A system dynamic defense method, device, equipment and storage medium

Abstract

A system dynamic defense method, device and equipment and storage medium are applied to the network security technical field, the method comprises the following steps: after receiving the order request initiated by the user, collecting the multi-dimensional identification information, device information and request timestamp of the user, and storing them into the user unique identification association data set; according to the order request, the user unique identification association data set, and the preset legal identification rule library and attack behavior characteristic library, multi-dimensional risk assessment is carried out, and a comprehensive risk score is obtained; according to the comprehensive risk score and a plurality of dynamically determined score thresholds, the risk level of the user is determined, and the resource allocation strategy and the defense strategy are dynamically adjusted. Through multi-dimensional identification collection and data set construction, and multi-dimensional risk assessment, accurate identification of malicious attack behavior is realized, and through dynamic score threshold, the resource allocation strategy and the defense strategy of the system are adjusted, flexible defense and resource scheduling are realized, and the problem of static resource allocation imbalance is solved.

Description

Technical Field

[0001] This application relates to the field of network security technology, specifically to a system dynamic defense method, apparatus, device, and storage medium. Background Technology

[0002] In insurance benefit systems, malicious attackers often exploit frequent order failures to launch attacks, such as consuming system resources, testing system vulnerabilities, or cracking account identification information. Traditional defense methods mainly employ fixed frequency limits, that is, setting a uniform threshold for the number of orders or frequency for all users, and limiting or blocking traffic when the threshold is exceeded.

[0003] However, this fixed threshold method has significant drawbacks: on the one hand, it cannot distinguish between normal user errors and malicious attacks, easily leading to misjudgments of normal users and affecting user experience; on the other hand, attackers can bypass the restrictions by changing IP addresses, accounts, etc., resulting in limited defense effectiveness. Furthermore, a fixed resource allocation method can cause malicious requests to consume excessive system resources, while legitimate requests from normal users may be rejected due to insufficient resources, leading to an imbalance in resource allocation.

[0004] Therefore, there is an urgent need for an algorithm that can dynamically adjust defense strategies and resource allocation based on user behavior in order to improve the accuracy of attack identification, optimize resource utilization efficiency, and balance system security and user experience. Summary of the Invention

[0005] At least one embodiment of this application provides a system dynamic defense method, apparatus, device, and storage medium to solve the problems of low attack accuracy, system security, and low resource utilization in the prior art when defense is based on a fixed threshold.

[0006] To solve the above-mentioned technical problems, this application is implemented as follows:

[0007] In a first aspect, embodiments of this application provide a system dynamic defense method, including:

[0008] After receiving an order request from a user, the system collects the user's multi-dimensional identification information, device information, and request timestamp, and stores them in the user's unique identifier association dataset. The identification information includes account identifier, device identifier, and Internet Protocol address.

[0009] A multi-dimensional risk assessment is conducted based on the order request, the user's unique identifier associated dataset, and the preset legal identifier rule base and attack behavior feature base to obtain a comprehensive risk score;

[0010] The user's risk level is determined based on the comprehensive risk score and multiple dynamically determined scoring thresholds;

[0011] Based on the risk level, dynamically adjust resource allocation and defense strategies.

[0012] Specifically, in the method described above, the step of performing a multi-dimensional risk assessment based on the order request, the user's unique identifier associated dataset, and a preset legitimate identifier rule base and attack behavior feature base to obtain a comprehensive risk score includes:

[0013] Based on the legal identifier rule base, the identifier information, and the device information, a legality verification is performed to obtain the verification result;

[0014] Failure behavior analysis is performed based on the user's unique identifier associated dataset to obtain failure analysis results;

[0015] Based on the order request and the attack behavior feature database, keyword and behavior sequence matching is performed to obtain the matching result;

[0016] The comprehensive risk score is obtained based on the verification results, the failure analysis results, and the matching results.

[0017] Specifically, in the method described above, the step of performing legality verification based on the legal identifier rule base, the identifier information, and the device information to obtain the verification result includes:

[0018] Perform account identifier verification, device identifier verification, Internet Protocol address verification, and device information verification respectively, and obtain the corresponding sub-verification results;

[0019] The verification result is obtained by combining the proportion of verification failures in each of the sub-verification results.

[0020] Preferably, the method described above, after obtaining the verification result, further includes:

[0021] If the verification result is that all the sub-verification results are verification failures, then the risk level is directly determined to be the highest risk level, and the step of dynamically adjusting the resource allocation strategy and defense strategy according to the risk level is executed.

[0022] Specifically, in the method described above, the step of performing failure behavior analysis based on the user's unique identifier associated dataset to obtain failure analysis results includes:

[0023] The failure count is obtained by classifying and statistically analyzing the number of times an order fails within a first preset time period and the reasons for each failure.

[0024] If the order placement result is an order failure, obtain the average failure interval of consecutive order failures to obtain a failure frequency statistics result; otherwise, determine that the failure frequency statistics result is zero or a missing value.

[0025] Based on a preset identifier association statistics method, the association relationships between the identifier information are statistically analyzed to obtain identifier association statistics results;

[0026] The failure analysis results are obtained by combining the failure count statistics, the failure frequency statistics, and the identifier association statistics.

[0027] Specifically, in the method described above, obtaining the comprehensive risk score based on the verification result, the failure analysis result, and the matching result includes:

[0028] The verification score is obtained based on the proportion of sub-verification results that are verification failures in the verification results.

[0029] Based on the failure count and cause weight corresponding to each failure cause in the failure count statistics, and the pre-obtained average failure count threshold for normal users, a failure count score is obtained.

[0030] Based on the failure frequency statistics and the corresponding frequency fluctuation weights, a failure frequency score is obtained, wherein the frequency fluctuation weights are related to the historical average frequency.

[0031] Based on the association coefficient and association similarity among the various identifier information in the identifier association statistics, an identifier association score is obtained, wherein the association coefficient and the association similarity are related to the number of associations among the various identifier information;

[0032] Based on the matching results, a matching score is obtained;

[0033] Historical risk scores are obtained based on the average score and weight of the first period within a preset number of periods, wherein the period weight corresponds to the period difference between the corresponding period and the current time.

[0034] The comprehensive risk score is obtained by weighting and summing the verification score, the number of failures score, the failure frequency score, the identifier association score, the historical risk score, and the matching score.

[0035] Preferably, in the method described above, the step of obtaining the comprehensive risk score by weighted summation of the verification score, the number of failures score, the failure frequency score, the identifier association score, the historical risk score, and the matching score includes:

[0036] According to the second cycle, preset core indicator data are periodically acquired and statistically analyzed. The core indicator data includes at least one of the following: attack identification accuracy rate, normal user false positive rate, malicious request resource consumption rate, and defense strategy execution success rate.

[0037] Based on the core indicator data and the corresponding reference thresholds, dynamically adjust the scoring weights of at least two of the following: the verification score, the number of failures score, the failure frequency score, the identifier association score, the historical risk score, and the matching score.

[0038] Specifically, the method described above, after obtaining the matching score, further includes:

[0039] If the matching score is greater than or equal to the first threshold and less than the second threshold, the comprehensive risk score is adjusted upward.

[0040] If the matching score is greater than or equal to the second threshold, the risk level is directly determined to be the highest level, and the step of dynamically adjusting the resource allocation strategy and defense strategy according to the risk level is executed.

[0041] Preferably, the method described above, after obtaining the comprehensive risk score, further includes:

[0042] If the order placement request results in a successful order, the overall risk score is lowered, and if the time interval between two consecutive successful orders is greater than a preset duration, the difference in the downward adjustment of the overall risk score is adjusted, and resource quotas are released according to a first preset ratio.

[0043] If the order placement request fails, the overall risk score is increased, and if the reason for failure is a preset reason, the increase difference of the overall risk score is adjusted, and the resource quota is tightened according to the second preset ratio.

[0044] Preferably, the method described above further includes:

[0045] After a user places an order, the average failure count threshold is updated at least based on the results of a consecutive number of orders.

[0046] And / or, upon reaching the baseline update time point based on the third period, obtain the average number of failures for all normal users within the corresponding third period, as well as the historical average number of failures for the previous third period, and update the average number of failures threshold.

[0047] Specifically, in the method described above, determining the user's risk level based on the comprehensive risk score and multiple dynamically determined scoring thresholds includes:

[0048] When the comprehensive risk score is greater than or equal to the first score threshold, the user's risk level is determined to be the highest level, the first level.

[0049] When the comprehensive risk score is greater than or equal to the second scoring threshold and less than the first scoring threshold, the user's risk level is determined to be the second level of medium risk.

[0050] When the overall risk score is less than the second scoring threshold, the user's risk level is determined to be the third level, which has the lowest risk.

[0051] Specifically, in the method described above, the step of dynamically adjusting the resource allocation strategy and defense strategy according to the risk level includes:

[0052] If the risk level is the third level, then the resource allocation strategy is determined to be the preset resource allocation strategy, and the defense strategy is one that does not require additional verification.

[0053] If the risk level is the second level, then the resource allocation strategy is determined to be a resource quota restriction strategy, and the defense strategy is enhanced verification and request rate limiting;

[0054] If the risk is at the first level, then the resource allocation strategy is determined to be a strict resource quota restriction strategy, and the defense strategy is a temporary blacklist, high-intensity verification, and attack alerts.

[0055] Specifically, the method described above, after determining the user's risk level, further includes:

[0056] Obtain system status information, which includes at least one of the following: percentage of normal user requests, percentage of attack requests, and attack scale:

[0057] The scoring threshold is dynamically adjusted based on the system status information.

[0058] The interference rate of the scoring threshold adjustment on normal users is obtained. If the interference rate is greater than the third threshold, the scoring threshold is reverse-calibrated. The normal users are the users of the third level with the lowest risk.

[0059] Preferably, in the method described above, after determining the user's risk level, the method further includes:

[0060] If the risk level corresponding to the user is the highest risk level, then the identification information corresponding to the user will be traced and marked, and included in the abnormal identification database;

[0061] If it is detected that another user initiates the order request using the identification information in the abnormal identification database, the corresponding resource allocation strategy and defense strategy will be executed directly.

[0062] Secondly, this application provides a control device, comprising:

[0063] The data acquisition module is used to collect the user's multi-dimensional identification information, device information and request timestamp after receiving the order request initiated by the user, and store them in the user's unique identifier associated dataset. The identification information includes account identifier, device identifier and Internet Protocol address.

[0064] The comprehensive assessment module is used to conduct multi-dimensional risk assessment based on the order request, the user's unique identifier associated dataset, and the preset legal identifier rule base and attack behavior feature base to obtain a comprehensive risk score;

[0065] The risk level determination module is used to determine the user's risk level based on the comprehensive risk score and multiple dynamically determined scoring thresholds;

[0066] The strategy adjustment module is used to dynamically adjust resource allocation strategies and defense strategies based on the risk level.

[0067] Thirdly, this application provides an electronic device, including: a processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, it implements the steps of the system dynamic defense method as described above.

[0068] Fourthly, this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the system dynamic defense method described above.

[0069] Fifthly, this application provides a computer program product including computer instructions that, when executed by a processor, implement the steps of the system dynamic defense method described above.

[0070] Compared with existing technologies, the system dynamic defense method, device, equipment and storage medium provided in this application embodiment achieves accurate identification of normal order failure behavior and malicious attack behavior by collecting multi-dimensional identifiers and constructing datasets, and performing malicious attack behavior analysis based on multi-dimensional analysis. At the same time, it determines the risk level by comprehensive risk scoring and dynamic scoring thresholds, and dynamically adjusts the system's resource allocation strategy and defense strategy, which can achieve elastic defense and associate resource allocation with security risks, realize dynamic resource scheduling based on risk perception, and effectively solve the problem of imbalance in existing static resource allocation. Attached Figure Description

[0071] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the scope of this application. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0072] Figure 1 This is one of the flowcharts illustrating the system dynamic defense method of this application;

[0073] Figure 2 This is the second flowchart illustrating the system dynamic defense method of this application;

[0074] Figure 3 This is the third flowchart illustrating the system dynamic defense method of this application;

[0075] Figure 4 This is the fourth flowchart illustrating the system dynamic defense method of this application;

[0076] Figure 5 This is the fifth flowchart illustrating the system dynamic defense method of this application;

[0077] Figure 6 This is the sixth flowchart illustrating the system dynamic defense method of this application;

[0078] Figure 7 This is the seventh flowchart illustrating the system dynamic defense method of this application;

[0079] Figure 8 This is a schematic diagram of the control device of this application;

[0080] Figure 9 This is a schematic diagram of the structure of the electronic device of this application. Detailed Implementation

[0081] Exemplary embodiments of the present application will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present application are shown in the drawings, it should be understood that the present application may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this application will be thorough and complete, and will fully convey the scope of the present application to those skilled in the art.

[0082] The terms “first,” “second,” etc., used in the specification and claims of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented, for example, in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus. The terms “and / or” in the specification and claims indicate at least one of the connected objects.

[0083] See Figure 1 This application provides a system dynamic defense method, comprising:

[0084] Step S101: After receiving the order request initiated by the user, collect the user's multi-dimensional identification information, device information and request timestamp, and store them in the user's unique identifier association dataset. The identification information includes account identifier, device identifier and Internet Protocol address.

[0085] Step S102: Perform a multi-dimensional risk assessment based on the order request, the user's unique identifier associated dataset, and the preset legal identifier rule base and attack behavior feature base to obtain a comprehensive risk score;

[0086] Step S103: Determine the user's risk level based on the comprehensive risk score and multiple dynamically determined scoring thresholds;

[0087] Step S104: Dynamically adjust the resource allocation strategy and defense strategy according to the risk level.

[0088] In this application, to achieve dynamic adjustment of the system's defense strategy, a risk level assessment is performed on users based on their order placement behavior, especially order failure behavior. Based on the obtained risk level, the defense strategy and resource allocation strategy are dynamically adjusted. Therefore, in a specific embodiment, after receiving an order request initiated by a user, multi-dimensional identification information, device information, and request timestamps related to the user are collected and stored in a user unique identifier associated dataset. This ensures that each request can be traced back to a specific user or device dimension, facilitating subsequent analysis of the data based on time and dimensions. It should be noted that the identification information is at least one identifier used to indicate the user, such as: account identifier (e.g., mobile phone number), device identifier (IMEI number), and Internet Protocol address, etc. The device information is device-related information, such as: device model, operating system version, network operator information, operation behavior logs (e.g., click path, input interval, page dwell time), etc.

[0089] Then, a multi-dimensional risk assessment is conducted based on the order request, the user's unique identifier associated dataset, and the preset legal identifier rule library and attack behavior feature library. This allows for a multi-dimensional assessment of whether the user is engaging in malicious attacks, resulting in a comprehensive risk score for the user. The multi-dimensional risk assessment can corroborate or supplement each other from multiple dimensions, reducing misjudgments or omissions from a single dimension. This enables accurate identification of normal order failures and malicious attacks.

[0090] Furthermore, based on the comprehensive risk score and multiple dynamic scoring thresholds, the threshold range can be determined, and the user's risk level can be determined based on the scoring range of the comprehensive risk score. Then, based on the risk level, the user's resource allocation strategy and defense strategy can be dynamically adjusted. The design of dynamic scoring thresholds enables resource allocation and defense strategies to be adaptively adjusted based on real-time risk scores, avoiding the system efficiency loss caused by static thresholds.

[0091] In summary, this application achieves accurate identification of normal order failures and malicious attacks by collecting identifiers and constructing datasets from multiple dimensions, and by analyzing malicious attack behaviors based on these dimensions. Furthermore, it determines risk levels through comprehensive risk scoring and dynamic scoring thresholds, and dynamically adjusts the system's resource allocation and defense strategies. This enables elastic defense and links resource allocation with security risks, achieving dynamic resource scheduling based on risk awareness, effectively solving the problem of imbalanced static resource allocation in existing systems.

[0092] See Figure 2 Specifically, in the method described above, the step of performing a multi-dimensional risk assessment based on the order request, the user's unique identifier associated dataset, and a preset legal identifier rule base and attack behavior feature base to obtain a comprehensive risk score includes:

[0093] Step S201: Perform a legality verification based on the legal identifier rule base, the identifier information, and the device information to obtain the verification result;

[0094] Step S202: Perform failure behavior analysis based on the user's unique identifier associated dataset to obtain failure analysis results;

[0095] Step S203: Perform keyword and behavior sequence matching based on the order request and the attack behavior feature database to obtain the matching result;

[0096] Step S204: Obtain the comprehensive risk score based on the verification result, the failure analysis result, and the matching result.

[0097] This embodiment illustrates the steps of the multi-dimensional risk assessment described above. These multi-dimensional dimensions include: legitimacy verification, failure behavior analysis, and attack behavior matching. Examples are provided below for each of these dimensions.

[0098] Among them, the legitimacy verification dimension is mainly based on the preset legitimacy identification rule library to perform legitimacy verification on the identification information and device information in this request, and obtain the verification result to determine the user's legitimacy status.

[0099] For the failure behavior analysis dimension, the analysis is primarily based on a user's unique identifier associated dataset. This dataset yields failure analysis results, which can be used to analyze the reasons for user request failures and whether they constitute an attack. Specific failure analysis steps are detailed below. It should be noted that in one embodiment, this step is performed for any request result (successful or failed); in another embodiment, this step is only executed when the request result is a failure, otherwise the failure analysis step is skipped, and only a preset failure analysis result is provided.

[0100] In the attack behavior matching dimension, keyword and behavior sequence matching is performed based on order requests and a pre-built attack behavior feature library to obtain the matching result, i.e., the matching degree. This matching result can characterize whether the user's request behavior is an attack behavior, thus providing corresponding data support for the user's risk level assessment. The pre-built attack behavior feature library includes historical attack behavior features (such as "multiple accounts placing orders repeatedly in a short period of time," "high-frequency repetition of fixed failure reasons," and "frequent switching of identification information") and industry-standard attack features (such as "dictionary-style requests" in brute-force attacks and "massive concurrent requests" in Distributed Denial of Service (DDoS) attacks). The matching degree calculation uses a keyword and behavior sequence matching algorithm. For example, first, keyword matching (e.g., continuously trying different mobile phone verification codes) is performed based on the order request, and relevant behavior sequences are obtained based on the matched keywords. Then, behavior sequence matching is performed based on historical data, i.e., sequence similarity is calculated. For example, the behavior sequence "place an order - fail - change internet protocol address - place another order - fail again" is used. The matching degree is determined based on the obtained sequence similarity to obtain the matching result.

[0101] Then, based on the verification results, failure analysis results, and matching results obtained above, a comprehensive evaluation can be performed to obtain the user's comprehensive risk score.

[0102] See Figure 3 Specifically, in the method described above, the step of performing a validity check based on the valid identifier rule base, the identifier information, and the device information to obtain a verification result includes:

[0103] Step S301: Perform account identifier verification, device identifier verification, Internet Protocol address verification, and device information verification respectively, and obtain the corresponding sub-verification results;

[0104] Step S302: The verification result is obtained by combining the proportion of verification failures in each of the sub-verification results.

[0105] This embodiment provides an example of specific validity verification content, which specifically includes multiple sub-verification steps: account identifier verification, device identifier verification, Internet Protocol address verification, and device information verification. These sub-verification steps can be executed in parallel. After obtaining the sub-verification results of each sub-verification step, the validity verification result is obtained by combining the proportion of verification failures in each sub-verification result.

[0106] In one specific embodiment, account identifier verification is used to verify whether the format of the account identifier conforms to national or regional rules, and the validity of the account identifier (whether it is in a cancelled or invalid state). The validity of the account identifier can be achieved based on the real-time verification interface of the connected operator. Device identifier verification is used to verify whether the device identifier conforms to the International Mobile Equipment Identity (IMEI) standard (15-17 digits) and whether there are any signs of tampering (it is mainly verified by the matching degree between device hardware information and device identifier). Internet Protocol address verification is used to determine whether the Internet Protocol address is a private IP, whether it is in the known "malicious network protocol address blacklist" (including historical attack IPs and malicious IPs shared by third-party security vendors), and to verify the geographical consistency between the IP address's location and the user's registration location and frequently used login location (e.g., if the user's registration location is Beijing, but the IP address's location is overseas and there is no historical cross-border login record, it is marked as abnormal). Device information verification: verifies the compatibility of the device model and operating system version (e.g., older models running the latest system version may have anomalies), and whether there are conflicts where multiple devices share the same device identifier or user identifier.

[0107] Preferably, the method described above, after obtaining the verification result, further includes:

[0108] If the verification result is that all the sub-verification results are verification failures, then the risk level is directly determined to be the highest risk level, and the step of dynamically adjusting the resource allocation strategy and defense strategy according to the risk level is executed.

[0109] In this embodiment, if all sub-verification results are verification failures, it indicates that the user is clearly an illegitimate user. Therefore, the risk level corresponding to the user is directly determined to be the highest level, the first level, and the resource allocation strategy and defense strategy are dynamically adjusted according to the first level. This can reduce other steps of analysis and risk level determination, thereby helping to reduce the consumption of computing resources.

[0110] Specifically, in the method described above, the step of performing failure behavior analysis based on the user's unique identifier associated dataset to obtain failure analysis results includes:

[0111] The failure count is obtained by classifying and statistically analyzing the number of times an order fails within a first preset time period and the reasons for each failure.

[0112] If the order placement result is an order failure, obtain the average failure interval of consecutive order failures to obtain a failure frequency statistics result; otherwise, determine that the failure frequency statistics result is zero or a missing value.

[0113] Based on a preset identifier association statistics method, the association relationships between the identifier information are statistically analyzed to obtain identifier association statistics results;

[0114] The failure analysis results are obtained by combining the failure count statistics, the failure frequency statistics, and the identifier association statistics.

[0115] In this embodiment, the steps for performing failure behavior analysis are illustrated, specifically including:

[0116] Failure count statistics are calculated based on the number of order failures within a preset time period (e.g., 24 hours, or a specific time configured according to the business scenario, such as 1 hour or 6 hours), and the reasons for each failure (e.g., incorrect parameters, incorrect verification code, insufficient balance, insufficient permissions, system rejection, etc.). Since different failure reasons correspond to different security risks—for example, system rejection and incorrect verification code are more relevant to attack behavior—classifying and counting failures based on reasons helps in subsequent adaptive assessments based on different failure reasons, ensuring the accuracy of the resulting comprehensive risk score.

[0117] Failure frequency statistics means that if the current order request fails, the average failure interval of consecutive failed orders is obtained to get the failure frequency statistics result; otherwise, if the current order request succeeds, the failure frequency statistics result is determined to be zero or missing.

[0118] Identifier association statistics, based on a preset identification association statistics method, statistically analyzes the relationships between identifier information to obtain identifier association statistics results. These results can be represented as an association relationship graph, which can show horizontal and vertical associations between identifier information. Horizontal association involves counting the number of other identifier information associated with one identifier information, such as the number of device identifiers or account identifiers associated with the same Internet Protocol address. Specifically, when one Internet Protocol address is associated with 10 or more account identifiers, it is determined as a multi-account association; when one device identifier is associated with 5 or more Internet Protocol addresses, it is determined as a multi-Internet Protocol address association. Vertical association involves tracing changes in user identifier associations within a second preset time period (e.g., 7 days). For example, if the number of times the same account identifier changes its Internet Protocol address within a third preset time period (e.g., 3 days) exceeds a threshold (e.g., 5), and there is no reasonable migration trajectory between the origins of the Internet Protocol addresses, the corresponding vertical association is marked as abnormal.

[0119] Furthermore, the associated networks can be visualized, making it easy to identify typical associated attack patterns such as "multiple accounts - single device", "single account - multiple Internet Protocol addresses", and "multiple accounts - multiple Internet Protocol addresses".

[0120] By combining the above-mentioned statistics on the number of failures, failure frequency, and correlation between indicators, the failure analysis results can be obtained. Optionally, these failure analysis results can be represented in the form of a dataset.

[0121] See Figure 4 Specifically, in the method described above, obtaining the comprehensive risk score based on the verification result, the failure analysis result, and the matching result includes:

[0122] Step S401: Obtain the verification score based on the proportion of sub-verification results that are verification failures in the verification results;

[0123] Step S402: Based on the failure count and cause weight corresponding to each failure cause in the failure count statistics results, and the pre-obtained average failure count threshold for normal users, obtain the failure count score;

[0124] Step S403: Based on the failure frequency statistics and the corresponding frequency fluctuation weight, obtain the failure frequency score, wherein the frequency fluctuation weight is related to the historical average frequency.

[0125] Step S404: Based on the association coefficient and association similarity between each of the identifier information in the identifier association statistics results, an identifier association score is obtained, wherein the association coefficient and the association similarity are related to the number of associations between each identifier information;

[0126] Step S405: Obtain the matching score based on the matching results;

[0127] Step S406: Obtain the historical risk score based on the average score and weight of the first cycle within a preset number of cycles, wherein the cycle weight corresponds to the cycle difference between the corresponding cycle and the current time.

[0128] Step S407: The comprehensive risk score is obtained by weighted summation of the verification score, the number of failures score, the failure frequency score, the identifier association score, the historical risk score, and the matching score.

[0129] In this embodiment, the steps for obtaining the comprehensive risk score are illustrated. First, multiple sub-scores are obtained based on the aforementioned verification results, failure analysis results, matching results, and historical scores. Specifically:

[0130] The verification score is obtained by calculating the proportion of sub-verification results that fail in the verification results. Specifically, it can be expressed as... ,in, Indicates the verification score. The failure rate is defined as the ratio of the number of failed sub-verification results to the total number of failed sub-verification results. A lower verification score has a greater negative contribution to the overall risk score.

[0131] Based on the failure count statistics, the failure count score is obtained by considering the failure count and cause weight for each failure reason, as well as the pre-obtained average failure count threshold for normal users. This score can be specifically represented as... ,in, The score represents the number of failures. This indicates the weight of the failure reason, which is adaptively adjusted according to the specific failure reason type. Specifically, for failure reasons such as "system rejection" and "incorrect verification code", Regarding other reasons for failure, , The average failure threshold for normal users (based on historical normal user data statistics, for example, the default value is 3 times / 24 hours).

[0132] Based on the failure frequency statistics and the corresponding frequency fluctuation weights, a failure frequency score is obtained. The frequency fluctuation weights are related to the historical average frequency and can be specifically expressed as follows: ,in, The score represents the number of failures. Indicates the average failure interval. This represents the frequency fluctuation weight, which is related to the historical average weight. If this frequency fluctuation weight is more than 50% shorter than the historical average frequency weight, then it is determined... Otherwise confirm ;

[0133] Based on the association coefficients and similarity among the various identifiers in the identifier association statistics, an identifier association score is obtained. The association coefficients and similarity are related to the number of associations between the identifiers; specifically, this can be expressed as follows: ,in, Indicates the score associated with the identifier. This is the correlation coefficient (default value 2, the more associated identifiers there are, the larger the value of k). This represents the similarity between identifier i and identifier j (calculated based on the number of associated identifiers and the duration of association; for example, if one Internet Protocol address is associated with 10 account identifiers, then...). (Value = 0.9)

[0134] Based on the matching results, a matching score is obtained, which is determined by normalizing the matching degree in the matching results. ,in, , where 0 indicates no match and 1 indicates a perfect match;

[0135] Based on the average score and weight of the first period within a preset number of periods, the historical risk score is obtained, which can be specifically expressed as: ,in, Indicates historical risk score, Indicates the preset quantity. This represents the average score over the period. The period weight represents the difference between the current period and the corresponding period. For example, the period weight of the first period is 1, the period weight of the second period is 0.8, and the period weight of the third period is 0.6.

[0136] Finally, the weighted sum of the scores obtained above yields the final comprehensive risk score, which can be expressed as follows: ,in, to These are the scoring weights for the corresponding scores.

[0137] See Figure 5 Preferably, the method described above further includes:

[0138] Step S501: According to the second cycle, periodically acquire and statistically analyze preset core indicator data, which includes at least one of the following: attack identification accuracy rate, normal user false positive rate, malicious request resource occupancy rate, and defense strategy execution success rate.

[0139] Step S502: Based on the core indicator data and the corresponding reference thresholds, dynamically adjust the scoring weights of at least two of the following: the verification score, the number of failures score, the failure frequency score, the identifier association score, the historical risk score, and the matching score.

[0140] In this embodiment, the scoring weights when obtaining the comprehensive risk score can be dynamically adjusted to adapt to different environments. First, preset core indicator data is acquired and statistically analyzed periodically (e.g., daily), such as: attack identification accuracy (i.e., the number of correctly identified attack requests / the total number of attack requests), normal user misjudgment rate (i.e., the number of requests from normal users with the lowest risk that are misjudged as other risk levels / the total number of normal requests), malicious request resource consumption rate (i.e., the resource consumed by malicious requests / the total system resources), and defense strategy execution success rate (i.e., the number of attack requests effectively blocked by the strategy / the number of attack requests that execute the strategy). Then, based on these core indicator data and the corresponding reference thresholds, the scores of at least two of the above scores are judged and adjusted. Weighting; In a specific embodiment, if the attack identification accuracy is less than the corresponding reference threshold, for example, 80%, the weights corresponding to the identifier association score and the matching score are increased by 0.05 respectively, and the weights corresponding to the failure count score and the failure frequency score are decreased by 0.05 respectively; If the normal user false positive rate is greater than the corresponding reference threshold, for example, 3%, the weight of the verification score is increased by 0.05, and the weights corresponding to the identifier association score and the matching score are decreased by 0.025 respectively; If the malicious request resource occupancy rate is greater than the corresponding reference threshold, for example, 10%, the weight of the historical risk score is increased by 0.05, and the weights corresponding to the failure count score and the failure frequency score are decreased by 0.025 respectively.

[0141] It should be noted that if the scoring weights are adjusted within a period, the adjusted scoring weight combination needs to be "offline tested" based on historical data to verify the effectiveness of the adjusted scoring weight combination, and it will only be applied to the online system if the verification is successful.

[0142] Specifically, the method described above, after obtaining the matching score, further includes:

[0143] If the matching score is greater than or equal to the first threshold and less than the second threshold, the comprehensive risk score is adjusted upward.

[0144] If the matching score is greater than or equal to the second threshold, the risk level is directly determined to be the highest level, and the step of dynamically adjusting the resource allocation strategy and defense strategy according to the risk level is executed.

[0145] This implementation provides supplementary explanations regarding the steps after obtaining the matching score. Since feature-based matching results can determine the probability of an attack request being high when the matching degree is high, after obtaining the matching score, it is judged based on a first threshold and a second threshold. If the matching score is greater than or equal to the first threshold but less than the second threshold, it indicates that the user request is likely to be an attack request, and therefore the final comprehensive risk score is adjusted upwards. For example, if the first threshold is 0.7 and the second threshold is 0.9, then if the matching score is between 0.7 and 0.9, the comprehensive risk score will be increased by 0.3 after obtaining the comprehensive risk score (where the maximum comprehensive risk score is 1). If the matching score is greater than 0.9, the user will be directly judged as having the highest risk level (Level 1), and the corresponding resource allocation strategy and defense strategy will be executed, which can effectively improve system efficiency and real-time defense capabilities.

[0146] Preferably, the method described above, after obtaining the comprehensive risk score, further includes:

[0147] If the order placement request results in a successful order, the overall risk score is lowered, and if the time interval between two consecutive successful orders is greater than a preset duration, the difference in the downward adjustment of the overall risk score is adjusted, and resource quotas are released according to a first preset ratio.

[0148] If the order placement request fails, the overall risk score is increased, and if the reason for failure is a preset reason, the difference in the increase of the overall risk score is adjusted, and the resource quota is tightened according to the second preset ratio.

[0149] In this embodiment, after obtaining the comprehensive risk score, the comprehensive risk score is further adjusted based on the order result of the current order request. If the current order is successfully placed, it indicates that the probability of it being an attack request has decreased, so the comprehensive risk score is lowered. Especially in special cases where the time interval between two consecutive successful orders is greater than a preset duration (e.g., 7 days), it indicates that the user is a normal user or has been converted to a normal user, so the reduction in the comprehensive risk score is increased. At the same time, the resource allocation quota is also increased to a certain extent (e.g., increased by 10%). Specifically, for a normal successful order, the comprehensive risk score is reduced by a preset reduction difference, for example (first adjustment value, 0.15). For the comprehensive risk score in special cases, the reduction difference is adjusted again to a second adjustment value (the second adjustment value is greater than the first adjustment value, for example, 0.2), and the resource quota is released according to a first preset ratio (e.g., 10%).

[0150] If the current order request fails, it indicates an increased probability that it is an attack request. Therefore, the overall risk score will be increased, for example, by a preset adjustment difference (e.g., the third adjustment value, 0.25). Since special reasons for failure can increase the probability that the order request is an attack request, if the failure reason is a preset special reason such as "system rejection", the overall risk score will be adjusted again to the fourth adjustment value (e.g., 0.3), and the user's resource allocation will be reduced, for example, according to the second preset ratio (e.g., 15%).

[0151] It should be noted that the range of values ​​for the comprehensive risk score is... Therefore, if the adjusted comprehensive risk score is greater than 1, it will be treated as a comprehensive risk score of 1. Similarly, if the adjusted comprehensive risk score is less than 0, it will be treated as a comprehensive risk score of 0.

[0152] Preferably, the method described above further includes:

[0153] After a user places an order, the average failure count threshold is updated at least based on the results of a consecutive number of orders.

[0154] And / or, upon reaching the baseline update time point based on the third period, obtain the average number of failures for all normal users within the corresponding third period, as well as the historical average number of failures for the previous third period, and update the average number of failures threshold.

[0155] In this embodiment, to further ensure the accuracy and real-time nature of the failure count scoring, the average failure count threshold during the calculation process is adjusted based on the "baseline hierarchical update" logic, considering both individual and group baselines. For individual baseline adjustments, the average failure count threshold is updated after each order placement based on consecutive identical order results. If a user's consecutive successful orders reach a first preset number (e.g., 3 times) and other anomalies occur, such as associated anomalies, the average failure count threshold is increased. For example, if the average failure count threshold is 2 times / 24 hours, it is increased to 2.5 times / 24 hours to adapt to changes in user operating habits. If a user's order failures reach a second preset number, and the failure reason is a pre-determined special reason such as "system rejection," the average failure count threshold is decreased to 1.5 times / 24 hours to improve risk sensitivity.

[0156] For adjusting the group baseline, when the baseline update time based on the third cycle is reached, the average number of failures for all normal users (i.e., users with the lowest risk level) within the corresponding third cycle is obtained and compared with the historical average number of failures in the previous third cycle. If the increase in the average number of failures is greater than or equal to a third preset percentage (e.g., 20%), the average number of failures threshold is increased according to a fourth preset percentage (e.g., 10%). If the decrease in the average number of failures is less than or equal to the third preset percentage (e.g., 20%), the average number of failures threshold is decreased according to a fourth preset percentage (e.g., 10%). This ensures that the average number of failures threshold used for judgment conforms to the current business scenario (e.g., during promotional periods, if user operation failures increase, the average number of failures threshold is increased). It should also be noted that after the group baseline is updated, it will also be synchronized to the maintenance team through a system announcement to avoid being mistaken for a fault.

[0157] Specifically, in the method described above, determining the user's risk level based on the comprehensive risk score and multiple dynamically determined scoring thresholds includes:

[0158] When the comprehensive risk score is greater than or equal to the first score threshold, the user's risk level is determined to be the highest level, the first level.

[0159] When the comprehensive risk score is greater than or equal to the second scoring threshold and less than the first scoring threshold, the user's risk level is determined to be the second level of medium risk.

[0160] When the overall risk score is less than the second scoring threshold, the user's risk level is determined to be the third level, which has the lowest risk.

[0161] In this embodiment, the user's risk level is divided into three levels, which are ranked from high to low as Level 1, Level 2 and Level 3. Therefore, two scoring thresholds are required. When divided into other levels, the scoring thresholds can be increased or decreased accordingly.

[0162] Specifically, in the method described above, the step of dynamically adjusting the resource allocation strategy and defense strategy according to the risk level includes:

[0163] If the risk level is the third level, then the resource allocation strategy is determined to be the preset resource allocation strategy, and the defense strategy is one that does not require additional verification.

[0164] If the risk level is the second level, then the resource allocation strategy is determined to be a resource quota restriction strategy, and the defense strategy is enhanced verification and request rate limiting;

[0165] If the risk is at the first level, then the resource allocation strategy is determined to be a strict resource quota restriction strategy, and the defense strategy is a temporary blacklist, high-intensity verification, and attack alerts.

[0166] In this embodiment, after determining the user's risk level, the resource allocation strategy and defense strategy are dynamically adjusted. If the user's risk level is level three, the lowest risk level, it means that the user does not require additional resource allocation or defense. Therefore, the resource allocation strategy is set to the preset strategy, and the defense strategy is set to require no additional verification. It should be noted that in this case, user behavior is also monitored in real time. If there is a sudden increase in the number of failures or changes in the associated identifiers, a second calculation of the risk score is triggered, which can dynamically optimize risk control and reduce misjudgments.

[0167] If the risk level is level two, which is neither the highest nor the lowest risk level, then the resource allocation strategy is determined to be a resource quota restriction strategy, and the defense strategy is enhanced authentication and request rate limiting. The resource quota in the resource quota restriction strategy can be calculated according to the following formula: ,in, Indicates the current resource quota. This represents the initial resource quota. This represents the overall risk score. and In one specific embodiment, pre-configured parameters are provided. and All are 0.5; when there are more than three risk levels, adjustments can be made. and To implement tiered restrictions, enhanced verification employs a dual verification method combining SMS verification and behavioral verification (where behavioral verification includes sliding verification codes, image splicing verification, etc., to prevent machines from automatically cracking SMS verification); request rate limiting restricts the number of requests per unit of time (e.g., a maximum of 10 order requests per hour), and temporarily blocks requests for a certain period of time (e.g., 1 hour) after the limit is exceeded.

[0168] If the risk level is Level 1, the highest risk level, then the resource allocation strategy will be a strict resource quota restriction strategy, and the defense strategy will be a temporary blacklist, high-intensity verification, and attack alerts. When implementing strict resource throttling, the specific comprehensive risk score can be disregarded, and the resource quota can be directly reduced by a certain percentage, for example: ,at this time, This means allocating only 30% of basic resources and prioritizing the rejection of high-consumption requests (such as batch order requests); a temporary blacklist will add the corresponding user to the temporary blacklist, with the duration dynamically adjusted according to the comprehensive risk score (for example: when the comprehensive risk score is between 0.7 and 0.8, the blacklist duration is 6 hours; when the comprehensive risk score is between 0.8 and 0.9, the blacklist duration is 12 hours; when the comprehensive risk score is greater than or equal to 0.9, the blacklist duration is 24 hours); high-strength verification will use triple verification of "verification code + identity verification + device binding verification" (identity verification includes but is not limited to ID card number verification and bank card number verification; device binding verification requires confirmation that the current device is the user's frequently used device); attack alarms will trigger system-level attack alarms, notifying security operations personnel to intervene and investigate (such as exporting the user's identifier association graph and behavior logs for manual analysis).

[0169] See Figure 6 Specifically, the method described above, after determining the user's risk level, further includes:

[0170] Step S601: Obtain system status information, which includes at least one of the following: percentage of normal user requests, percentage of attack requests, and attack scale:

[0171] Step S602: Dynamically adjust the scoring threshold based on the system status information;

[0172] Step S603: Obtain the interference rate of the scoring threshold adjustment on normal users. If the interference rate is greater than the third threshold, then reverse the scoring threshold. The normal user is the user of the third level with the lowest risk.

[0173] In this embodiment, after determining the user's risk level, system status information is further obtained. This system status information is used to characterize the system's security health, including but not limited to: the proportion of normal user requests (i.e., the number of requests from users with the lowest risk level / the current total number of requests), the proportion of attack requests (the number of requests identified as attack requests / the current total number of requests), and the attack scale (determined by comparing attack traffic with a traffic threshold). Then, the scoring threshold is adjusted based on the system status information. If the proportion of normal user requests is determined to be greater than the fourth threshold (e.g., 95%) based on the system status information, the second scoring threshold is lowered from the first value (e.g., 0.3) to the second value (e.g., 0.25).

[0174] If the system status information determines that the proportion of attack requests is greater than the fifth threshold (e.g., 10%), then the first scoring threshold will be lowered from the third value (e.g., 0.7) to the fourth value (e.g., 0.6).

[0175] If a large-scale attack is determined based on system status information, the first scoring threshold is lowered from the third value to the fifth value (e.g., 0.65).

[0176] Furthermore, the risk level is determined again based on the adjusted scoring threshold, and the interference rate of the scoring threshold adjustment on normal users is obtained, which is the number of users who are upgraded from level 3 to level 2 or level 1 / the number of users who were previously at level 3. If the interference rate is large, for example, greater than the third threshold (e.g., 3%), it indicates that the scoring threshold adjustment is inappropriate at this time. Therefore, the scoring threshold is reverse-calibrated to balance security and user experience.

[0177] See Figure 7 Preferably, in the method described above, after determining the user's risk level, the method further includes:

[0178] Step S701: If the risk level corresponding to the user is the highest risk level, then the identification information corresponding to the user is traced and marked, and included in the abnormal identification database.

[0179] Step S702: If it is detected that another user initiates the order request using the identification information in the abnormal identification database, the corresponding resource allocation strategy and defense strategy are executed directly.

[0180] In this embodiment, after determining a user's risk level, if the user's risk level is the highest level (Level 1), then the user's corresponding identifier is identified as an anomaly identifier and marked for tracing. This identifier is then added to the anomaly identifier database. Through tracing, the historical usage records of the anomaly identifier can be traced through system logs (e.g., all account identifiers and order placement behaviors associated with the internet protocol address in the past 30 days), locating the attacking entity behind the identifier (e.g., whether it's operated by the same group). Furthermore, to prevent other users from using this high-risk identifier to launch attacks, if another user is detected using identifier information from the anomaly identifier database to initiate an order request, the highest-risk level resource allocation and defense strategies are directly applied to that order request. This allows for early interception of potential attacks, expanding the defense coverage and ensuring system security.

[0181] It should also be noted that other abnormal users can be marked with corresponding levels of traceability and included in the anomaly identifier database. When the corresponding identifier is detected again, the resource allocation strategy and defense strategy corresponding to the risk level will be directly applied.

[0182] The various methods of the embodiments of this application have been described above. Apparatus for implementing the above methods will now be provided.

[0183] Please see Figure 8Another embodiment of this application provides a control device, including:

[0184] The data acquisition module 801 is used to collect the user's multi-dimensional identification information, device information and request timestamp after receiving the order request initiated by the user, and store them in the user's unique identifier associated dataset. The identification information includes account identifier, device identifier and Internet Protocol address.

[0185] The comprehensive evaluation module 802 is used to perform multi-dimensional risk assessment based on the order request, the user's unique identifier associated dataset, and the preset legal identifier rule base and attack behavior feature base to obtain a comprehensive risk score;

[0186] The risk level determination module 803 is used to determine the user's risk level based on the comprehensive risk score and multiple dynamically determined scoring thresholds;

[0187] The strategy adjustment module 804 is used to dynamically adjust the resource allocation strategy and defense strategy according to the risk level.

[0188] Specifically, in the control device described above, the comprehensive evaluation module includes:

[0189] The validity verification submodule is used to perform validity verification based on a preset validity identification rule library, the identification information, and the device information, and obtain the verification result;

[0190] The failure analysis submodule is used to perform failure behavior analysis based on the user's unique identifier associated with the dataset, and obtain the failure analysis results.

[0191] The feature matching submodule is used to perform keyword and behavior sequence matching based on the order request and the pre-built attack behavior feature library to obtain the matching result;

[0192] The scoring submodule is used to obtain the comprehensive risk score based on the verification result, the failure analysis result, and the matching result;

[0193] Specifically, in the control device described above, the validity verification submodule includes:

[0194] The first sub-processing module is used to perform account identifier verification, device identifier verification, Internet Protocol address verification, and device information verification respectively, and obtain the corresponding sub-verification results;

[0195] The second sub-processing module is used to synthesize the proportion of verification failures in each of the sub-verification results to obtain the verification result.

[0196] Preferably, in the control device described above, the validity verification module further includes:

[0197] The third sub-processing module is used to determine the risk level as the highest level (first level) if the verification result is that all the sub-verification results are verification failures, and to execute the step of dynamically adjusting the resource allocation strategy and defense strategy according to the risk level.

[0198] Specifically, in the control device described above, the failure analysis submodule includes:

[0199] The fourth sub-processing module is used to classify and statistically analyze the number of order failures within a first preset time period and the reasons for each order failure to obtain the failure count statistics.

[0200] The fifth sub-processing module is used to obtain the average failure interval of consecutive order failures when the order result is the order failure, and obtain the failure frequency statistics result; otherwise, it determines that the failure frequency statistics result is zero or a missing value.

[0201] The sixth sub-processing module is used to calculate the association relationship between the identifier information according to a preset identifier association statistical method, and obtain the identifier association statistical result;

[0202] The seventh sub-processing module is used to combine the failure count statistics, the failure frequency statistics, and the identifier association statistics to obtain the failure analysis results.

[0203] Specifically, in the control device described above, the scoring submodule includes:

[0204] The eighth sub-processing module is used to obtain a verification score based on the proportion of sub-verification results that are verification failures in the verification results;

[0205] The ninth sub-processing module is used to obtain a failure score based on the failure count and cause weight corresponding to each failure cause in the failure count statistics results and the pre-obtained average failure count threshold for normal users.

[0206] The tenth sub-processing module is used to obtain a failure frequency score based on the failure frequency statistics and the corresponding frequency fluctuation weight, wherein the frequency fluctuation weight is related to the historical average frequency.

[0207] The eleventh sub-processing module is used to obtain an identifier association score based on the association coefficient and association similarity between each identifier information in the identifier association statistics results, wherein the association coefficient and the association similarity are related to the number of associations between each identifier information;

[0208] The twelfth sub-processing module is used to obtain a matching score based on the matching results;

[0209] The thirteenth sub-processing module is used to obtain a historical risk score based on the average score and weight of the first cycle within a preset number of cycles, wherein the cycle weight corresponds to the cycle difference between the corresponding cycle and the current time.

[0210] The fourteenth sub-processing module is used to perform a weighted summation of the verification score, the failure count score, the failure frequency score, the identifier association score, the historical risk score, and the matching score to obtain the comprehensive risk score.

[0211] Preferably, in the control device described above, the fourteenth sub-processing module includes:

[0212] The first processing unit is used to periodically acquire and statistically analyze preset core indicator data according to the second cycle. The core indicator data includes at least one of the following: attack identification accuracy rate, normal user false positive rate, malicious request resource occupancy rate, and defense strategy execution success rate.

[0213] The second processing unit is used to dynamically adjust the scoring weights of at least two of the verification score, the number of failures score, the failure frequency score, the identifier association score, the historical risk score, and the matching score based on the core indicator data and the corresponding reference thresholds.

[0214] Specifically, the control device described above, after obtaining the matching score, further includes:

[0215] The fifteenth sub-processing module is used to adjust the comprehensive risk score upward if the matching score is greater than or equal to the first threshold and less than the second threshold.

[0216] The sixteenth sub-processing module is used to directly determine the risk level as the highest risk level (first level) if the matching score is greater than or equal to the second threshold, and to execute the step of dynamically adjusting the resource allocation strategy and defense strategy according to the risk level.

[0217] Preferably, the control device described above, after obtaining the comprehensive risk score, further includes:

[0218] The seventeenth sub-processing module is used to lower the comprehensive risk score if the order result of the order request is successful, and adjust the downward difference of the comprehensive risk score and release resource quota according to the first preset ratio if the time interval between two consecutive successful orders is greater than a preset duration.

[0219] The eighteenth sub-processing module is used to increase the comprehensive risk score if the order placement result of the order request is an order failure, and adjust the increase difference of the comprehensive risk score and tighten the resource quota according to the second preset ratio if the reason for failure is a preset reason.

[0220] Preferably, the control device described above further includes:

[0221] The first parameter update module is used to update the average failure number threshold based on at least a number of consecutive order results after a user places an order.

[0222] And / or, the second parameter update module is used to obtain the average number of failures of all normal users in the corresponding third period and the historical average number of failures in the previous third period when the baseline update time point based on the third period is reached, and update the average number of failures threshold.

[0223] Specifically, in the control device described above, the risk level determination module includes:

[0224] The nineteenth sub-processing module is used to determine the user's risk level as the highest level (first level) when the comprehensive risk score is greater than or equal to the first score threshold.

[0225] The twentieth sub-processing module is used to determine the user's risk level as the second level of medium risk when the comprehensive risk score is greater than or equal to the second scoring threshold and less than the first scoring threshold.

[0226] The twenty-first sub-processing module is used to determine the user's risk level as the third level, which has the lowest risk, when the comprehensive risk score is less than the second scoring threshold.

[0227] Specifically, in the control device described above, the strategy adjustment module includes:

[0228] The twenty-second sub-processing module is used to determine, if the risk level is the third level, that the resource allocation strategy is a preset resource allocation strategy and the defense strategy is one that does not require additional verification.

[0229] The twenty-third sub-processing module is used to determine, if the risk level is the second level, that the resource allocation strategy is a resource quota restriction strategy and the defense strategy is enhanced verification and request rate limiting;

[0230] The twenty-fourth sub-processing module is used to determine, if the risk is at the first level, that the resource allocation strategy is a strict resource quota restriction strategy, and the defense strategy is a temporary blacklist, high-intensity verification, and attack alarm.

[0231] Specifically, the control device described above, after determining the user's risk level, further includes:

[0232] The first processing module is used to acquire system status information, which includes at least one of the following: the proportion of normal user requests, the proportion of attack requests, and the scale of the attack:

[0233] The second processing module is used to dynamically adjust the scoring threshold based on the system status information;

[0234] The third processing module is used to obtain the interference rate of the scoring threshold adjustment on normal users. If the interference rate is greater than the third threshold, the scoring threshold is reverse-calibrated. The normal user is the user of the third level with the lowest risk.

[0235] Preferably, the control device described above further includes:

[0236] The fourth processing module is used to trace and mark the identification information corresponding to the user and include it in the anomaly identification database if the risk level corresponding to the user is the highest risk level.

[0237] The fifth processing module is used to directly execute the corresponding resource allocation strategy and defense strategy if it detects that another user has initiated the order request using the identification information in the abnormal identification database.

[0238] The apparatus embodiments of this application are apparatuses corresponding to the embodiments of the methods described above. All implementation means in the method embodiments described above are applicable to the apparatus embodiments and can achieve the same technical effects. The apparatus provided in this application embodiments can implement all the method steps implemented in the method embodiments described above and can achieve the same technical effects. Therefore, the parts and beneficial effects that are the same as those in the method embodiments in this embodiment will not be described in detail here.

[0239] See Figure 9 Another embodiment of this application provides an electronic device 900, including: a processor 901, a memory 902, and a program stored in the memory 902 and executable on the processor 901. When the program is executed by the processor 901, it implements the steps of the system dynamic defense method described above and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0240] Another embodiment of this application provides a computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements the steps of the system dynamic defense method described above and achieves the same technical effect. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0241] Another embodiment of this application provides a computer program product, including computer instructions that, when executed by a processor, implement the steps of the system dynamic defense method described above and achieve the same technical effect. To avoid repetition, it will not be described again here.

[0242] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0243] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0244] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A system dynamic defense method, characterized in that, include: After receiving an order request from a user, the system collects the user's multi-dimensional identification information, device information, and request timestamp, and stores them in the user's unique identifier association dataset. The identification information includes account identifier, device identifier, and Internet Protocol address. A multi-dimensional risk assessment is conducted based on the order request, the user's unique identifier associated dataset, and the preset legal identifier rule base and attack behavior feature base to obtain a comprehensive risk score; The user's risk level is determined based on the comprehensive risk score and multiple dynamically determined scoring thresholds; Based on the risk level, dynamically adjust resource allocation and defense strategies.

2. The method according to claim 1, characterized in that, The process involves a multi-dimensional risk assessment based on the order request, the user's unique identifier associated dataset, and a pre-defined legal identifier rule base and attack behavior feature base, resulting in a comprehensive risk score, including: Based on the legal identifier rule base, the identifier information, and the device information, a legality verification is performed to obtain the verification result; Failure behavior analysis is performed based on the user's unique identifier associated dataset to obtain failure analysis results; Based on the order request and the attack behavior feature database, keyword and behavior sequence matching is performed to obtain the matching result; The comprehensive risk score is obtained based on the verification results, the failure analysis results, and the matching results.

3. The method according to claim 2, characterized in that, The step of performing a validity check based on the valid identifier rule base, the identifier information, and the device information to obtain a verification result includes: Perform account identifier verification, device identifier verification, Internet Protocol address verification, and device information verification respectively, and obtain the corresponding sub-verification results; The verification result is obtained by combining the proportion of verification failures in each of the sub-verification results.

4. The method according to claim 3, characterized in that, After obtaining the verification result, the following is also included: If the verification result is that all the sub-verification results are verification failures, then the risk level is directly determined to be the highest risk level, and the step of dynamically adjusting the resource allocation strategy and defense strategy according to the risk level is executed.

5. The method according to claim 3, characterized in that, The failure behavior analysis based on the user's unique identifier associated dataset, to obtain failure analysis results, includes: The failure count is obtained by classifying and statistically analyzing the number of times an order fails within a first preset time period and the reasons for each failure. If the order placement result is an order failure, obtain the average failure interval of consecutive order failures to obtain a failure frequency statistics result; otherwise, determine that the failure frequency statistics result is zero or a missing value. Based on a preset identifier association statistics method, the association relationships between the identifier information are statistically analyzed to obtain identifier association statistics results; The failure analysis results are obtained by combining the failure count statistics, the failure frequency statistics, and the identifier association statistics.

6. The method according to claim 5, characterized in that, The step of obtaining the comprehensive risk score based on the verification result, the failure analysis result, and the matching result includes: The verification score is obtained based on the proportion of sub-verification results that are verification failures in the verification results. Based on the failure count and cause weight corresponding to each failure cause in the failure count statistics, and the pre-obtained average failure count threshold for normal users, a failure count score is obtained. Based on the failure frequency statistics and the corresponding frequency fluctuation weights, a failure frequency score is obtained, wherein the frequency fluctuation weights are related to the historical average frequency. Based on the association coefficient and association similarity among the various identifier information in the identifier association statistics, an identifier association score is obtained, wherein the association coefficient and the association similarity are related to the number of associations among the various identifier information; Based on the matching results, a matching score is obtained; Historical risk scores are obtained based on the average score and weight of the first period within a preset number of periods, wherein the period weight corresponds to the period difference between the corresponding period and the current time. The comprehensive risk score is obtained by weighting and summing the verification score, the number of failures score, the failure frequency score, the identifier association score, the historical risk score, and the matching score.

7. The method according to claim 6, characterized in that, The comprehensive risk score is obtained by weighted summation of the verification score, the number of failures score, the failure frequency score, the identifier association score, the historical risk score, and the matching score, including: According to the second cycle, preset core indicator data are periodically acquired and statistically analyzed. The core indicator data includes at least one of the following: attack identification accuracy rate, normal user false positive rate, malicious request resource consumption rate, and defense strategy execution success rate. Based on the core indicator data and the corresponding reference thresholds, dynamically adjust the scoring weights of at least two of the following: the verification score, the number of failures score, the failure frequency score, the identifier association score, the historical risk score, and the matching score.

8. The method according to claim 6, characterized in that, After obtaining the matching score, the following is also included: If the matching score is greater than or equal to the first threshold and less than the second threshold, the comprehensive risk score is adjusted upward. If the matching score is greater than or equal to the second threshold, the risk level is directly determined to be the highest level, and the step of dynamically adjusting the resource allocation strategy and defense strategy according to the risk level is executed.

9. The method according to claim 6, characterized in that, After obtaining the comprehensive risk score, the following is also included: If the order placement request results in a successful order, the overall risk score is lowered, and if the time interval between two consecutive successful orders is greater than a preset duration, the difference in the downward adjustment of the overall risk score is adjusted, and resource quotas are released according to a first preset ratio. If the order placement request fails, the overall risk score is increased, and if the reason for failure is a preset reason, the difference in the increase of the overall risk score is adjusted, and the resource quota is tightened according to the second preset ratio.

10. The method according to claim 6, characterized in that, Also includes: After a user places an order, the average failure count threshold is updated at least based on the results of a consecutive number of orders. And / or, upon reaching the baseline update time point based on the third period, obtain the average number of failures for all normal users within the corresponding third period, as well as the historical average number of failures for the previous third period, and update the average number of failures threshold.

11. The method according to claim 1, characterized in that, The step of determining the user's risk level based on the comprehensive risk score and multiple dynamically determined scoring thresholds includes: When the comprehensive risk score is greater than or equal to the first score threshold, the user's risk level is determined to be the highest level, the first level. When the comprehensive risk score is greater than or equal to the second scoring threshold and less than the first scoring threshold, the user's risk level is determined to be the second level of medium risk. When the overall risk score is less than the second scoring threshold, the user's risk level is determined to be the third level, which has the lowest risk.

12. The method according to claim 11, characterized in that, The dynamic adjustment of resource allocation and defense strategies based on the risk level includes: If the risk level is the third level, then the resource allocation strategy is determined to be the preset resource allocation strategy, and the defense strategy is one that does not require additional verification. If the risk level is the second level, then the resource allocation strategy is determined to be a resource quota restriction strategy, and the defense strategy is enhanced verification and request rate limiting; If the risk is at the first level, then the resource allocation strategy is determined to be a strict resource quota restriction strategy, and the defense strategy is a temporary blacklist, high-intensity verification, and attack alerts.

13. The method according to claim 11, characterized in that, After determining the user's risk level, the process also includes: Obtain system status information, which includes at least one of the following: percentage of normal user requests, percentage of attack requests, and attack scale: The scoring threshold is dynamically adjusted based on the system status information. The interference rate of the scoring threshold adjustment on normal users is obtained. If the interference rate is greater than the third threshold, the scoring threshold is reverse-calibrated. The normal users are the users of the third level with the lowest risk.

14. The method according to claim 1 or 11, characterized in that, After determining the user's risk level, the method further includes: If the risk level corresponding to the user is the highest risk level, then the identification information corresponding to the user will be traced and marked, and included in the abnormal identification database; If it is detected that another user initiates the order request using the identification information in the abnormal identification database, the corresponding resource allocation strategy and defense strategy will be executed directly.

15. A control device, characterized in that, include: The data acquisition module is used to collect the user's multi-dimensional identification information, device information and request timestamp after receiving the order request initiated by the user, and store them in the user's unique identifier associated dataset. The identification information includes account identifier, device identifier and Internet Protocol address. The comprehensive assessment module is used to conduct multi-dimensional risk assessment based on the order request, the user's unique identifier associated dataset, and the preset legal identifier rule base and attack behavior feature base to obtain a comprehensive risk score; The risk level determination module is used to determine the user's risk level based on the comprehensive risk score and multiple dynamically determined scoring thresholds; The strategy adjustment module is used to dynamically adjust resource allocation strategies and defense strategies based on the risk level.

16. An electronic device, characterized in that, include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the system dynamic defense method as described in any one of claims 1 to 14.

17. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the system dynamic defense method as described in any one of claims 1 to 14.

18. A computer program product, characterized in that, It includes computer instructions that, when executed by a processor, implement the steps of the system dynamic defense method as described in any one of claims 1 to 14.

Images