Bot Access Identification Using Time Sliding Window Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for identifying malicious user behavior, particularly during high-frequency access events like flash sales, are not accurate enough to distinguish between user-driven and software-driven access patterns, leading to ineffective prevention of malicious attacks.
Innovation Solution
A method and device utilizing a time sliding window to monitor and evaluate access behavior by analyzing the number of accesses, time variance, and ratios within predefined thresholds, enabling real-time identification of malicious access patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If simple threshold-based access counting is used, then the prevention mechanism is easy to implement, but the accuracy in distinguishing user-driven vs software-driven access is insufficient
Solution Approach 1:
The patent divides the access evaluation into multiple dimensions: (1) time sliding window segmentation to analyze access patterns over different time periods, (2) access behavior segmentation into different types (normal, suspicious, malicious), and (3) multi-factor segmentation including access frequency, time intervals, and behavioral patterns. This segmentation enables more precise identification while maintaining implementation feasibility through modular evaluation.
2Measurement precision
If real-time monitoring with time sliding window is implemented, then the accuracy of malicious behavior identification is improved, but the computational complexity increases
Solution Approach 1:
The patent pre-defines threshold values for access frequency, time intervals, and behavioral patterns before runtime evaluation. These preliminary thresholds are established based on historical data and normal user behavior patterns, allowing the system to quickly compare real-time access data against predefined criteria without performing complex calculations during real-time monitoring, thus reducing computational complexity while maintaining high accuracy.
3Measurement precision
If multiple evaluation criteria (access frequency, time variance, ratios) are used, then the detection accuracy is enhanced, but the system complexity increases
Solution Approach 1:
The patent implements dynamic threshold adjustment where evaluation thresholds are not fixed but adapt based on historical data, user profiles, and changing access patterns. The system dynamically modifies time window sizes, frequency thresholds, and variance criteria to optimize detection accuracy for different scenarios while managing system complexity through adaptive rather than static multi-criteria evaluation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present disclosure relates to a method and device for identifying user behavior, configured to identify a malicious behavior more effectively and accurately. The method includes: acquiring (101) an access behavior of a terminal within a preset time sliding window; evaluating (102) the access behavior within the time sliding window according to the access behavior within the time sliding window; and determining (103) whether the access behavior of the terminal is a malicious access according to an evaluation result.