Business detection method and apparatus, computer program product, and electronic device

Abstract

The present disclosure relates to the technical field of computer, and relates to a service detection method and device, a computer program product and an electronic device. The method is applied to a service detection engine, the service detection engine comprises a control node, a data transceiving node and a traffic processing node, the traffic processing node comprises a plurality of processing nodes; the method comprises: receiving a service processing strategy by the control node, and sending the service processing strategy to the data transceiving node and the traffic processing node, the control node is also used for controlling the version consistency of the processing nodes; acquiring target traffic data from global service traffic data according to the service processing strategy by the data transceiving node, and sending the target traffic data to the processing nodes; each processing node matches the target traffic data and the service processing strategy, determines the target traffic data corresponding to the processing node to be counted, and determines whether there is a rule violation service according to the statistical result of the processing node. The present disclosure can improve the comprehensiveness and accuracy of service security detection.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and more specifically, to a business detection method, a business detection device, a computer program product, and an electronic device. Background Technology

[0002] With the development of computer and internet technologies, the types and number of business violations are gradually increasing, necessitating timely detection for analysis and protection. However, traditional business detection methods rely on single-business dimensions or on point-based modifications and monitoring within the business's own system, making it difficult to achieve global monitoring. This affects the comprehensiveness and accuracy of business detection to some extent, thus failing to effectively protect the system's security.

[0003] It should be noted that the information in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0004] The purpose of this disclosure is to provide a business security testing method and apparatus, computer program product and electronic device, thereby improving the comprehensiveness and accuracy of business security testing to at least a certain extent.

[0005] Other features and advantages of this disclosure will become apparent from the following detailed description, or may be learned in part from practice of this disclosure.

[0006] According to one aspect of this disclosure, a service detection method is provided, applied to a service detection engine. The service detection engine includes a control node, a data transceiver node, and a traffic processing node. The traffic processing node includes multiple processing nodes. The method includes: receiving a service processing policy through the control node and sending the service processing policy to the data transceiver node and the traffic processing node, wherein the control node is also used to control the version consistency of the multiple processing nodes; using the data transceiver node to obtain target traffic data from global service traffic data according to the service processing policy, and sending the target traffic data to each processing node; for each processing node, matching the target traffic data with the service processing policy, determining the target traffic data corresponding to that processing node, and performing statistics, so as to determine whether there is any illegal service based on the statistical results obtained by each processing node.

[0007] In an exemplary embodiment, global service traffic data is stored in a circular array, which includes multiple levels of storage corresponding to different time granularities. For each level of storage, global traffic data is input from the tail of the circular array of that level of storage and output from the head of the circular array of that level of storage to the next level of storage.

[0008] In an exemplary embodiment, the process of using data transceiver nodes to obtain target traffic data from global business traffic data according to a business processing strategy and sending the target traffic data to each processing node includes: using data transceiver nodes to obtain target traffic data corresponding to the time range information in the global business traffic data according to the time range information in the business processing strategy; and sending the target traffic data to each processing node respectively.

[0009] In one exemplary embodiment, the service processing strategy includes processing configuration information, which is used to indicate the processing entries and metric statistics strategies corresponding to each processing node. For each processing node, the target traffic data and the service processing strategy are matched to determine the target traffic data corresponding to the processing node and perform statistics, including: determining the target processing entries for the processing node according to the service processing strategy; matching the target processing entries with the target traffic data through the processing node to determine the target traffic data corresponding to the processing node; and performing statistical processing on the target traffic data corresponding to the processing node based on the metric statistics strategy through the processing node.

[0010] In an exemplary embodiment, determining whether there is any illegal business based on the statistical results obtained by each processing node includes: summarizing the statistical results obtained by each processing node to obtain target statistical data; and performing abnormal behavior detection on the target statistical data to determine whether there is any illegal business based on the detection results.

[0011] In an exemplary embodiment, abnormal behavior detection is performed on target statistical data to determine whether there is any illegal business activity based on the detection results. This includes: determining feature values ​​corresponding to several preset business features based on the target statistical data; if a target feature value exceeds the corresponding feature threshold, it is determined that there is illegal business activity.

[0012] In one exemplary embodiment, the method further includes: adjusting the feature threshold corresponding to each preset business feature in response to triggering a target event.

[0013] In an exemplary embodiment, abnormal behavior detection is performed on target statistical data to determine whether there is any illegal business activity based on the detection results. This includes: obtaining a standard traffic model of the target business characteristics, wherein the standard traffic model is established based on historical statistical data of the target business characteristics and is used to reflect the changes of the target business characteristics over time; and verifying the feature values ​​of the target business characteristics based on the standard traffic model to determine whether there is any illegal business activity based on the verification results.

[0014] In one exemplary embodiment, the target statistics include at least one of the request dimension, the accessing user dimension, and the access target dimension.

[0015] According to one aspect of this disclosure, a service detection device is provided, applied to a service detection engine. The service detection engine includes a control node, a data transceiver node, and a traffic processing node. The traffic processing node includes multiple processing nodes. The service detection device includes: a global control module, used to receive service processing policies through the control node and send the service processing policies to the data transceiver node and the traffic processing node, wherein the control node is also used to control the version consistency of the multiple processing nodes; a traffic statistics module, used to obtain target traffic data from global service traffic data according to the service processing policies using the data transceiver node and send the target traffic data to each processing node; and a service detection module, used to match the target traffic data and the service processing policies for each processing node, determine the target traffic data corresponding to that processing node, and perform statistics to determine whether there are any illegal services based on the statistical results obtained by each processing node.

[0016] According to one aspect of this disclosure, a computer program product is provided, including a computer program that, when executed by a processor, implements any of the above methods.

[0017] According to one aspect of this disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform any of the above methods by executing the executable instructions.

[0018] The service detection method in the exemplary embodiments of this disclosure includes a service detection engine comprising a control node, a data transceiver node, and a traffic processing node. The traffic processing node comprises multiple processing nodes. The control node receives service processing policies and sends these policies to the data transceiver node and the traffic processing node. The data transceiver node retrieves target traffic data from global service traffic data according to the service processing policies and sends this target traffic data to each processing node. For each processing node, the target traffic data and the service processing policies are matched to determine the target traffic data corresponding to that processing node and perform statistical analysis. Based on the statistical results obtained by each processing node, it is determined whether any illegal services exist. On one hand, based on policy configuration, the data transceiver node can retrieve the target traffic data required by the current service processing policy from the globally collected traffic, enabling global traffic monitoring in a massive traffic environment and improving the comprehensiveness of service detection. Furthermore, since each processing node matches the target traffic data with the service processing policies to determine the target traffic data it can process for statistical processing (i.e., different processing nodes process different statistical characteristics), it avoids all processing nodes processing all target traffic data, improving concurrent processing capabilities and facilitating real-time service detection. On the other hand, by controlling the version consistency of multiple processing nodes through the control node, the processing nodes can follow the consistent version requirements when processing their respective target traffic data in parallel, thereby improving the accuracy of business detection. Since business detection can be fully and in real time, the accuracy of business detection can be improved, avoiding false alarms or missed alarms.

[0019] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0020] The above and other objects, features, and advantages of this disclosure will become readily apparent from the following detailed description of exemplary embodiments, taken in conjunction with the accompanying drawings. Several embodiments of this disclosure are illustrated in the drawings by way of example and not limitation.

[0021] Figure 1 A system logic architecture diagram according to an exemplary embodiment of the present disclosure is shown.

[0022] Figure 2 A flowchart of a service detection method according to an exemplary embodiment of the present disclosure is shown.

[0023] Figure 3 A schematic diagram of a storage structure for a ring array according to an exemplary embodiment of the present disclosure is shown.

[0024] Figure 4 A logical schematic diagram of traffic acquisition and reconstruction according to an exemplary embodiment of the present disclosure is shown.

[0025] Figure 5 A flowchart illustrating how each processing node acquires and processes target traffic data according to an exemplary embodiment of the present disclosure is shown.

[0026] Figure 6 A schematic diagram of the composition of a service detection apparatus according to an exemplary embodiment of the present disclosure is shown.

[0027] Figure 7 A block diagram of an electronic device according to an exemplary embodiment of the present disclosure is shown.

[0028] In the accompanying drawings, the same or corresponding reference numerals indicate the same or corresponding parts. Detailed Implementation

[0029] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be more comprehensive and complete, and will fully convey the concept of exemplary embodiments to those skilled in the art. The same reference numerals in the drawings denote the same or similar structures, and therefore their detailed description will be omitted.

[0030] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a thorough understanding of embodiments of this disclosure. However, those skilled in the art will recognize that the technical solutions of this disclosure can be practiced without one or more of the specific details, or other methods, components, apparatuses, steps, etc., can be employed. In other instances, well-known structures, methods, apparatuses, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of this disclosure.

[0031] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, or in one or more software-hardened modules, or in different network and / or processor devices and / or microcontroller devices.

[0032] It should be noted that the collection, updating, analysis, use, transmission, and storage of user personal information involved in the technical solution disclosed herein all comply with relevant laws and regulations, are used for legitimate and reasonable purposes, and are not shared, disclosed, or sold outside of these legitimate uses, and are subject to supervision and management by national regulatory authorities. Necessary measures should be taken to selectively block the use or access to personal information data to prevent unauthorized access to such personal information data, ensure that personnel authorized to access personal information data comply with relevant laws and regulations, and ensure the security of user personal information. Furthermore, once this user personal information data is no longer needed, the risk should be minimized by restricting or even prohibiting data collection and / or deleting the data.

[0033] Current business detection methods generally rely on single business dimensions or on the modification and monitoring of the business's own system, making it difficult to achieve global monitoring. This results in a limited monitoring scope and difficulty in fully acquiring abnormal behavior. At the same time, there is a delay in the detection and response of the system to abnormal behavior, making it impossible to take timely defensive measures. In other words, traditional business detection methods affect the comprehensiveness and accuracy of business detection to a certain extent, thus failing to effectively protect the system.

[0034] An exemplary embodiment of this disclosure provides a service detection method applied to a service detection engine. Based on the service detection engine, it enables comprehensive and accurate service security detection in environments with massive traffic. The exemplary embodiment of this disclosure can be applied to scenarios requiring service security detection, such as online social platforms and shopping platforms, and does not impose any special limitations on the application scenarios of the service detection method.

[0035] like Figure 1 A system logic architecture diagram relating to exemplary embodiments of this disclosure is shown, such as... Figure 1 As shown, the business detection engine includes control nodes, data transceiver nodes, and traffic processing nodes. The traffic processing nodes include multiple processing nodes, meaning that the data transceiver nodes and traffic processing nodes can be a logically distributed cluster to improve the processing efficiency of traffic data.

[0036] like Figure 1 As shown, the control node, acting as the global control node, can receive business processing policies and distribute them to the data transceiver nodes and traffic processing nodes. Furthermore, to ensure version consistency across processing nodes, the control node can monitor and control the versions of each node. The data transceiver nodes retrieve target traffic data from the global business traffic data and, under the control and guidance of the control node, send the target traffic data to the traffic processing nodes. The traffic processing nodes then perform traffic statistics based on the received business processing policies and, by aggregating the statistical results from all processing nodes, determine whether any unauthorized business activities exist.

[0037] In this process, target traffic data can be obtained through a distributed publish-subscribe messaging system (such as Kafka), and business processing strategies can be pushed through any of the following methods: distributed publish-subscribe messaging system, Redis, HTTP, etc. The exemplary embodiments of this disclosure do not impose specific restrictions on the specific methods of obtaining traffic data and pushing business processing strategies.

[0038] refer to Figure 2 The diagram shown is a flowchart of a service detection method according to an exemplary embodiment of the present disclosure. The service detection method includes steps S210 to S230, as detailed below:

[0039] In step S210, the control node receives the service processing policy and sends the service processing policy to the data transceiver node and the traffic processing node. The control node is also used to ensure that the versions of multiple processing nodes are consistent.

[0040] In the exemplary embodiments of this disclosure, the service processing strategy refers to strategy information used to guide data transceiver nodes to collect traffic data and to guide traffic processing nodes to obtain their target traffic data and perform statistics. The service processing strategy may include, but is not limited to, time range information and processing configuration information. The time range information guides the time range for service detection and can be at the second, minute, hour, or day level, for example, indicating the acquisition of target traffic data within the most recent second, minute, hour, or day. Of course, the exemplary embodiments of this disclosure can set the time range information according to actual detection needs. Additionally, the default time range information can be set to 5 minutes, without limitation.

[0041] The processing configuration information guides the processing nodes in processing traffic data, specifically indicating the processing entries and statistical strategies for each node. Processing entries reflect which processing nodes can process which traffic data, and statistical strategies include specific methods for statistically analyzing the traffic data, such as statistical dimensions and feature types. Exemplary embodiments of this disclosure allow for configuration of the specific content of the processing configuration information according to actual needs, without imposing specific limitations.

[0042] Controlling the version consistency of multiple processing nodes by the control node ensures that each processing node follows a unified processing standard. That is, when a traffic processing node needs to be upgraded, it must be ensured that the versions of each processing node are upgraded to the same version at the same time, thereby ensuring the accuracy and consistency of the final statistical data.

[0043] In step S220, the data transceiver node obtains the target traffic data from the global business traffic data according to the business processing strategy, and sends the target traffic data to each processing node.

[0044] In the exemplary embodiments of this disclosure, as described above, the service processing strategy includes time range information. Data transceiver nodes can obtain the target traffic data corresponding to the time range information from the global service traffic data based on the time range information in the service processing strategy. That is, data transceiver nodes can obtain the required target traffic data from the global service traffic data according to the service processing strategy. For example, if the service processing strategy indicates second-level service detection, the data transceiver node can obtain the target traffic data from the global service traffic data at the second level; if the service processing strategy indicates day-level service detection, the data transceiver node can obtain the target traffic data from the global service traffic data at the day level.

[0045] Global business traffic data refers to the total traffic of the business detection system, encompassing all business traffic data collected and statistically analyzed. This global business traffic data is stored in a circular array, enabling the reading and writing of massive amounts of data, a process detailed later. Global business traffic data includes, but is not limited to, Layer 7 protocol logs, Layer 4 flow logs (records of user access to external network flows), and LB logs (load balancing logs), without any special restrictions.

[0046] After acquiring the target traffic data, the data transceiver node sends the target traffic data to each processing node so that each processing node can process the traffic data it needs to process.

[0047] In step S230, for each processing node, the target traffic data and business processing strategy are matched to determine the target traffic data corresponding to the processing node and perform statistics, so as to determine whether there is any illegal business based on the statistical results obtained from each processing node.

[0048] In an exemplary embodiment of this disclosure, the processes by which different processing nodes process their respective target traffic data do not interfere with each other. Since the target traffic data and the service processing strategy are matched, each processing node can determine the target traffic data that needs to be processed by that processing node. For example, target traffic data belonging to items 1 to 100 is processed by the first processing node, target traffic data belonging to items 101 to 150 is processed by the second processing node, and so on.

[0049] After determining and statistically analyzing the target traffic data at each processing node, the presence of any unauthorized transactions is determined based on the statistical results from all processing nodes. The presence of abnormal traffic statistics indicates the existence of unauthorized transactions.

[0050] When each processing node performs statistics on its target traffic data, it can do so from at least one of the following dimensions: request dimension, access user dimension, and access target dimension, without any restrictions.

[0051] For example, at the request dimension, the number and characteristics of each request can be counted; at the user dimension, the behavioral characteristics of each user (such as the number of requests, request frequency, etc.) can be counted; and at the destination dimension, the access volume and frequency of each URL (uniform resource location) can be counted. Of course, other types or finer-grained content can also be counted according to actual needs, including but not limited to the above-mentioned statistical content. Optionally, the exemplary embodiments of this disclosure can perform multi-dimensional and multi-time-range statistics on traffic data based on the Flink framework.

[0052] The service detection method in the exemplary embodiments of this disclosure, on the one hand, can obtain the target traffic data required by the current service processing strategy from the globally collected traffic through data transceiver nodes based on policy configuration. This enables monitoring of global traffic in a massive traffic environment, improving the comprehensiveness of service detection. Furthermore, since each processing node matches the target traffic data with the service processing strategy to determine the target traffic data it can process and performs statistical processing, meaning that different processing nodes process different statistical characteristics, it avoids all processing nodes processing all target traffic data, improving concurrent processing capabilities and thus facilitating real-time service detection. On the other hand, by controlling the version consistency of multiple processing nodes through the control node, the processing nodes follow consistent version requirements when processing their respective target traffic data in parallel, improving the accuracy of service detection. Because it can achieve comprehensive and real-time service detection, it improves the accuracy of service detection and avoids false alarms or missed alarms.

[0053] In one exemplary embodiment, global service traffic data is stored in a circular array, which includes multiple levels of storage corresponding to different time granularities. Specifically, for each level of storage, global traffic data is input from the tail of the circular array of that level and output from the head of the circular array of that level to the next level of storage.

[0054] Circular memory structures can be reused cyclically, thus eliminating the need to allocate a fixed amount of memory continuously. When the buffer of a circular memory structure is full, new data overwrites the oldest data, reducing memory usage and making it beneficial for handling large amounts of data. Furthermore, circular memory structures improve the efficiency of data reading and writing. Because data is stored cyclically in the buffer of a circular memory structure, the read / write pointers only need to move continuously without frequent memory allocation and deallocation. This makes circular memory structures suitable for handling high-speed data streams, such as network transmissions or real-time data processing.

[0055] Specifically, for each storage level, global traffic data is input from the tail of the circular array of that level, and timeout data is output from the head of the circular array of that level or input to the next level of storage. Correspondingly, when reading data from the circular array, data with the corresponding time range information can be obtained step by step from the tail upwards based on the time range information. If the circular array of the current storage level has been completely read, the process continues to read the next level of storage.

[0056] Specifically, Figure 3 A schematic diagram illustrating a storage structure of a circular array according to an exemplary embodiment of the present disclosure is shown, such as... Figure 3 As shown, this includes multi-level storage corresponding to different time granularities. The lowest time granularity is seconds, and subsequent granularities can be integer multiples of seconds, or even minutes, days, etc. To reduce data volume, traffic data in the circular array at lower time granularities can be aggregated and statistically analyzed, and the results passed to the next level of the circular array. Similarly, traffic data in the next level of the circular array can be aggregated and statistically analyzed, and then passed to the next level of the circular array. Given sufficient memory, a circular data structure can store data spanning hours, days, or even months.

[0057] Optionally, when traffic data in adjacent time periods is the same, compressed storage can be used to save memory. For example, in the case of sparse data, the same traffic data in adjacent time periods can be merged into a single data segment, that is, stored only once, thereby reducing memory usage.

[0058] Optionally, through multi-level storage with multiple time granularities, statistical values ​​of business characteristics can also be stored, such as the total value of business characteristics. It can also support the total number of business characteristics in the most recent time or deduplication query, etc., which will not be described in detail.

[0059] Furthermore, acquiring global business traffic data involves traffic collection and reconstruction. Raw network traffic is presented in binary format and cannot be directly read or used. Therefore, relevant tools and technologies are needed to transform the network traffic into easily readable data. This process requires decoding and analyzing the collected network traffic, including identifying protocols and services within the traffic and extracting raw files. For example, the process of parsing and reconstructing traffic data packets involves extracting, parsing, and reassembling fields from various locations in the binary bitstream. This process utilizes multiple technologies, including port matching, traffic feature detection, automatic connection association, and behavioral feature analysis. Figure 4 A logical diagram of traffic acquisition and reconstruction is shown, such as... Figure 4As shown, network traffic can be collected using hardware acceleration technologies (such as DPDK (Data Plane Development Kit) / PF_RING (a packet processing speed tool)). Then, packet capture, IP fragment reassembly, TCP (Transmission Control Protocol) / UDP (User Datagram Protocol) state tracking and flow table session management, as well as protocol identification and analysis, yield global service traffic data. The processing logic for this traffic collection and reconstruction is no different from traditional traffic collection and reconstruction logic, and therefore, no excessive restrictions are imposed.

[0060] The exemplary embodiments of this disclosure utilize a multi-level storage ring array structure with multi-level time granularity to store statistical data over long time spans. When performing real-time business detection, the required target business data can be obtained from the ring array according to the business processing strategy, providing basic traffic data for comprehensive and real-time business detection.

[0061] In one exemplary embodiment, such as Figure 5 As shown, each processing node matches the target traffic data with the business processing strategy, determines the target traffic data corresponding to that processing node, and performs statistics, which may include:

[0062] Step S510: Determine the target processing item for this processing node based on the business processing strategy.

[0063] As mentioned above, the business processing strategy includes processing configuration information, which is used to instruct the processing entries and metric statistics strategies corresponding to each processing node. Optionally, the control node can send the complete processing configuration information to each processing node, enabling each processing node to match the target processing entry with the target traffic data to determine its corresponding target traffic data. Optionally, the control node can also split the processing entries according to the entries that each processing node can process, and send the split results to the corresponding processing nodes separately. In this case, the reason why it is still necessary to match the target processing entry with the target traffic data through the processing nodes is to ensure the accuracy of the traffic data processed by each processing node.

[0064] Step S520: Match the target processing entry with the target traffic data through the processing node to determine the target traffic data corresponding to the processing node.

[0065] Processing entries can be URL information. By matching the URL information with the target traffic data URL, the target traffic data corresponding to each processing node is determined. For example, for a certain processing node, the traffic data URL that matches its corresponding processing entry is used as the target traffic data for that processing node. Of course, the way to set processing entries is not limited to this; they can also be divided by entry number, which can be flexibly set according to actual needs.

[0066] Step S530: Perform statistical processing on the target traffic data corresponding to the processing node based on the indicator statistical strategy.

[0067] As mentioned above, the statistical strategy for indicators may include statistical dimensions, and the processing node can perform statistical processing on the target traffic data corresponding to the statistical indicator strategy.

[0068] Different processing nodes can obtain and statistically analyze their respective target traffic data, thus avoiding the situation where all processing nodes process all target traffic data. This improves data statistical efficiency and consequently enhances the efficiency of business detection.

[0069] In one exemplary embodiment, determining whether there are any illegal transactions based on the statistical results obtained from each processing node may include:

[0070] The statistical results obtained from each processing node are summarized to obtain the target statistical data;

[0071] Perform anomaly detection on target statistical data to determine whether there are any illegal operations based on the detection results.

[0072] See also Figure 1 As shown, after obtaining the statistical results, each processing node can store them in Redis. Then, it can aggregate the data stored in the database to obtain the target statistical data. The target statistical data includes at least one of the following dimensions: request dimension, access user dimension, and access target dimension. For each dimension, the target statistical data corresponding to the time range information is obtained.

[0073] In some optional embodiments, performing abnormal behavior detection on target statistical data to determine whether there are any unauthorized business activities based on the detection results may include:

[0074] Based on the target statistical data, the feature values ​​of several preset business characteristics are determined. If any target feature value exceeds the corresponding feature threshold, it is determined that there is an illegal business.

[0075] For example, if the number of IPs using the same request packet exceeds a corresponding feature threshold, then an illegal service is identified. For a gateway, if the data traffic at 9:00 AM exceeds a set feature threshold of 500, then an illegal service is identified, and so on. These are just a few examples.

[0076] In the exemplary embodiments of this disclosure, when an illegal service is identified, an alarm mechanism can be triggered through alarm and response nodes to notify the administrator. Alternatively, timely protection can be provided in conjunction with WAF (Web Application Firewall) response measures, including but not limited to limiting the access frequency of abnormal IP addresses, blocking abnormal IP addresses, or adjusting blocking rules. No specific limitations are imposed on these measures. It should be understood that, in the exemplary embodiments of this disclosure, when an illegal service is identified, the corresponding IP address or service can be determined based on the service characteristics corresponding to the illegal service.

[0077] In some optional embodiments, the feature thresholds corresponding to each preset business feature can also be adjusted in response to the triggering of a target event. Here, a target event refers to an event that affects business traffic data, such as a platform's major promotional activities. Since the occurrence of a target event will affect the business traffic data of the preset business features—for example, the network traffic of an online shopping platform during a major promotion is significantly higher than normal levels—the feature thresholds corresponding to each preset business feature can be adjusted in response to the triggering of the target event, such as by increasing the feature thresholds. This can avoid false alarms from the system during the occurrence of the target event and improve the accuracy of security detection.

[0078] In some optional embodiments, performing abnormal behavior detection on target statistical data to determine whether there are any unauthorized business activities based on the detection results may include:

[0079] A standard traffic model of the target business characteristics is obtained, and the feature values ​​of the target business characteristics are verified based on the standard traffic model to determine whether any illegal business activities exist. The standard traffic model is established based on historical statistical data of the target business characteristics to reflect how these characteristics change over time. The target business characteristics are set according to actual needs, such as the access traffic of certain gateways with very high access traffic.

[0080] Standard traffic models can be built based on historical statistical data of target business characteristics, or they can be built by combining machine learning algorithms. For example, one can statistically analyze the network traffic of a gateway every half hour, starting at 9:00 AM each day for seven days. Then, the average network traffic at each time point over the seven days is taken to build a standard traffic model for the gateway's network traffic. Subsequently, when the gateway's current network traffic is obtained, if the characteristic value of the current network traffic at 9:00 AM is significantly higher than the characteristic average value at 9:00 AM indicated in the standard traffic model, then an illegal business activity is identified.

[0081] By utilizing historical statistical data to establish a standard traffic model for target business characteristics, dynamic thresholds for these characteristics can be continuously established. This allows for the detection of business violations based on these dynamic thresholds, supplementing the threshold-based comparison detection method mentioned above and improving the overall accuracy of business detection.

[0082] The service detection method in the exemplary embodiments of this disclosure includes a service detection engine comprising a control node, a data transceiver node, and a traffic processing node. The traffic processing node comprises multiple processing nodes. The control node receives service processing policies and sends these policies to the data transceiver node and the traffic processing node. The data transceiver node retrieves target traffic data from global service traffic data according to the service processing policies and sends this target traffic data to each processing node. For each processing node, the target traffic data and the service processing policies are matched to determine the target traffic data corresponding to that processing node and perform statistical analysis. Based on the statistical results obtained by each processing node, it is determined whether any illegal services exist. On one hand, based on policy configuration, the data transceiver node can retrieve the target traffic data required by the current service processing policy from the globally collected traffic, enabling global traffic monitoring in a massive traffic environment and improving the comprehensiveness of service detection. Furthermore, since each processing node matches the target traffic data with the service processing policies to determine the target traffic data it can process for statistical processing (i.e., different processing nodes process different statistical characteristics), it avoids all processing nodes processing all target traffic data, improving concurrent processing capabilities and facilitating real-time service detection. On the other hand, by controlling the version consistency of multiple processing nodes through the control node, the processing nodes can follow the consistent version requirements when processing their respective target traffic data in parallel, thereby improving the accuracy of business detection. Since business detection can be fully and in real time, the accuracy of business detection is improved, and false alarms or missed alarms are avoided.

[0083] In an exemplary embodiment of this disclosure, a service detection apparatus is also provided, applied to a service detection engine. The service detection engine includes a control node, a data transceiver node, and a traffic processing node, wherein the traffic processing node includes multiple processing nodes. (See reference...) Figure 6 As shown, the service detection device 600 may include a global control module 610, a traffic statistics module 620, and a service detection module 630. Specifically:

[0084] A global control module 610 is used to receive service processing policies through the control node and send the service processing policies to the data transceiver node and the traffic processing node. The control node is also used to control the version consistency of the multiple processing nodes. A traffic statistics module 620 is used to obtain target traffic data from global service traffic data according to the service processing policies using the data transceiver node and send the target traffic data to each of the processing nodes. A service detection module 630 is used to match the target traffic data and the service processing policies for each processing node, determine the target traffic data corresponding to the processing node, and perform statistics to determine whether there are any illegal services based on the statistical results obtained by each processing node.

[0085] In an exemplary embodiment, global service traffic data is stored in a circular array, which includes multiple levels of storage corresponding to different time granularities. For each level of storage, global traffic data is input from the tail of the circular array of that level of storage and output from the head of the circular array of that level of storage to the next level of storage.

[0086] In an exemplary embodiment, the traffic statistics module 620 is configured to perform the following: using the data transceiver node to obtain the target traffic data corresponding to the time range information from the global business traffic data according to the time range information in the business processing strategy; and sending the target traffic data to each processing node respectively.

[0087] In an exemplary embodiment, the service processing strategy includes processing configuration information, which is used to indicate the processing entries and indicator statistics strategies corresponding to each processing node; the service detection module 630 is configured to perform: determining the target processing entry of the processing node according to the service processing strategy; matching the target processing entry with the target traffic data through the processing node to determine the target traffic data corresponding to the processing node; and performing statistical processing on the target traffic data corresponding to the processing node based on the indicator statistics strategy through the processing node.

[0088] In an exemplary embodiment, the service detection module 630 is configured to perform: summarizing the statistical results obtained from each processing node to obtain target statistical data; and performing abnormal behavior detection on the target statistical data to determine whether there is any illegal service based on the detection results.

[0089] In an exemplary embodiment, the service detection module 630 is configured to perform the following: determine feature values ​​corresponding to several preset service features based on target statistical data; if a target feature value exceeds the corresponding feature threshold, then it is determined that there is an illegal service.

[0090] In an exemplary embodiment, the service detection module 630 is further configured to perform: adjusting the feature thresholds corresponding to each preset service feature in response to triggering a target event.

[0091] In an exemplary embodiment, the service detection module 630 is configured to perform: obtaining a standard traffic model of the target service characteristics, the standard traffic model being established based on historical statistical data of the target service characteristics to reflect the changes of the target service characteristics over time; and verifying the feature values ​​of the target service characteristics based on the standard traffic model to determine whether there are any illegal services based on the verification results.

[0092] In one exemplary embodiment, the target statistics include at least one of the request dimension, the accessing user dimension, and the access target dimension.

[0093] Since the details of each functional module of the service detection apparatus of the exemplary embodiments of this disclosure have been described in the exemplary embodiments of the service detection method described above, they will not be repeated here.

[0094] It should be noted that although several modules or units of the service detection device have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0095] An exemplary embodiment of this disclosure also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, implements the above-described business detection method.

[0096] In one embodiment, the computer program product can be a tangible product containing a computer program, such as a computer-readable storage medium storing the computer program. The readable storage medium can be a storage medium based on electrical, magnetic, optical, electromagnetic, infrared, or other signals, including but not limited to: random access memory (RAM), read-only memory (ROM), magnetic tape, floppy disk, flash memory, hard disk drive (HDD), solid-state drive (SSD), etc. For example, the computer program product can be implemented as a non-volatile storage medium storing the computer program, such as read-only memory, NAND flash memory, etc.

[0097] In one implementation, the computer program product can be an intangible product containing a computer program. For example, the computer program product can be implemented as a virtual digital product, such as an executable file, installation package, or other digital file storing the computer program.

[0098] Computer program code can be written in one or more programming languages. Examples of programming languages ​​include C, Java, and C++. Program code can execute entirely on the user's computing device, partially on the user's computing device, or as a standalone software package. It can also execute partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, such as a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via an internet connection provided by a mobile network operator).

[0099] Computer programs can be carried or transmitted via signals such as electrical, magnetic, optical, electromagnetic, and infrared rays. Electronic devices can convert the signals carrying computer programs into digital signals, thereby running the computer programs. When a computer program runs on an electronic device, its code is used to cause the electronic device to execute (more specifically, the processor of the electronic device to execute) the method steps of various exemplary embodiments of this disclosure, such as the data processing method described above.

[0100] Furthermore, in exemplary embodiments of this disclosure, an electronic device capable of implementing the above-described methods is also provided. Those skilled in the art will understand that various aspects of this disclosure can be implemented as systems, methods, or program products. Therefore, various aspects of this disclosure can be specifically implemented as entirely hardware embodiments, entirely software embodiments (including firmware, microcode, etc.), or embodiments combining hardware and software aspects, collectively referred to herein as "circuit," "module," or "system."

[0101] The following reference Figure 7 To describe an electronic device 700 according to such an embodiment of the present disclosure. Figure 7 The electronic device 700 shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments disclosed herein.

[0102] like Figure 7 As shown, the electronic device 700 is manifested in the form of a general-purpose computing device. The components of the electronic device 700 may include, but are not limited to: at least one processing unit 710, at least one storage unit 720, a bus 730 connecting different system components (including storage unit 720 and processing unit 710), and a display unit 740.

[0103] The storage unit stores program code that can be executed by the processing unit 710, causing the processing unit 710 to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of this disclosure. For example, the processing unit 710 can perform the steps shown in the exemplary embodiments described above.

[0104] Storage unit 720 may include a readable medium in the form of a volatile storage unit, such as random access memory (RAM) 721 and / or cache memory 722, and may further include a read-only memory (ROM) 723.

[0105] The storage unit 720 may also include a program / utility 724 having a set (at least one) of program modules 725, including but not limited to: an operating system, one or more application programs, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.

[0106] Bus 730 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0107] Electronic device 700 can also communicate with one or more external devices 800 (e.g., keyboard, pointing device, Bluetooth device, etc.), and with one or more devices that enable a user to interact with electronic device 700, and / or with any device that enables electronic device 700 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 750. Furthermore, electronic device 700 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 760. As shown, network adapter 760 communicates with other modules of electronic device 700 via bus 730. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 700, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0108] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0109] Furthermore, the above figures are merely illustrative of the processes included in the method according to exemplary embodiments of this disclosure and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0110] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and embodiments are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the claims.

Claims

1. A business detection method, characterized in that, Applied to a business detection engine, the business detection engine includes a control node, a data transceiver node, and a traffic processing node, the traffic processing node including multiple processing nodes, the method includes: The control node receives the service processing policy and sends the service processing policy to the data transceiver node and the traffic processing node. The control node is also used to ensure that the versions of the multiple processing nodes are consistent. The data transceiver nodes are used to obtain target traffic data from global business traffic data according to the business processing strategy, and the target traffic data is sent to each of the processing nodes. For each processing node, the target traffic data and the business processing strategy are matched to determine the target traffic data corresponding to that processing node and perform statistics to determine whether there is any illegal business based on the statistical results obtained from each processing node.

2. The method according to claim 1, characterized in that, The global business traffic data is stored in a circular array, which includes multi-level storage corresponding to different time granularities; Specifically, for each storage level, the global traffic data is input from the tail of the circular array of that storage level and output from the head of the circular array of that storage level to the next storage level.

3. The method according to claim 1 or 2, characterized in that, The step of using the data transceiver node to obtain target traffic data from global service traffic data according to the service processing strategy, and sending the target traffic data to each of the processing nodes, includes: Using the data transceiver node, the target traffic data corresponding to the time range information in the business processing strategy is obtained from the global business traffic data; The target traffic data is sent to each of the processing nodes respectively.

4. The method according to claim 1, characterized in that, The business processing strategy includes processing configuration information, which is used to indicate the processing entries and indicator statistics strategies corresponding to each processing node; For each processing node, the target traffic data and the service processing strategy are matched to determine the target traffic data corresponding to that processing node and statistical analysis is performed, including: The target processing item for the processing node is determined according to the business processing strategy. The target processing entry is matched with the target traffic data through the processing node to determine the target traffic data corresponding to the processing node; The processing node performs statistical processing on the target traffic data corresponding to the processing node based on the indicator statistical strategy.

5. The method according to claim 1, characterized in that, The step of determining whether there are any illegal transactions based on the statistical results obtained from each of the processing nodes includes: The statistical results obtained from each of the processing nodes are summarized to obtain the target statistical data; Anomaly detection is performed on the target statistical data to determine whether any illegal business activities exist based on the detection results.

6. The method according to claim 5, characterized in that, The step of detecting abnormal behavior in the target statistical data, and determining whether there are any illegal business operations based on the detection results, includes: Based on the target statistical data, determine the feature values ​​corresponding to several preset business features; If a target feature value exceeds the corresponding feature threshold, then it is determined that there is an illegal business activity.

7. The method according to claim 6, characterized in that, The method further includes: In response to the triggering of the target event, the feature thresholds corresponding to each of the preset business features are adjusted.

8. The method according to claim 6, characterized in that, The step of detecting abnormal behavior in the target statistical data, and determining whether there are any illegal business operations based on the detection results, includes: A standard traffic model for obtaining target business characteristics is established based on historical statistical data of the target business characteristics, and is used to reflect the changes of the target business characteristics over time. The feature values ​​of the target business characteristics are verified based on the standard traffic model to determine whether there are any illegal businesses based on the verification results.

9. The method according to claim 5, characterized in that, The target statistics include at least one of the following: request dimension, access user dimension, and access target dimension.

10. A business detection device, characterized in that, The service detection device is applied to a service detection engine, which includes a control node, a data transceiver node, and a traffic processing node. The traffic processing node includes multiple processing nodes. A global control module is used to receive service processing policies through the control node and send the service processing policies to the data transceiver node and the traffic processing node. The control node is also used to control the version consistency of the multiple processing nodes. The traffic statistics module is used to obtain target traffic data from global business traffic data according to the business processing strategy using the data transceiver node, and send the target traffic data to each of the processing nodes; The service detection module is used to match the target traffic data and the service processing strategy for each processing node, determine the target traffic data corresponding to the processing node and perform statistics, so as to determine whether there is any illegal service based on the statistical results obtained from each processing node.

11. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method according to any one of claims 1 to 9.

12. An electronic device, characterized in that, include: processor; as well as Memory for storing the executable instructions of the processor; The processor is configured to perform the method of any one of claims 1 to 9 by executing the executable instructions.

Images