A service anomaly detection method, device, equipment and readable storage medium

Abstract

This application discloses a method, apparatus, device, and readable storage medium for detecting business anomalies, applied in the field of network security technology. The method includes: standardizing multi-source security data of the current business to obtain standard events; determining a dynamic risk score for the current business environment using the feature values ​​of risk factors in the standard events; adjusting the judgment threshold in the business identification baseline according to a preset interval corresponding to the dynamic risk score; and performing anomaly detection on the current business access based on the adjusted business identification baseline to obtain detection results. This application, by real-time sensing of environmental risks and adaptively adjusting the judgment threshold, effectively solves the problem of high false positive or false negative rates caused by the inability of static baselines to adapt to dynamic business scenarios, thus improving the accuracy of business anomaly detection.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, apparatus, device, and readable storage medium for detecting business anomalies. Background Technology

[0002] In the field of cybersecurity, baseline-based anomaly detection is one of the important means of identifying unknown threats. Traditional solutions typically involve operations and maintenance personnel configuring static business identification baselines based on experience and setting fixed judgment thresholds to distinguish between normal business traffic and malicious attack traffic.

[0003] However, the aforementioned static baseline solution has significant shortcomings in practical applications. First, business scenarios are dynamic. For example, some customers have numerous business devices and high daily business traffic, so normal business fluctuations may trigger alarms (false alarms). Conversely, some customers experience massive attack traffic but relatively low business traffic during attack and defense drills, making it difficult to adjust the static baseline in a timely manner, potentially leading to missed detections of real attacks (false alarms). Furthermore, adjusting static thresholds often relies on manual experience, making real-time response and refined operations difficult.

[0004] In conclusion, improving the accuracy of anomaly detection in business operations is a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] The purpose of this application is to provide a business anomaly detection method, apparatus, device, and readable storage medium, which improves the accuracy of business anomaly detection by defining the dynamic risk score of the current business environment and dynamically adjusting the judgment threshold in the business identification baseline based on the dynamic risk score.

[0006] To solve the above-mentioned technical problems, this application provides the following technical solution: A business anomaly detection method, comprising: Standardize the multi-source security data of current business operations to obtain standard events; By utilizing the characteristic values ​​of risk factors in the standard events, a dynamic risk score for the current business environment is determined. Adjust the judgment threshold in the business identification baseline according to the preset range corresponding to the dynamic risk score; Based on the adjusted business identification baseline, anomaly detection is performed on the current business access to obtain the detection results.

[0007] Preferably, the multi-source security data of the current business is standardized to obtain standard events, including: Real-time collection of network traffic data, and acquisition of business context data and external threat intelligence data; The network traffic data, the business context data, and the external threat intelligence data are identified as the multi-source security data. The multi-source security data is cleaned; The cleaned data is normalized according to a preset data structure to obtain the standard event.

[0008] Preferably, the cleaned data is normalized according to a preset data structure to obtain the standard events, including: The cleaned data is mapped to the preset data structure to obtain standard events including network layer information, application layer information, and context fields. The context field includes at least a business time period identifier and an asset importance level.

[0009] Preferably, the dynamic risk score of the current business environment is determined by utilizing the characteristic values ​​of risk factors in the standard events, including: The feature values ​​of risk factors are extracted from the standard events; wherein the feature values ​​include feature values, risk weights, and contextual factors. The characteristic values ​​of each risk factor are multiplied by their respective risk weights and context factors, and the multiplications are accumulated to obtain the dynamic risk score.

[0010] Preferably, extracting feature values ​​of risk factors from the standard events includes: The application layer information of standard events is matched with attack feature rules, and the feature values ​​corresponding to the attack feature hit are determined based on the matching results. Based on the business time period identifier in the context field of the standard event, determine whether the current access belongs to an abnormal time period access, and determine the characteristic value corresponding to the abnormal time period access situation.

[0011] Preferably, adjusting the judgment threshold in the business identification baseline according to the preset interval corresponding to the dynamic risk score includes: From a number of preset intervals, determine the preset interval corresponding to the dynamic risk score, and the protection mode corresponding to the preset interval; Adjust the request success rate threshold and the continuous occurrence time threshold in the judgment threshold according to the adjustment method corresponding to the protection mode.

[0012] Preferably, based on the adjusted service identification baseline, anomaly detection is performed on the current service access to obtain the detection results, including: Get the success rate and duration of current business access requests; The request success rate is compared with the adjusted request success rate threshold to obtain the request success rate detection sub-result; The duration of occurrence is compared with the adjusted duration of occurrence threshold to obtain the duration detection sub-result; The detection result is determined by combining the request success rate detection sub-result and the duration detection sub-result.

[0013] A business anomaly detection device, comprising: The data acquisition module is used to acquire multi-source security data for the current business. The data standardization module is used to standardize the multi-source security data to obtain standard events; The risk scoring module is used to determine the dynamic risk score of the current business environment by utilizing the feature values ​​of risk factors in the standard events. The strategy adjustment module is used to adjust the judgment threshold in the business identification baseline according to the preset range corresponding to the dynamic risk score. The anomaly detection module is used to perform anomaly detection on the current business access based on the adjusted business identification baseline and obtain the detection results.

[0014] An electronic device, comprising: Memory, used to store computer programs; A processor is used to implement the steps of the above-described business anomaly detection method when executing the computer program.

[0015] A readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of the above-described business anomaly detection method.

[0016] The method provided in this application embodiment is used to standardize the multi-source security data of the current business to obtain standard events; the feature values ​​of risk factors in the standard events are used to determine the dynamic risk score of the current business environment; the judgment threshold in the business identification baseline is adjusted according to the preset interval corresponding to the dynamic risk score; and anomaly detection is performed on the current business access based on the adjusted business identification baseline to obtain the detection result.

[0017] Standardizing multi-source security data from current business operations creates standardized events in a unified format, enabling the fusion and analysis of security data from different sources and types. This improves the efficiency of security data utilization and risk identification capabilities. Risk factor feature values ​​are extracted from the standardized events to dynamically score the current business environment, allowing for real-time awareness of business operation status and security risk changes. This avoids the detection lag issues caused by relying on fixed baselines in traditional solutions. The judgment thresholds in the business identification baseline are automatically adjusted based on preset intervals corresponding to the dynamic risk scores, enabling the detection strategy to adaptively adjust to changes in the business environment. When normal business traffic fluctuates significantly, the detection thresholds can be dynamically increased or optimized to reduce false alarms caused by business growth, changes in equipment scale, etc. When the business is in a high-risk environment or attack activity intensifies, the detection thresholds can be dynamically tightened to increase sensitivity to abnormal access behavior and reduce missed attack detections. Replacing manual experience-based configuration with dynamic baseline adjustment allows for automated optimization of business anomaly detection strategies. Anomaly detection based on the adjusted business identification baseline improves the ability to discover unknown threats and the accuracy of detection results, thereby enhancing the real-time performance, adaptability, and precision of network security protection.

[0018] In other words, this application solves the contradiction between false alarms and false negatives caused by static baselines by sensing environmental risks in real time and adaptively adjusting the judgment thresholds, thereby improving the accuracy of anomaly detection based on baselines.

[0019] Accordingly, embodiments of this application also provide a business anomaly detection device, equipment, and readable storage medium corresponding to the above-described business anomaly detection method, which have the above-described technical effects, and will not be repeated here. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart illustrating the implementation of a business anomaly detection method in this application. Figure 2 This is a flowchart illustrating a specific implementation of a business anomaly detection method in this application. Figure 3 This is a schematic diagram of the structure of a service anomaly detection device according to an embodiment of this application; Figure 4 This is a schematic diagram of the structure of an electronic device according to an embodiment of this application; Figure 5This is a schematic diagram of the specific structure of an electronic device in an embodiment of this application. Detailed Implementation

[0022] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are merely some embodiments of the present application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0023] For ease of understanding, the technical terms used in this application will be explained below.

[0024] Dynamic Risk Scoring: This refers to a quantitative value calculated in real time by an algorithm model based on real-time changes in the current network environment, taking into account multiple dimensions of data such as sudden increases / decreases in traffic, threat intelligence, and business context. It is used to characterize the degree of threat to the current environment.

[0025] Business Identification Baseline: This refers to the set of criteria used to distinguish between normal business traffic and malicious attack traffic. It typically includes thresholds for specific indicators such as request success rate, access duration, and time regularity.

[0026] Judgment Threshold: In security detection, this is a specific numerical threshold used to determine whether to trigger an alert. For example, an attack might be considered when the success rate of requests falls below a certain threshold.

[0027] Attack and Defense Drill: This refers to a test activity conducted by an enterprise or organization to simulate a real hacker attack in order to verify the effectiveness of its security defense system. During this period, the attack traffic is large, but the business traffic may be relatively small.

[0028] AIBusinessAgent (AI Business Intelligence Agent): Refers to the AI ​​algorithm module used to perform business traffic correlation analysis, time series analysis, and comprehensive judgment.

[0029] False Positive: This refers to the phenomenon where normal business traffic is mistakenly identified as attack traffic, resulting in an alert.

[0030] False Negative: This refers to the phenomenon where real attack traffic is mistakenly identified as normal business traffic and no alert is generated.

[0031] Please refer to Figure 1 , Figure 1 This is a flowchart of a business anomaly detection method according to an embodiment of this application. The method includes the following steps.

[0032] S101. Standardize the multi-source security data of the current business to obtain standard events.

[0033] In this embodiment, the current business is the baseline that needs to be identified based on the business. Multi-source security data refers to security-related data from different sources related to the current business, such as traffic, logs, threat intelligence, and business context.

[0034] In this embodiment, network traffic data is collected in real time by data collection probes deployed on the business traffic path. At the same time, business context data (such as business time period information, asset importance level, etc.) and external threat intelligence data (such as IP reputation database, malicious domain name database, etc.) are obtained through API interface, and the above data are used together as multi-source security data.

[0035] After acquiring multi-source security data, the data from each source is first cleaned to remove redundant information and noisy data. Then, the cleaned data is normalized according to a preset unified data structure to generate standard events. These standard events include at least network layer information (such as source IP, destination IP, source port, destination port, and protocol type), application layer information (such as HTTP method, URL, request body, and request headers), and context fields (such as business time period identifier and asset importance level).

[0036] The business time period identifier in the context field is used to mark whether the current access occurs within a normal working period, and the asset importance level is used to mark the importance of the accessed business asset (e.g., the importance level of a core database asset is higher than that of a regular front-end application). By injecting business context information into standard events, subsequent risk assessments gain environmental awareness. The introduction of external threat intelligence data enables the system to detect whether the current access source IP or domain has a known malicious background, thereby improving the coverage and accuracy of risk assessments.

[0037] In one specific embodiment of this application, the step of standardizing multi-source security data of current business to obtain standard events includes: Real-time collection of network traffic data, and acquisition of business context data and external threat intelligence data; Network traffic data, business context data, and external threat intelligence data are identified as multi-source security data. Clean the multi-source security data; normalize the cleaned data according to the preset data structure to obtain standard events.

[0038] Network traffic data is collected in real time by probes deployed on business traffic paths; business context data is synchronized from business systems (such as CMDB and time period configuration tables) via API; and external threat intelligence data is obtained by accessing third-party threat intelligence platforms. These three types of data come from different sources and have different formats. They need to be cleaned (removing noise and redundancy) and normalized (unified to a preset data structure) before they can be merged into structured standard events for subsequent consumption.

[0039] In one specific embodiment of this application, the cleaned data is normalized according to a preset data structure to obtain standard events, including: mapping the cleaned data to a preset data structure to obtain standard events including network layer information, application layer information and context fields; wherein, the context fields at least include a business time period identifier and an asset importance level.

[0040] Among them, network layer information is used to identify the two communicating parties (IP, port, protocol), application layer information is used to carry the application payload (such as URL, request body) required for attack detection, and context fields are used to inject environment-aware elements. Business time period identifier and asset importance level are two typical examples of context factors. The former is used to determine whether the access time is abnormal, and the latter is used to assign higher weight to access to core assets. Both are key inputs for subsequent dynamic risk scoring calculations.

[0041] For example: The system is deployed along the business traffic path and collects the following data in real time: Network traffic data: HTTP / HTTPS request headers, Body, Method, URL parameters.

[0042] Behavioral log data: login logs, API call logs, and database audit logs.

[0043] Asset and business data: Synchronize CMDB asset information (such as server importance level) and business time period information (such as whether it is a major promotion) via API.

[0044] External intelligence: Access to third-party threat intelligence platforms (such as IP reputation databases and malicious domain databases).

[0045] This data constitutes multi-source security data. Then, this data is cleaned and standardized into a unified event format.

[0046] The following section uses an attack scenario as an example to explain in detail how to obtain multi-source security data and how to obtain standard time.

[0047] In the attack scenario (2 AM, employee information interface, SQL injection), the raw data collected by the system, after cleaning and enrichment, will be transformed into standard events with the following structure: { "event_id": "EVT-20260701-020315-8821", "timestamp": "2026-07-01T02:03:15.882+08:00", "event_type": "HTTP_REQUEST", "data_source": "WAF_ACCESS_LOG", "network": { "src_ip": "203.0.113.45", "src_port": 54321, "dst_ip": "192.168.10.200", "dst_port": 443, "protocol": "HTTPS" }, http: { "method": "POST", "url": " / api / v1 / employee / info / query", "host": "hrms.internal.company.com", "user_agent": "Mozilla / 5.0 (Windows NT 10.0; Win64; x64)AppleWebKit / 537.36", "body": "employeeId=1001' UNION SELECT username,password FROMadmin_users WHERE '1'='1", "body_length": 128, "headers": { "content-type": "application / x-www-form-urlencoded", "x-forwarded-for": "203.0.113.45" } }, "context": { "business_hours": false, / / Non-working hours "time_slot": "early morning period", "asset_importance": 2.0, / / High-weighted assets (core database) "asset_type": "Employee Information Database", "cmdb_owner": "HR-Team", "scenario": "normal_operation" / / Not a major promotion, not a drill }, "threat_intel": { "ip_reputation": "malicious", "ip_confidence_score": 92, / / Confidence score in the reputation database "malicious_domain": false, "matched_threat_rules": ["SQL_Injection_Generic", "Union_Select_Detected"] }, "feature_extraction": { "sql_injection_keyword_count": 2, / / Matches "UNION" and "SELECT" "time_based_blind_indicator": true, / / Sleep() class feature exists "path_traversal_indicator": false, "request_frequency_1min": 12 / / Number of requests from this source IP in the past minute }, "status": { "http_status_code": 200, "response_body_length": 4096, "response_time_ms": 350} }

[0048] The fields in the standard event are described below: network: Five-tuple information used for source tracing and correlation analysis; http: Key fields in the original HTTP message, preserving the attack payload; context: Inject business context (asset weight, time period type) to enable scoring to have context awareness; threat_intel: External intelligence hit results, improving detection coverage; feature_extraction: The pre-extracted raw feature values, which are directly consumed by the subsequent scoring model; status: Response result, used for success rate calculation.

[0049] S102. Utilize the characteristic values ​​of risk factors in standard events to determine the dynamic risk score of the current business environment.

[0050] In this embodiment, different risk factors and the mapping relationship between the feature values ​​of the risk factors and the dynamic risk score can be preset. In this way, the feature values ​​of the risk factors can be extracted from standard events. Then, the dynamic risk score of the current business environment can be determined based on these feature values.

[0051] In one specific embodiment of this application, the step of determining the dynamic risk score of the current business environment by using the feature values ​​of risk factors in standard events includes: extracting feature values ​​of risk factors from standard events; wherein the feature values ​​include feature values, risk weights, and context factors; multiplying the feature values ​​of each risk factor by their respective risk weights and context factors, and summing the multiplications to obtain the dynamic risk score.

[0052] Among them, the feature value reflects the degree of quantification of the feature in the current request, such as the number of times the SQL injection keyword appears is 2; the risk weight reflects the inherent danger level of the feature itself, such as the weight of the Union Select keyword is 10, and the weight of the Sleep() blind injection feature is 15; the context factor is the real-time correction of the feature value, such as the built-in 1.5 times for non-working time.

[0053] In other words, each risk factor's feature value comprises three elements: a feature value (reflecting the frequency or intensity of the feature's occurrence in the current request), a risk weight (reflecting the inherent danger level of the feature, derived from expert experience or historical data training), and a context factor (a dynamic adjustment coefficient for the feature value based on the current environment; for example, this coefficient increases during non-working hours). Then, the feature value of each risk factor is multiplied by its corresponding risk weight and context factor, and these multiplications are summed to obtain a dynamic risk score for the current business environment. This score is updated in real time as the environment changes, providing an environmentally conscious basis for subsequent baseline adjustments.

[0054] In one specific embodiment of this application, the step of extracting feature values ​​of risk factors from standard events includes: performing attack feature rule matching on the application layer information of the standard events, determining the feature value corresponding to the attack feature hit situation based on the matching result; determining whether the current access belongs to an abnormal time period access based on the business time period identifier in the context field of the standard event, and determining the feature value corresponding to the abnormal time period access situation.

[0055] For attack signature matching, the number of matched keywords (e.g., "UNION" and "SELECT") is the feature value, calculated by performing regular expression or signature rule matching on application layer information (e.g., if both "UNION" and "SELECT" are matched, the feature value is 2). For access during abnormal periods, the business time period identifier in the context field is read to determine if the current access occurred outside of working hours; if so, a corresponding feature value is generated. Both feature values ​​provide quantitative input for subsequent weighted cumulative calculation of the risk score.

[0056] To facilitate understanding of how to extract feature values ​​of risk factors based on standard events, the following example illustrates the process using event-extracted feature vectors: { "feature_vector_id": "FV-20260701-020315-8821", "event_ref": "EVT-20260701-020315-8821", "extract_time": "2026-07-01T02:03:15.890+08:00", "features": [ { "feature_name": "sql_injection_keyword_count", "feature_value": 2, "risk_weight": 10, "context_factor": 1.0, "contribution": 20.0, "evidence": "Keywords hit: UNION, SELECT" }, { "feature_name": "time_based_blind_indicator", "feature_value": 1, "risk_weight": 15, "context_factor": 1.5, / / Corrected at 2 AM "contribution": 22.5, "evidence": "A Sleep(5) delay function call was detected" }, { "feature_name": "request_body_length", "feature_value": 500, / / Unit: bytes "risk_weight": 0.01, "context_factor": 1.0, "contribution": 5.0, "evidence": "Normal queries typically < 200 bytes" }, { "feature_name": "threat_intel_hit", "feature_value": 1, "risk_weight": 20, "context_factor": 1.5, / / Double correction for malicious IPs at midnight "contribution": 30.0, "evidence": "Source IP 203.0.113.45 is marked as a C2 node in the threat intelligence database." }, { "feature_name": "abnormal_time_access", "feature_value": 1, "risk_weight": 8, "context_factor": 1.0, "contribution": 8.0, "evidence": "Access to the core HR system outside of working hours (02:03)" }, { "feature_name": "request_frequency_deviation", "feature_value": 3.2, / / Z-score = 3.2, significantly deviating from the historical baseline. "risk_weight": 5, "context_factor": 1.0, "contribution": 16.0, "evidence": "This source IP has a historical average QPS of 0.5, and has experienced 12 QPS in the past minute." } ], "total_risk_score": 101.5, / / ΣTotal contribution score = 20 + 22.5 + 5 + 30 + 8 + 16 = 101.5 "score_interval": ">= 70", / / Maps to enhanced protection mode "risk_level": "HIGH" }

[0057] The feature extraction logic is shown in the table below.

[0058]

[0059] In practical applications, a risk assessment engine can also be used to calculate dynamic risk scores. Specifically, the risk assessment engine receives standard events and executes the following calculation logic: Feature extraction: Extracting risk factors from events. For example: F1: Is there a threat intelligence hit (Yes = 10 points, No = 0 points)?

[0060] F2: Request frequency deviation (based on historical baseline Z-score, the greater the deviation, the higher the score).

[0061] F3: Attack feature matching degree (e.g., the number of SQL injection features matched by regular expressions).

[0062] F4: Asset Importance Weight (Core Database = Weight 2.0, Regular Front-end = Weight 1.0).

[0063] The weighted calculation formula is used as follows: .

[0064] Feature_Value: The frequency or intensity of this feature in the current request.

[0065] For example: the SQL injection feature appears 3 times, with a value of 3; or the request body length is 1024 bytes, with a value of 1.024.

[0066] Risk_Weight: The level of danger of this feature itself (derived from expert experience or historical data).

[0067] For example: the keyword weight of Union Select is 10; the weight of path traversal is 8; the weight of Sleep() time-based blind injection is 15 (because it is very harmful).

[0068] Context_Factor: A dynamic adjustment factor based on the environment.

[0069] For example: if it is outside working hours (0:00-6:00), the coefficient is 1.5; if it is a known malicious IP range, the coefficient is 2.0.

[0070] The following example illustrates how dynamic risk scores are obtained.

[0071] Scenario: At 2 a.m. (outside of working hours), a hacker attempted to attack the company's employee information interface (a high-weight asset) by sending a request containing SQL injection characteristics.

[0072] The feature extraction and attack score calculation are shown in the table below:

[0073] In practical applications, lightweight models can be used directly to calculate risk scores, or more complex machine learning models (such as random forests and XGBoost) can be used for score calculation.

[0074] S103. Adjust the judgment threshold in the business identification baseline according to the preset range corresponding to the dynamic risk score.

[0075] In this embodiment, multiple intervals can be pre-set for the dynamic risk score, with different intervals corresponding to different judgment threshold adjustment methods. After calculating the dynamic risk score, the system determines the preset interval corresponding to the dynamic risk score from several preset intervals, and adjusts the judgment threshold according to the adjustment method corresponding to the preset interval. The judgment threshold refers to various thresholds in the business identification baseline used to determine whether the business is normal, such as the request success rate threshold and the duration threshold.

[0076] In one specific embodiment of this application, the step of adjusting the judgment threshold in the business identification baseline according to the preset interval corresponding to the dynamic risk score includes: From a number of preset intervals, determine the preset interval corresponding to the dynamic risk score, and the protection mode corresponding to the preset interval; Adjust the request success rate threshold and the continuous occurrence time threshold in the judgment threshold according to the adjustment method corresponding to the protection mode.

[0077] That is, the system has several preset scoring intervals (such as low-risk intervals corresponding to low-interference protection mode, medium-risk intervals corresponding to standard protection mode, and high-risk intervals corresponding to enhanced protection mode), and each protection mode corresponds to a specific set of judgment threshold configurations (request success rate threshold and continuous occurrence time threshold). The system automatically matches the corresponding protection mode based on the interval into which the calculated dynamic risk score falls, and updates the current judgment threshold according to the configuration parameters of that mode, thereby achieving adaptive adjustment of the strategy.

[0078] For example, when the dynamic risk score falls into the preset range corresponding to low risk, the system adopts the corresponding protection mode (such as low interference mode), lowers the request success rate threshold and shortens the continuous occurrence time threshold, thereby relaxing the judgment criteria and avoiding normal business fluctuations being misjudged as attacks; when the dynamic risk score falls into the preset range corresponding to high risk, the system adopts the corresponding protection mode (such as enhanced protection mode), raises the request success rate threshold and lengthens the continuous occurrence time threshold, thereby tightening the judgment criteria and preventing attack traffic from being missed.

[0079] The risk score can be divided into three intervals (e.g., <30, 30-70, >=70). However, in practical applications, it can be divided into more or fewer intervals according to specific business needs, and the specific thresholds of each interval (e.g., success rate of 50% / 75% / 95%) can be adjusted according to the specific business tolerance.

[0080] S104. Based on the adjusted business identification baseline, perform anomaly detection on the current business access and obtain the detection results.

[0081] After baseline adjustment, the system performs anomaly detection on current business access based on the business identification baseline, using the adjusted threshold for judgment. This ensures the detection results are adapted to the current business environment, effectively reducing missed and false positives.

[0082] The following examples illustrate anomaly detection using specific business behaviors.

[0083] Regarding the identification of one-to-one persistent requests, the following applies.

[0084] Criteria for whitelisting: internal-to-internal access, same source / destination IP / URL, and meeting the following conditions: access occurs continuously (e.g., for 3 days), concentrated in normal time periods (regularity), high success rate of requests (>80%), and no abnormal behavior.

[0085] Criteria for identifying a blacklist: sudden requests, low success rate (<80%), carrying attack characteristics, access during abnormal time periods, and malicious history of the source IP.

[0086] For example, AIBusinessAgent analysis shows that if the alarm time series is stable (volatility <15%), and the request pattern to the same URL is consistent for several consecutive days (≥3 days, where 3 days is the continuous occurrence time threshold), with a success rate >95%, then it is considered a high-confidence business behavior.

[0087] Regarding the identification of many-to-one similar requests, the following applies.

[0088] Criteria for whitelisting: internal to internal / internal to external, same destination IP / URL, and meeting the following conditions: more than 3 source IPs (multi-source access), regular time pattern, and success rate >80%.

[0089] Criteria for identifying a hacker: few source IPs (<3), low success rate, and carrying attack characteristics.

[0090] For example, if the target URL is accessed frequently by multiple internal network IPs, the time series pattern similarity is >85%, and the success rate is consistently >90%, then it is determined to be a business behavior involving multi-system collaboration.

[0091] In one specific embodiment of this application, the step of performing anomaly detection on the current service access based on the adjusted service identification baseline and obtaining the detection result includes: Get the success rate and duration of current business access requests; The request success rate is compared with the adjusted request success rate threshold to obtain the request success rate detection sub-result; The duration of occurrence is then compared with the adjusted duration threshold to obtain the duration detection sub-result. The detection result is determined by combining the request success rate detection sub-result and the duration detection sub-result.

[0092] In other words, the system obtains the request success rate and duration of current business access (such as the number of days or hours of continuous occurrence). It compares the request success rate with an adjusted request success rate threshold to obtain a request success rate detection sub-result; and compares the number of days of continuous occurrence with an adjusted duration threshold to obtain a duration detection sub-result. Combining the request success rate and duration detection sub-results, the system determines the detection result. For example, if the request success rate is greater than or equal to the adjusted request success rate threshold, and the number of days of continuous occurrence is greater than or equal to the adjusted duration threshold, it is determined to be normal business activity; otherwise, it is determined to be a potential attack.

[0093] In other words, the system independently compares the request success rate and the number of consecutive days of occurrence, obtaining separate detection sub-results. These two sub-results are then combined for a comprehensive judgment. For example, if the request success rate sub-result indicates a success rate greater than or equal to a threshold, and the duration sub-result indicates a consecutive number of days of occurrence greater than or equal to a threshold, the system determines the current access as normal business activity; otherwise, it is judged as a potential attack. This two-step comparison and comprehensive judgment method effectively filters out false positives caused by random fluctuations in a single dimension, improving the accuracy of the detection results.

[0094] In addition to using rule-based baseline matching (such as time regularity and success rate) in business behavior recognition, deep learning models (such as LSTM) can be introduced to perform more complex anomaly detection on time series.

[0095] like Figure 2 As shown, the process involves multi-source data acquisition, data preprocessing and analysis, traffic comparison analysis (historical baseline and current traffic), traffic classification statistics such as type distribution analysis, dynamic risk score calculation, obtaining the current risk score, determining the risk range, and adjusting the baseline threshold (e.g., Score < 30: low interference mode, adjusting historical baseline vs. current traffic; 30 <= Score < 70: standard protection mode, adjusting baseline threshold). Success rate 75%, lasting 3 days; Score >= 70: Enhanced protection mode, adjust baseline threshold. With a success rate of 95% for 5 consecutive days, the system identifies and analyzes business behavior (e.g., whether it conforms to the baseline; if it does, it is judged as normal business; if it does not, it is judged as a potential attack). It has achieved a complete technical closed loop from environmental perception to quantitative assessment, and from policy adaptation to accurate detection. This enables the business anomaly detection to dynamically and adaptively adjust the judgment criteria according to the real-time environment, effectively solving the contradiction between false alarms and false negatives caused by static baselines.

[0096] The method provided in this application embodiment is used to standardize the multi-source security data of the current business to obtain standard events; the feature values ​​of risk factors in the standard events are used to determine the dynamic risk score of the current business environment; the judgment threshold in the business identification baseline is adjusted according to the preset interval corresponding to the dynamic risk score; and anomaly detection is performed on the current business access based on the adjusted business identification baseline to obtain the detection result.

[0097] Standardizing multi-source security data from current business operations creates standardized events in a unified format, enabling the fusion and analysis of security data from different sources and types. This improves the efficiency of security data utilization and risk identification capabilities. Risk factor feature values ​​are extracted from the standardized events to dynamically score the current business environment, allowing for real-time awareness of business operation status and security risk changes. This avoids the detection lag issues caused by relying on fixed baselines in traditional solutions. The judgment thresholds in the business identification baseline are automatically adjusted based on preset intervals corresponding to the dynamic risk scores, enabling the detection strategy to adaptively adjust to changes in the business environment. When normal business traffic fluctuates significantly, the detection thresholds can be dynamically increased or optimized to reduce false alarms caused by business growth, changes in equipment scale, etc. When the business is in a high-risk environment or attack activity intensifies, the detection thresholds can be dynamically tightened to increase sensitivity to abnormal access behavior and reduce missed attack detections. Replacing manual experience-based configuration with dynamic baseline adjustment allows for automated optimization of business anomaly detection strategies. Anomaly detection based on the adjusted business identification baseline improves the ability to discover unknown threats and the accuracy of detection results, thereby enhancing the real-time performance, adaptability, and precision of network security protection.

[0098] In other words, this application solves the contradiction between false alarms and false negatives caused by static baselines by sensing environmental risks in real time and adaptively adjusting the judgment thresholds, thereby improving the accuracy of anomaly detection based on baselines.

[0099] Corresponding to the above method embodiments, this application also provides a business anomaly detection device. The business anomaly detection device described below can be referred to in correspondence with the business anomaly detection method described above.

[0100] See Figure 3 As shown, the device includes the following modules: Data acquisition module 101 is used to acquire multi-source security data for the current business. The data standardization module 102 is used to standardize multi-source security data to obtain standard events; Risk scoring module 103 is used to determine the dynamic risk score of the current business environment by utilizing the characteristic values ​​of risk factors in standard events; The strategy adjustment module 104 is used to adjust the judgment threshold in the business identification baseline according to the preset range corresponding to the dynamic risk score. The anomaly detection module 105 is used to perform anomaly detection on the current business access based on the adjusted business identification baseline and obtain the detection results.

[0101] Using the apparatus and method provided in the embodiments of this application, the multi-source security data of the current business is standardized to obtain standard events; the dynamic risk score of the current business environment is determined by using the feature values ​​of risk factors in the standard events; the judgment threshold in the business identification baseline is adjusted according to the preset interval corresponding to the dynamic risk score; and anomaly detection is performed on the current business access based on the adjusted business identification baseline to obtain the detection result.

[0102] Standardizing multi-source security data from current business operations creates standardized events in a unified format, enabling the fusion and analysis of security data from different sources and types. This improves the efficiency of security data utilization and risk identification capabilities. Risk factor feature values ​​are extracted from the standardized events to dynamically score the current business environment, allowing for real-time awareness of business operation status and security risk changes. This avoids the detection lag issues caused by relying on fixed baselines in traditional solutions. The judgment thresholds in the business identification baseline are automatically adjusted based on preset intervals corresponding to the dynamic risk scores, enabling the detection strategy to adaptively adjust to changes in the business environment. When normal business traffic fluctuates significantly, the detection thresholds can be dynamically increased or optimized to reduce false alarms caused by business growth, changes in equipment scale, etc. When the business is in a high-risk environment or attack activity intensifies, the detection thresholds can be dynamically tightened to increase sensitivity to abnormal access behavior and reduce missed attack detections. Replacing manual experience-based configuration with dynamic baseline adjustment allows for automated optimization of business anomaly detection strategies. Anomaly detection based on the adjusted business identification baseline improves the ability to discover unknown threats and the accuracy of detection results, thereby enhancing the real-time performance, adaptability, and precision of network security protection.

[0103] In other words, this application solves the contradiction between false alarms and false negatives caused by static baselines by sensing environmental risks in real time and adaptively adjusting the judgment thresholds, thereby improving the accuracy of anomaly detection based on baselines.

[0104] In one specific embodiment of this application, the data standardization module is specifically used to collect network traffic data in real time and obtain business context data and external threat intelligence data; identify the network traffic data, business context data and external threat intelligence data as multi-source security data; clean the multi-source security data; and normalize the cleaned data according to a preset data structure to obtain standard events.

[0105] In one specific embodiment of this application, the data standardization module is specifically used to map the cleaned data to a preset data structure to obtain standard events including network layer information, application layer information, and context fields; wherein, the context fields at least include a business time period identifier and an asset importance level.

[0106] In one specific embodiment of this application, the risk scoring module is specifically used to extract feature values ​​of risk factors from standard events; wherein, the feature values ​​include feature values, risk weights, and context factors; the feature values ​​of each risk factor are multiplied by their respective risk weights and context factors, and the multiplications are accumulated to obtain a dynamic risk score.

[0107] In one specific embodiment of this application, the risk scoring module is specifically used to perform attack feature rule matching on the application layer information of standard events, determine the feature value corresponding to the attack feature hit situation based on the matching result, determine whether the current access belongs to the abnormal time period access based on the business time period identifier in the context field of the standard event, and determine the feature value corresponding to the abnormal time period access situation.

[0108] In one specific embodiment of this application, the strategy adjustment module is specifically used to determine a preset interval corresponding to the dynamic risk score from several preset intervals, and the protection mode corresponding to the preset interval; and adjust the request success rate threshold and the continuous occurrence time threshold in the judgment threshold according to the adjustment method corresponding to the protection mode.

[0109] In one specific embodiment of this application, the anomaly detection module is specifically used to obtain the request success rate and duration of the current business access; compare the request success rate with an adjusted request success rate threshold to obtain a request success rate detection sub-result; compare the duration of the current access with an adjusted duration threshold to obtain a duration detection sub-result; and combine the request success rate detection sub-result and the duration detection sub-result to determine the detection result.

[0110] Corresponding to the above method embodiments, this application also provides an electronic device. The electronic device described below can be referred to in conjunction with the business anomaly detection method described above.

[0111] See Figure 4 As shown, the electronic device includes: Memory 332 is used to store computer programs; The processor 322 is used to implement the steps of the business anomaly detection method in the above method embodiment when executing a computer program.

[0112] For details, please refer to Figure 5 , Figure 5This is a schematic diagram of a specific structure of an electronic device provided in this embodiment. The electronic device can vary significantly due to differences in configuration or performance. It may include one or more central processing units (CPUs) (e.g., one or more processors) and a memory 332. The memory 332 stores one or more computer programs 342 or data 344. The memory 332 can be temporary or permanent storage. The program stored in the memory 332 may include one or more modules (not shown in the diagram), each module may include a series of instruction operations on the data processing device. Furthermore, the processor 322 may be configured to communicate with the memory 332 and execute the series of instruction operations stored in the memory 332 on the electronic device 301.

[0113] Electronic device 301 may also include one or more power supplies 326, one or more wired or wireless network interfaces 350, one or more input / output interfaces 358, and / or one or more operating systems 341.

[0114] The steps in the business anomaly detection method described above can be implemented by the structure of electronic devices.

[0115] Corresponding to the above method embodiments, this application also provides a readable storage medium. The readable storage medium described below can be referred to in conjunction with the business anomaly detection method described above.

[0116] A readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of the service anomaly detection method described in the above method embodiments.

[0117] The readable storage medium can specifically be a USB flash drive, external hard drive, read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk, or any other readable storage medium capable of storing program code.

[0118] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0119] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0120] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0121] Finally, it should be noted that in this document, relationships such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "include," "contain," or any other variations are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus.

[0122] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for detecting business anomalies, characterized in that, include: Standardize the multi-source security data of current business operations to obtain standard events; By utilizing the characteristic values ​​of risk factors in the standard events, a dynamic risk score for the current business environment is determined. Adjust the judgment threshold in the business identification baseline according to the preset range corresponding to the dynamic risk score; Based on the adjusted business identification baseline, anomaly detection is performed on the current business access to obtain the detection results.

2. The method according to claim 1, characterized in that, Standardize the multi-source security data of current business operations to obtain standard events, including: Real-time collection of network traffic data, and acquisition of business context data and external threat intelligence data; The network traffic data, the business context data, and the external threat intelligence data are identified as the multi-source security data. The multi-source security data is cleaned; The cleaned data is normalized according to a preset data structure to obtain the standard event.

3. The method according to claim 2, characterized in that, The cleaned data is normalized according to a preset data structure to obtain the standard events, including: The cleaned data is mapped to the preset data structure to obtain standard events including network layer information, application layer information, and context fields. The context field includes at least a business time period identifier and an asset importance level.

4. The method according to claim 1, characterized in that, Using the characteristic values ​​of risk factors in the aforementioned standard events, a dynamic risk score for the current business environment is determined, including: The feature values ​​of risk factors are extracted from the standard events; wherein the feature values ​​include feature values, risk weights, and contextual factors. The characteristic values ​​of each risk factor are multiplied by their respective risk weights and context factors, and the multiplications are accumulated to obtain the dynamic risk score.

5. The method according to claim 4, characterized in that, The feature values ​​of risk factors are extracted from the standard events, including: The application layer information of standard events is matched with attack feature rules, and the feature values ​​corresponding to the attack feature hit are determined based on the matching results. Based on the business time period identifier in the context field of the standard event, determine whether the current access belongs to an abnormal time period access, and determine the characteristic value corresponding to the abnormal time period access situation.

6. The method according to any one of claims 1 to 5, characterized in that, Based on the preset range corresponding to the dynamic risk score, adjust the judgment threshold in the business identification baseline, including: From a number of preset intervals, determine the preset interval corresponding to the dynamic risk score, and the protection mode corresponding to the preset interval; Adjust the request success rate threshold and the continuous occurrence time threshold in the judgment threshold according to the adjustment method corresponding to the protection mode.

7. The method according to claim 6, characterized in that, Based on the adjusted business identification baseline, anomaly detection is performed on the current business access, and the detection results are obtained, including: Get the success rate and duration of current business access requests; The request success rate is compared with the adjusted request success rate threshold to obtain the request success rate detection sub-result; The duration of occurrence is compared with the adjusted duration of occurrence threshold to obtain the duration detection sub-result; The detection result is determined by combining the request success rate detection sub-result and the duration detection sub-result.

8. A business anomaly detection device, characterized in that, include: The data acquisition module is used to acquire multi-source security data for the current business. The data standardization module is used to standardize the multi-source security data to obtain standard events; The risk scoring module is used to determine the dynamic risk score of the current business environment by utilizing the feature values ​​of risk factors in the standard events. The strategy adjustment module is used to adjust the judgment threshold in the business identification baseline according to the preset range corresponding to the dynamic risk score. The anomaly detection module is used to perform anomaly detection on the current business access based on the adjusted business identification baseline and obtain the detection results.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the business anomaly detection method as described in any one of claims 1 to 7 when executing the computer program.

10. A readable storage medium, characterized in that, The readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the service anomaly detection method as described in any one of claims 1 to 7.

Images