

[0151] Based on the above embodiments, in other embodiments for determining the type of client operation behavior based on AI confidence, in order to improve the recognition accuracy, the quantitative features of each dimension can be combined into a feature vector, which is then input into the isolated forest anomaly detection model to obtain anomaly scores. The type of client operation behavior is then determined based on the anomaly scores and AI confidence.

[0152] This approach introduces the Isolation Forest anomaly detection model, fusing multi-dimensional quantified features into a single feature vector. Anomaly detection scores are then used to help determine the type of client-side actions. Isolation Forest is an unsupervised anomaly detection algorithm based on ensemble learning. Its core idea is that anomalous points (i.e., AI actions) are more easily isolated by random partitioning in the feature space, resulting in shorter path lengths from the root node to the leaf node; conversely, normal points (i.e., human actions) require more random partitioning for isolation, leading to longer path lengths. By calculating the anomaly score for each sample, its anomalousness can be quantified; a higher score indicates a greater likelihood of anomaly (i.e., AI action). This algorithm does not rely on labeled data, effectively identifying unknown types of AI actions, complementing AI confidence levels, and improving recognition accuracy.

[0153] When constructing the feature vector, the firewall device first extracts all quantized features from the time-series, interaction sequence, packet payload, and protocol behavior dimensions. These quantized features are then arranged in a fixed order to form a multi-dimensional feature vector. Each component in the feature vector corresponds to a specific quantized feature, such as: [mean request interval, variance of request interval, coefficient of variation of request interval, first response time interval, duration of continuous operation, sequence repetition, proportion of redundant requests, fixed request order, mean packet size, variance of packet size, randomness of request parameters, trustworthiness of User-Agent, number of concurrent connections, and response time fluctuation]. All quantized features can be standardized before being input into the model (e.g., Z-score normalization or Min-Max normalization) to eliminate the influence of different feature dimensions and value ranges, ensuring that each feature contributes equally to anomaly detection. The standardized feature vector is denoted as X=[x1,x2,…,x…]. d ], where d is the total number of features.

[0154] The Isolation Forest model consists of multiple isolated trees (iTrees). The construction process for each isolated tree is as follows: It is randomly sampled from the training sample set (composed of historically collected client behavior feature vectors, which can contain both AI and human samples, but the model does not rely on labels). The samples are used as a subset; a feature dimension is randomly selected in the subset, and a cut point is randomly generated between the minimum and maximum values ​​of the feature; samples with feature values ​​less than the cut point are assigned to the left subtree, and those with feature values ​​greater than or equal to the cut point are assigned to the right subtree; the above process is recursively repeated on the subtrees until there is only one sample in the subtree or the preset tree height limit is reached. After training, for a new feature vector X, the firewall device inputs it into each isolated tree and records its path length h(X) in each tree: the number of edges traversed from the root node to the leaf node. Then, the average path length E(h(X)) of the sample on all isolated trees is calculated, and the anomaly score S_iso is calculated based on this, using the following formula:

[0155] in When the sample size is The average path length is used for normalization. The anomaly score S_iso ranges from 0 to 1: when S_iso is close to 1, it indicates that the path length of the sample is very short and easily isolated, belonging to anomalies (probably AI operations); when S_iso is close to 0, it indicates that the path length is very long and belongs to normal points (probably human operations); when S_iso is around 0.5, it indicates no obvious anomalies.

[0156] In practical deployments, the Isolation Forest model can be trained in advance using historical network traffic data (including known AI operations and human operations), or it can be incrementally updated during firewall operation to adapt to constantly changing behavior patterns.

[0157] The trained Isolation Forest model can be used as an Isolation Forest anomaly detection model for real-time detection, obtaining anomaly scores. After obtaining the anomaly scores and AI confidence scores, these two pieces of information can be combined to determine the type of client-side behavior.

[0158] Through the above implementation methods, the isolated forest anomaly detection and AI confidence score complement each other, effectively overcoming the limitations of a single discrimination method. AI confidence score, based on domain knowledge and preset thresholds, has good recognition performance for known types of AI operations; isolated forest, which requires no labels and is sensitive to unknown anomalies, can capture novel or mutated AI automated behaviors. The combination of these two methods improves the accuracy of recognition.

[0159] In some implementations, when combining anomaly scores and AI confidence levels to determine the type of client-side behavior, the judgment rules may be as follows: When the anomaly score is greater than or equal to the first threshold and the AI ​​confidence score is greater than or equal to the second threshold, the client's operation behavior is determined to be an AI operation; when the anomaly score is less than or equal to the third preset threshold and the AI ​​confidence score is less than or equal to the fourth preset threshold, the client's operation behavior is determined to be a real person operation; when neither the anomaly score nor the AI ​​confidence score meets any of the above conditions, the client's operation behavior is determined to be a suspected AI operation.

[0160] The three thresholds are as follows: The first threshold (Th1) is the lower limit for judging AI operations based on anomaly scores, with a default value of 0.8. A higher anomaly score indicates a more anomalous sample and a higher likelihood of AI operation. The second threshold (Th2) is the lower limit for judging AI operations based on AI confidence, with a default value of 0.7. A higher AI confidence indicates that the behavior pattern more closely matches known AI characteristics. The third threshold (Th3) is the upper limit for judging human operations based on anomaly scores, with a default value of 0.3. An anomaly score below this value indicates that the sample is within the normal range and is likely a human operation. The fourth threshold (Th4) is the upper limit for judging human operations based on AI confidence, with a default value of 0.3. An AI confidence below this value indicates that the behavior pattern does not conform to AI characteristics.

[0161] Based on the above thresholds, the following judgment rules are adopted: AI Operation: When the anomaly score is ≥ Th1 and the AI ​​confidence score is ≥ Th2, the client's operation behavior is determined to be an AI operation. This rule requires both indicators to point to AI simultaneously, ensuring high reliability of the determination.

[0162] Human-centric behavior: When the anomaly score is ≤Th3 and the AI ​​confidence score is ≤Th4, the client's behavior is determined to be human-centric. This rule requires both indicators to be in the low range, indicating that the behavior is neither outlier nor AI-driven.

[0163] Suspected AI operation: When none of the above conditions are met (i.e., the anomaly score and AI confidence score are one high and one low, or both are in the middle range), the client operation behavior is determined to be suspected AI operation.

[0164] It should be noted that the four thresholds mentioned above are not fixed and can be dynamically adjusted by the firewall device based on the actual deployment environment. For example, in a financial transaction system, to strictly prevent automated attacks, the threshold for judging AI operations can be appropriately lowered: Th1 can be set to 0.6 and Th2 to 0.5, so that more suspicious behaviors are identified as AI operations and blocked. Conversely, in websites that prioritize user experience, to avoid mistakenly blocking normal users, the threshold for AI operations can be increased (e.g., Th1=0.9, Th2=0.85), while the threshold for human operations can be decreased (e.g., Th3=0.2, Th4=0.2), so that restrictive measures are only taken when there is a high degree of certainty. The firewall device can also automatically find the optimal combination of thresholds based on historical labeled data using machine learning methods (such as grid search and Bayesian optimization).

[0165] Through the above implementation methods, firewall devices can use the joint threshold determination of anomaly scores and AI confidence levels to achieve clear and rule-based classification of client operation behavior types.

[0166] Based on the above embodiments, in order to further improve the accuracy of recognition, after determining that the type of client operation behavior is suspected AI operation, the client's request path sequence can be matched with a preset AI operation sequence template to obtain sequence similarity. When the sequence similarity is greater than or equal to the first preset similarity threshold, the type of client operation behavior is re-determined as AI operation. When the sequence similarity is less than or equal to the second preset similarity threshold, the type of client operation behavior is re-determined as real person operation.

[0167] When the firewall device determines that the client's operation behavior is suspected to be an AI operation based on the method in the above embodiments, it enters the sequence similarity verification process. This process is only executed for suspected samples, avoiding high-overhead sequence comparison for all samples, thus balancing recognition accuracy and computational efficiency.

[0168] When constructing a request path sequence, firewall devices can collect all HTTP request paths from the client in the most recent session (or multiple consecutive sessions) on a TCP session basis, and arrange them into a request path sequence in chronological order. For HTTPS encrypted traffic, if the request path cannot be directly obtained, the firewall device can use the SNI field (Server Name Indicator) from the TLS handshake phase as a substitute to construct a domain name access sequence. To eliminate the impact of dynamic parameters on similarity calculations, firewall devices can normalize the request path, replacing dynamic parts such as numeric IDs and timestamps in the path with placeholders (e.g., " / user / 123 / profile" normalized to " / user / {id} / profile").

[0169] Firewall devices can be pre-configured with an AI operation sequence template library. This library is generated through offline learning or manual annotation and includes typical request path sequence patterns for common AI automation tools (such as web crawlers, batch registration scripts, automated testing tools, vote-rigging software, etc.). Each template in the library is a request path sequence, representing a fixed behavioral pattern for a type of AI operation. The template library can be updated regularly to address the emergence of new AI tools.

[0170] Firewall devices can use the Dynamic Time Warping (DTW) algorithm to calculate the similarity between a client's request path sequence and each template sequence in the template library. DTW is a time series matching algorithm that can handle situations where two sequences have inconsistent lengths or local offsets, making it suitable for comparing the similarity of operation paths in different sessions.

[0171] The basic steps of the DTW algorithm are as follows: First, construct a matrix of pairwise distances between all elements of the two sequences. The distance metric can be either string edit distance (Levenshtein distance) or path semantic similarity (e.g., " / login" and " / signin" are considered similar). Then, use dynamic programming to find a regular path from the top left corner to the bottom right corner in the matrix that minimizes the sum of the cumulative distances along the path. This minimum cumulative distance is the DTW distance D_dtw between the two sequences. Finally, convert the DTW distance into a similarity S_dtw, with the formula: S_dtw = 1 / (1 + D_dtw), or using a normalized method: S_dtw = 1 - D_dtw / L_max, where L_max is the maximum length of the two sequences. The value of S_dtw ranges from 0 to 1, with values ​​closer to 1 indicating greater similarity between the two sequences.

[0172] In some implementations, to improve efficiency, firewall devices may not need to match the client's request path sequence with all templates in the template library. Instead, they can first quickly filter out candidate templates by index (such as the first element of the sequence or the sequence length), and then calculate the DTW similarity for each candidate template and take the maximum value as the final sequence similarity for the client.

[0173] When making judgments, firewall devices can preset two similarity thresholds: a first preset similarity threshold (Th_sim_high) and a second preset similarity threshold (Th_sim_low). The default values ​​are Th_sim_high = 0.9 and Th_sim_low = 0.6, respectively. Based on the calculated maximum sequence similarity S_dtw, the firewall device adjusts the judgment result for suspected AI operations as follows: Upgraded to AI operation: When S_dtw ≥ Th_sim_high (e.g., 0.9), it indicates that the request path sequence of the client is highly similar to the known AI operation template. The firewall device can re-determine the type of the client operation behavior from a suspected AI operation to an AI operation.

[0174] Downgraded to human operation: When S_dtw ≤ Th_sim_low (e.g., 0.6), it indicates that the sequence of the client is significantly different from the known AI template. The firewall device can re-determine the type from a suspected AI operation to a human operation.

[0175] Maintain the suspected AI operation: When Th_sim_low < S_dtw < Th_sim_high, it indicates that the sequence similarity is in the intermediate range. The firewall device can maintain the original determination of the suspected AI operation and continue to execute a mild flow-limiting or continuous observation strategy.

[0176] Understandably, the above-mentioned scheme for identifying using the similarity matching of the request sequence can also be combined with the aforementioned AI confidence for comprehensive identification, that is, comprehensive identification based on AI confidence and sequence similarity. Only when both identify it as an AI operation, it is determined as an AI operation. Only when both identify it as a human operation, it is determined as a human operation. Otherwise, it is a suspected AI operation, and the suspected AI operation can be further observed.

[0177] In some embodiments, for AI confidence, anomaly score, and sequence similarity, AI confidence can be comprehensively judged with the anomaly score and / or sequence similarity. When making a comprehensive judgment, only when both identify it as an AI operation, it is determined as an AI operation. Only when both identify it as a human operation, it is determined as a human operation. Otherwise, it is a suspected AI operation, and the suspected AI operation can be further observed.

[0178] Through the above embodiments, the firewall device uses the similarity matching of the request path sequence to perform secondary refined discrimination on suspected samples. This mechanism utilizes the high fixity of AI operations in the sequence pattern, can effectively upgrade those suspected samples with obvious script behavior characteristics to AI operations, and at the same time downgrade the suspected samples with natural randomness to human operations, thereby reducing the misjudgment rate in the fuzzy area and improving the accuracy of the overall identification system.

[0179] The following uses a specific example to illustrate the above method process.

[0180] An e-commerce website deployed firewall equipment based on this solution to identify and restrict the high-frequency crawling of product pages by AI-automated crawlers and the server resource consumption caused by AI's batch login attempts. This crawler simulates browser requests via scripts, continuously scraping product prices and inventory information at fixed intervals (approximately 150 milliseconds), causing a continuous increase in server CPU utilization and resulting in lag for normal users.

[0181] The firewall device's packet capture module captured 10 consecutive HTTP requests initiated by a client with a source IP of 192.168.1.100 and extracted metadata including timestamps, request paths, packet sizes, and User-Agent. After feature extraction and quantization, the following multidimensional features were obtained: In the time series dimension, the average request interval is 150ms, the variance is 50ms², the coefficient of variation is 0.08, the first response interval is 120ms, and the continuous operation duration is 1350ms without interruption; In the interaction sequence dimension, the sequence repetition is R=0.95, the redundant request ratio is R1=0.005, and the request order fixity is F=1.0; In the message payload dimension, the average data packet size is 200 bytes, the variance is 15 bytes², and the request parameter randomness is R_p=0.02 (the parameters only contain a fixed product ID, without timestamps or random codes); In the protocol behavior dimension, the number of concurrent connections is C=6, the User-Agent credibility is C1=0.2, and the response time fluctuation is σ_r²=8ms².

[0182] The firewall device inputs the above features into the fusion discrimination algorithm: the time sequence dimension score is 0.5 (meets the AI ​​threshold), the interaction sequence dimension score is 0.25, the packet payload dimension score is 0.15, the protocol behavior dimension score is 0.1, the AI ​​confidence score is 1.0, the anomaly score is 0.92, and the DTW sequence similarity is 0.96 compared with the known crawler template.

[0183] All three sliding windows (10 requests per window) were identified as AI operations. The client was ultimately determined to be engaging in AI operations. The firewall control module, based on preset policies, implemented rate limiting on the source IP (limiting it to a maximum of 2 requests per second) and generated an alarm log, sending it to the security operations center. If the IP continues to trigger AI detections for more than 5 minutes after rate limiting, the operation is automatically escalated to blocking, and the IP is added to the blacklist.

[0184] Please refer to the above method embodiments. Figure 2 , Figure 2This is a structural block diagram of an AI and human operation recognition device 200 provided in an embodiment of this application. The device 200 may be a module, program segment, or code on a firewall device. It should be understood that the device 200 corresponds to the above method embodiment and is capable of performing the various steps involved in the method embodiment. The specific functions of the device 200 can be found in the description above. To avoid repetition, detailed descriptions are appropriately omitted here.

[0185] Optionally, the device 200 includes: Information acquisition module 210 is used to acquire the interaction data packets between the client and the server, and extract data packet related information from the interaction data packets; The feature acquisition module 220 is used to acquire quantitative features of the client's operation behavior under multiple identification dimensions based on the relevant information of the data packet. The multiple identification dimensions include at least two of the following: time sequence dimension, interaction sequence dimension, message payload dimension, and protocol behavior dimension. The time sequence dimension is used to reflect the temporal regularity of the client's operation behavior, the interaction sequence dimension is used to reflect the request path regularity of the client's operation behavior, the message payload dimension is used to reflect the regularity of the client's operation behavior in terms of data content, and the protocol behavior dimension is used to reflect the regularity of the client's operation behavior at the protocol interaction level. The operation recognition module 230 is used to identify the type of the client operation behavior based on the quantitative features under the multiple recognition dimensions, and the type includes AI operation or real person operation.

[0186] Optionally, the plurality of identification dimensions include a time-series dimension, the data packet related information includes a timestamp, and the feature acquisition module 220 is used to acquire the time-series quantization features of the client's operation behavior under the time-series dimension based on the timestamp in the data packet related information. The time-series quantization features include at least one of the following: mean request interval, variance of request interval, coefficient of variation of request interval, first response time interval, and continuous operation duration.

[0187] Optionally, the plurality of identification dimensions include an interaction sequence dimension, the data packet related information includes a request path, and the feature acquisition module 220 is used to determine the request path sequence of the client in a session based on the request path in the data packet related information; and based on the request path sequence, to obtain the interaction sequence quantization features of the client's operation behavior under the interaction sequence dimension, wherein the interaction sequence quantization features include at least one of the following: sequence repetition, redundant request ratio, and request order fixity.

[0188] Optionally, the plurality of identification dimensions include a message payload dimension, the data packet related information includes a data packet size and request parameters, and the feature acquisition module 220 is used to obtain the message payload quantization features of the client's operation behavior under the message payload dimension based on the data packet size and the request parameters in the data packet related information. The message payload quantization features include at least one of the following: mean data packet size, variance of data packet size, and randomness of request parameters.

[0189] Optionally, the multiple identification dimensions include a protocol behavior dimension, the data packet related information includes a User-Agent field and TCP connection information, and the feature acquisition module 220 is used to obtain the protocol behavior quantification features of the client's operation behavior under the protocol behavior dimension based on the User-Agent field in the data packet related information and the TCP connection information. The protocol behavior quantification features include at least one of the following: User-Agent credibility, number of concurrent connections, and response time fluctuation.

[0190] Optionally, the operation recognition module 230 is used to calculate the AI ​​confidence level of the client's operation behavior as an AI operation based on the quantitative features under the multiple recognition dimensions; and to determine the type of the client's operation behavior based on the AI ​​confidence level.

[0191] Optionally, the operation recognition module 230 is used to compare the quantitative features of each dimension with the corresponding AI threshold and real person threshold respectively, and determine the single-dimensional score of each dimension according to the comparison results; and to perform weighted summation of the single-dimensional scores of each dimension according to preset rules to obtain the AI ​​confidence level.

[0192] Optionally, the operation recognition module 230 is used to form a feature vector from the quantified features of each dimension, input it into the isolated forest anomaly detection model to obtain an anomaly score, and determine the type of the client operation behavior based on the anomaly score and the AI ​​confidence level.

[0193] Optionally, the operation recognition module 230 is configured to determine that the type of the client operation behavior is an AI operation when the abnormal score is greater than or equal to a first preset threshold and the AI ​​confidence level is greater than or equal to a second preset threshold; to determine that the type of the client operation behavior is a real person operation when the abnormal score is less than or equal to a third preset threshold and the AI ​​confidence level is less than or equal to a fourth preset threshold; and to determine that the type of the client operation behavior is a suspected AI operation when the abnormal score and the AI ​​confidence level do not meet any of the above conditions.

[0194] Optionally, the type also includes suspected AI operation. The operation identification module 230 is further configured to, after determining that the type of the client operation behavior is suspected AI operation, perform similarity matching between the client's request path sequence and a preset AI operation sequence template to obtain sequence similarity; when the sequence similarity is greater than or equal to a first preset similarity threshold, re-determine the type of the client operation behavior as AI operation; when the sequence similarity is less than or equal to a second preset similarity threshold, re-determine the type of the client operation behavior as real person operation.

[0195] Optionally, the device 200 further includes: The access control module is used to perform at least one of the following operations on the client if the client's operation is an AI operation: rate limiting, blocking, and alarming; and to allow the client to access the system normally if the client's operation is a real-person operation.

[0196] It should be noted that those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the device described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0197] Please refer to Figure 3 , Figure 3 This is a schematic diagram of a firewall device for performing a recognition method for AI and human operation, provided in an embodiment of this application. The firewall device may include: at least one processor 310, such as a CPU, at least one communication interface 320, at least one memory 330, and at least one communication bus 340. The communication bus 340 is used to establish communication between these components. In this embodiment, the communication interface 320 is used for signaling or data communication with other node devices. The memory 330 may be a high-speed RAM or non-volatile memory, such as at least one disk storage device. Optionally, the memory 330 may also be at least one storage device located remotely from the aforementioned processor. The memory 330 stores computer-readable instructions, which, when executed by the processor 310, cause the firewall device to perform the aforementioned method process.

[0198] Understandable. Figure 3 The structure shown is for illustrative purposes only; the firewall device may also include components that are more advanced than those shown. Figure 3 The more or fewer components shown, or having the same Figure 3 The different configurations shown. Figure 3 The components shown can be implemented using hardware, software, or a combination thereof.

[0199] This application provides a computer-readable storage medium storing a computer program thereon. When the computer program is executed by a processor, it performs the method process executed by the firewall device in the above method embodiments.

[0200] This embodiment discloses a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions, and when the program instructions are executed by a computer, the computer can perform the methods provided in the above-described method embodiments, such as including: Acquire the data packets exchanged between the client and the server, and extract relevant data packet information from the data packets. Based on the data packet information, quantitative features of the client's operation behavior under multiple identification dimensions are obtained. The multiple identification dimensions include at least two of the following: time sequence dimension, interaction sequence dimension, message payload dimension, and protocol behavior dimension. The time sequence dimension is used to reflect the temporal regularity of the client's operation behavior, the interaction sequence dimension is used to reflect the request path regularity of the client's operation behavior, the message payload dimension is used to reflect the regularity of the client's operation behavior in terms of data content, and the protocol behavior dimension is used to reflect the regularity of the client's operation behavior at the protocol interaction level. Based on the quantitative features under the multiple recognition dimensions, the type of the client operation behavior is identified, and the type includes AI operation or human operation.

[0201] In summary, the embodiments of this application provide a method for identifying AI and human operations, a firewall device, a storage medium, and a program product. The firewall device utilizes multi-dimensional quantitative features to perform refined identification of AI operations and human operations. The entire process does not require front-end cooperation and can accurately distinguish between AI operations and human operations, effectively reducing the burden on the client and providing effective technical support for server resource protection and network access control.

[0202] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0203] Furthermore, the units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0204] Furthermore, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0205] In this document, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, without necessarily requiring or implying any such actual relationship or order between these entities or operations.

[0206] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A method for recognizing AI and human operation, characterized in that, Applied to firewall devices, the method includes: Acquire the data packets exchanged between the client and the server, and extract relevant data packet information from the data packets. Based on the data packet information, quantitative features of the client's operation behavior under multiple identification dimensions are obtained. The multiple identification dimensions include at least two of the following: time sequence dimension, interaction sequence dimension, message payload dimension, and protocol behavior dimension. The time sequence dimension is used to reflect the temporal regularity of the client's operation behavior, the interaction sequence dimension is used to reflect the request path regularity of the client's operation behavior, the message payload dimension is used to reflect the regularity of the client's operation behavior in terms of data content, and the protocol behavior dimension is used to reflect the regularity of the client's operation behavior at the protocol interaction level. Based on the quantitative features under the multiple recognition dimensions, the type of the client operation behavior is identified, and the type includes AI operation or human operation.

2. The method according to claim 1, characterized in that, The multiple identification dimensions include a time-series dimension, and the data packet related information includes a timestamp. The step of obtaining the quantized features of the client's operational behavior across multiple identification dimensions based on the data packet related information includes: Based on the timestamp in the data packet information, the temporal quantization characteristics of the client's operation behavior under the temporal dimension are obtained. The temporal quantization characteristics include at least one of the following: mean request interval, variance of request interval, coefficient of variation of request interval, first response time interval, and continuous operation duration.

3. The method according to claim 1, characterized in that, The multiple recognition dimensions include an interaction sequence dimension, and the data packet related information includes a request path. The step of obtaining the quantified features of the client's operational behavior across multiple recognition dimensions based on the data packet related information includes: Based on the request path in the data packet information, determine the request path sequence of the client in a single session; Based on the request path sequence, the interaction sequence quantification features of the client's operation behavior under the interaction sequence dimension are obtained. The interaction sequence quantification features include at least one of the following: sequence repetition, proportion of redundant requests, and fixed request order.

4. The method according to claim 1, characterized in that, The multiple identification dimensions include a message payload dimension, and the data packet related information includes data packet size and request parameters. The step of obtaining quantified features of the client's operational behavior across multiple identification dimensions based on the data packet related information includes: Based on the data packet size and the request parameters in the data packet information, the message payload quantization characteristics of the client's operation behavior under the message payload dimension are obtained. The message payload quantization characteristics include at least one of the following: mean data packet size, variance of data packet size, and randomness of request parameters.

5. The method according to claim 1, characterized in that, The multiple identification dimensions include protocol behavior dimensions, and the data packet related information includes a User-Agent field and TCP connection information. The step of obtaining quantified features of the client's operational behavior across multiple identification dimensions based on the data packet related information includes: Based on the User-Agent field in the data packet information and the TCP connection information, the protocol behavior quantitative characteristics of the client's operation behavior under the protocol behavior dimension are obtained. The protocol behavior quantitative characteristics include at least one of the following: User-Agent credibility, number of concurrent connections, and response time fluctuation.

6. The method according to claim 1, characterized in that, The step of identifying the type of client operation behavior based on the quantized features under the multiple identification dimensions includes: Based on the quantitative features under the multiple recognition dimensions, calculate the AI ​​confidence level that the client's operation behavior belongs to AI operation; The type of client operation behavior is determined based on the AI ​​confidence level.

7. The method according to claim 6, characterized in that, The step of calculating the AI ​​confidence score of the client's operation behavior as an AI operation based on the quantified features under the multiple recognition dimensions includes: The quantitative features of each dimension are compared with the corresponding AI threshold and real human threshold, and the single-dimensional score of each dimension is determined based on the comparison results. The individual scores of each dimension are weighted and summed according to preset rules to obtain the AI ​​confidence score.

8. The method according to claim 6, characterized in that, Determining the type of client operation behavior based on the AI ​​confidence level includes: The quantified features of each dimension are combined into a feature vector, which is then input into the isolated forest anomaly detection model to obtain anomaly scores. The type of client operation behavior is determined based on the anomaly score and the AI ​​confidence level.

9. The method according to claim 8, characterized in that, The step of determining the type of client operation behavior based on the anomaly score and the AI ​​confidence level includes: When the abnormal score is greater than or equal to the first preset threshold and the AI ​​confidence is greater than or equal to the second preset threshold, the type of the client operation behavior is determined to be an AI operation. When the abnormal score is less than or equal to the third preset threshold and the AI ​​confidence is less than or equal to the fourth preset threshold, the type of the client operation behavior is determined to be a real person operation. When neither the anomaly score nor the AI ​​confidence level meets the above conditions, the type of the client operation behavior is determined to be a suspected AI operation.

10. The method according to any one of claims 1-9, characterized in that, The type also includes suspected AI operations. After determining that the client operation behavior is a suspected AI operation, it further includes: The client's request path sequence is matched with a preset AI operation sequence template to obtain the sequence similarity. When the sequence similarity is greater than or equal to the first preset similarity threshold, the type of the client operation behavior is redefined as an AI operation; When the sequence similarity is less than or equal to the second preset similarity threshold, the type of the client operation behavior is redefined as a real person operation.

11. The method according to any one of claims 1-9, characterized in that, After identifying the type of the client operation behavior, the method further includes: If the type of the client operation is an AI operation, then at least one of the following operations is performed on the client: rate limiting, blocking, and alarm. If the client's operation is a real-person operation, then the client is allowed to access the service normally.

12. A firewall device, characterized in that, It includes a processor and a memory, the memory storing computer-readable instructions that, when executed by the processor, perform the method as described in any one of claims 1-11.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it performs the method as described in any one of claims 1-11.

14. A computer program product, characterized in that, It includes computer program instructions, which, when read and executed by a processor, perform the method as described in any one of claims 1-11.

Images