CN107818132A - A kind of webpage agent discovery method based on machine learning - Google Patents
A kind of webpage agent discovery method based on machine learning Download PDFInfo
- Publication number
- CN107818132A CN107818132A CN201710858063.4A CN201710858063A CN107818132A CN 107818132 A CN107818132 A CN 107818132A CN 201710858063 A CN201710858063 A CN 201710858063A CN 107818132 A CN107818132 A CN 107818132A
- Authority
- CN
- China
- Prior art keywords
- features
- url
- webpage
- dom
- machine learning
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/95—Retrieval from the web
- G06F16/955—Retrieval from the web using information identifiers, e.g. uniform resource locators [URL]
- G06F16/9566—URL specific, e.g. using aliases, detecting broken or misspelled links
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/95—Retrieval from the web
- G06F16/951—Indexing; Web crawling techniques
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/95—Retrieval from the web
- G06F16/958—Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
- G06F16/986—Document structures and storage, e.g. HTML extensions
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
- G06F21/562—Static detection
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/2119—Authenticating web pages, e.g. with suspicious links
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Databases & Information Systems (AREA)
- General Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Data Mining & Analysis (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Software Systems (AREA)
- Health & Medical Sciences (AREA)
- General Health & Medical Sciences (AREA)
- Virology (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The present invention provides a kind of webpage agent discovery method based on machine learning, and step includes：Acted on behalf of by reptile active obtaining and non-proxy web data collection；Concentrated from the web data and extract URL features and DOM features respectively, the vector of multidimensional characteristic is contained as training set according to the URL features and/or DOM feature constructions one；Model being built on the training set using machine learning method and being trained, webpage agency's identification is carried out by the model trained.URL and webpage content extraction feature of the present invention based on reptile capture, and build model and are trained, and go out webpage agency according to the Model Identification of training, and the accuracy rate of identification, recall rate and F1 score are high.
Description
Technical field
The present invention relates to technical field of network security, it is more particularly to a kind of under open cyberspace environment based on machine
The webpage agent discovery method of device study.
Background technology
As cyberspace scale constantly expands, while being facilitated to people, corresponding " black production " (porn site, takes advantage of
Swindleness transaction, network intrusions information stealth etc.) it is even more like a raging fire.Criminal more focuses on itself and accessed to escape detection
Behavior is hidden (frequently using agency etc.), and risk control of these malicious acts to enterprise, country is proposed new challenge.
Agency service relies on vast resources that its own possesses or that internet public service provides in recent years, constantly expands
Its agent address is resisted.User more focuses on it and accesses hiding for behavior, and the communication channel of agency is also more hidden, these
The difficulty of network forensics is all deepened.
In cyberspace service under open environment, agency service form characterizes more, quantity and distribution dynamic change, tool
There is the characteristics of concealment, dynamic, time-varying so that the truth of service is difficult to portray.In addition, agency service has lifting access property
The multiple functions such as energy, resources accessing control, security fence, therefore, by the detection to cyberspace agency service resource, divide
Analysis and discovery, can grasp characteristic and its distribution of agency service comprehensively, and business network environment optimization and national network are made the country prosperous
Strategy is significant.
Pointed out according to GWI (global web index) the social reports of 2014, in the population of 16 to 64 years old, China
The third-largest country using agency service in the world, therefore, carry out agency service find it is very urgent.In addition, agency service
Species is various, such as webpage agency, HTTP Proxy, Socks agencies, VPN agencies.But online webpage agency has freely, no
It is widely used with the advantages that installation, easily use.
Staniford and the people of Heberlein bis- propose the concept of agency service detection first, and propose based on net
The detection method of network bag content, certainly, this method is helpless to the agency service for encrypting flow.Certainly, also have
Many is the method based on blacklist, but this method based on blacklist is only limitted to detect known agency service, lacks
Good autgmentability.In addition, though based on blacklist method, operationally efficiency is very high, but in the process of construction blacklist
In, it is cumbersome, because the nowadays method of most of construction blacklists or manual mode.In order to strengthen scalability, together
When in order to tackle act on behalf of the periodically variable problem of domain name, it is proposed that the method based on regular expression, such as produce Snort rules
Etc..Although the method scalability based on regular expression is good, accuracy is not relatively high, and generates regular expression
Process be also inefficient.
Nowadays in most research, 2 kinds of methods mainly detect agency service：Method based on signature
(Signature-based) and feature based method (characteristic-based).
Method based on signature is mainly based upon content, such as based on fingerprint and based on watermark.Side based on fingerprint
Method is mainly based upon the content of flow, and such as characteristic attribute of bag, content extract the modes such as signature, regular expression and examined
Survey；Method based on watermark is mainly to inject watermark feature in the flow for flowing into main frame, if being examined in the flow of outflow main frame
The bag feature containing watermark is measured, then judges the main frame to provide the main frame of agency service.Both methods based on content exist
It is difficult to apply in encryption flow.
The method of the latter's feature based does not detect to bag content, has on the one hand abandoned the worry for invading privacy of user,
On the other hand also bypassed to the difficult problem of encrypted content detection content.Vahid et al. is based on being stored in server not
Same traffic log, agency service is identified with the method for machine learning, but this is for the memory capacity and analysis efficiency of server
Propose challenge.Rueimin et al. proposes one kind based on the method for RTT (Round-Trip Time) times to detect whether
For proxy.If its based on theoretical foundation be proxy provide relay services, it necessarily responds the request of user, laid equal stress on
It is new to establish TCP links, the RTT total times so based on proxy it is naturally larger than the RTT without proxy.In addition, also
Have and be based on further feature, such as bag size, bag timestamp, establish the link beginning and ending time, parlor delay etc., to detect agency's clothes
Business.These are very big by network environment influence based on the method for timestamp, and precision is relatively low, and robustness (Robust) is poor.
The content of the invention
It is an object of the invention to provide a kind of webpage agent discovery method based on machine learning, based on reptile capture
URL and webpage content extraction feature, and build model and be trained, webpage agency is gone out according to the Model Identification of training, identification
Accuracy rate, recall rate and F1-score are high.
To reach above-mentioned purpose, the present invention adopts the following technical scheme that：
A kind of webpage agent discovery method based on machine learning, step include：
Acted on behalf of by reptile active obtaining and non-proxy web data collection；
Concentrated from the web data and extract URL features and DOM features respectively, according to the URL features and/or DOM features
Structure one contains the vector of multidimensional characteristic as training set；
Model is built on the training set using machine learning method and be trained, carried out by the model trained
Webpage agency's identification.
Further, the web data collection includes URL and web page contents.
Further, the URL features include：It is digital, sensitive vocabulary, additional character, IP domain names, embedded domain name, top
Domain name is short using non-conventional domain name and URL life cycle of coming into force.
Further, the DOM features include：List, Javascript features.
Further, the list includes：
Architectural feature：Multiple optional check boxes including an input frame and below input frame；
Attributive character：Final election box value contains sensitive vocabulary, and action property values contain sensitive character string.
Further, the Javascript features contain sensitive character string including function property value.
Further, the extraction includes three kinds of methods：
1) the URL features are directed to, character string detection are carried out by URL regular expressions, by the whois for asking domain name
Information calculates URL and come into force life cycle；
2) the DOM features are directed to, are parsed by Beautiful Soup find_all () method；
3) the function processing navigation, search, modification parsing tree function of python formulas are passed through.
Further, acted on behalf of by reptile active obtaining and non-proxy test set, from the test set extract URL features and
DOM features, construction feature vector simultaneously carry out agency's identification, with the knot that webpage agency's identification is carried out by the model trained
Fruit is analyzed.
Further, the training set is based on the URL features and DOM features
Further, the machine learning method include Logistic Regression, Bayes, SVM-linear and
SVM-RBF。
Further, if acting on behalf of recognition result has error, its wrong sample is added in training set and re-started
Model training.
Method provided by the invention, the webpage URL captured based on reptile and webpage content extraction URL features and DOM features,
According to feature construction training set, build model on training set using machine learning method and be trained, pass through the mould of training
Type identifies that webpage is acted on behalf of；Extracted additionally by test set and construction feature is vectorial, carried out contrast identification, utilize the mistake of identification
Sample re -training more new model, improve discrimination.Through experiment test, structure of the present invention such as based on URL features, the standard of identification
True rate, recall rate and F1-score respectively reach 96%, 71.5% and 82%；Based on the structure of DOM features, agency's is accurate
Rate, recall rate and F1-score respectively reach 93.75%, 78.75% and 85%；And the structure simultaneously based on two features, know
Other accuracy rate, recall rate and F1-score are up to 95%, 96.5% and 95.25% respectively.
Brief description of the drawings
Fig. 1 is a kind of webpage agent discovery method schematic diagram based on machine learning of the present invention.
Fig. 2 is ROC curve comparison diagram under different characteristic collection.
Embodiment
To enable the features described above of the present invention and advantage to become apparent, special embodiment below, and coordinate institute's accompanying drawing to make
Describe as follows that the present invention will be described in detail below in conjunction with above-mentioned in detail.
A kind of webpage agent discovery method based on machine learning, as shown in figure 1, step includes：
1st, by writing reptile active obtaining agency and non-proxy web data collection, mainly URL and web page contents are included.
2nd, the URL features and DOM features for extracting webpage respectively are concentrated from web data, is specifically included：
URL features include：
A) containing numeral, or domain name is IP；
B) sensitive vocabulary, such as proxy, hide, block are contained；
C) additional character, such as "-" "@" are contained；
D) containing embedded domain name, such as http://rhe.rxxrh.com/http://www.google.com；
E) TLD uses non-conventional domain name, such as " .xyz " " .top "；
F) URL effective life cycles are too short, are such as no more than 280 days.
DOM features include：
A) list (Form)：
Architectural feature：Contain an input frame in Form lists, contain multiple check boxes (optional) below input frame；
Attributive character：Final election box value contains sensitive vocabulary；Action attributes：Action property values contain sensitive character string；
B) Javascript features, such as Onsubmit functions：Property value contains sensitive character string.
The mode of extraction feature has three kinds：
A) URL features are directed to, its preceding 5 feature is to carry out character string detection, the 6th feature by URL regular expressions
It is to be come into force life cycle by asking the whois information of domain name to calculate corresponding URL；
B) DOM features are directed to, its Form list and Javascript features are by Beautiful Soup find_all
() method is parsed, and wherein Beautiful Soup are a tool boxes, need to parse by parsing document and providing the user
Data because simply, not needing how many code cans to write out a complete application program；
C) it is used for handling the functions such as navigation, search, modification parsing tree using some simple, python formulas functions.
3rd, for each webpage, by above-mentioned URL features and DOM feature constructions one containing multidimensional characteristic to
Amount, as training set.
4th, in order to verify validity of the feature extraction to agency's identification, the present invention is respectively in URL features, DOM features and complete
Collect feature (FULL, including URL and DOM features) different scales feature set on respectively by Logistic Regression,
Tetra- kinds of machine learning method structure training patterns of Bayes, SVM-linear, SVM-RBF.
5th, agency and non-proxy test set are obtained by reptile.
6th, URL features and DOM features, construction feature vector are extracted from test set.
7th, carry out acting on behalf of identification respectively and be analyzed by the model and the characteristic vector of test set that train, demonstrate,prove
The former bright recognition result is better than the latter.
8th, recognition result is acted on behalf of for acquisition, if error be present, wrong sample can be added in training set to enter again
Row model training.
It is the experiment test to the inventive method below：
Table 1 compared in different scales feature set respectively by Logistic Regression, Bayes, SVM-
The Detection results of tetra- kinds of machine learning method structure training patterns of linear, SVM-RBF.
The different model inspection results of table 1
As shown in Table 1, on the one hand indicate the robustness of this method, on the other hand higher accuracy rate and recall rate also from
Side demonstrates validity and feasibility of the present invention in webpage proxy feature structure.
It is illustrated in figure 2 the present invention and ROC curve comparison diagram is carried out on different characteristic collection, as seen from the figure URL features, DOM
Feature and complete or collected works' feature area are all higher than prior art (diagonal), and complete or collected works' feature (Full) area is maximum, illustrates its effect
It is best.Specific testing result is as shown in table 2.
The different characteristic collection training result of table 2
From table 2, URL features or the feature construction of DOM features or complete or collected works are carried out, there is higher accuracy rate, recall
Rate and F1-score, the feature construction effect for especially carrying out complete or collected works are best.
The above embodiments are merely illustrative of the technical solutions of the present invention rather than is limited, the ordinary skill of this area
Technical scheme can be modified by personnel or equivalent substitution, without departing from the spirit and scope of the present invention, this
The protection domain of invention should be to be defined described in claims.
Claims (10)
1. a kind of webpage agent discovery method based on machine learning, step include：
Acted on behalf of by reptile active obtaining and non-proxy web data collection；
Concentrated from the web data and extract URL features and DOM features respectively, according to the URL features and/or DOM feature constructions
One contains the vector of multidimensional characteristic as training set；
Model being built on the training set using machine learning method and being trained, webpage is carried out by the model trained
Agency's identification.
2. according to the method for claim 1, it is characterised in that the web data collection includes URL and web page contents.
3. according to the method for claim 1, it is characterised in that the URL features include：Digital, sensitive vocabulary, special symbol
Number, IP domain names, embedded domain name, TLD it is short using non-conventional domain name and URL life cycle of coming into force.
4. according to the method for claim 1, it is characterised in that the DOM features include：List, Javascript features.
5. according to the method for claim 4, it is characterised in that the list includes：
Architectural feature：Multiple optional check boxes including an input frame and below input frame；
Attributive character：Final election box value contains sensitive vocabulary, and action property values contain sensitive character string.
6. according to the method for claim 4, it is characterised in that the Javascript features contain including function property value
Sensitive character string.
7. according to the method for claim 1, it is characterised in that the extraction includes three kinds of methods：
1) the URL features are directed to, character string detection are carried out by URL regular expressions, by the whois information for asking domain name
URL is calculated to come into force life cycle；
2) the DOM features are directed to, are parsed by Beautiful Soup find_all () method；
3) the function processing navigation, search, modification parsing tree function of python formulas are passed through.
8. according to the method for claim 1, it is characterised in that acted on behalf of by reptile active obtaining and non-proxy test
Collection, URL features and DOM features are extracted from the test set, construction feature vector simultaneously carries out agency's identification, with described by training
Model carry out webpage agency identification result be analyzed.
9. according to the method for claim 1, it is characterised in that the machine learning method includes Logistic
Regression, Bayes, SVM-linear and SVM-RBF.
10. according to the method for claim 1, it is characterised in that if acting on behalf of recognition result has error, by its mistake
Sample adds in training set and re-starts model training.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710858063.4A CN107818132A (en) | 2017-09-21 | 2017-09-21 | A kind of webpage agent discovery method based on machine learning |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710858063.4A CN107818132A (en) | 2017-09-21 | 2017-09-21 | A kind of webpage agent discovery method based on machine learning |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN107818132A true CN107818132A (en) | 2018-03-20 |
Family
ID=61607801
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201710858063.4A Pending CN107818132A (en) | 2017-09-21 | 2017-09-21 | A kind of webpage agent discovery method based on machine learning |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN107818132A (en) |
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110233774A (en) * | 2019-05-28 | 2019-09-13 | 华中科技大学 | A kind of Distributed probing method and system of Socks proxy server |
| CN110493088A (en) * | 2019-09-24 | 2019-11-22 | 国家计算机网络与信息安全管理中心 | A kind of mobile Internet traffic classification method based on URL |
| CN110677313A (en) * | 2019-08-25 | 2020-01-10 | 北京亚鸿世纪科技发展有限公司 | Method for discovering VPN software background server |
| CN111459365A (en) * | 2020-04-03 | 2020-07-28 | 南方电网科学研究院有限责任公司 | Method for managing user-defined consultation help application |
| CN111787110A (en) * | 2020-07-03 | 2020-10-16 | 国网湖北省电力有限公司 | Socks proxy discovery method and system |
| WO2021169239A1 (en) * | 2020-02-24 | 2021-09-02 | 网宿科技股份有限公司 | Crawler data recognition method, system and device |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20100205297A1 (en) * | 2009-02-11 | 2010-08-12 | Gurusamy Sarathy | Systems and methods for dynamic detection of anonymizing proxies |
| CN102790762A (en) * | 2012-06-18 | 2012-11-21 | 东南大学 | Phishing website detection method based on uniform resource locator (URL) classification |
| CN102932348A (en) * | 2012-10-30 | 2013-02-13 | 常州大学 | Real-time detection method and system of phishing website |
| CN103544210A (en) * | 2013-09-02 | 2014-01-29 | 烟台中科网络技术研究所 | System and method for identifying webpage types |
| US20140033307A1 (en) * | 2012-07-24 | 2014-01-30 | Webroot Inc. | System and method to provide automatic classification of phishing sites |
| CN104077396A (en) * | 2014-07-01 | 2014-10-01 | 清华大学深圳研究生院 | Method and device for detecting phishing website |
| CN106789888A (en) * | 2016-11-18 | 2017-05-31 | 重庆邮电大学 | A kind of fishing webpage detection method of multiple features fusion |
-
2017
- 2017-09-21 CN CN201710858063.4A patent/CN107818132A/en active Pending
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20100205297A1 (en) * | 2009-02-11 | 2010-08-12 | Gurusamy Sarathy | Systems and methods for dynamic detection of anonymizing proxies |
| CN102790762A (en) * | 2012-06-18 | 2012-11-21 | 东南大学 | Phishing website detection method based on uniform resource locator (URL) classification |
| US20140033307A1 (en) * | 2012-07-24 | 2014-01-30 | Webroot Inc. | System and method to provide automatic classification of phishing sites |
| CN102932348A (en) * | 2012-10-30 | 2013-02-13 | 常州大学 | Real-time detection method and system of phishing website |
| CN103544210A (en) * | 2013-09-02 | 2014-01-29 | 烟台中科网络技术研究所 | System and method for identifying webpage types |
| CN104077396A (en) * | 2014-07-01 | 2014-10-01 | 清华大学深圳研究生院 | Method and device for detecting phishing website |
| CN106789888A (en) * | 2016-11-18 | 2017-05-31 | 重庆邮电大学 | A kind of fishing webpage detection method of multiple features fusion |
Cited By (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110233774A (en) * | 2019-05-28 | 2019-09-13 | 华中科技大学 | A kind of Distributed probing method and system of Socks proxy server |
| CN110233774B (en) * | 2019-05-28 | 2020-12-29 | 华中科技大学 | Detection method, distributed detection method and system for Socks proxy server |
| CN110677313A (en) * | 2019-08-25 | 2020-01-10 | 北京亚鸿世纪科技发展有限公司 | Method for discovering VPN software background server |
| CN110493088A (en) * | 2019-09-24 | 2019-11-22 | 国家计算机网络与信息安全管理中心 | A kind of mobile Internet traffic classification method based on URL |
| WO2021169239A1 (en) * | 2020-02-24 | 2021-09-02 | 网宿科技股份有限公司 | Crawler data recognition method, system and device |
| CN111459365A (en) * | 2020-04-03 | 2020-07-28 | 南方电网科学研究院有限责任公司 | Method for managing user-defined consultation help application |
| CN111459365B (en) * | 2020-04-03 | 2021-06-25 | 南方电网科学研究院有限责任公司 | Method for managing user-defined consultation help application |
| CN111787110A (en) * | 2020-07-03 | 2020-10-16 | 国网湖北省电力有限公司 | Socks proxy discovery method and system |
| CN111787110B (en) * | 2020-07-03 | 2023-03-31 | 国网湖北省电力有限公司 | Socks proxy discovery method and system |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN107818132A (en) | A kind of webpage agent discovery method based on machine learning | |
| CN103559235B (en) | A kind of online social networks malicious web pages detection recognition methods | |
| CN104954372B (en) | A kind of evidence obtaining of fishing website and verification method and system | |
| CN101820366B (en) | Pre-fetching-based fishing web page detection method | |
| CN104077396B (en) | Method and device for detecting phishing website | |
| CN102035698B (en) | HTTP tunnel detection method based on decision tree classification algorithm | |
| Zhu et al. | A deep learning approach for network anomaly detection based on AMF-LSTM | |
| CN107659570A (en) | Webshell detection methods and system based on machine learning and static and dynamic analysis | |
| CN108337255B (en) | Phishing website detection method based on web automatic test and width learning | |
| WO2016201938A1 (en) | Multi-stage phishing website detection method and system | |
| CN107332848A (en) | A kind of exception of network traffic real-time monitoring system based on big data | |
| CN112929390B (en) | Network intelligent monitoring method based on multi-strategy fusion | |
| CN103458042A (en) | Microblog advertisement user detection method | |
| CN103179132A (en) | Method and device for detecting and defending CC (challenge collapsar) | |
| CN102222187A (en) | Domain name structural feature-based hang horse web page detection method | |
| JP2014502753A (en) | Web page information detection method and system | |
| CN106779278A (en) | The evaluation system of assets information and its treating method and apparatus of information | |
| CN106095979A (en) | URL merging treatment method and apparatus | |
| CN109657470A (en) | Malicious web pages detection model training method, malicious web pages detection method and system | |
| CN104202291A (en) | Anti-phishing method based on multi-factor comprehensive assessment method | |
| CN102158499A (en) | Trojan-embedded website detection method based on hyper text transfer protocol (HTTP) traffic analysis | |
| CN106169050B (en) | A kind of PoC Program extraction method based on webpage Knowledge Discovery | |
| Singh et al. | A survey on different phases of web usage mining for anomaly user behavior investigation | |
| Ren et al. | App identification based on encrypted multi-smartphone sources traffic fingerprints | |
| CN110225009A (en) | It is a kind of that user's detection method is acted on behalf of based on communication behavior portrait |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| WD01 | Invention patent application deemed withdrawn after publication | ||
| WD01 | Invention patent application deemed withdrawn after publication |
Application publication date: 20180320 |