An unauthorized access detection method, device and electronic equipment

Abstract

The application discloses an unauthorized access detection method and device and electronic equipment, and relates to the technical field of network security, and aims to improve the accuracy of unauthorized access detection and reduce the false positive rate, comprising: acquiring at least one first access behavior data in a historical time period and at least one second access behavior data in a current time period respectively; constructing a first permission behavior relationship graph based on the first access behavior data, and constructing a second permission behavior relationship graph based on the second access behavior data; determining an abnormal score of a target source IP address based on the first permission behavior relationship graph and the second permission behavior relationship graph; when the abnormal score is greater than a preset threshold, determining whether the target source IP address exists an unauthorized access behavior according to a first API access set, a second API access set and a third API access set, and obtaining an unauthorized access detection result. In this way, whether the source IP address exists an abnormal connection condition can be accurately identified, and the accuracy of unauthorized access detection is improved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, apparatus and electronic device for detecting unauthorized access. Background Technology

[0002] Unauthorized access is a common vulnerability in network security, typically categorized into horizontal and vertical privilege escalation. Horizontal privilege escalation allows users to manipulate or access resources belonging to other users at the same privilege level, such as data, files, and orders, but prevents access to functions with higher privilege levels. Vertical privilege escalation, on the other hand, allows lower-privilege users to manipulate or access resources belonging to higher-privilege users (such as administrators), thus exceeding their own privilege level. Therefore, both horizontal and vertical privilege escalation can easily lead to issues such as the leakage of sensitive data.

[0003] Therefore, to avoid sensitive data leaks and other problems, unauthorized access detection to identify potential security threats is an indispensable technical means. One related technology is to implement unauthorized access detection by setting business logic and rules. However, this method relies on manually written rules, requiring personnel to have strong prior knowledge, and the rules set are often not very accurate. Alternatively, detection methods based on user behavior analysis can be used, which construct behavioral baselines by statistically analyzing user access frequency and time distribution to identify unauthorized access behavior. However, this method usually only focuses on the behavior of individual objects, ignoring the current business environment and group relationships of individual objects, resulting in low detection accuracy and high false positive rates in complex and dynamic network environments.

[0004] Therefore, how to provide an unauthorized access detection method that can achieve high detection accuracy and low false alarm rate in complex and dynamic network environments is a technical problem that urgently needs to be solved. Summary of the Invention

[0005] This application provides an unauthorized access detection method, apparatus, and electronic device to improve the accuracy of unauthorized access detection and reduce the false alarm rate during the unauthorized access detection process.

[0006] Firstly, this application provides a method for detecting unauthorized access, the method comprising: Acquire at least one first access behavior data within a historical time period and at least one second access behavior data within the current time period; wherein, the first access behavior data and the second access behavior data include at least the association relationship between the source IP address and the destination IP address and the association relationship between the source IP address and the destination API; A first permission behavior relationship diagram is constructed based on the first access behavior data, and a second permission behavior relationship diagram is constructed based on the second access behavior data; Based on the first permission behavior relationship diagram and the second permission behavior relationship diagram, the abnormal score of the target source IP address is determined; When the abnormal score exceeds a preset threshold, the system determines whether the target source IP address has engaged in unauthorized access behavior based on the first API access set, the second API access set, and the third API access set, and obtains the unauthorized access detection result. The first API access set includes the target APIs corresponding to the target source IP address in the current time period, the second API access set includes the target APIs corresponding to other source IP addresses in the same permission behavior relationship graph as the target source IP address in the current time period, and the third API access set includes the target APIs corresponding to the target source IP address in historical time periods.

[0007] By introducing a permission behavior graph, the accuracy of detecting and identifying unauthorized access such as lateral movement of legitimate identities and API abuse and privilege escalation can be improved. The anomaly score calculation method can quantify the degree of structural changes in the permission behavior graph and accurately capture abnormal changes in the source IP address.

[0008] In one optional implementation, constructing a first permission behavior relationship graph based on first access behavior data and constructing a second permission behavior relationship graph based on second access behavior data includes: Determine the number of times each source IP address accessed the destination IP address and the number of times each source IP address accessed the destination API within a historical time period, and determine the number of times each source IP address accessed the destination IP address and the number of times each source IP address accessed the destination API within the current time period. If, within a historical time period, the number of times any two source IP addresses access the same destination IP address exceeds a first threshold and / or the number of times any two source IP addresses access the same destination API exceeds a second threshold, then a first permission behavior relationship graph is established based on any two source IP addresses. Similarly, if, within the current time period, the number of times any two source IP addresses access the same destination IP address exceeds the first threshold and / or the number of times any two source IP addresses access the same destination API exceeds the second threshold, then a second permission behavior relationship graph is established based on any two source IP addresses. In either the first or second permission behavior relationship graph, any two source IP addresses serve as nodes, and the association between any two source IP addresses serves as edges.

[0009] By constructing a permission behavior relationship diagram using the above method, the permission behavior relationship diagram of the source IP address is regarded as its proper permission behavior benchmark. By determining the correspondence between the source IP address and the permission behavior relationship diagram, it is possible to accurately identify whether there are abnormal connection situations of the source IP address.

[0010] In one optional implementation, the anomaly score of the target source IP address is determined based on the first permission behavior relationship graph and the second permission behavior relationship graph, including: A preset community detection algorithm is used to cluster the nodes in the first permission behavior relationship graph to obtain at least one first permission behavior relationship subgraph, and a preset community detection algorithm is used to cluster the nodes in the second permission behavior relationship graph to obtain at least one second permission behavior relationship subgraph. Extract the first connection feature vector corresponding to each node in each first permission behavior relationship subgraph, and extract the second connection feature vector corresponding to each node in each second permission behavior relationship subgraph; wherein, the first connection feature vector and the second connection feature vector include at least: the shortest path length from any node to other nodes in the corresponding permission behavior relationship subgraph and the connection pressure index between any node and other nodes in the corresponding permission behavior relationship subgraph; Based on each first connection feature vector, a first permission behavior matrix is ​​obtained, and based on each second connection feature vector, a second permission behavior matrix is ​​obtained. The feature similarity inner product is obtained based on the first permission behavior matrix and the second permission behavior matrix, and the norm squared corresponding to the second permission behavior matrix is ​​obtained based on the second permission behavior matrix; wherein, the feature similarity inner product is used to indicate the connection consistency of the target source IP in the current time period and the historical time period. Anomaly scores for target source IP addresses are determined based on feature similarity inner product and norm squared.

[0011] In one optional implementation, based on the first API access set, the second API access set, and the third API access set, it is determined whether the target source IP address has engaged in unauthorized access behavior, and an unauthorized access detection result is obtained, including: Determine the target difference set corresponding to the first API access set and the third API access set; wherein, the target difference set includes APIs that were accessible by the source IP address in the historical time period, but were not accessed in the current time period; Based on the difference between the second API access set and the target set, determine whether the target source IP address has unauthorized access behavior and obtain the unauthorized access detection result.

[0012] By constructing a triple API access set using the above method, we can accurately identify resources that other source IP addresses can access but have no historical access rights to in the relationship graph of the same permission behavior, which significantly improves the accuracy of unauthorized behavior detection.

[0013] In one optional implementation, based on the difference between the second API access set and the target set, it is determined whether the target source IP address has engaged in unauthorized access behavior, and an unauthorized access detection result is obtained, including: If the intersection of the second API access set and the target difference set is not empty, then it is determined that the target source IP address has engaged in unauthorized access behavior.

[0014] In one optional implementation, after determining that the target source IP address has engaged in unauthorized access, the method further includes: Output a list of source IP addresses that exhibit unauthorized access behavior and their corresponding URL relationships.

[0015] The above methods can also automatically generate interpretable chains of evidence, providing a basis for security operations and improving the credibility of security operations.

[0016] Secondly, this application provides an unauthorized access detection device, the device comprising: The acquisition module is used to acquire at least one first access behavior data within a historical time period and at least one second access behavior data within the current time period; wherein, the first access behavior data and the second access behavior data include at least the association relationship between the source IP address and the destination IP address and the association relationship between the source IP address and the destination API. The graph building module is used to build a first permission behavior relationship graph based on the first access behavior data, and to build a second permission behavior relationship graph based on the second access behavior data; The scoring module is used to determine the abnormal score of the target source IP address based on the first permission behavior relationship diagram and the second permission behavior relationship diagram. The processing module is used to determine whether the target source IP address has engaged in unauthorized access behavior based on the first API access set, the second API access set, and the third API access set when the abnormal score exceeds a preset threshold, and to obtain the unauthorized access detection result. The first API access set includes the target APIs corresponding to the target source IP address in the current time period, the second API access set includes the target APIs corresponding to other source IP addresses in the same permission behavior relationship graph as the target source IP address in the current time period, and the third API access set includes the target APIs corresponding to the target source IP address in historical time periods.

[0017] In one optional implementation, when constructing a first permission behavior relationship graph based on first access behavior data and a second permission behavior relationship graph based on second access behavior data, the graph construction module is specifically used for: Determine the number of times each source IP address accessed the destination IP address and the number of times each source IP address accessed the destination API within a historical time period, and determine the number of times each source IP address accessed the destination IP address and the number of times each source IP address accessed the destination API within the current time period. If, within a historical time period, the number of times any two source IP addresses access the same destination IP address exceeds a first threshold and / or the number of times any two source IP addresses access the same destination API exceeds a second threshold, then a first permission behavior relationship graph is established based on any two source IP addresses. Similarly, if, within the current time period, the number of times any two source IP addresses access the same destination IP address exceeds the first threshold and / or the number of times any two source IP addresses access the same destination API exceeds the second threshold, then a second permission behavior relationship graph is established based on any two source IP addresses. In either the first or second permission behavior relationship graph, any two source IP addresses serve as nodes, and the association between any two source IP addresses serves as edges.

[0018] In one optional implementation, when determining the anomaly score of the target source IP address based on the first permission behavior relationship diagram and the second permission behavior relationship diagram, the scoring module is specifically used for: A preset community detection algorithm is used to cluster the nodes in the first permission behavior relationship graph to obtain at least one first permission behavior relationship subgraph, and a preset community detection algorithm is used to cluster the nodes in the second permission behavior relationship graph to obtain at least one second permission behavior relationship subgraph. Extract the first connection feature vector corresponding to each node in each first permission behavior relationship subgraph, and extract the second connection feature vector corresponding to each node in each second permission behavior relationship subgraph; wherein, the first connection feature vector and the second connection feature vector include at least: the shortest path length from any node to other nodes in the corresponding permission behavior relationship subgraph and the connection pressure index between any node and other nodes in the corresponding permission behavior relationship subgraph; Based on each first connection feature vector, a first permission behavior matrix is ​​obtained, and based on each second connection feature vector, a second permission behavior matrix is ​​obtained. The feature similarity inner product is obtained based on the first permission behavior matrix and the second permission behavior matrix, and the norm squared corresponding to the second permission behavior matrix is ​​obtained based on the second permission behavior matrix; wherein, the feature similarity inner product is used to indicate the connection consistency of the target source IP in the current time period and the historical time period. Anomaly scores for target source IP addresses are determined based on feature similarity inner product and norm squared.

[0019] In one optional implementation, when determining whether the target source IP address has engaged in unauthorized access behavior based on the first API access set, the second API access set, and the third API access set, and obtaining the unauthorized access detection result, the processing module is specifically used for: Determine the target difference set corresponding to the first API access set and the third API access set; wherein, the target difference set includes APIs that were accessible by the source IP address in the historical time period, but were not accessed in the current time period; Based on the difference between the second API access set and the target set, determine whether the target source IP address has unauthorized access behavior and obtain the unauthorized access detection result.

[0020] In an optional implementation, when determining whether the target source IP address has engaged in unauthorized access based on the difference between the second API access set and the target set, and obtaining the unauthorized access detection result, the processing module is specifically used for: If the intersection of the second API access set and the target difference set is not empty, then it is determined that the target source IP address has engaged in unauthorized access behavior.

[0021] In an optional implementation, after determining that the target IP address has engaged in unauthorized access, the processing module is further configured to: Output a list of source IP addresses that exhibit unauthorized access behavior and their corresponding URL relationships.

[0022] Thirdly, this application provides an electronic device including a processor and a memory, wherein the memory stores program code that, when executed by the processor, causes the processor to perform the steps of the unauthorized access detection method described in the first aspect.

[0023] Fourthly, this application provides a computer-readable storage medium including program code that, when executed on an electronic device, causes the electronic device to perform the steps of the unauthorized access detection method described in the first aspect.

[0024] Fifthly, this application provides a computer program product that, when invoked by a computer, causes the computer to execute the unauthorized access detection method steps as described in the first aspect.

[0025] Furthermore, other features and advantages of this application will be set forth in the following description and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0026] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings: Figure 1 A schematic diagram of a suitable system architecture is provided for an embodiment of this application; Figure 2 A flowchart illustrating an unauthorized access detection method provided in an embodiment of this application; Figure 3 An example diagram of a first permission behavior relationship diagram provided in an embodiment of this application; Figure 4 A schematic diagram of a first permission behavior relationship subgraph provided for an embodiment of this application; Figure 5 This application provides a schematic diagram of the structure of an unauthorized access detection device; Figure 6 This application provides a schematic diagram of the structure of an electronic device. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments of this application. Obviously, the described embodiments are only some embodiments of the technical solutions of this application, and not all embodiments. Based on the embodiments recorded in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the technical solutions of this application.

[0028] It should be noted that in the description of this application, "multiple" is understood as "at least two". "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. A connected to B can represent: A and B directly connected, or A and B connected through C. Furthermore, in the description of this application, terms such as "first" and "second" are used only for descriptive purposes and should not be construed as indicating or implying relative importance or order.

[0029] Furthermore, the data collection, dissemination, and use in the technical solution of this application all comply with the requirements of relevant national laws and regulations.

[0030] The design concept of the embodiments of this application is briefly introduced below: Currently, unauthorized access is a common vulnerability in network security, typically categorized into horizontal and vertical privilege escalation. Horizontal privilege escalation allows users to manipulate or access resources belonging to users with the same access level, such as data, files, and orders, but prevents access to functions with higher privilege levels. Vertical privilege escalation, on the other hand, allows lower-privilege users to manipulate or access resources belonging to higher-privilege users (such as administrators), thus exceeding their own permission level. Therefore, both horizontal and vertical privilege escalation can easily lead to issues such as the leakage of sensitive data.

[0031] Therefore, to avoid sensitive data leaks and other problems, unauthorized access detection to identify potential security threats is an indispensable technical means. One related technology is to implement unauthorized access detection by setting business logic and rules. However, this method relies on manually written rules, requiring personnel to have strong prior knowledge, and the rules set are often not very accurate. Alternatively, detection methods based on user behavior analysis can be used, which construct behavioral baselines by statistically analyzing user access frequency and time distribution to identify unauthorized access behavior. However, this method usually only focuses on the behavior of individual objects, ignoring the current business environment and the relationship between the individual object and the group, resulting in low detection accuracy and a high false positive rate in complex and dynamic network environments.

[0032] In view of this, this application provides an unauthorized access detection method, which includes: first, acquiring at least one first access behavior data within a historical time period and at least one second access behavior data within the current time period; wherein the first and second access behavior data include at least the association relationship between a source IP address and a destination IP address and the association relationship between a source IP address and a destination API; then, constructing a first permission behavior relationship graph based on the first access behavior data and constructing a second permission behavior relationship graph based on the second access behavior data; second, determining the abnormal score of the target source IP address based on the first and second permission behavior relationship graphs; finally, when the abnormal score is greater than a preset threshold, determining whether the target source IP address has unauthorized access behavior based on a first API access set, a second API access set, and a third API access set, and obtaining an unauthorized access detection result; wherein the first API access set includes the destination API corresponding to the target source IP address within the current time period, the second API access set includes the destination API corresponding to other source IP addresses in the same permission behavior relationship graph as the target source IP address within the current time period, and the third API access set includes the destination API corresponding to the target source IP address within a historical time period. By introducing a permission behavior relationship graph, the above method can identify lateral movement of legitimate identities and unauthorized access such as API abuse and privilege escalation, and the anomaly score calculation method can quantify the degree of structural changes in the permission behavior relationship graph, and accurately capture abnormal changes in the source IP address.

[0033] It should be noted that the acquisition, storage, use, and processing of data in this application embodiment all comply with the relevant provisions of national laws and regulations.

[0034] See Figure 1 The diagram shown illustrates a system architecture according to an embodiment of this application. This system architecture includes a target terminal 101 and a server 102. The target terminal 101 and the server 102 can interact via a communication network. The communication network can employ wireless communication or wired communication methods.

[0035] For example, the target terminal 101 can access the network and communicate with the server 102 through cellular mobile communication technology, wherein the cellular mobile communication technology includes, for example, 5th generation mobile networks (5G) technology.

[0036] Optionally, the target terminal 101 can access the network and communicate with the server 102 via short-range wireless communication, wherein the short-range wireless communication method includes, for example, Wireless Fidelity (Wi-Fi) technology.

[0037] This application embodiment does not impose any limitation on the number of communication devices involved in the above system architecture. For example, there may be more target terminals, or no target terminals, or other network devices may be included, such as... Figure 1 As shown, only the target terminal 101 and server 102 are described as examples. The following is a brief introduction to each of the above devices and their respective functions.

[0038] The target terminal 101 is a device that can provide voice and / or data connectivity to a user, and may be a device that supports limited and / or wireless connectivity.

[0039] For example, the target terminal 101 includes, but is not limited to: mobile phones, tablets, laptops, handheld computers, mobile internet devices (MID), wearable devices, virtual reality (VR) devices, augmented reality (AR) devices, wireless terminal devices in industrial control, wireless terminal devices in autonomous driving, wireless terminal devices in smart grids, wireless terminal devices in transportation safety, wireless terminal devices in smart cities, or wireless terminal devices in smart homes, etc.

[0040] Furthermore, the target terminal 101 may have a related client installed, and this client may be software, such as an application (APP), browser, short video software, etc., or it may be a network element, mini-program, etc. In this embodiment of the application, the target terminal 101 may use the aforementioned client related to unauthorized access detection to send the acquired first access behavior data and second access behavior data to the server 102 for subsequent unauthorized access detection methods.

[0041] Server 102 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms.

[0042] It is worth noting that, in the embodiments of this application, the methods in these embodiments can be executed by an electronic device, which can be the target terminal 101 or the server 102. That is, the method can be executed by the terminal device 101 or the server 102 alone, or by the target terminal device 101 and the server 102 together. Furthermore, the executing entities for each method can be the same or different, and this embodiment of the application does not impose any restrictions on this.

[0043] For example, when the target terminal 101 executes the unauthorized access detection method provided in this application alone, the target terminal 101 can directly obtain at least one first access behavior data in a historical time period and at least one second access behavior data in the current time period; then, it constructs a first permission behavior relationship diagram based on the first access behavior data, and constructs a second permission behavior relationship diagram based on the second access behavior data; secondly, it determines the abnormal score of the target source IP address based on the first permission behavior relationship diagram and the second permission behavior relationship diagram; finally, when the abnormal score is greater than a preset threshold, it determines whether the target source IP address has unauthorized access behavior based on the first API access set, the second API access set, and the third API access set, and obtains the unauthorized access detection result.

[0044] For example, when the unauthorized access detection method of this application is jointly executed by the target terminal 101 and the server 102, the target terminal 101 can obtain at least one first access behavior data in a historical time period and at least one second access behavior data in the current time period, and send the obtained first access behavior data and second access behavior data to the server 102. The server 102 constructs a first permission behavior relationship diagram based on the first access behavior data and a second permission behavior relationship diagram based on the second access behavior data. Next, based on the first permission behavior relationship diagram and the second permission behavior relationship diagram, the abnormal score of the target source IP address is determined. Finally, when the abnormal score is greater than a preset threshold, the target source IP address is determined to have unauthorized access behavior according to the first API access set, the second API access set, and the third API access set, and the unauthorized access detection result is obtained.

[0045] The unauthorized access detection method provided by the exemplary embodiments of this application will now be described with reference to the accompanying drawings.

[0046] See Figure 2 The diagram shown illustrates the implementation flow of an unauthorized access detection method provided in this application. The specific implementation flow of this method is as follows: S1: Obtain at least one first access behavior data within a historical time period and at least one second access behavior data within the current time period.

[0047] In this embodiment, to detect unauthorized access by a source IP address within its current business environment and group context, and to avoid detecting unauthorized access solely based on the individual behavior of the source IP address, this embodiment requires acquiring not only first access behavior data from historical time periods but also second access behavior data from the current time period.

[0048] Specifically, in this embodiment, the historical time period and the current time period are two adjacent time periods used to distinguish the access behavior of the source IP address in historical and current situations. The historical time period can be defined as T. past =[t-2W, tW], where the current time period can be defined as T. cur =[tW, t], where W is the length of a single time period. For example, W can be set to 7 days × 24 hours × 3600 seconds according to actual needs. Of course, the actual value of W can be set to other reasonable values ​​according to the actual application scenario. Therefore, based on the above division of time periods, access behavior data is collected in two time periods: historical time period and current time period.

[0049] It should be noted that the first access behavior data and the second access behavior data in this application embodiment include at least the association between the source IP address and the destination IP address, and the association between the source IP address and the destination API (Application Programming Interface). The only difference between the first access behavior data and the second access behavior data is that they are collected in different time periods. Furthermore, it is worth noting that in this application embodiment, in addition to obtaining the association between the source IP address and the destination IP address, the association between the source IP address and the destination API is also obtained. This is because when a source IP address accesses a destination IP address, it may correspond to multiple API interfaces; that is, when a source IP address accesses a destination IP address, it may correspond to multiple destination APIs. Therefore, in order to accurately obtain the first access behavior data and the second access behavior data, it is necessary to accurately identify the association between the source IP address and the destination API.

[0050] Furthermore, in this embodiment, raw access logs can be collected from devices such as firewalls, API gateways, and probes in various network environments, and key fields can be extracted from the raw access logs to distinguish the first access behavior data and the second access behavior data according to historical time periods and the current time period, respectively. Additionally, in this embodiment, the first access behavior data and the second access behavior data may also include the API request path, the corresponding HTTP status code, and a timestamp.

[0051] Therefore, as shown in Table 1, the first and second access behavior data collected according to the time period can include the following data.

[0052] Table 1

[0053] In this embodiment of the application, the original access log may include first access behavior data and / or second access behavior data of access failure. In order to avoid the first access behavior data and / or second access behavior data of access failure interfering with the unauthorized access detection, the first access behavior data and / or second access behavior data of access failure in the original access log can also be determined according to the Status_code. If the first access behavior data and / or second access behavior data of access failure exist in the original access log, the first access behavior data and / or second access behavior data of access failure are deleted.

[0054] For example, if the Status_code of successful access behavior data in the original access log is 200, then if there is a Status_code other than 200 in the original access log, it can be determined that it is the first and / or second access behavior data that failed, and it should be deleted.

[0055] Using the above method, at least one first access behavior data and at least one second access behavior data are obtained respectively, so as to facilitate subsequent unauthorized access detection.

[0056] S2: Construct a first permission behavior relationship diagram based on the first access behavior data, and construct a second permission behavior relationship diagram based on the second access behavior data.

[0057] In this embodiment of the application, after obtaining at least one first access behavior data and at least one second access behavior data, a first permission behavior relationship diagram can be constructed based on the obtained at least one first access behavior data, and a second permission behavior relationship diagram can be constructed based on the obtained at least one second access behavior data.

[0058] It should be noted that the first permission behavior relationship diagram and the second permission behavior relationship diagram constructed in the embodiments of this application can be represented as an undirected weighted relationship structure, specifically as G=(V, E, W). Wherein, V represents the set of nodes, with each source IP address as a node, E represents the set of edges, used to represent the association relationship between source IPs, and W represents the set of edge weights, used to reflect the tightness of the association relationship between each source IP address.

[0059] In one alternative implementation, when establishing the first permission behavior relationship diagram, the number of times each source IP address accesses the destination IP address and the number of times each source IP address accesses the destination API within a historical time period are first determined; similarly, when establishing the second permission behavior relationship diagram, the number of times each source IP address accesses the destination IP address and the number of times each source IP address accesses the destination API within the current time period are first determined.

[0060] For example, based on the first access behavior data, it is determined that within a historical time period, source IP address 1 accessed destination IP address 1 5 times and source IP address 2 accessed destination IP address 1 6 times; or based on the first access behavior data, it is determined that within a historical time period, source IP address 1 accessed destination API 1 7 times and source IP address 1 accessed destination API 1 8 times.

[0061] In this way, based on the determined number of accesses, it is possible to determine whether there is a correlation between source IPs. For example, if the first threshold is set to 4, then if source IP address 1 accesses destination IP address 1 more times than the first threshold, and source IP address 2 accesses destination IP address 1 more times than the first threshold, it indicates that there is a correlation between source IP address 1 and source IP address 2. For example, if source IP address 3 accesses destination IP address 1 a total of 5 times within a historical period, then the number of times source IP address 3 accesses destination IP address 1 is also greater than the first threshold. Therefore, source IP address 3 has accessed destination IP address 1 multiple times with both source IP address 1 and source IP address 2 within a historical period. This means that not only are there correlations between source IP address 1 and source IP address 2, but source IP address 3 also has correlations with both source IP address 1 and source IP address 2. Therefore, a first permission behavior relationship graph can be established based on source IP addresses 1, 2, and 3. In this case, source IP addresses 1, 2, and 3 can be considered as nodes, and there are connecting edges between source IP addresses 1, 2, and 3.

[0062] Similarly, the number of accesses between source IP addresses and destination APIs can determine whether there is a correlation between source IP addresses. For example, if source IP address 1 accessed destination API 1 9 times, source IP address 2 accessed it 10 times, and source IP address 3 accessed it 11 times, and the second threshold is set to 6 times, then the number of times source IP addresses 1, 2, and 3 accessed destination API 1 is greater than the second threshold, indicating that there is a correlation between source IP addresses 1, 2, and 3. As another example, if source IP address 5 accessed destination API 1 3 times and source IP address 6 accessed it 1 time, both less than the second threshold, then there is no correlation between source IP addresses 5 and 6, meaning a correlation cannot be established using source IP addresses 5 and 6 as nodes in the first permission behavior relationship graph.

[0063] Similarly, the same method is used to determine the number of times each source IP address accesses the destination IP address and the number of times each source IP address accesses the destination API within the current time period, and compares them with the corresponding thresholds to determine whether there is a correlation between the source IP addresses. If there is a correlation, the second permission behavior relationship graph is constructed using the corresponding source IP address as a node and the correlation between the source IP addresses as a connection edge.

[0064] It should be noted that in both the first and second permission behavior relationship diagrams, any two related source IP addresses are used as nodes, and the relationship between any two source IP addresses is used as the connecting edge. Furthermore, any two source IP addresses also have an edge weight. In this embodiment, the frequency with which any two source IP addresses jointly access the same destination IP address and destination API can be used as the weight.

[0065] Specifically, in this embodiment of the application, the edge weight can be calculated using the following formula (1):

[0066] in, express and The edge weights between them are dimensionless and range from 1 to 1. ; ( () indicates the number of logs that meet the criteria; This represents all original access log records within the time window T.

[0067] For example, if source IP address 1 accesses destination IP address 1 5 times, source IP address 2 accesses destination IP address 1 6 times, source IP address 1 accesses destination API 1 8 times, and source IP address 2 accesses destination API 1 9 times, then... =5+6+8+9=28, meaning the edge weight between source IP address 1 and source IP address 2 is 28.

[0068] Therefore, see Figure 3 As shown, this application embodiment provides a schematic diagram of a first permission behavior relationship diagram. Figure 3 Source IP address 1 and source IP address 2 are associated with each other; source IP address 3 is associated with both source IP address 1 and source IP address 2; source IP address 4 and source IP address 5 are associated with each other, but source IP address 4 and source IP address 5 are not associated with source IP address 1, 2, or 3 respectively.

[0069] Using the above methods, the first access behavior data collected within a historical time period can be used to construct a first permission behavior relationship graph, and the second access behavior data collected within the current time period can be used to construct a second permission behavior relationship graph. This can represent the association between each source IP address, which can facilitate subsequent detection of unauthorized behavior by the source IP address.

[0070] S3: Based on the first permission behavior relationship diagram and the second permission behavior relationship diagram, determine the abnormal score of the target source IP address.

[0071] In this embodiment, after constructing the first permission behavior relationship diagram and the second permission behavior relationship diagram, the abnormal score of the target source IP address can be determined. The target source IP address is any one of the source IP addresses participating in the unauthorized access detection. Here, we take one target source IP address as an example for explanation. In the actual detection process, unauthorized access detection needs to be performed on all source IP addresses in sequence.

[0072] In one optional implementation, a preset community detection algorithm is first used to cluster the nodes in the first permission behavior relationship graph to obtain at least one first permission behavior relationship subgraph, and a preset community detection algorithm is used to cluster the nodes in the second permission behavior relationship subgraph to obtain at least one second permission behavior relationship subgraph.

[0073] For example, in this embodiment, the Leiden algorithm can be used to cluster each node in the first permission behavior relationship graph and the second permission behavior relationship graph, respectively. This allows for the determination of the first permission behavior relationship subgraph to which each node in the first permission behavior relationship graph belongs, and the second permission behavior relationship subgraph to which each node in the second permission behavior relationship graph belongs.

[0074] When the first permission behavior relationship subgraph is obtained, the mapping relationship between the source IP address and the first permission behavior relationship subgraph can be obtained. For example, it can be represented as f: IP→communityID, that is, the source IP address has a mapping relationship with the ID of the corresponding first permission behavior relationship subgraph.

[0075] In this embodiment, the modularity function in the Leiden algorithm is optimized, which can improve the convergence speed when performing node clustering and quickly divide the permission behavior relationship subgraph in batches.

[0076] Specifically, in the embodiments of this application, the modularity function can be expressed as the following formula (2): ; in, Represents the adjacency matrix; Indicates resolution parameters; These represent the node degree; m represents the total edge weight; This function represents the instruction function for the permission behavior relationship diagram.

[0077] See Figure 4 As shown in the illustration, this application provides a schematic diagram of a first permission behavior relationship subgraph. Through a preset community detection algorithm, each node in the first permission behavior relationship graph can be clustered to obtain at least one first permission behavior relationship subgraph. For example, in... Figure 4 This includes three subgraphs representing first-level permission behavior relationships: A, B, and C. Furthermore, these three subgraphs are mutually exclusive. Similarly, clustering the nodes in the second-level permission relationship subgraph will also yield at least one second-level permission behavior relationship subgraph, which will not be elaborated upon here.

[0078] Using the above method, the first permission behavior relationship diagram and the second permission relationship diagram can be processed respectively to obtain at least one first permission behavior relationship sub-diagram corresponding to the first permission behavior relationship diagram and at least one second permission behavior relationship sub-diagram corresponding to the second permission behavior relationship diagram.

[0079] Furthermore, the first connection feature vector corresponding to each node in each first permission behavior relationship subgraph is extracted, and the second connection feature vector corresponding to each node in each second permission behavior relationship subgraph is extracted.

[0080] It should be noted that, in the embodiments of this application, both the first connection feature vector and the second connection feature vector may include the shortest path length between any node and other nodes in the corresponding permission relationship behavior subgraph and the connection pressure index between any node and other nodes in the corresponding permission relationship behavior subgraph. The connection pressure index can represent the degree of communication pressure between two nodes, thereby enabling the determination of the size of the communication traffic between the two nodes.

[0081] Taking the first permission behavior relationship subgraph A as an example, the first connection feature vector corresponding to each node in the first permission behavior relationship subgraph A can be extracted. For example, if there is a source IP address 1 (or node 1) in the first permission behavior relationship subgraph, the shortest path length S from source IP address 1 in the first permission behavior relationship subgraph A to other source IP addresses in the first permission behavior relationship subgraph A can be determined by Dijkstra's algorithm or the breadth-first search (BFS) algorithm. ij The connection pressure index P between any node and other nodes in the first-authority behavior relationship subgraph A is... ij The calculation can be performed using the following formula (3): ; in, This represents the connection pressure index between any node and other nodes in the corresponding permission relationship behavior subgraph; W ij The edge weight is represented by the aforementioned formula (1); This represents the shortest path length.

[0082] Then, the average value of the connection pressure index of the other nodes in the first permission behavior relationship subgraph A of the source IP address 1 is calculated as one dimension in the first connection feature vector.

[0083] Specifically, the average value of the connection pressure index can be calculated using the following formula (4): ; in, This represents the average connection pressure index of node i; This represents the total number of nodes in the subgraph corresponding to the permission behavior.

[0084] Thus, the first connection feature vector of source IP address 1 (node ​​1) can be represented as [mean] stepi , Using the same method, the first connection feature vector corresponding to each node in each of the first permission behavior relationship subgraphs, and the second connection feature vector corresponding to each node in each of the second permission behavior relationship subgraphs, can be extracted. The above description only uses node 1 in the first permission behavior relationship subgraph A as an example to illustrate the method of extracting the first connection feature vector corresponding to node 1. The extraction methods for the first connection feature vector corresponding to each node in other first permission behavior relationship subgraphs and the second connection feature vector corresponding to each node in second permission behavior relationship subgraphs are the same, and will not be repeated here.

[0085] Furthermore, after obtaining the first connection feature vectors corresponding to each node, the first permission behavior matrix M corresponding to the historical time period can be obtained based on each first connection feature vector. past And based on each second connection feature vector, obtain the second permission behavior matrix M corresponding to the current time period. cur .

[0086] Furthermore, after determining the first permission behavior matrix corresponding to the historical time period and the second permission behavior matrix corresponding to the current time period, the structural changes of a certain source IP address in the first permission behavior relationship graph compared to the second permission behavior relationship graph can be quantified, thereby determining whether a certain source IP address has generated permission behavior changes in the entire associated permission behavior relationship graph.

[0087] Specifically, after obtaining the first and second permission behavior matrices, the similarity difference between the connection feature vectors of the historical time period and the current time period can be calculated. That is, the inner product of feature similarity is calculated using the following formula (5): ; in, Represents the inner product of feature similarity; This represents the first-level permission behavior matrix; This represents the transpose of the second permission behavior matrix.

[0088] It is worth noting that the inner product of this feature similarity can indicate the consistency of the target source IP address's connections in the current time period and in historical time periods. In other words, it can indicate whether the connection behavior of the target source IP address is stable and unchanged in historical time periods and in the current time period.

[0089] Then, based on the first permission behavior matrix, the square of the norm corresponding to the first permission behavior matrix can be obtained, that is, the square of the norm corresponding to the first permission behavior feature can be calculated by the following formula (6): ; in, This represents the square of the norm corresponding to the matrix of the first-authority behavior.

[0090] Finally, based on the inner product of feature similarity and the square of the norm, the anomaly score of the target source IP address is determined, that is, the anomaly score is calculated by the following formula (7):

[0091] in, This indicates the anomaly score of the target source IP address; This is a preset small constant to prevent division by zero.

[0092] Furthermore, after calculating the anomaly score corresponding to the target source IP address using the above formula (7), it is necessary to standardize the above anomaly score to obtain the standardized anomaly score corresponding to the target source IP address.

[0093] Specifically, in this embodiment of the application, the standardized anomaly score can be calculated using the following formula (8):

[0094] in, [0, 1] represents the standardized outlier score; This represents the scaling factor, used to adjust the distribution of outlier scores; This represents the sigmoid normalization function.

[0095] In this way, the calculated anomaly score can indicate whether there is an anomaly in the connection relationship of the target source IP address in the first permission behavior relationship diagram compared with the connection relationship in the second permission behavior relationship diagram. The higher the anomaly score, the more serious the deviation of the target source IP address's current connection mode from the historical connection mode.

[0096] S4: When the abnormal score is greater than the preset threshold, determine whether the target source IP address has unauthorized access behavior based on the first API access set, the second API access set, and the third API access set, and obtain the unauthorized access detection result.

[0097] In this embodiment of the application, when the calculated abnormal score is greater than a preset threshold, it can be determined whether the target source IP address has unauthorized access behavior based on the first API access set, the second API access set, and the third API access set.

[0098] It should be noted that the first API access set includes the target API corresponding to the target source IP address in the current time period, the second API access set includes the target API corresponding to other source IP addresses in the same permission behavior relationship graph within the current time period, and the third API access set includes the target API corresponding to the target source IP address in historical time periods.

[0099] Specifically, the first API access set can be represented as: .

[0100] The second API access set can be represented as: .

[0101] The third API access set can be represented as: .

[0102] For example, the first API access set can record the path of the destination API accessed by source IP address 1 within the current time period. The second API access set can record the path of the destination API accessed by sources other than source IP address 1, such as source IP address 2 and source IP address 3, within the current time period in the first access permission relationship graph. The third API access set can record the path of the destination API accessed by source IP address 1 within historical time periods.

[0103] In one alternative implementation, after determining the first API access set, the second API access set, and the third API access set, the target difference set corresponding to the first API access set and the third API access set can be determined. This target difference set represents the target API that the target source IP address was historically able to access but is not currently accessing; that is, the target source IP address may currently not have access to the corresponding API interface.

[0104] Specifically, the target difference set can be represented as: .

[0105] Therefore, after obtaining the target difference set, it is possible to determine whether the target source IP address has engaged in unauthorized access behavior based on the target difference set and the second API access set. That is, if the intersection of the second API access set and the target difference set is not empty, then the target source IP address has engaged in unauthorized access behavior. When the intersection of the second API access set and the target difference set is not empty, it indicates that the target source IP address attempted to access resources within its own subset of second-level access permissions that other source IP addresses can access, but the target source IP address did not have access to during the historical time period.

[0106] Specifically, the relationship between the second API access set and the target difference set can be expressed as:

[0107] That is, When the value is 1, it indicates that the target source IP address has engaged in unauthorized access behavior.

[0108] Furthermore, when it is determined that the target source IP address has engaged in unauthorized access behavior, the comprehensive risk coefficient corresponding to the target source IP address can also be calculated.

[0109] Specifically, the comprehensive risk coefficient can be calculated using the following formula (9):

[0110] in, This represents the overall risk coefficient; This represents the weighting coefficient, which is set according to actual needs.

[0111] Using the method described above, unauthorized access behavior is detected for all source IP addresses within the current time period. When an unauthorized access behavior is detected, it is recorded in the list of source IP addresses with unauthorized access behavior, along with the corresponding URL path. Finally, the list of source IP addresses with unauthorized access behavior and their corresponding URL relationships are output. Subsequent processing can then directly locate the source IP address with the unauthorized access behavior.

[0112] Furthermore, based on the same technical concept, embodiments of this application provide an unauthorized access detection device, which is used to implement the above-described method flow of embodiments of this application. See also... Figure 5 As shown, the device includes: an acquisition module 501, a mapping module 502, a scoring module 503, and a processing module 504, wherein, The acquisition module 501 is used to acquire at least one first access behavior data within a historical time period and at least one second access behavior data within the current time period; wherein, the first access behavior data and the second access behavior data include at least the association relationship between the source IP address and the destination IP address and the association relationship between the source IP address and the destination API. The graph building module 502 is used to build a first permission behavior relationship graph based on the first access behavior data, and to build a second permission behavior relationship graph based on the second access behavior data; The scoring module 503 is used to determine the abnormal score of the target source IP address based on the first permission behavior relationship diagram and the second permission behavior relationship diagram. The processing module 504 is used to determine whether the target source IP address has unauthorized access behavior based on the first API access set, the second API access set, and the third API access set when the abnormal score is greater than a preset threshold, and to obtain the unauthorized access detection result. The first API access set includes the target API corresponding to the target source IP address in the current time period, the second API access set includes the target API corresponding to other source IP addresses in the same permission behavior relationship graph as the target source IP address in the current time period, and the third API access set includes the target API corresponding to the target source IP address in historical time periods.

[0113] In an optional implementation, when constructing a first permission behavior relationship graph based on first access behavior data and a second permission behavior relationship graph based on second access behavior data, the graph construction module 502 is specifically used for: Determine the number of times each source IP address accessed the destination IP address and the number of times each source IP address accessed the destination API within a historical time period, and determine the number of times each source IP address accessed the destination IP address and the number of times each source IP address accessed the destination API within the current time period. If, within a historical time period, the number of times any two source IP addresses access the same destination IP address exceeds a first threshold and / or the number of times any two source IP addresses access the same destination API exceeds a second threshold, then a first permission behavior relationship graph is established based on any two source IP addresses. Similarly, if, within the current time period, the number of times any two source IP addresses access the same destination IP address exceeds the first threshold and / or the number of times any two source IP addresses access the same destination API exceeds the second threshold, then a second permission behavior relationship graph is established based on any two source IP addresses. In either the first or second permission behavior relationship graph, any two source IP addresses serve as nodes, and the association between any two source IP addresses serves as edges.

[0114] In an optional implementation, when determining the anomaly score of the target source IP address based on the first permission behavior relationship diagram and the second permission behavior relationship diagram, the scoring module 503 is specifically used for: A preset community detection algorithm is used to cluster the nodes in the first permission behavior relationship graph to obtain at least one first permission behavior relationship subgraph, and a preset community detection algorithm is used to cluster the nodes in the second permission behavior relationship graph to obtain at least one second permission behavior relationship subgraph. Extract the first connection feature vector corresponding to each node in each first permission behavior relationship subgraph, and extract the second connection feature vector corresponding to each node in each second permission behavior relationship subgraph; wherein, the first connection feature vector and the second connection feature vector include at least: the shortest path length from any node to other nodes in the corresponding permission behavior relationship subgraph and the connection pressure index between any node and other nodes in the corresponding permission behavior relationship subgraph; Based on each first connection feature vector, a first permission behavior matrix is ​​obtained, and based on each second connection feature vector, a second permission behavior matrix is ​​obtained. The feature similarity inner product is obtained based on the first permission behavior matrix and the second permission behavior matrix, and the norm squared corresponding to the second permission behavior matrix is ​​obtained based on the second permission behavior matrix; wherein, the feature similarity inner product is used to indicate the connection consistency of the target source IP in the current time period and the historical time period. Anomaly scores for target source IP addresses are determined based on feature similarity inner product and norm squared.

[0115] In an optional implementation, when determining whether the target source IP address has engaged in unauthorized access behavior based on the first API access set, the second API access set, and the third API access set, and obtaining the unauthorized access detection result, the processing module 504 is specifically used for: Determine the target difference set corresponding to the first API access set and the third API access set; wherein, the target difference set includes APIs that were accessible by the source IP address in the historical time period, but were not accessed in the current time period; Based on the difference between the second API access set and the target set, determine whether the target source IP address has unauthorized access behavior and obtain the unauthorized access detection result.

[0116] In an optional implementation, when determining whether the target source IP address has engaged in unauthorized access behavior based on the difference between the second API access set and the target set, and obtaining the unauthorized access detection result, the processing module 504 is specifically used for: If the intersection of the second API access set and the target difference set is not empty, then it is determined that the target source IP address has engaged in unauthorized access behavior.

[0117] In an optional implementation, after determining that the target IP address has engaged in unauthorized access behavior, the processing module 504 is further configured to: Output a list of source IP addresses that exhibit unauthorized access behavior and their corresponding URL relationships.

[0118] Based on the same technical concept, embodiments of this application also provide an electronic device that can implement the unauthorized access detection method flow provided in the above embodiments of this application. In one embodiment, the electronic device may be a server, a terminal device, or other electronic devices. See also... Figure 6 As shown, the electronic device may include: At least one processor 601 and a memory 602 connected to at least one processor 601. In this embodiment, the specific connection medium between the processor 601 and the memory 602 is not limited. Figure 6 The example shown is the connection between processor 601 and memory 602 via bus 600. Bus 600 is... Figure 6 The connections between other components are indicated by thick lines and are for illustrative purposes only, not as limiting information. The 600 bus can be divided into address bus, data bus, control bus, etc., for ease of representation. Figure 6 The term is represented by a single thick line, but this does not imply that there is only one bus or one type of bus. Alternatively, the processor 601 can also be called a controller; there is no restriction on the name.

[0119] In this embodiment, memory 602 stores instructions executable by at least one processor 601. By executing the instructions stored in memory 602, at least one processor 601 can execute an unauthorized access detection method as described above. Processor 601 can implement... Figure 5 The functions of each module in the device shown.

[0120] The processor 601 is the control center of the device. It can connect to various parts of the control device through various interfaces and lines. By running or executing instructions stored in memory 602 and calling data stored in memory 602, the processor can perform various functions and process data, thereby monitoring the device as a whole.

[0121] In one possible design, processor 601 may include one or more processing units. Processor 601 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may also not be integrated into processor 601. In some embodiments, processor 601 and memory 602 may be implemented on the same chip; in some embodiments, they may also be implemented on separate chips.

[0122] Processor 601 can be a general-purpose processor, such as a CPU, digital signal processor, application-specific integrated circuit, field-programmable gate array or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of an unauthorized access detection method disclosed in the embodiments of this application can be directly manifested as execution by a hardware processor, or execution by a combination of hardware and software modules within the processor.

[0123] Memory 602, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory 602 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic memory, magnetic disk, optical disk, etc. Memory 602 can be any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. In the embodiments of this application, memory 602 can also be a circuit or any other device capable of implementing storage functions for storing program instructions and / or data.

[0124] By designing and programming the processor 601, the code corresponding to the unauthorized access detection method described in the foregoing embodiments can be embedded into the chip, thereby enabling the chip to execute the code during runtime. Figure 2 The illustrated embodiment presents the steps of an unauthorized access detection method. How to design and program the processor 601 is a technique well-known to those skilled in the art and will not be described further here.

[0125] Based on the same inventive concept, embodiments of this application also provide a storage medium storing computer instructions that, when executed on a computer, cause the computer to perform an unauthorized access detection method described above.

[0126] In some possible implementations, this application also provides that various aspects of an unauthorized access detection method can also be implemented as a program product including program code, which, when the program product is run on a device, causes the control device to perform the steps in an unauthorized access detection method according to various exemplary embodiments of this application as described above.

[0127] It should be noted that although several units or sub-units of the device have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of this application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided and embodied by multiple units.

[0128] Furthermore, although the operations of the method of this application are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0129] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0130] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable unauthorized access detection device to produce a server, such that the instructions, which execute via the processor of the computer or other programmable unauthorized access detection device, generate instructions for implementing the process... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0131] Program code for performing the operations of this application can be written using any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0132] These computer program instructions can also be loaded onto a computer or other programmable unauthorized access detection device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable device for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0133] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for detecting unauthorized access, characterized in that, The method includes: At least one first access behavior data within a historical time period and at least one second access behavior data within the current time period are obtained respectively; wherein, the first access behavior data and the second access behavior data include at least the association relationship between the source IP address and the destination IP address and the association relationship between the source IP address and the destination API. A first permission behavior relationship diagram is constructed based on the first access behavior data, and a second permission behavior relationship diagram is constructed based on the second access behavior data; Based on the first permission behavior relationship diagram and the second permission behavior relationship diagram, the abnormal score of the target source IP address is determined; When the abnormal score is greater than a preset threshold, the system determines whether the target source IP address has engaged in unauthorized access behavior based on the first API access set, the second API access set, and the third API access set, and obtains an unauthorized access detection result. The first API access set includes the target APIs corresponding to the target source IP address in the current time period, the second API access set includes the target APIs corresponding to other source IP addresses in the same permission behavior relationship graph as the target source IP address in the current time period, and the third API access set includes the target APIs corresponding to the target source IP address in the historical time period.

2. The method as described in claim 1, characterized in that, The construction of a first permission behavior relationship diagram based on the first access behavior data and a second permission behavior relationship diagram based on the second access behavior data include: Determine the number of times each source IP address accesses the destination IP address and the number of times each source IP address accesses the destination API within the historical time period, and determine the number of times each source IP address accesses the destination IP address and the number of times each source IP address accesses the destination API within the current time period. If, within the historical time period, the number of times any two source IP addresses access the same destination IP address exceeds a first threshold and / or the number of times any two source IP addresses access the same destination API exceeds a second threshold, then a corresponding first permission behavior relationship graph is established based on the any two source IP addresses. Similarly, if, within the current time period, the number of times any two source IP addresses access the same destination IP address exceeds the first threshold and / or the number of times any two source IP addresses access the same destination API exceeds the second threshold, then a corresponding second permission behavior relationship graph is established based on the any two source IP addresses. In either the first or second permission behavior relationship graph, any two source IP addresses serve as nodes, and the association between any two source IP addresses serves as edges.

3. The method as described in claim 1, characterized in that, The step of determining the anomaly score of the target source IP address based on the first permission behavior relationship diagram and the second permission behavior relationship diagram includes: The nodes in the first permission behavior relationship graph are clustered using a preset community detection algorithm to obtain at least one first permission behavior relationship subgraph, and the nodes in the second permission behavior relationship graph are clustered using the preset community detection algorithm to obtain at least one second permission behavior relationship subgraph. Extract the first connection feature vector corresponding to each node in each of the first permission behavior relationship subgraphs, and extract the second connection feature vector corresponding to each node in each of the second permission behavior relationship subgraphs; wherein the first connection feature vector and the second connection feature vector include at least: the shortest path length from any node to other nodes in the corresponding permission behavior relationship subgraph and the connection pressure index between any node and other nodes in the corresponding permission behavior relationship subgraph; A first permission behavior matrix is ​​obtained based on each of the first connection feature vectors, and a second permission behavior matrix is ​​obtained based on each of the second connection feature vectors; The feature similarity inner product is obtained based on the first permission behavior matrix and the second permission behavior matrix, and the norm squared corresponding to the second permission behavior matrix is ​​obtained based on the second permission behavior matrix; wherein, the feature similarity inner product is used to indicate the connection consistency of the target source IP in the current time period and the historical time period; Anomaly score for the target source IP address is determined based on the inner product of the feature similarity and the square of the norm.

4. The method as described in claim 1, characterized in that, The step of determining whether the target source IP address has engaged in unauthorized access behavior based on the first API access set, the second API access set, and the third API access set, and obtaining the unauthorized access detection result, includes: Determine the target difference set corresponding to the first API access set and the third API access set; wherein, the target difference set includes APIs that the source IP address could access during the historical time period, but were not accessed during the current time period; Based on the difference between the second API access set and the target set, determine whether the target source IP address has unauthorized access behavior and obtain the unauthorized access detection result.

5. The method as described in claim 4, characterized in that, Based on the difference between the second API access set and the target set, determine whether the target source IP address exhibits unauthorized access behavior, and obtain unauthorized access detection results, including: If the intersection of the second API access set and the target difference set is not an empty set, then it is determined that the target source IP address has engaged in unauthorized access behavior.

6. The method according to any one of claims 1-5, characterized in that, After determining that the target source IP address has engaged in unauthorized access behavior, the process also includes: Output a list of source IP addresses that exhibit unauthorized access behavior and their corresponding URL relationships.

7. An unauthorized access detection device, characterized in that, The device includes: The acquisition module is used to acquire at least one first access behavior data within a historical time period and at least one second access behavior data within the current time period; wherein, the first access behavior data and the second access behavior data include at least the association relationship between the source IP address and the destination IP address and the association relationship between the source IP address and the destination API. The graph building module is used to build a first permission behavior relationship graph based on the first access behavior data, and to build a second permission behavior relationship graph based on the second access behavior data; The scoring module is used to determine the abnormal score of the target source IP address based on the first permission behavior relationship diagram and the second permission behavior relationship diagram; The processing module is used to determine whether the target source IP address has engaged in unauthorized access behavior based on a first API access set, a second API access set, and a third API access set when the abnormal score is greater than a preset threshold, and to obtain an unauthorized access detection result; wherein, the first API access set includes the target API corresponding to the target source IP address in the current time period, the second API access set includes the target API corresponding to other source IP addresses in the same permission behavior relationship graph as the target source IP address in the current time period, and the third API access set includes the target API corresponding to the target source IP address in the historical time period.

8. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method as described in any one of claims 1-6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1-6.

10. A computer program product, characterized in that, The computer program product includes: computer program code, which, when run on a computer, causes the computer to perform the method described in any one of claims 1-6.

Images