CN114676422A

CN114676422A - Resource access abnormity detection method, device and equipment

Info

Publication number: CN114676422A
Application number: CN202210303787.3A
Authority: CN
Inventors: 金锡波; 段会康; 刘志强
Original assignee: Alibaba Cloud Computing Ltd
Current assignee: Alibaba Cloud Computing Ltd
Priority date: 2022-03-24
Filing date: 2022-03-24
Publication date: 2022-06-28

Abstract

The application provides a resource access abnormity detection method, device and equipment. According to the method, original time sequence data of the account number access resources in the time period to be detected are determined according to behavior data of the account number access resources in the time period to be detected, wherein the original time sequence data comprise a time stamp and an access frequency of each unit time period of the time period to be detected and an initial time stamp of the time period to be detected; inputting the original time sequence data into a multi-task self-encoder for reconstruction to obtain a plurality of reconstructed time sequence data; the plurality of reconstructed time sequence data are compared with the original time sequence data, and an abnormal detection result is determined, wherein the abnormal detection result comprises a unit time interval with abnormal access behaviors in a time period to be detected, so that the accuracy of abnormal detection of account access resources is improved, and the false alarm rate and the false missing report rate of abnormal detection are reduced.

Description

Resource access abnormity detection method, device and equipment

Technical Field

The present application relates to the field of computer technologies, and in particular, to a method, an apparatus, and a device for detecting an exception of resource access.

Background

In a large application system, there are often multiple accounts, including accounts of different roles, multiple accounts of the same role, and the like. Because the roles or users of different accounts are different, the behavior of different accounts accessing the same resource has different characteristics, and the abnormal use of the accounts and other conditions may occur in the process of accessing the resource by the accounts. For example, the account numbers are stolen by others, the use of the account numbers is not standardized, and the mode of accessing resources between the account numbers is changed without authorization of a user owner. And if the behavior of the account for accessing a certain resource is obviously deviated from the frequency of the account for historically accessing the same resource, the account is considered to have abnormal access to the resource.

One of the conventional anomaly detection methods is based on a theory of statistics, a detection index is determined by counting account number access resources, and the detection index is combined with a fixed threshold set for the detection index, so that anomaly detection of the account number access resources is realized. However, the thresholds need to be manually set and optimized, the anomaly detection effect depends heavily on the quality of the fixed threshold, the fixed threshold depends on the experience and the capability of the setting personnel, the effect is unstable, and the false alarm rate is high. And the other method is to perform abnormal detection of account access resources based on a single-task self-encoder, wherein the abnormal detection result is unstable and the false alarm rate is high.

Disclosure of Invention

The application provides a resource access anomaly detection method, device and equipment, which are used for solving the problems of unstable anomaly detection result and high false alarm rate in the current resource access scene.

In one aspect, the present application provides a method for detecting an exception of resource access, including:

determining original time sequence data of the account accessing the resource in the time period to be detected according to behavior data of the account accessing the resource in the time period to be detected;

inputting the original time sequence data into a multi-task self-encoder for reconstruction to obtain a plurality of reconstructed time sequence data;

and comparing the plurality of reconstructed time sequence data with the original time sequence data to determine an abnormal detection result.

In another aspect, the present application provides an apparatus for detecting an exception of a resource access, including:

the time sequence determining module is used for determining original time sequence data of resources accessed by the account in a time period to be detected according to behavior data of resources accessed by the account in the time period to be detected;

the time sequence reconstruction module is used for inputting the original time sequence data into a multi-task self-encoder for reconstruction to obtain a plurality of reconstructed time sequence data;

and the detection processing module is used for comparing the plurality of reconstructed time sequence data with the original time sequence data to determine an abnormal detection result.

In another aspect, the present application provides an electronic device comprising: a processor, and a memory communicatively coupled to the processor;

the memory stores computer-executable instructions;

the processor executes computer-executable instructions stored in the memory to implement the method described above.

In another aspect, the present application provides a computer-readable storage medium having stored thereon computer-executable instructions for implementing the method described above when executed by a processor.

According to the resource access abnormity detection method, device and equipment, original time sequence data of the account number access resources in the time period to be detected are determined according to behavior data of the account number access resources in the time period to be detected; inputting the original time sequence data into a multi-task self-encoder for reconstruction to obtain a plurality of reconstructed time sequence data; the plurality of reconstructed time sequence data are compared with the original time sequence data, and an abnormal detection result is determined, wherein the abnormal detection result comprises a unit time interval with abnormal access behaviors in a time period to be detected, so that the accuracy of abnormal detection of account access resources is improved, and the false alarm rate and the false missing report rate of abnormal detection are reduced.

Drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and together with the description, serve to explain the principles of the application.

FIG. 1 is a schematic diagram of an exemplary network architecture upon which the present application is based;

FIG. 2 is a flowchart of an anomaly detection method for resource access according to an exemplary embodiment of the present application;

FIG. 3 is a block diagram of a multi-tasking auto-encoder provided in an exemplary embodiment of the present application;

FIG. 4 is a flowchart of an anomaly detection method for resource access according to an exemplary embodiment of the present application;

fig. 5 is a schematic structural diagram of an anomaly detection apparatus for resource access according to an exemplary embodiment of the present application;

fig. 6 is a schematic structural diagram of an electronic device according to an example embodiment of the present application.

With the above figures, there are shown specific embodiments of the present application, which will be described in more detail below. The drawings and written description are not intended to limit the scope of the inventive concepts in any manner, but rather to illustrate the concepts of the application by those skilled in the art with reference to specific embodiments.

Detailed Description

Reference will now be made in detail to the exemplary embodiments, examples of which are illustrated in the accompanying drawings. When the following description refers to the accompanying drawings, like numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.

The terms referred to in this application are explained first:

time domain Convolutional Network (TCN): a convolutional neural network model.

Recurrent Neural Network (RNN): one of the commonly used time series deep learning network models.

Mean Square Error (MSE for short): is a function of performance.

Application Programming Interface (API for short): is an interface predefined by some applications, such as functions, HTTP interfaces.

Furthermore, the terms "first", "second", etc. are used for descriptive purposes only and are not to be construed as indicating or implying relative importance or implicitly indicating the number of technical features indicated. In the description of the following examples, "plurality" means two or more unless specifically limited otherwise.

In a large application system, there are often multiple accounts, including accounts in different roles, multiple accounts in the same role, and so on. Because the roles or users of different accounts are different, the behavior of different accounts accessing the same resource has different characteristics, and the abnormal use of the accounts and other conditions may occur in the process of accessing the resource by the accounts. The account number is stolen by others, the use of the account number is not standard, and the mode of accessing resources between the account numbers is changed without authorization of a user owner. If the behavior of the account accessing a resource is obviously deviated from the frequency of the account accessing the same resource historically, the account is considered to have abnormal access to the resource.

For example, in a cloud service scenario, under different primary accounts of an enterprise user, there are typically multiple different sub-accounts under the enterprise. Different sub-accounts have different Application Programming Interface (API) calling behaviors, and in the calling behaviors, the conditions of abnormal account use and the like occur. For example, the account numbers are stolen by others, the use of the account numbers is not standardized, and the mode of calling the API between the account numbers is changed without authorization of a user owner. If a certain API called by the account number has obvious deviation from the historical calling behavior, the API called by the account number is considered to be abnormal.

Aiming at the application scene, the traditional anomaly detection method has the technical problems of unstable anomaly detection result and high false alarm rate.

The application provides an anomaly detection method for resource access, which is based on a multitask self-coding model, determines original time sequence data of the resource access of the account in a time period to be detected based on behavior data of each account in the last interval time (time period to be detected) at intervals, wherein the original time sequence data comprises a time stamp and access frequency of each unit time period of the time period to be detected and a starting time stamp of the time period to be detected; inputting the original time sequence data into a multi-task self-encoder for reconstruction to obtain a plurality of reconstructed time sequence data; and comparing the plurality of reconstructed time sequence data with the original time sequence data to determine an abnormal detection result, wherein the abnormal detection result comprises a unit time interval with abnormal access behaviors in a time period to be detected, and the accuracy of abnormal detection can be greatly improved.

Fig. 1 is a schematic diagram of an exemplary network architecture based on the present application, and the network architecture shown in fig. 1 may specifically include a server and a terminal.

The terminal may specifically be a hardware device having a network communication function, an operation function, and an information display function, and includes, but is not limited to, a smart phone, a tablet computer, a desktop computer, an internet of things device, and the like. Through communication interaction with the server, the user can access various resources provided by the server through the terminal by using the own account.

The server may be specifically a server cluster arranged at the cloud, the server provides resources to be accessed by each user account, and behavior data of resources accessed by each account can be recorded and stored. The server also stores model data related to the multitask self-coding model. Through the operation logic preset in the server, the server can realize various operation functions such as model training, abnormality detection and the like.

The server determines original time sequence data of the account access resources in the time period to be detected according to behavior data of the account access resources in the time period to be detected based on a preset anomaly detection strategy, inputs the original time sequence data into a multi-task self-encoder for reconstruction, and obtains a plurality of reconstructed time sequence data; and comparing the plurality of reconstructed time sequence data with the original time sequence data to determine an abnormal detection result.

The following describes the technical solutions of the present application and how to solve the above technical problems with specific embodiments. The following several specific embodiments may be combined with each other, and details of the same or similar concepts or processes may not be repeated in some embodiments. Embodiments of the present application will be described below with reference to the accompanying drawings.

Fig. 2 is a flowchart of an anomaly detection method for resource access according to an exemplary embodiment of the present application. The method for detecting the abnormality of the resource access provided by the present embodiment can be specifically applied to the aforementioned server. As shown in fig. 2, the method comprises the following specific steps:

step S201, according to behavior data of the account accessing resources in the time period to be detected, determining original time sequence data of the account accessing resources in the time period to be detected.

The original time sequence data comprises a time stamp and an access frequency of each unit time period of the time period to be detected and a starting time stamp of the time period to be detected.

In practical application, the server may execute the anomaly detection method of resource access once at intervals according to a preset anomaly detection policy, and perform anomaly detection once.

For example, the anomaly detection policy may be to perform anomaly detection once every one hour according to behavior data of each resource accessed by each account in the previous hour.

The anomaly detection strategy may be: the anomaly detection is performed periodically, and the like, and based on different anomaly detection strategies, the time period to be detected during the anomaly detection can be different, for example, the anomaly detection is performed periodically, and the time period to be detected can be the last period; the anomaly detection is performed periodically, and the time period to be detected can be a historical time period before the timing moment. The anomaly detection strategy and the time period to be detected can be set and adjusted according to the requirements of the actual application scene, and are not specifically limited here.

In this embodiment, when performing anomaly detection, behavior data of an account accessing a resource in a time period to be detected is acquired, the frequency of the account accessing the resource in each unit time period of the time period to be detected, a timestamp corresponding to each unit time period, and a timestamp (i.e., a start timestamp) of a start time of the time period to be detected are determined according to the behavior data, and original time sequence data corresponding to the behavior data of each account accessing each resource are generated by arranging according to the sequence of the unit time periods.

The data items in the original time series data can be arranged according to a set specified sequence, a uniform specified sequence is used in the model training and abnormality detection processes, and the specific sequence is not specifically limited.

Illustratively, the raw time series data may be arranged in any of the following ways: { start timestamp, frequency 1, timestamp 1, frequency 2, timestamp 2, … }, or { frequency 1, frequency 2, …, timestamp 1, timestamp 2, …, start timestamp }, or { timestamp 1: frequency 1, timestamp 2: frequency 2, …, start timestamp }.

Optionally, an account set that needs to be subjected to anomaly detection may be configured, and during the anomaly detection, the behavior of accessing resources by a target account is subjected to anomaly detection with respect to the target account in the account set.

Optionally, a resource set that needs to be subjected to anomaly detection may be configured, and during anomaly detection, for a target resource in the resource set, the behavior of each account accessing the target resource is subjected to anomaly detection.

Optionally, an account set and a resource set which need to be subjected to anomaly detection may be configured, and during the anomaly detection, an anomaly detection is performed on a behavior that a target account accesses a target resource with respect to a target account in the account set and a target resource in the resource set.

In addition, if the account set and the resource set are not configured, the behavior of accessing each resource by each account is detected abnormally by default.

The process of performing the anomaly detection on the behavior of any account accessing any resource is consistent, and the process of performing the anomaly detection on the behavior of one account accessing one resource is taken as an example in the embodiment, and the process of performing the anomaly detection is exemplarily described.

And S202, inputting the original time sequence data into a multi-task self-encoder for reconstruction to obtain a plurality of reconstructed time sequence data.

In this embodiment, the multitask self-encoder is a trained self-encoder based on multitask learning, and the multitask self-encoder learns the behavior characteristics of each account normally accessing each resource in the model training process. Compared with a single-task self-encoder, the multi-task self-encoder has the advantages that the loss function is relatively lower during training, and the feature extraction of a time sequence is more accurate and richer. Meanwhile, a plurality of single-task self-encoders with good effects are fused to form the multi-task self-encoder, and the multi-task self-encoder can exert the maximum effect by combining the abnormal detection and identification capabilities of each single-task self-encoder.

After the original time sequence data are determined, the original time sequence data of any account accessing any resource are input into a trained multi-task self-encoder, behavior reconstruction of the account accessing the resource is carried out according to the input original time sequence data through the trained multi-task self-encoder, a plurality of reconstruction time sequence data are obtained, and the plurality of reconstruction time sequence data reflect behavior characteristics of the account accessing the resource normally.

Step S203, comparing the plurality of reconstructed time-series data with the original time-series data, and determining an abnormal detection result.

The abnormal detection result comprises a unit time interval with abnormal access behaviors in the time period to be detected.

After the plurality of reconstruction time series data are reconstructed by the multitask self-encoder, the original time series data and the plurality of reconstruction time series data of the resource accessed by the account are compared, the difference between the access frequency of each unit time interval in the original time series data and the access frequency of the same unit time interval in the plurality of reconstruction time series data is analyzed, if the difference is large, the possibility that the behavior of the account accessing the resource in the unit time interval is abnormal access behavior is high, and the unit time interval is determined to be the unit time interval with the abnormal access behavior.

Exemplarily, assuming that the original time series data of a certain account accessing a certain resource is a sequence 1, the following 3 reconstruction sequences are obtained after reconstruction is performed by using a multitask self-encoder: sequence 2, sequence 3 and sequence 4. Then, the difference value a1 of the access frequency in the first unit period in the sequence 1 and the sequence 2, the difference a2 of the access frequency in the first unit period in the sequence 1 and the sequence 3, the difference a3 of the access frequency in the first unit period in the sequence 1 and the sequence 4, and according to the difference values a1, a2 and a3, if one or more of the difference values are larger, the first unit period is determined as the unit period in which abnormal access behavior exists, or if the average value of a1, a2 and a3 is larger, the first unit period is determined as the unit period in which abnormal access behavior exists.

According to the method, the original time sequence data of the account number access resources in the time period to be detected is determined according to the behavior data of the account number access resources in the time period to be detected, wherein the original time sequence data comprises a time stamp and an access frequency of each unit time period of the time period to be detected and an initial time stamp of the time period to be detected; inputting the original time sequence data into a multi-task self-encoder for reconstruction to obtain a plurality of reconstructed time sequence data; the plurality of reconstructed time sequence data are compared with the original time sequence data, and an abnormal detection result is determined, wherein the abnormal detection result comprises a unit time interval with abnormal access behaviors in a time period to be detected, so that the accuracy of abnormal detection of account access resources is improved, and the false alarm rate and the false missing report rate of abnormal detection are reduced.

In an alternative embodiment, the multi-tasking self-encoder includes at least two self-encoder units, and different self-encoder units include convolution kernels of different sizes.

Wherein each self-encoder unit is a single task learning self-encoder, which comprises an encoder and a decoder. The multiple different convolution kernel structures have different detection effects in the self-encoder unit of the single-task learning, the self-encoder units of the multiple different convolution kernels are combined together to form the multi-task self-encoder, different time sequence characteristics learned by the different convolution kernels can be shared, the loss function value of the model can be reduced to a lower degree, the time sequence characteristics capable of being captured by the single model can still be captured, and after the loss function is reduced to a proper degree, the more accurate abnormality detection effect is obtained by combining the time sequence characteristics learned by the three different convolution kernels.

In addition, compared with the use of multiple independent single-task self-encoders, the multi-task self-encoder provided by the embodiment can reduce the memory occupation, and in the model training process, the result is obtained by multi-task one-time forward calculation, so that the reasoning speed is increased, the training time can be reduced, and the training efficiency is improved.

Optionally, the convolution kernel included in the self-encoder unit is a symmetric convolution kernel. Of course, the convolution kernel included in the self-encoder unit may also be an asymmetric convolution kernel.

Alternatively, each of the self-encoder units may be a single-tasking self-encoder model based on a time-domain convolutional network (TCN).

The convolutional layer in the time domain convolutional network is a time sequence convolutional layer specially designed for a time sequence and consists of expanded causal one-dimensional convolutional layers with the same input and output lengths. Compared with the traditional convolutional neural network, long-term dependence information cannot be well captured due to the limitation of the size of a convolutional kernel, and the time sequence convolutional layer in the time domain convolutional network can exceed an RNN model in performance on various tasks compared with various RNN structures. The time domain convolution network can process sequences in parallel, can flexibly customize the sensing range (namely the size of a convolution kernel) according to different tasks and different characteristics, does not have the problems of gradient disappearance and gradient explosion, and has lower memory use.

Illustratively, the multitask self-encoder comprises 3 self-encoder units, each self-encoder unit adopts symmetrical convolution kernels with different sizes, and self-encoders of 3 different convolution kernels are combined together to construct the multitask learning-based self-encoder. For example, the sizes of the 3 symmetric convolution kernels are: 16 × 8 × 16, 16 × 4 × 16, 24 × 12 × 24.

Illustratively, fig. 3 is a block diagram of a multi-task self-encoder according to an exemplary embodiment of the present application, and as shown in fig. 3, the multi-task self-encoder includes 3 symmetric convolution kernels having respective sizes: 16 × 8 × 16, 16 × 4 × 16, 24 × 12 × 24 self-encoder unit: an encoder 1 (including an encoder 1 and a decoder 1), an encoder 2 (including an encoder 2 and a decoder 2), and an encoder 3 (including an encoder 3 and a decoder 3). The original time sequence data are respectively input into encoders of 3 self-encoder units, each encoder generates an abstract feature and inputs a corresponding decoder, the decoders decode the abstract features to generate corresponding reconstruction time sequence data, and finally 3 reconstruction time sequence data are obtained: reconstructing time-series data 1, reconstructing time-series data 2 and reconstructing time-series data 3.

When model training is carried out, the training data are historical behavior data of the account accessing resources normally in a historical period. The historical period may be a longer period of time to acquire more training data. Splitting the historical period into a plurality of time periods to be detected, determining historical behavior data in each time period to be detected, and determining an original time sequence sample corresponding to the time period to be detected according to the historical behavior data, wherein the specific implementation manner is similar to the implementation manner of determining the original time sequence data of the account access resource of the time period to be detected in step S201, and is not repeated here.

Further, based on the original time sequence samples corresponding to each time period to be detected in the historical period, the original time sequence samples are input into the multi-task self-encoder to be reconstructed, and a plurality of corresponding reconstructed time sequence samples are obtained. And calculating a loss function value according to the difference between the original time sequence sample and the corresponding multiple reconstruction time sequence samples, and updating the model parameters of the multi-task self-encoder according to the loss function value so as to minimize the loss function value.

For example, various training parameters in the model training process may be set according to practical application scenarios and empirical values, and are not specifically limited herein. For example, the learning rate of the model may be set to 0.001, the activation function may be a Linear rectification function (ReLU function), and the loss function may be set to Mean Square Error (MSE) or a regression loss function (LogCosh). The training Batch (Batch) size may be set to 16. The round of training (epoch) can be set to 100, and after so many rounds of training the loss function will in most cases drop to a steady state, indicating that the model has learned a relatively steady and thorough state for the features.

Optionally, when the loss function value is calculated according to the difference between the original time series sample and the corresponding multiple reconstructed time series samples, a loss value may be calculated according to the difference between the original time series sample and each corresponding reconstructed time series sample, the multiple loss values may be weighted and averaged to obtain a total loss, and the total loss is used as a final loss function value corresponding to the original time series sample.

The trained multi-task self-encoder is used for performing behavior reconstruction of the account for accessing the resource according to the input original time sequence data to obtain a plurality of reconstruction time sequence data, and the plurality of reconstruction time sequences embody the behavior characteristics of the account for normally accessing the resource.

Compared with a single-task self-encoder, the multi-task self-encoder has the advantages that the loss function is relatively lower during training, and the feature extraction of a time sequence is more accurate and richer. Meanwhile, a plurality of single-task self-encoders with better effect are fused to form a multi-task self-encoder, and the multi-task self-encoder can exert the maximum effect by combining the abnormal detection and identification capabilities of each single-task self-encoder. The test result on the Benchmark data set shows that the multi-task self-encoder has lower loss value, lower false alarm rate and lower false alarm rate. And the multitask self-encoder has better nonlinear fitting capability than a statistical model.

Optionally, the multitask self-encoder may be trained and optimized at intervals by using newly added behavior data, so that the multitask self-encoder can learn more behavior characteristics of the account number for normally accessing the resource, and the accuracy of abnormality detection is improved.

In an optional embodiment, whether the account number accesses the resource before the time period to be detected is determined according to historical access data before the time period to be detected; if the account number is determined to have accessed the resource before the time period to be detected, performing anomaly detection by using a multitask self-coding model; if it is determined that the account does not access the resource before the time period to be detected, that is, the account accesses the resource for the first time within the time period to be detected, the account can access the resource for the first time as an abnormal access, and the unit time period during which the account accesses the resource for the first time within the time period to be detected is determined as the unit time period during which the abnormal access behavior exists, so as to obtain an abnormal detection result.

Fig. 4 is a flowchart of an anomaly detection method for resource access according to an exemplary embodiment of the present application, and as shown in fig. 4, the method includes the following specific steps:

step S400, according to the behavior data of the account accessing resources in the time period to be detected, determining original time sequence data of the account accessing resources in the time period to be detected.

Step S401, determining whether the account number has accessed the resource before the time period to be detected.

In this embodiment, during the anomaly detection, historical access data before the time period to be detected may be obtained, and whether the account number has accessed the resource before the time period to be detected is determined according to the historical access data before the time period to be detected.

If the account accesses the resource before the time slot to be detected is determined, executing steps S402-S405, performing anomaly detection by using a multitask self-coding model to determine an anomaly detection result, detecting an anomaly condition which is not consistent with the historical behavior of the account accessing the resource and is not consistent with the historical access frequency, giving an anomaly result, and performing anomaly early warning.

If it is determined in this step that the account does not access the resource before the time period to be detected, step S406 is executed to determine the unit time period during which the account accesses the resource for the first time in the time period to be detected as the unit time period during which the abnormal access behavior exists, so as to obtain the abnormal detection result.

For example, in a cloud service scenario, a plurality of different sub-account numbers of different enterprise users exist under different primary account numbers of the enterprise users, and different sub-account numbers call an API, if the API is not called by the sub-account number before a time period to be detected, behavior data of calling a certain API by a certain sub-account number does not exist in training data used in a model training stage, and during an anomaly detection process, when the API is called by the sub-account number for the first time, it is determined that an anomaly access behavior exists, an anomaly detection result is given, and anomaly early warning can be performed. If a certain sub-account calls a certain API before a time period to be detected, behavior data of calling the API by the sub-account exists in training data used in a model training stage, a multi-task self-encoder learns the behavior characteristics of normally calling the API by the account during training, and a multi-task self-encoder is used for carrying out abnormity detection, so that other behavior characteristics of the API to the API and historical calling of the API are not consistent, and abnormity can be detected under the condition that the historical calling frequency is inconsistent, abnormity detection results are given, and abnormity early warning can be carried out.

Step S402, according to the configured size of the sliding window, dividing the original time sequence data into a plurality of vectors, and arranging the plurality of vectors into a first feature matrix.

The size of the sliding window can be set according to the requirements of the actual application scenario, for example, set to 10, 20, 25, and the like.

Illustratively, the sliding window size may be represented by N, which is a positive integer. In this step, segments containing data items in N unit periods are sequentially segmented from the start position of the original time series data, and a vector corresponding to each segment is generated, so that a plurality of vectors can be obtained. Each vector generated by the division is a row vector, and a plurality of row vectors form a first feature matrix.

Optionally, this step may be specifically implemented as follows:

converting each data item in the original time sequence data into vector representation to obtain a vector representation sequence; dividing the vector representation sequence according to the configured size of the sliding window to obtain a plurality of row vectors, wherein each row vector comprises vector representations of a specified number of data items in a unit time interval in the vector representation sequence, and the specified number is equal to the size of the sliding window; the plurality of row vectors are arranged into a matrix to obtain a first feature matrix.

Optionally, this step may be specifically implemented in the following manner:

segmenting the original time sequence data according to the configured size of the sliding window to obtain a plurality of data segments, wherein each data segment comprises a specified number of data items in the original time sequence data within a unit time period, and the specified number is equal to the size of the sliding window; converting each data item in each data segment into vector representation to obtain a vector corresponding to each data segment; the plurality of row vectors are arranged into a matrix to obtain a first feature matrix.

In addition, in this embodiment, according to the configured size of the sliding window, the original time series data is divided into a plurality of vectors, and the vectors are arranged into the first feature matrix, which can be implemented by using a similar method in the prior art, and is not specifically limited herein.

Optionally, after the first feature matrix is determined, before the first feature matrix is input into each self-encoder unit for reconstruction, normalization processing is performed on the first feature matrix, and in subsequent steps, the normalized first feature matrix is input into each self-encoder unit for reconstruction, so that input of the multitask self-encoder is normalized, and fitting speed and accuracy of the multitask self-encoder are improved.

And S403, inputting the first feature matrix into each self-encoder unit for reconstruction, and obtaining a second feature matrix reconstructed by each self-encoder unit.

In this embodiment, the multitask self-encoder is a trained self-encoder based on multitask learning, and the multitask self-encoder learns the behavior characteristics of each account normally accessing each resource in the model training process. The multitask self-encoder comprises at least two self-encoder units, and different self-encoder units contain convolution kernels with different sizes.

Wherein each self-encoder unit is a single task learning self-encoder, which comprises an encoder and a decoder. The multiple different convolution kernel structures have different detection effects in the self-encoder unit of the single-task learning, and the self-encoder units of the multiple different convolution kernels are combined together to form the multi-task self-encoder, so that after a loss function is reduced to a proper degree, more accurate abnormal detection effects are obtained by combining time sequence characteristics learned by the three different convolution kernels.

After a first feature matrix corresponding to the original time series data is determined, inputting the first feature matrix into a trained multi-task self-encoder, and performing behavior reconstruction of the account accessing the resource according to the input first feature matrix through the trained multi-task self-encoder to obtain a plurality of second feature matrices, wherein the plurality of second feature matrices comprise behavior features of the account accessing the resource normally.

And S404, analyzing each second feature matrix to obtain corresponding reconstruction time sequence data.

After a plurality of second feature matrixes are obtained through the reconstruction of the multitask self-encoder, corresponding reconstruction time sequence data can be obtained through analyzing each second feature matrix.

Illustratively, the reconstructed time-series data is consistent with the type, quantity, and order of the data items contained in the original time-series data. In this step, each row vector in the second feature matrix may be sequentially spliced to obtain a complete sequence; and according to the dimension of the vector corresponding to each data item in the reconstructed time sequence data, segmenting the vector corresponding to each data item from the complete sequence, and converting the vector corresponding to each data item into the value of the data item, thereby obtaining the reconstructed time sequence data.

In this embodiment, when the multitask self-encoding model is used to perform the anomaly detection, the original time series data is input into the multitask self-encoder for reconstruction through the above steps S402-S404, so as to obtain a plurality of reconstructed time series data.

After the plurality of reconstruction time series data are reconstructed by using the multitask self-coding model, through steps S405-S407, the plurality of reconstruction time series data are compared with the original time series data, the difference between the access frequency of each unit time interval in the original time series data and the access frequency of the same unit time interval in the plurality of reconstruction time series data is analyzed, if the difference is large, the possibility that the behavior of the account number accessing the resource in the unit time interval is abnormal access behavior is high, the unit time interval is determined as the unit time interval with the abnormal access behavior, and therefore the abnormal detection result is determined.

Step S405, comparing the plurality of reconstructed time-series data with the original time-series data, and determining an abnormal detection result.

Optionally, this step may be specifically implemented as follows:

determining the difference value of the access frequency of the same unit time interval in the original time sequence data and each reconstructed time sequence data; weighting and summing difference values of the access frequency of the same unit time interval in the original time sequence data and each reconstructed time sequence data, and determining comprehensive difference information corresponding to each unit time interval; and determining the unit time interval with the corresponding comprehensive difference information larger than the difference threshold value as the unit time interval with the abnormal access behavior in the time period to be detected, and obtaining an abnormal detection result.

Optionally, the difference threshold may be a standard deviation of the integrated difference information corresponding to all unit time periods, or the difference threshold may be a standard deviation of all difference values corresponding to all unit time periods, or the difference threshold may be a fixed value set according to an actual application scenario, which is not specifically limited herein.

Exemplarily, assuming that the original time series data of a certain account accessing a certain resource is a sequence 1, the following 3 reconstruction sequences are obtained after reconstruction is performed by using a multitask self-encoder: sequence 2, sequence 3 and sequence 4. Then, the difference value a1 of the access frequency in the first unit time interval in the sequence 1 and the sequence 2, the difference a2 of the access frequency in the first unit time interval in the sequence 1 and the sequence 3, the difference a3 of the access frequency in the first unit time interval in the sequence 1 and the sequence 4, the a1, the a2 and the a3 are weighted and summed according to the difference values a1, a2 and a3 to obtain the comprehensive difference information corresponding to the first unit time interval, and if the comprehensive difference information is greater than the difference threshold value, the first unit time interval is determined to be the unit time interval with abnormal access behavior; if the integrated difference information is less than or equal to the difference threshold, it is determined that the first unit period is not a unit period in which abnormal access behavior exists. Similarly, whether each unit time interval in the time period to be detected is the unit time interval with abnormal access behavior can be determined, so that an abnormal detection result is obtained.

Optionally, the step may be specifically implemented by the following method:

determining difference values of the access frequency of the same unit time interval in the original time sequence data and each reconstructed time sequence data; averaging difference values of the access frequency of the same unit time interval in the original time sequence data and each reconstructed time sequence data to obtain average difference information corresponding to each unit time interval; and determining the unit time interval with the corresponding mean difference information larger than the difference mean threshold value as the unit time interval with abnormal access behaviors in the time period to be detected, and obtaining an abnormal detection result.

Optionally, the difference mean threshold may be a standard deviation of the mean difference information corresponding to all unit time periods, or the difference mean threshold may be a standard deviation of all difference values corresponding to all unit time periods, or the difference mean threshold may be a fixed value set according to an actual application scenario, and is not specifically limited herein.

Step S406, determining the unit time interval of the account accessing the resource for the first time in the time period to be detected as the unit time interval with abnormal access behavior, and obtaining an abnormal detection result.

In this embodiment, if it is determined in step S401 that the account does not access the resource before the time period to be detected, the unit time period during which the account accesses the resource for the first time in the time period to be detected is determined as the unit time period during which the abnormal access behavior exists, so as to obtain the abnormal detection result.

And S407, performing abnormal access early warning according to the abnormal detection result.

In this embodiment, after the abnormal detection result is determined, an abnormal access early warning may be performed according to the abnormal detection result to remind related personnel to check and process the behavior of the account accessing resources abnormally, so as to improve the security of the resources.

In the embodiment, whether the account number accesses the resource before the time period to be detected is determined according to historical access data before the time period to be detected; if the account number is determined to have accessed the resource before the time period to be detected, performing anomaly detection by using a multitask self-coding model; if it is determined that the account does not access the resource before the time period to be detected, that is, the account accesses the resource for the first time within the time period to be detected, the account can access the resource for the first time as abnormal access, and the unit time period during which the account accesses the resource for the first time within the time period to be detected is determined as the unit time period in which the abnormal access behavior exists, so that an abnormal detection result is obtained, the behavior of accessing the resource for the first time by the account can be warned, the safety of the resource is improved, and the false alarm rate and the false alarm missing rate of abnormal detection are reduced.

Fig. 5 is a schematic structural diagram of an apparatus for detecting an exception of resource access according to an exemplary embodiment of the present application. The resource access anomaly detection device provided by the embodiment of the application can execute the processing flow provided by the resource access anomaly detection method. As shown in fig. 5, the resource access abnormality detection apparatus 50 includes: a time series determination module 501, a time series reconstruction module 502 and a detection processing module 503.

Specifically, the time sequence determining module 501 is configured to determine, according to behavior data of an account accessing a resource in a time period to be detected, original time sequence data of the account accessing the resource in the time period to be detected.

The time sequence reconstructing module 502 is configured to input the original time sequence data into a multi-task self-encoder for reconstruction, so as to obtain a plurality of reconstructed time sequence data.

The detection processing module 503 is configured to compare the multiple reconstructed time-series data with the original time-series data, and determine an abnormal detection result.

The apparatus provided in the embodiment of the present application may be specifically configured to execute the scheme provided in the embodiment of the method corresponding to fig. 2, and specific functions and technical effects that can be achieved are not described herein again.

In an alternative embodiment, the multi-tasking self-encoder includes at least two self-encoder units, different self-encoder units containing convolution kernels of different sizes.

When the original time sequence data is input into the multi-task self-encoder to be reconstructed to obtain a plurality of reconstructed time sequence data, the time sequence reconstruction module is specifically configured to:

dividing the original time sequence data into a plurality of vectors according to the configured size of the sliding window, wherein the plurality of vectors are arranged into a first feature matrix; inputting the first characteristic matrix into each self-encoder unit for reconstruction to obtain a second characteristic matrix reconstructed by each self-encoder unit; and analyzing each second feature matrix to obtain corresponding reconstruction time sequence data.

In an optional embodiment, when the original time-series data is segmented into a plurality of vectors according to the configured sliding window size, the plurality of vectors being arranged into the first feature matrix, the time-series reconstruction module is further configured to:

converting each data item in the original time sequence data into vector representation to obtain a vector representation sequence, wherein the original time sequence data comprises a time stamp and an access frequency of each unit time period of a time period to be detected and an initial time stamp of the time period to be detected; dividing the vector representation sequence according to the configured size of the sliding window to obtain a plurality of row vectors, wherein each row vector comprises vector representations of a specified number of data items in a unit time interval in the vector representation sequence, and the specified number is equal to the size of the sliding window; the plurality of row vectors are arranged into a matrix to obtain a first feature matrix.

In an alternative embodiment, the self-encoder unit includes a symmetric convolution kernel, and each self-encoder unit is a single-task self-encoder based on a time-domain convolution network.

In an optional embodiment, when comparing the plurality of reconstructed time-series data with the original time-series data to determine an abnormal detection result, the detection processing module is specifically configured to:

determining difference values of the access frequency of the same unit time interval in the original time sequence data and each reconstructed time sequence data; weighting and summing difference values of the access frequency of the same unit time interval in the original time sequence data and each reconstructed time sequence data, and determining comprehensive difference information corresponding to each unit time interval; and determining the unit time interval with the corresponding comprehensive difference information larger than the difference threshold value as the unit time interval with the abnormal access behavior in the time period to be detected, and obtaining an abnormal detection result.

In an optional embodiment, before the original time-series data is input into the multi-tasking self-encoder for reconstruction, and the plurality of reconstructed time-series data is obtained, the time-series reconstruction module is further configured to:

and determining that the account number has accessed the resource before the time period to be detected according to historical access data before the time period to be detected.

In an optional embodiment, before the original time-series data is input into the multi-tasking self-encoder to be reconstructed, and a plurality of reconstructed time-series data are obtained, the detection processing module is further configured to:

according to historical access data before a time period to be detected, if the account does not access the resource before the time period to be detected, determining a unit time period in which the account accesses the resource for the first time in the time period to be detected as a unit time period in which abnormal access behaviors exist, and obtaining an abnormal detection result.

The apparatus provided in the embodiment of the present application may be specifically configured to execute the scheme provided in any one of the method embodiments, and specific functions and technical effects that can be achieved are not described herein again.

Fig. 6 is a schematic structural diagram of an electronic device according to an example embodiment of the present application. As shown in fig. 6, the electronic device 60 includes: a processor 601, and a memory 602 communicatively coupled to the processor 601, the memory 602 storing computer-executable instructions.

The processor executes the computer execution instructions stored in the memory to implement the scheme provided by any of the above method embodiments, and the specific functions and the technical effects that can be achieved are not described herein again. The electronic device may be the above-mentioned server.

The embodiment of the present application further provides a computer-readable storage medium, where computer-executable instructions are stored in the computer-readable storage medium, and when the computer-executable instructions are executed by a processor, the computer-executable instructions are used to implement the solutions provided in any of the above method embodiments, and specific functions and technical effects that can be achieved are not described herein again.

An embodiment of the present application further provides a computer program product, where the program product includes: the computer program is stored in a readable storage medium, at least one processor of the electronic device can read the computer program from the readable storage medium, and the at least one processor executes the computer program to enable the electronic device to execute the scheme provided by any one of the above method embodiments, and specific functions and achievable technical effects are not described herein again.

Other embodiments of the present application will be apparent to those skilled in the art from consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the invention following, in general, the principles of the application and including such departures from the present disclosure as come within known or customary practice within the art to which the invention pertains. It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the application being indicated by the following claims.

It will be understood that the present application is not limited to the precise arrangements described above and shown in the drawings and that various modifications and changes may be made without departing from the scope thereof. The scope of the application is limited only by the appended claims.

Claims

1. An anomaly detection method for resource access, comprising:

2. The method of claim 1, wherein the multi-tasking self-encoder comprises at least two self-encoder units, different self-encoder units have different sizes of convolution kernels, and the inputting the original time-series data into the multi-tasking self-encoder for reconstruction results in a plurality of reconstructed time-series data, comprises:

segmenting the original time sequence data into a plurality of vectors according to the configured size of the sliding window, wherein the plurality of vectors are arranged into a first feature matrix;

inputting the first feature matrix into each self-encoder unit for reconstruction to obtain a second feature matrix reconstructed by each self-encoder unit;

and analyzing each second feature matrix to obtain corresponding reconstruction time sequence data.

3. The method of claim 2, wherein the segmenting the raw time series data into a plurality of vectors according to the configured sliding window size, the plurality of vectors being arranged into a first feature matrix comprises:

converting each data item in the original time sequence data into vector representation to obtain a vector representation sequence, wherein the original time sequence data comprises a time stamp and an access frequency of each unit time period of the time period to be detected and a starting time stamp of the time period to be detected;

dividing the vector representation sequence according to the configured size of the sliding window to obtain a plurality of row vectors, wherein each row vector comprises vector representations of data items in a specified number of unit time periods in the vector representation sequence, and the specified number is equal to the size of the sliding window;

and arranging the plurality of row vectors into a matrix to obtain the first characteristic matrix.

4. The method of claim 2, wherein the convolution kernel included in the self-encoder units is a symmetric convolution kernel, and each of the self-encoder units is a single-task self-encoder based on a time-domain convolution network.

5. The method of claim 1, wherein comparing the plurality of reconstructed time-series data with the original time-series data to determine an anomaly detection result comprises:

determining difference values of access frequencies of the original time sequence data and each reconstructed time sequence data in the same unit time interval;

weighting and summing difference values of the access frequency of the same unit time interval in the original time sequence data and each reconstructed time sequence data, and determining comprehensive difference information corresponding to each unit time interval;

and determining the unit time interval of which the corresponding comprehensive difference information is greater than the difference threshold value as the unit time interval of which the abnormal access behavior exists in the time period to be detected, and obtaining an abnormal detection result.

6. The method according to any one of claims 1-5, wherein before inputting the raw time-series data into a multitask self-encoder for reconstruction, and obtaining a plurality of reconstructed time-series data, the method further comprises:

and determining that the account accesses the resource before the time period to be detected according to historical access data before the time period to be detected.

7. The method of claim 6, wherein before inputting the raw time-series data into a multitask self-encoder for reconstruction, and before obtaining a plurality of reconstructed time-series data, the method further comprises:

according to the historical access data before the time period to be detected, if the account does not access the resource before the time period to be detected, determining the unit time period in which the account accesses the resource for the first time in the time period to be detected as the unit time period in which abnormal access behaviors exist, and obtaining an abnormal detection result.

8. An apparatus for detecting an abnormality in resource access, comprising:

and the detection processing module is used for comparing the plurality of reconstructed time series data with the original time series data to determine an abnormal detection result.

9. An electronic device, comprising: a processor, and a memory communicatively coupled to the processor;

the memory stores computer-executable instructions;

the processor executes computer-executable instructions stored by the memory to implement the method of any of claims 1-7.

10. A computer-readable storage medium having computer-executable instructions stored thereon, which when executed by a processor, perform the method of any one of claims 1-7.