CN107888602A - A kind of method and device for detecting abnormal user - Google Patents
A kind of method and device for detecting abnormal user Download PDFInfo
- Publication number
- CN107888602A CN107888602A CN201711181755.6A CN201711181755A CN107888602A CN 107888602 A CN107888602 A CN 107888602A CN 201711181755 A CN201711181755 A CN 201711181755A CN 107888602 A CN107888602 A CN 107888602A
- Authority
- CN
- China
- Prior art keywords
- user
- daily record
- targeted customer
- abnormal user
- similitude
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
Abstract
The invention discloses a kind of method and device for detecting abnormal user, the method includes：Gather daily record；The daily record collected is classified；According to the access parameter in of all categories to scoring of all categories, the classification of selection scoring ranking top n, using the daily record in this N number of classification as key log；Population characteristic is extracted to the key log according to feature extraction algorithm, personal feature is extracted according to daily record of the feature extraction algorithm to targeted customer, judges whether the targeted customer is abnormal user according to the similitude of the population characteristic and the personal feature.The present invention possesses longer time window, can obtain the feature of more accurate user independently of real-time policy system.
Description
Technical field
The present invention relates to Internet technical field, more particularly to a kind of method and device for detecting abnormal user.
Background technology
Existing network security classes product is typically using some rules or the behavior boundary of policy depiction user, if user
A certain feature breach normal users threshold value will trigger processing action.
In rule-based network safety prevention scheme, the parameter such as regular threshold value, algorithm is highly dependent upon rule author
Experience, and be relatively fixed, can not accomplish after the completion of configuration with the development of business and the change of website structure function etc. adaptive
Should.
Have the disadvantage that in the prior art：
1. need to understand the framework and function of customer rs site in advance.
2. security strategy is customized respectively for different domain name distinct interfaces.
3. the framework or function of customer rs site change, or when business has growth, tactful accuracy and recall rate
It can reduce.
4th, after the change of website visiting user characteristics tactful validity can be caused to be deteriorated, or even the feelings that mistake stops occurs
Condition.
5th, periodically artificial amendment relevant parameter greatly improves protection and ensures cost.
The content of the invention
In order to solve the above-mentioned technical problem, the invention provides a kind of method and device for calculating access parameter.
The method of detection abnormal user provided by the invention, including：
Gather daily record；
The daily record collected is classified；
According to the access parameter in of all categories to scoring of all categories, the classification of selection scoring ranking top n, by this N number of class
Daily record in not is as key log；
Population characteristic, the day according to feature extraction algorithm to targeted customer are extracted to key log according to feature extraction algorithm
Will extracts personal feature, judges whether targeted customer is abnormal user according to the similitude of population characteristic and personal feature.
The method of above-mentioned detection abnormal user also has the characteristics that：
Carrying out classification to the daily record collected includes：
Website URI features are extracted to the daily record collected using URI disaggregated models, by the daily record with identical URI features
It is divided into same category.
The method of above-mentioned detection abnormal user also has the characteristics that：
Feature extraction algorithm includes：The algorithm of source characteristics is accessed for extracting user, behavioural characteristic is accessed for extracting
Algorithm, for extracting the algorithm of access path conversion parameter.
The method of above-mentioned detection abnormal user also has the characteristics that：
User, which accesses source characteristics, includes at least one of following characteristics：It is the operating system of user, browser type, clear
Look at device version, device type；
Accessing behavioural characteristic includes at least one of following characteristics：Significance level, the access path process of access path
The middle access parameter used, access method, interface path, interface path support parameter attribute, upload operation data attribute,
The data attribute of down operation；
Access path conversion parameter includes at least one of following characteristics：Obtain page of the user when normally accessing website
Face redirects order and redirects probability.
The method of above-mentioned detection abnormal user also has the characteristics that：
When the number of feature extraction algorithm is multiple, targeted customer is judged according to the similitude of population characteristic and personal feature
Include for the possibility of abnormal user：It is determined that the population characteristic that is obtained by each feature extraction algorithm and personal feature is similar
Property, the normalization similar value of each similitude is calculated using the average value of each similitude or by normalization creep function, according to this
Average value or normalization similar value judge whether targeted customer is abnormal user.
The method of above-mentioned detection abnormal user also has the characteristics that：
Method also includes：The daily record prediction subsequent period single user list period according to collecting is accessed in the visit capacity of website
Limit, when targeted customer is more than the visit capacity upper limit in subsequent period to the visit capacity of an at least website, or, exist in targeted customer
Subsequent period is more than the visit capacity upper limit and according to population characteristic and the similitude of personal feature to the visit capacity of an at least website
When judging targeted customer for abnormal user, it is abnormal user to determine targeted customer.
The device of detection abnormal user provided by the invention, including：
Acquisition module, for gathering daily record；
Sort module, for classifying to the daily record collected；
Selecting module, for according to the access parameter in of all categories to scoring of all categories, the class of selection scoring ranking top n
Not, using the daily record in this N number of classification as key log；
Judge module, for extracting population characteristic to key log according to feature extraction algorithm, according to feature extraction algorithm
To targeted customer daily record extraction personal feature, according to the similitude of population characteristic and personal feature judge targeted customer whether be
Abnormal user.
The device of above-mentioned detection abnormal user also has the characteristics that：
Sort module, it is also used for URI disaggregated models and website URI features is extracted to the daily record collected, there will be phase
Daily record with URI features is divided into same category.
The device of above-mentioned detection abnormal user also has the characteristics that：
Feature extraction algorithm includes：The algorithm of source characteristics is accessed for extracting user, behavioural characteristic is accessed for extracting
Algorithm, for extracting the algorithm of access path conversion parameter.
The device of above-mentioned detection abnormal user also has the characteristics that：
User, which accesses source characteristics, includes at least one of following characteristics：It is the operating system of user, browser type, clear
Look at device version, device type；
Accessing behavioural characteristic includes at least one of following characteristics：Significance level, the access path process of access path
The middle access parameter used, access method, interface path, interface path support parameter attribute, upload operation data attribute,
The data attribute of down operation；
Access path conversion parameter includes at least one of following characteristics：Obtain page of the user when normally accessing website
Face redirects order and redirects probability.
The device of above-mentioned detection abnormal user also has the characteristics that：
Judge module, it is additionally operable to when the number of feature extraction algorithm is multiple, using following methods according to population characteristic
Judge possibility of the targeted customer for abnormal user with the similitude of personal feature：It is determined that obtained by each feature extraction algorithm
Population characteristic and personal feature similitude, calculate each phase using the average value of each similitude or by normalization creep function
Like the normalization similar value of property, judge whether targeted customer is abnormal user according to this average value or normalization similar value.
The device of above-mentioned detection abnormal user also has the characteristics that：
Device also includes：Visit capacity analysis module, when predicting subsequent period single user list for the daily record that basis collects
Section accesses the visit capacity upper limit of website；
Judge module, it is additionally operable to be more than the visit capacity upper limit to the visit capacity of an at least website in subsequent period in targeted customer
When, or, the visit capacity upper limit is more than and according to colony spy to the visit capacity of an at least website in subsequent period in targeted customer
When the similitude for personal feature of seeking peace judges targeted customer for abnormal user, it is abnormal user to determine targeted customer.
The present invention possesses longer time window, can obtain more accurate user's independently of real-time policy system
Feature, have further the advantage that:
(1) deployment configuration workload is reduced, the framework for understanding each website and business scenario is not spent and then matches somebody with somebody respectively
Put.
(2) system reliability is increased, threshold parameter can update with business development automatic Prediction over time.
(3) influence of subjective factor is reduced, reference statistical historical data is as a result more scientific.
(4) adaptability is increased, the new interface of automatic identification simultaneously extracts its feature.
Brief description of the drawings
The accompanying drawing for forming the part of the present invention is used for providing a further understanding of the present invention, schematic reality of the invention
Apply example and its illustrate to be used to explain the present invention, do not form inappropriate limitation of the present invention.In the accompanying drawings：
Fig. 1 is the flow chart for the method that abnormal user is detected in embodiment；
Fig. 2 is the structure chart for the device that abnormal user is detected in embodiment.
Embodiment
To make the purpose, technical scheme and advantage of the embodiment of the present invention clearer, below in conjunction with the embodiment of the present invention
In accompanying drawing, the technical scheme in the embodiment of the present invention is clearly and completely described, it is clear that described embodiment is
Part of the embodiment of the present invention, rather than whole embodiments.Based on the embodiment in the present invention, those of ordinary skill in the art
The every other embodiment obtained under the premise of creative work is not made, belongs to the scope of protection of the invention.Need
Illustrate, in the case where not conflicting, the feature in embodiment and embodiment in the application can be mutually combined.
Fig. 1 is the flow chart for the method that abnormal user is detected in embodiment；The method includes：
Step 1, daily record is gathered；
Step 2, the daily record collected is classified；
Step 3, according to the access parameter in of all categories to scoring of all categories, the classification of selection scoring ranking top n, by this
Daily record in N number of classification is as key log；
Step 4, population characteristic is extracted to key log according to feature extraction algorithm, target used according to feature extraction algorithm
The daily record extraction personal feature at family, judges possibility of the targeted customer for abnormal user according to the similitude of group character and personal feature
Property.
Wherein,
Also include between step 1 and step 2：In the form disunity of the daily record collected, the daily record collected is entered
Row pretreatment, export the daily record of unified form.
Carrying out classification to the daily record collected in step 2 includes：Using URI disaggregated models to the daily record extraction station that collects
Point URI features, the daily record with identical URI features is divided into same category.
Parameter is accessed in step 3 includes the number of visiting people or visit capacity.
Feature extraction algorithm in step 4 includes at least one of following methods：Source spy is accessed for extracting user
The algorithm of sign, the algorithm of behavioural characteristic is accessed for extracting, for extracting the algorithm of access path conversion parameter.
User, which accesses source characteristics, includes at least one of following characteristics：It is the operating system of user, browser type, clear
Look at device version, device type.
Accessing behavioural characteristic includes at least one of following characteristics：Significance level, the access path process of access path
The middle access parameter used, access method, interface path, interface path support parameter attribute, upload operation data attribute,
The data attribute of down operation.
Access path conversion parameter includes at least one of following characteristics：Obtain page of the user when normally accessing website
Face redirects order and redirects probability.
The parameter of marked targeted customer can be the combination that IP address can also be an input parameter or parameter.
When the number of feature extraction algorithm is multiple, targeted customer is judged according to the similitude of population characteristic and personal feature
Include for the possibility of abnormal user：It is determined that the population characteristic that is obtained by each feature extraction algorithm and personal feature is similar
Property, the normalization similar value of each similitude is calculated using the average value of each similitude or by normalization creep function, according to this
Average value or normalization similar value judge whether targeted customer is abnormal user., can when the number of feature extraction algorithm is multiple
To obtain more user behavior information, the accuracy of identification can be further improved.
This method also includes：The daily record prediction subsequent period single user list period according to collecting accesses the visit capacity of website
The upper limit, when targeted customer is more than the visit capacity upper limit in subsequent period to the visit capacity of an at least website, or, in targeted customer
It is more than the visit capacity upper limit to the visit capacity of an at least website and according to the similar of population characteristic and personal feature in subsequent period
When property judges targeted customer for abnormal user, it is abnormal user to determine targeted customer.
Fig. 2 is the structure chart for the device that abnormal user is detected in embodiment, and this device includes：
Acquisition module, for gathering daily record；
Sort module, for classifying to the daily record collected；
Selecting module, for according to the access parameter in of all categories to scoring of all categories, the class of selection scoring ranking top n
Not, using the daily record in this N number of classification as key log；
Judge module, for extracting population characteristic to key log according to feature extraction algorithm, according to feature extraction algorithm
To targeted customer daily record extraction personal feature, according to the similitude of population characteristic and personal feature judge targeted customer whether be
Abnormal user.
Wherein,
Sort module is also used for URI disaggregated models and extracts website URI features to the daily record collected, will have identical
The daily record of URI features is divided into same category.
Feature extraction algorithm includes being used to extract the algorithm that user accesses source characteristics, and behavioural characteristic is accessed for extracting
Algorithm, for extracting the algorithm of access path conversion parameter.
User, which accesses source characteristics, includes at least one of following characteristics：It is the operating system of user, browser type, clear
Look at device version, device type；
Accessing behavioural characteristic includes at least one of following characteristics：Significance level, the access path process of access path
The middle access parameter used, access method, interface path, interface path support parameter attribute, upload operation data attribute,
The data attribute of down operation；
Access path conversion parameter includes at least one of following characteristics：Obtain page of the user when normally accessing website
Face redirects order and redirects probability.
Judge module be additionally operable to number in feature extraction algorithm for it is multiple when, using following methods according to population characteristic and
The similitude of personal feature judges possibility of the targeted customer for abnormal user：It is determined that obtained by each feature extraction algorithm
The similitude of population characteristic and personal feature, calculated using the average value of each similitude or by normalization creep function each similar
Property normalization similar value, according to this average value or normalization similar value judge whether targeted customer is abnormal user.
This device also includes visit capacity analysis module, when predicting subsequent period single user list for the daily record that basis collects
Section accesses the visit capacity upper limit of website.Judge module is additionally operable to the visit capacity in subsequent period to an at least website in targeted customer
During more than the visit capacity upper limit, or, the visit capacity upper limit is more than to the visit capacity of an at least website in subsequent period in targeted customer
And when judging targeted customer according to the similitude of population characteristic and personal feature for abnormal user, determine targeted customer for exception
User.
The present invention possesses longer time window, can obtain more accurate user's independently of real-time policy system
Feature, have further the advantage that:
(1) deployment configuration workload is reduced, the framework for understanding each website and business scenario is not spent and then matches somebody with somebody respectively
Put.
(2) system reliability is increased, threshold parameter can update with business development automatic Prediction over time.
(3) influence of subjective factor is reduced, reference statistical historical data is as a result more scientific.
(4) adaptability is increased, the new interface of automatic identification simultaneously extracts its feature.
Descriptions above can combine implementation individually or in a variety of ways, and these variants all exist
Within protection scope of the present invention.
One of ordinary skill in the art will appreciate that all or part of step in the above method can be instructed by program
Related hardware is completed, and described program can be stored in computer-readable recording medium, such as read-only storage, disk or CD
Deng.Alternatively, all or part of step of above-described embodiment can also be realized using one or more integrated circuits, accordingly
Ground, each module/unit in above-described embodiment can be realized in the form of hardware, can also use the shape of software function module
Formula is realized.The present invention is not restricted to the combination of the hardware and software of any particular form.
It should be noted that herein, term " comprising ", "comprising" or its any other variant are intended to non-row
His property includes, so that article or equipment including a series of elements not only include those key elements, but also including not
There is an other element being expressly recited, or also include for this article or the intrinsic key element of equipment.Do not limiting more
In the case of system, the key element that is limited by sentence " including ... ", it is not excluded that in the article including the key element or equipment
Other identical element also be present.
The above embodiments are merely illustrative of the technical solutions of the present invention and it is unrestricted, reference only to preferred embodiment to this hair
It is bright to be described in detail.It will be understood by those within the art that technical scheme can be modified
Or equivalent substitution, without departing from the spirit and scope of technical solution of the present invention, the claim model in the present invention all should be covered
Among enclosing.
Claims (12)
- A kind of 1. method for detecting abnormal user, it is characterised in that including：Gather daily record；The daily record collected is classified；According to the access parameter in of all categories to scoring of all categories, the classification of selection scoring ranking top n, by this N number of classification Daily record as key log；Population characteristic, the day according to feature extraction algorithm to targeted customer are extracted to the key log according to feature extraction algorithm Will extracts personal feature, judges whether the targeted customer is different according to the similitude of the population characteristic and the personal feature Conventional family.
- 2. the method for detection abnormal user as claimed in claim 1, it is characterised in thatThe described pair of daily record collected, which carries out classification, to be included：Website URI features are extracted to the daily record collected using URI disaggregated models, the daily record with identical URI features is divided For same category.
- 3. the method for detection abnormal user as claimed in claim 1, it is characterised in thatThe feature extraction algorithm includes：The algorithm of source characteristics is accessed for extracting user, behavioural characteristic is accessed for extracting Algorithm, for extracting the algorithm of access path conversion parameter.
- 4. the method for detection abnormal user as claimed in claim 3, it is characterised in thatThe user, which accesses source characteristics, includes at least one of following characteristics：It is the operating system of user, browser type, clear Look at device version, device type；The access behavioural characteristic includes at least one of following characteristics：Significance level, the access path process of access path The middle access parameter used, access method, interface path, interface path support parameter attribute, upload operation data attribute, The data attribute of down operation；The access path conversion parameter includes at least one of following characteristics：Obtain page of the user when normally accessing website Face redirects order and redirects probability.
- 5. the method for detection abnormal user as claimed in claim 1, it is characterised in thatIt is described according to the population characteristic and the similitude of the personal feature when number of the feature extraction algorithm is multiple Judge that the targeted customer includes for the possibility of abnormal user：It is determined that the population characteristic obtained by each feature extraction algorithm With the similitude of personal feature, the normalizing of each similitude is calculated using the average value of each similitude or by normalization creep function Change similar value, judge whether the targeted customer is abnormal user according to this average value or normalization similar value.
- 6. the method for detection abnormal user as claimed in claim 1, it is characterised in thatMethods described also includes：The daily record prediction subsequent period single user list period according to collecting is accessed in the visit capacity of website Limit, when the targeted customer is more than the visit capacity upper limit in subsequent period to the visit capacity of an at least website, or, in institute State targeted customer and the visit capacity upper limit is more than and according to colony spy to the visit capacity of an at least website in subsequent period When the similitude for the personal feature of seeking peace judges the targeted customer for abnormal user, determine that the targeted customer uses to be abnormal Family.
- A kind of 7. device for detecting abnormal user, it is characterised in that including：Acquisition module, for gathering daily record；Sort module, for classifying to the daily record collected；Selecting module, for according to the access parameter in of all categories to scoring of all categories, the classification of selection scoring ranking top n, Using the daily record in this N number of classification as key log；Judge module, for extracting population characteristic to the key log according to feature extraction algorithm, according to feature extraction algorithm Daily record extraction personal feature to targeted customer, judges the mesh according to the similitude of the population characteristic and the personal feature Mark whether user is abnormal user.
- 8. the device of detection abnormal user as claimed in claim 7, it is characterised in thatThe sort module, it is also used for URI disaggregated models and website URI features is extracted to the daily record collected, there will be phase Daily record with URI features is divided into same category.
- 9. the device of detection abnormal user as claimed in claim 7, it is characterised in thatThe feature extraction algorithm includes：The algorithm of source characteristics is accessed for extracting user, behavioural characteristic is accessed for extracting Algorithm, for extracting the algorithm of access path conversion parameter.
- 10. the device of detection abnormal user as claimed in claim 9, it is characterised in thatThe user, which accesses source characteristics, includes at least one of following characteristics：It is the operating system of user, browser type, clear Look at device version, device type；The access behavioural characteristic includes at least one of following characteristics：Significance level, the access path process of access path The middle access parameter used, access method, interface path, interface path support parameter attribute, upload operation data attribute, The data attribute of down operation；The access path conversion parameter includes at least one of following characteristics：Obtain page of the user when normally accessing website Face redirects order and redirects probability.
- 11. the device of detection abnormal user as claimed in claim 7, it is characterised in thatThe judge module, it is additionally operable to when the number of the feature extraction algorithm is multiple, using following methods according to The similitude of population characteristic and the personal feature judges possibility of the targeted customer for abnormal user：It is determined that by each Feature extraction algorithm obtain population characteristic and personal feature similitude, using each similitude average value or pass through normalizing Change the normalization similar value that model calculates each similitude, the targeted customer is judged according to this average value or normalization similar value Whether it is abnormal user.
- 12. the device of detection abnormal user as claimed in claim 7, it is characterised in thatDescribed device also includes：Visit capacity analysis module, when predicting subsequent period single user list for the daily record that basis collects Section accesses the visit capacity upper limit of website；The judge module, it is additionally operable to be more than the visit to the visit capacity of an at least website in subsequent period in the targeted customer During the amount of the asking upper limit, or, the visit capacity of an at least website is more than in the visit capacity in subsequent period in the targeted customer When limiting and judging the targeted customer according to the similitude of the population characteristic and the personal feature for abnormal user, it is determined that The targeted customer is abnormal user.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201711181755.6A CN107888602A (en) | 2017-11-23 | 2017-11-23 | A kind of method and device for detecting abnormal user |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201711181755.6A CN107888602A (en) | 2017-11-23 | 2017-11-23 | A kind of method and device for detecting abnormal user |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN107888602A true CN107888602A (en) | 2018-04-06 |
Family
ID=61774727
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201711181755.6A Pending CN107888602A (en) | 2017-11-23 | 2017-11-23 | A kind of method and device for detecting abnormal user |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN107888602A (en) |
Cited By (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109359263A (en) * | 2018-10-16 | 2019-02-19 | 杭州安恒信息技术股份有限公司 | A kind of user behavior characteristics extracting method and system |
| CN109525558A (en) * | 2018-10-22 | 2019-03-26 | 深信服科技股份有限公司 | Leaking data detection method, system, device and storage medium |
| CN109587248A (en) * | 2018-12-06 | 2019-04-05 | 腾讯科技（深圳）有限公司 | User identification method, device, server and storage medium |
| CN109657148A (en) * | 2018-12-24 | 2019-04-19 | 北京百度网讯科技有限公司 | For abnormal operation recognition methods, device, server and the medium for reporting POI |
| CN109905411A (en) * | 2019-04-25 | 2019-06-18 | 北京腾云天下科技有限公司 | A kind of abnormal user recognition methods, device and calculate equipment |
| CN110389874A (en) * | 2018-04-20 | 2019-10-29 | 比亚迪股份有限公司 | Journal file method for detecting abnormality and device |
| CN113837325A (en) * | 2021-11-25 | 2021-12-24 | 上海观安信息技术股份有限公司 | Unsupervised algorithm-based user anomaly detection method and unsupervised algorithm-based user anomaly detection device |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103853841A (en) * | 2014-03-19 | 2014-06-11 | 北京邮电大学 | Method for analyzing abnormal behavior of user in social networking site |
| CN104915455A (en) * | 2015-07-02 | 2015-09-16 | 焦点科技股份有限公司 | Website exception access identification method and system based on user behaviors |
| CN105516128A (en) * | 2015-12-07 | 2016-04-20 | 中国电子技术标准化研究院 | Detecting method and device of Web attack |
-
2017
- 2017-11-23 CN CN201711181755.6A patent/CN107888602A/en active Pending
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103853841A (en) * | 2014-03-19 | 2014-06-11 | 北京邮电大学 | Method for analyzing abnormal behavior of user in social networking site |
| CN104915455A (en) * | 2015-07-02 | 2015-09-16 | 焦点科技股份有限公司 | Website exception access identification method and system based on user behaviors |
| CN105516128A (en) * | 2015-12-07 | 2016-04-20 | 中国电子技术标准化研究院 | Detecting method and device of Web attack |
Cited By (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110389874A (en) * | 2018-04-20 | 2019-10-29 | 比亚迪股份有限公司 | Journal file method for detecting abnormality and device |
| CN110389874B (en) * | 2018-04-20 | 2021-01-19 | 比亚迪股份有限公司 | Method and device for detecting log file abnormity |
| CN109359263A (en) * | 2018-10-16 | 2019-02-19 | 杭州安恒信息技术股份有限公司 | A kind of user behavior characteristics extracting method and system |
| CN109525558A (en) * | 2018-10-22 | 2019-03-26 | 深信服科技股份有限公司 | Leaking data detection method, system, device and storage medium |
| CN109587248A (en) * | 2018-12-06 | 2019-04-05 | 腾讯科技（深圳）有限公司 | User identification method, device, server and storage medium |
| CN109587248B (en) * | 2018-12-06 | 2023-08-29 | 腾讯科技（深圳）有限公司 | User identification method, device, server and storage medium |
| CN109657148A (en) * | 2018-12-24 | 2019-04-19 | 北京百度网讯科技有限公司 | For abnormal operation recognition methods, device, server and the medium for reporting POI |
| CN109657148B (en) * | 2018-12-24 | 2020-10-13 | 北京百度网讯科技有限公司 | Abnormal operation identification method, device, server and medium for reported POI |
| CN109905411A (en) * | 2019-04-25 | 2019-06-18 | 北京腾云天下科技有限公司 | A kind of abnormal user recognition methods, device and calculate equipment |
| CN109905411B (en) * | 2019-04-25 | 2021-11-16 | 北京腾云天下科技有限公司 | Abnormal user identification method and device and computing equipment |
| CN113837325A (en) * | 2021-11-25 | 2021-12-24 | 上海观安信息技术股份有限公司 | Unsupervised algorithm-based user anomaly detection method and unsupervised algorithm-based user anomaly detection device |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN107888602A (en) | A kind of method and device for detecting abnormal user | |
| CN111428231B (en) | Safety processing method, device and equipment based on user behaviors | |
| US9531743B2 (en) | Data trend analysis | |
| CN108600200B (en) | Domain name detection method and device, computer equipment and storage medium | |
| CN104899508B (en) | A kind of multistage detection method for phishing site and system | |
| CN102946319B (en) | Networks congestion control information analysis system and analytical method thereof | |
| CN105809035B (en) | The malware detection method and system of real-time behavior is applied based on Android | |
| CN107332848A (en) | A kind of exception of network traffic real-time monitoring system based on big data | |
| CN104579773B (en) | Domain name system analyzes method and device | |
| CN106056407A (en) | Online banking user portrait drawing method and equipment based on user behavior analysis | |
| CN108334758A (en) | A kind of detection method, device and the equipment of user's ultra vires act | |
| CN103176983A (en) | Event warning method based on Internet information | |
| CN105224691B (en) | A kind of information processing method and device | |
| CN108833139B (en) | OSSEC alarm data aggregation method based on category attribute division | |
| CN109347808B (en) | Safety analysis method based on user group behavior activity | |
| CN107016298B (en) | Webpage tampering monitoring method and device | |
| CN107797894A (en) | APP user behavior analysis method and apparatus | |
| CN107454076A (en) | A kind of website portrait method | |
| CN107733902A (en) | A kind of monitoring method and device of target data diffusion process | |
| CN108733791A (en) | network event detection method | |
| CN107239563A (en) | Public feelings information dynamic monitoring and controlling method | |
| CN114329455B (en) | User abnormal behavior detection method and device based on heterogeneous graph embedding | |
| CN106021552A (en) | Internet creeper concurrency data collection method and system based on crowd behavior simulation | |
| CN108270637B (en) | Website quality multi-layer drilling system and method | |
| CN112016317A (en) | Sensitive word recognition method and device based on artificial intelligence and computer equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20180406 |