WO2019153581A1 - 异常接口检测方法、装置、计算机设备和存储介质 - Google Patents

异常接口检测方法、装置、计算机设备和存储介质 Download PDF

Info

Publication number
WO2019153581A1
WO2019153581A1 PCT/CN2018/088563 CN2018088563W WO2019153581A1 WO 2019153581 A1 WO2019153581 A1 WO 2019153581A1 CN 2018088563 W CN2018088563 W CN 2018088563W WO 2019153581 A1 WO2019153581 A1 WO 2019153581A1
Authority
WO
WIPO (PCT)
Prior art keywords
interface identifier
normal
interface
access
user access
Prior art date
Application number
PCT/CN2018/088563
Other languages
English (en)
French (fr)
Inventor
王元铭
Original Assignee
平安科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 平安科技（深圳）有限公司 filed Critical 平安科技（深圳）有限公司
Publication of WO2019153581A1 publication Critical patent/WO2019153581A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection

Definitions

  • the application relates to an abnormal interface detecting method, device, computer device and storage medium.
  • Traditional network access detection mostly detects the various parameters in the network access request, and the traditional detection methods are manual preset detection methods.
  • the inventor realizes that as the demand for network security becomes higher and higher, it is necessary to detect an abnormal interface. Since the concealment of the abnormal interface is now stronger, the detection effect on the abnormal interface according to the manual preset detection mode is more The worse the difference, the lower the detection accuracy of the abnormal interface.
  • an abnormal interface detecting method for detecting abnormal interface detecting method, apparatus, computer device, and storage medium.
  • An abnormal interface detection method includes:
  • the extracted feature information is input into the pre-trained normal access detection model for detection, and the user access detection result corresponding to each interface identifier is obtained;
  • An abnormal interface detecting device includes:
  • the historical data obtaining module is configured to obtain historical access data corresponding to each interface identifier
  • a feature information extraction module configured to extract, for each interface identifier, historical feature data, and extract feature information in each piece of historical access data
  • a detection result obtaining module configured to input the extracted feature information into a pre-trained normal access detection model, and obtain a user access detection result corresponding to each interface identifier
  • the abnormal interface determining module is configured to determine an interface identifier of the abnormal interface according to the user access detection result corresponding to each interface identifier.
  • a computer device comprising a memory and one or more processors having stored therein computer readable instructions, the computer readable instructions being executed by the one or more processors such that the one or more The processor implements the steps of the abnormal interface detection method provided in any one of the embodiments of the present application.
  • One or more non-transitory computer readable storage media storing computer readable instructions, which when executed by one or more processors, cause the one or more processors to implement any of the present application. The steps of the anomaly interface detection method provided in one embodiment.
  • FIG. 1 is an application scenario diagram of an abnormal interface detection method according to one or more embodiments.
  • FIG. 2 is a flow diagram of an abnormal interface detection method in accordance with one or more embodiments.
  • FIG. 3 is a schematic flow chart of an abnormal interface detecting method in another embodiment.
  • FIG. 4 is a flow diagram of the steps of generating a test report in accordance with one or more embodiments.
  • FIG. 5 is a flow diagram of the steps of replacing a normal access detection model in accordance with one or more embodiments.
  • FIG. 6 is a flow diagram of the steps of generating a normal access detection model in accordance with one or more embodiments.
  • FIG. 7 is a block diagram of an anomaly interface detection device in accordance with one or more embodiments.
  • Figure 8 is a block diagram of an abnormal interface detecting apparatus in another embodiment.
  • Figure 9 is a block diagram of an abnormal interface detecting apparatus in still another embodiment.
  • FIG. 10 is an internal block diagram of a computer device in accordance with one or more embodiments.
  • the abnormal interface detection method provided by the present application can be applied to an application environment as shown in FIG. 1.
  • the terminal 102 communicates with the server 104 via the network through the network.
  • the terminal 102 can be, but is not limited to, various personal computers, notebook computers, smart phones, tablets, and portable wearable devices, and the server 104 can be implemented with a stand-alone server or a server cluster composed of a plurality of servers.
  • an abnormal interface detection method is provided.
  • the method is applied to the server in FIG. 1 as an example, and includes the following steps:
  • the server scans the interface, and obtains the interface identifier corresponding to each interface by scanning, and queries the historical access data corresponding to each interface identifier from the database according to the acquired interface identifiers, and extracts the historical access data of the query.
  • the server after receiving the interface access request, extracts the interface identifier in the interface access request and the interface access data in the interface access request, and stores the extracted interface access data and the interface identifier in the database. The historical access data corresponding to the extracted interface identifier is obtained.
  • the server sorts the historical access data corresponding to each interface identifier according to the access time, reads each historical access data in the order of access time, parses the read historical access data, and reads from the parsing Feature information is extracted from the historical access data.
  • the feature information specifically includes at least one of a user account, a terminal network address, a browser type, and a terminal device type.
  • S204 specifically includes the following: for each interface identifier corresponding to the historical access data, reading each piece of historical access data; extracting from the read historical access data according to the preset feature information identifier Feature information.
  • the server sets a corresponding historical access data table for each interface identifier in the database. After obtaining the user access data corresponding to the interface identifier, the server adds the user access data to the corresponding historical access data table according to the access time.
  • the server reads the historical access data one by one according to the order of the records in the historical access data table corresponding to each interface identifier.
  • the server extracts feature information from the read historical access data according to the preset feature information identifier. For example, the server extracts at least one of a user account, a terminal network address, a browser type, and a terminal type from the read history access data.
  • the extracted feature information is input into a pre-trained normal access detection model for detection, and a user access detection result corresponding to each interface identifier is obtained.
  • the normal access detection model is configured to detect whether the historical access data corresponding to the extracted feature information is historical access data generated by a normal user when accessing the interface.
  • the server takes the extracted feature information as an input, and inputs the extracted feature information to the pre-trained normal access detection model for detection, and obtains the output of the pre-trained normal access detection model corresponding to the extracted feature information.
  • Test results The detection result is whether the historical access data corresponding to the extracted feature information is historical access data generated when a normal user accesses the interface.
  • the server stores the obtained detection result corresponding to the corresponding interface identifier, and obtains the user access detection result corresponding to each interface identifier.
  • the user access detection result includes a normal user access amount, and may also include at least one of an abnormal user access amount and a total user access amount.
  • the server obtains the user access detection result corresponding to each interface identifier from the stored user access detection interface.
  • the server compares the abnormal user access amount corresponding to each interface identifier from the user access detection result corresponding to each interface identifier, and compares the counted abnormal user access amount with the preset abnormal traffic threshold.
  • the server determines the abnormal user access amount that is greater than the preset abnormal access threshold, and the interface identifier corresponding to the abnormal user access amount that is determined by the query, and the queried interface identifier is the interface identifier of the abnormal interface.
  • the server compares the normal user access amount corresponding to each interface identifier from the corresponding user access detection interface of each interface identifier, and compares the counted normal user access amount with the preset normal access amount threshold.
  • the server determines the normal user access amount that is less than the preset normal access threshold, and queries the interface identifier corresponding to the determined normal user access amount.
  • the queried interface identifier is the interface identifier of the abnormal interface. The server closes the detected exception interface or rejects the access request from the exception interface.
  • the historical access data corresponding to each interface identifier is obtained, and the feature information in each historical access data is extracted for each historical access data corresponding to each interface identifier, and the extracted feature information is input into the pre-trained normal access.
  • the detection model is tested to obtain the user access detection result corresponding to each interface identifier, and the historical access data is detected according to the normal access detection model, thereby improving the accuracy of the user access detection result.
  • the user access detection result corresponding to each interface identifier with a high accuracy rate is directly determined, and the interface identifier of the abnormal interface is determined, thereby improving the detection accuracy of the abnormal interface.
  • an abnormal interface detection method comprising the following contents:
  • the server stores a historical access data table corresponding to each interface identifier.
  • the server reads the historical access data corresponding to each interface identifier from the stored historical access data table.
  • the server reads the historical access data one by one in the historical access data corresponding to each interface identifier, and extracts information corresponding to each field from the read historical access data as the feature information.
  • the extracted feature information is input to the pre-trained normal access detection model to obtain whether the read historical access data is a detection result of normal user access data.
  • the server processes the extracted feature information, converts the extracted feature vector into a feature vector, and inputs the converted feature vector into the pre-trained normal access detection model to obtain a normal access detection model output.
  • the detection result corresponding to the read history access data.
  • the detection result includes determining whether the read historical access data is the content of the normal user access data. For example, the detected result of the read historical access data is the access data generated by the real user access interface.
  • S308 The normal user access amount and the abnormal access amount corresponding to each interface identifier are counted according to the obtained detection result, and the normal user access amount and the abnormal user access amount are counted as the user access detection result corresponding to each interface identifier.
  • the server stores the detection result corresponding to the interface identifier storage.
  • the server counts, according to the detection result corresponding to each historical access data, the number of the data that is determined to be normal user access data corresponding to each interface identifier, and the number of data that is determined to be abnormal user access data, to count the normal user access data.
  • the number is used as the normal user access amount, and the number of abnormal user access data is counted as the abnormal user access amount, and the normal user access amount and the abnormal user access amount are used as the user access detection result.
  • the server extracts the normal user access amount and the abnormal user access amount in the user access detection result corresponding to each interface identifier, and adds the extracted normal user access amount and the abnormal user access amount to obtain the total user access amount, so as to be normal.
  • the user access is divided by the total number of user accesses to obtain the normal access ratio, and the normal access ratio corresponding to each interface identifier is obtained.
  • S312 Determine an interface identifier corresponding to a normal access ratio that is lower than a preset ratio threshold, and determine that the interface corresponding to the interface identifier is an abnormal interface.
  • the server compares the normal access ratio corresponding to each interface identifier with a preset ratio threshold, and filters the interface identifier corresponding to the normal access ratio lower than the preset ratio threshold from all the interface identifiers, and determines the filtered interface identifier.
  • the interface corresponding to the interface ID is an abnormal interface.
  • the server obtains an abnormal access ratio by dividing the abnormal access amount by the total amount of user access.
  • the server compares the abnormal access proportion corresponding to each interface identifier with the preset ratio threshold, and compares the interface identifiers that are filtered from the interface identifier to the interface with the abnormal proportion of the abnormality. Is an exception interface.
  • each historical access data is detected by a pre-trained normal access detection model to detect whether the user corresponding to each historical access data is a real user, and the detection result of the corresponding historical access data is identified according to each interface.
  • the normal access ratio corresponding to each interface identifier is counted to determine the identifier of the abnormal interface, that is, whether the interface is abnormal according to the real user access amount corresponding to each interface identifier, thereby improving the detection accuracy of the abnormal interface.
  • the method further includes the step of generating a detection report, and the step specifically includes the following content:
  • S402 Regularly count the normal access amount and the abnormal access amount corresponding to each interface identifier according to the user access detection result corresponding to each interface identifier.
  • the server periodically obtains the user access detection result corresponding to each interface identifier, and compares the normal access amount and the abnormal access amount corresponding to each interface identifier to the user access detection result corresponding to each interface identifier.
  • S404 Generate a detection report according to the normal access amount and the abnormal access amount.
  • the server adds the total number of user accesses according to the statistics of the normal access amount and the abnormal access amount, and divides the statistical normal access amount by the total user access amount to obtain the normal access ratio, and divides the statistical abnormal access amount by The total number of user accesses is abnormally accessed.
  • the detection report is generated based on the statistics time, interface identifier, normal traffic, abnormal traffic, total user access, normal access ratio, and abnormal access ratio.
  • the generated test report and corresponding interface identifier are generated. Corresponding storage.
  • the normal access amount and the abnormal access amount corresponding to each interface identifier are periodically counted according to the user access detection result corresponding to each interface identifier, and the corresponding detection report is generated according to the normal access amount and the abnormal access amount, so as to obtain the detection report through the detection report.
  • the access status of the interface corresponding to each interface identifier is periodically counted according to the user access detection result corresponding to each interface identifier, and the corresponding detection report is generated according to the normal access amount and the abnormal access amount, so as to obtain the detection report through the detection report.
  • S208 specifically includes a step of replacing the normal access detection model, and the step specifically includes the following:
  • the server obtains the user access detection result corresponding to each interface identifier, and extracts historical access data determined to be normal user access data from the historical access data according to the user access detection result.
  • the server adds a flag to the historical access data determined to be normal user access data, and the server directly extracts the historical access data added with the tag from the historical access data, and the extracted historical access data is determined to be a normal user. Access historical access data for data.
  • the server extracts the normal user access data
  • the data of the extracted normal user access data is counted, and the amount of normal user access data is obtained through statistics.
  • the preset training sample data amount is the amount of data of the training samples used to pre-train the normal access detection model.
  • the server subtracts the amount of normal user access data from the preset amount of training data, and the obtained data amount difference is the sample data amount difference.
  • the server compares the calculated sample data difference with the preset data amount difference. If the sample data amount difference is greater than the preset data amount difference, the extracted normal user access data is used as a training sample, and the training sample is extracted. Each user accesses the feature information in the data, and takes the extracted feature information as an input to determine that the normal user accesses the data as an output, and retrains the normal access detection model.
  • the server after retraining the normal access detection model, changes the preset sample data amount to the counted normal user access data amount.
  • the amount of sample data that is subsequently used to train the normal access detection model is increasing.
  • the server replaces the pre-trained normal access detection model with the retrained normal access detection model. After the server obtains the historical access data corresponding to each interface identifier again, the feature information in each historical access data is extracted, and the extracted feature information is input into the re-trained normal access detection model to obtain user access corresponding to each interface identifier. Test results.
  • the normal user access data is determined as the training sample.
  • the normal access detection model is retrained, and the pre-trained normal access detection model is updated to the retrained normal access detection model, thereby improving the detection accuracy of the normal access detection model.
  • the abnormal interface detection method further includes the step of generating a normal access detection model, specifically including the following:
  • the terminal when the terminal detects that the model training button in the model training page is clicked, the terminal triggers the model training instruction, and sends the model training instruction to the server.
  • the server receives the model training instruction sent by the terminal.
  • the model training instructions are used to instruct the server to begin training instructions for normal access detection models.
  • the server extracts a sample data storage address in the model training instruction, and extracts model sample data from the database according to the sample data storage address.
  • Model sample data includes access data that is marked as normal user access data.
  • the server reads the normal user access data in the model sample data one by one, parses the read normal user access data, and extracts the feature information in the normal user access data through parsing.
  • the server takes the feature information extracted from each normal user access data as an input, the normal user access as an output training normal access detection model, and the trained normal access detection model as a pre-trained normal access detection model.
  • the model sample data is obtained from the database according to the model training instruction, and the normal access detection model is trained according to the model sample data, so that the normal access detection model is used to detect the corresponding historical access data of each interface identifier, and the detection of the historical access data is improved.
  • Efficiency which increases the efficiency of detecting anomalous interfaces.
  • FIGS. 2-6 are sequentially displayed as indicated by the arrows, these steps are not necessarily performed in the order indicated by the arrows. Except as explicitly stated herein, the execution of these steps is not strictly limited, and the steps may be performed in other orders. Moreover, at least some of the steps in FIGS. 2-6 may include a plurality of sub-steps or stages, which are not necessarily performed at the same time, but may be executed at different times, these sub-steps or stages The order of execution is not necessarily performed sequentially, but may be performed alternately or alternately with at least a portion of other steps or sub-steps or stages of other steps.
  • an abnormal interface detecting apparatus 700 including: a historical data obtaining module 702, a feature information extracting module 704, a detection result obtaining module 706, and an abnormal interface determining module 708, wherein :
  • the historical data obtaining module 702 is configured to obtain historical access data corresponding to each interface identifier.
  • the feature information extraction module 704 is configured to extract feature information in each history access data for the historical access data corresponding to each interface identifier.
  • the detection result obtaining module 706 is configured to input the extracted feature information into the pre-trained normal access detection model for detection, and obtain a user access detection result corresponding to each interface identifier.
  • the abnormal interface determining module 708 is configured to determine an interface identifier of the abnormal interface according to the corresponding user access detection result of each interface identifier.
  • the historical access data corresponding to each interface identifier is obtained, and the feature information in each historical access data is extracted for each historical access data corresponding to each interface identifier, and the extracted feature information is input into the pre-trained normal access.
  • the detection model is tested to obtain the user access detection result corresponding to each interface identifier, and the historical access data is detected according to the normal access detection model, thereby improving the accuracy of the user access detection result.
  • the user access detection result corresponding to each interface identifier with a high accuracy rate is directly determined, and the interface identifier of the abnormal interface is determined, thereby improving the detection accuracy of the abnormal interface.
  • the feature information extraction module 704 is further configured to: read, for each interface identifier, historical access data, and read each historical access data; and identify the historical access data from the read according to the preset feature information. Extract feature information.
  • the detection result obtaining module 706 is further configured to input the extracted feature information into the pre-trained normal access detection model, to obtain whether the read historical access data is a detection result of the normal user access data; and each of the obtained detection results is counted.
  • the normal user access amount and the abnormal access amount corresponding to the interface identifiers are used to count the normal user access amount and the abnormal user access amount as the user access detection result corresponding to each interface identifier.
  • the abnormal interface determining module 708 is further configured to: according to the user access detection result corresponding to each interface identifier, the normal access proportion corresponding to each interface identifier is determined; and the interface identifier corresponding to the normal access ratio lower than the preset ratio threshold is determined, The interface corresponding to the identified interface identifier is an abnormal interface.
  • each historical access data is detected by a pre-trained normal access detection model to detect whether the user corresponding to each historical access data is a real user, and the detection result of the corresponding historical access data is identified according to each interface.
  • the normal access ratio corresponding to each interface identifier is counted to determine the identifier of the abnormal interface, that is, whether the interface is abnormal according to the real user access amount corresponding to each interface identifier, thereby improving the detection accuracy of the abnormal interface.
  • the abnormal interface detecting apparatus 700 specifically includes a detection report generating module.
  • the detection report generation module is further configured to periodically collect the normal access amount and the abnormal access amount corresponding to each interface identifier according to the user access detection result corresponding to each interface identifier, and generate a detection report according to the statistical normal access amount and the abnormal access amount.
  • the normal access amount and the abnormal access amount corresponding to each interface identifier are periodically counted according to the user access detection result corresponding to each interface identifier, and the corresponding detection report is generated according to the normal access amount and the abnormal access amount, so as to obtain the detection report through the detection report.
  • the access status of the interface corresponding to each interface identifier is periodically counted according to the user access detection result corresponding to each interface identifier, and the corresponding detection report is generated according to the normal access amount and the abnormal access amount, so as to obtain the detection report through the detection report.
  • the abnormal interface detecting apparatus 700 specifically includes: an access data extracting module 710, a data amount counting module 712, a data amount difference obtaining module 714, a model retraining module 716, and a detection model replacement. Module 718.
  • the access data extraction module 710 is configured to extract normal user access data from the historical access data according to the corresponding user access detection result of each interface identifier.
  • the data volume statistics module 712 is configured to count the amount of normal user access data extracted.
  • the data amount difference obtaining module 714 is configured to subtract the preset training sample data amount from the counted normal user access data amount to obtain a sample data amount difference.
  • the model retraining module 716 is configured to retrain the normal access detection model if the sample data amount difference is greater than the preset data amount difference to extract the normal user access data as the training sample.
  • the detection model replacement module 718 is configured to replace the pre-trained normal access detection model with the retrained normal access detection model.
  • the normal user access data is determined as the training.
  • the sample retrains the normal access detection model, and updates the pre-trained normal access detection model to the retrained normal access detection model, thereby improving the detection accuracy of the normal access detection model.
  • the abnormal interface detecting apparatus 700 specifically includes the following: a training instruction acquiring module 720, a sample data acquiring module 722, a feature information extracting module 724, and a detecting model training module 726.
  • the training instruction acquisition module 720 is configured to acquire a model training instruction.
  • the sample data obtaining module 722 is configured to acquire model sample data from a database according to the model training instruction.
  • the feature information extraction module 724 is configured to extract feature information in each normal user access data in the model sample data.
  • the detection model training module 726 is configured to use the extracted feature information as an input, and use normal user access as an output training normal access detection model to obtain a pre-trained normal access detection model.
  • the model sample data is obtained from the database according to the model training instruction, and the normal access detection model is trained according to the model sample data, so that the normal access detection model is used to detect the corresponding historical access data of each interface identifier, and the detection of the historical access data is improved.
  • Efficiency which increases the efficiency of detecting anomalous interfaces.
  • each of the above-described abnormal interface detecting devices may be implemented in whole or in part by software, hardware, and a combination thereof.
  • Each of the above modules may be embedded in or independent of the processor in the computer device, or may be stored in a memory in the computer device in a software form, so that the processor invokes the operations corresponding to the above modules.
  • a computer device which may be a server, and its internal structure diagram may be as shown in FIG.
  • the computer device includes a processor, memory, network interface, and database connected by a system bus.
  • the processor of the computer device is used to provide computing and control capabilities.
  • the memory of the computer device includes a non-volatile storage medium, an internal memory.
  • the non-volatile storage medium stores an operating system, computer readable instructions, and a database.
  • the internal memory provides an environment for operation of an operating system and computer readable instructions in a non-volatile storage medium.
  • the database of the computer device is used to store historical access data corresponding to each interface identifier.
  • the network interface of the computer device is used to communicate with an external terminal via a network connection.
  • the computer readable instructions are executed by the processor to implement an anomaly interface detection method.
  • FIG. 10 is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation of the computer device to which the solution of the present application is applied.
  • the specific computer device may It includes more or fewer components than those shown in the figures, or some components are combined, or have different component arrangements.
  • a computer device comprising a memory and one or more processors having stored therein computer readable instructions, the computer readable instructions being executed by one or more processors such that one or more processors implement any of the present application
  • the steps of the abnormal interface detection method provided in the embodiment are not limited to:
  • One or more non-transitory computer readable storage mediums storing computer readable instructions, when executed by one or more processors, cause one or more processors to be implemented in any one embodiment of the present application The steps provided by the exception interface detection method.
  • Non-volatile memory can include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory.
  • Volatile memory can include random access memory (RAM) or external cache memory.
  • RAM is available in a variety of formats, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronization chain.
  • SRAM static RAM
  • DRAM dynamic RAM
  • SDRAM synchronous DRAM
  • DDRSDRAM double data rate SDRAM
  • ESDRAM enhanced SDRAM
  • Synchlink DRAM SLDRAM
  • Memory Bus Radbus
  • RDRAM Direct RAM
  • DRAM Direct Memory Bus Dynamic RAM
  • RDRAM Memory Bus Dynamic RAM

Abstract

一种异常接口检测方法，包括：获取各接口标识对应的历史访问数据；对于每个接口标识所对应的历史访问数据，提取每条历史访问数据中的特征信息；将提取到的特征信息输入预先训练好的正常访问检测模型进行检测，得到所述每个接口标识对应的用户访问检测结果；根据所述每个接口标识对应的用户访问检测结果，确定异常接口的接口标识。

Description

异常接口检测方法、装置、计算机设备和存储介质
本申请要求于2018年02月07日提交中国专利局，申请号为2018101243386，申请名称为“异常接口检测方法、装置、计算机设备和存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及一种异常接口检测方法、装置、计算机设备和存储介质。
背景技术
随着网络技术的发展，各种网络安全方面的问题也不断的凸显出来。为了保证网络安全，需要对网络访问过程中的访问接口进行检测，以检测是否存在异常的网络访问情况。
传统的网络访问检测，大都是通过对网络访问请求中的各中参数的检测，且传统的检测方式，都是人工预设检测方式。发明人意识到，随着网络安全的需求越来越高，需要对异常接口进行检测，由于现在异常接口的隐蔽性也越来越强，使得根据人工预设检测方式对异常接口的检测效果越来越差，降低了异常接口的检测准确率。
发明内容
根据本申请公开的各种实施例，提供一种异常接口检测方法、装置、计算机设备和存储介质。
一种异常接口检测方法包括：
获取各接口标识对应的历史访问数据；
对于每个接口标识所对应的历史访问数据，提取每条历史访问数据中的特征信息；
将提取到的特征信息输入预先训练好的正常访问检测模型进行检测，得到所述每个接口标识对应的用户访问检测结果；及
根据所述每个接口标识对应的用户访问检测结果，确定异常接口的接口标识。
一种异常接口检测装置包括：
历史数据获取模块，用于获取各接口标识对应的历史访问数据；
特征信息提取模块，用于对于每个接口标识所对应的历史访问数据，提取每条历史访问数据中的特征信息；
检测结果得到模块，用于将提取到的特征信息输入预先训练好的正常访问检测模型进行检测，得到所述每个接口标识对应的用户访问检测结果；及
异常接口确定模块，用于根据所述每个接口标识对应的用户访问检测结果，确定异常接口的接口标识。
一种计算机设备，包括存储器和一个或多个处理器，所述存储器中储存有计算机可读 指令，所述计算机可读指令被所述一个或多个处理器执行时，使得所述一个或多个处理器实现本申请任意一个实施例中提供的异常接口检测方法的步骤。
一个或多个存储有计算机可读指令的非易失性计算机可读存储介质，所述计算机可读指令被一个或多个处理器执行时，使得所述一个或多个处理器实现本申请任意一个实施例中提供的异常接口检测方法的步骤。
本申请的一个或多个实施例的细节在下面的附图和描述中提出。本申请的其它特征和优点将从说明书、附图以及权利要求书变得明显。
附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其它的附图。
图1为根据一个或多个实施例中异常接口检测方法的应用场景图。
图2为根据一个或多个实施例中异常接口检测方法的流程示意图。
图3为另一个实施例中异常接口检测方法的流程示意图。
图4为根据一个或多个实施例中生成检测报告的步骤的流程示意图。
图5为根据一个或多个实施例中替换正常访问检测模型的步骤的流程示意图。
图6为根据一个或多个实施例中生成正常访问检测模型的步骤的流程示意图。
图7为根据一个或多个实施例中异常接口检测装置的框图。
图8为另一个实施例中异常接口检测装置的框图。
图9为再一个实施例中异常接口检测装置的框图。
图10为根据一个或多个实施例中计算机设备的内部框图。
具体实施方式
为了使本申请的技术方案及优点更加清楚明白，以下结合附图及实施例，对本申请进行进一步详细说明。应当理解，此处描述的具体实施例仅仅用以解释本申请，并不用于限定本申请。
本申请提供的异常接口检测方法，可以应用于如图1所示的应用环境中。其中，终端102通过网络与服务器104通过网络进行通信。终端102可以但不限于是各种个人计算机、笔记本电脑、智能手机、平板电脑和便携式可穿戴设备，服务器104可以用独立的服务器或者是多个服务器组成的服务器集群来实现。
在其中一个实施例中，如图2所示，提供了一种异常接口检测方法，以该方法应用于图1中的服务器为例进行说明，包括以下步骤：
S202，获取各接口标识对应的历史访问数据。
具体地，服务器对接口进行扫描，通过扫描获取各接口对应的接口标识，根据获取 到的各接口标识，从数据库中查询各接口标识分别对应的历史访问数据，提取查询到的历史访问数据。
在其中一个实施例中，服务器在接收到接口访问请求后，提取接口访问请求中的接口标识和接口访问请求中的接口访问数据，将提取到的接口访问数据与接口标识对应存储到数据库中，得到提取到的接口标识对应的历史访问数据。
S204，对于每个接口标识所对应的历史访问数据，提取每条历史访问数据中的特征信息。
具体地，服务器对于每个接口标识对应的历史访问数据按访问时间进行排序，按照访问时间的顺序读取每条历史访问数据中，对读取到的历史访问数据进行解析，通过解析从读取到的历史访问数据中提取特征信息。
特征信息具体包括用户账号、终端网络地址、浏览器种类和终端设备类型中的至少一种。
在其中一个实施例中，S204具体还包括以下内容：对于每个接口标识所对应的历史访问数据，读取每条历史访问数据；根据预设特征信息标识从读取到的历史访问数据中提取特征信息。
具体地，服务器在数据库中对于每个接口标识都设置有一张对应的历史访问数据表。服务器在获取到接口标识对应的用户访问数据后，按照访问时间将用户访问数据添加到相应的历史访问数据表中。服务器按照每个接口标识对应的历史访问数据表中的排列顺序，逐条读取历史访问数据。服务器根据预设特征信息标识从读取到的历史访问数据中提取特征信息。例如，服务器从读取到的历史访问数据中提取用户账号、终端网络地址、浏览器类型和终端类型中的至少一种。
S206，将提取到的特征信息输入预先训练好的正常访问检测模型进行检测，得到每个接口标识对应的用户访问检测结果。
正常访问检测模型用于检测提取到的特征信息所对应的历史访问数据是否为正常用户在访问接口时产生的历史访问数据。
具体地，服务器将提取到的特征信息作为输入，将提取到的特征信息输入至预先训练好的正常访问检测模型进行检测，获取预先训练好的正常访问检测模型输出的与提取到的特征信息对应的检测结果。检测结果为检测提取到的特征信息所对应的历史访问数据是否为正常用户在访问接口时产生的历史访问数据。服务器将获取到的检测结果与相应的接口标识对应存储，得到每个接口标识对应的用户访问检测结果。
S208，根据每个接口标识对应的用户访问检测结果，确定异常接口的接口标识。
用户访问检测结果中包括正常用户访问量，还可以包括异常用户访问量和用户访问总量中的至少一种。
具体地，服务器从存储的用户访问检测接口中，获取每个接口标识对应的用户访问检测结果。服务器从每个接口标识对应的用户访问检测结果中统计每个接口标识对应的异常 用户访问量，将统计到的异常用户访问量与预设异常访问量阈值比较。服务器确定大于预设异常访问量阈值的异常用户访问量，查询确定的异常用户访问量对应的接口标识，查询到的接口标识为异常接口的接口标识。
在其中一个实施例中，服务器从每个接口标识对应的用户访问检测接口中统计每个接口标识对应的正常用户访问量，将统计到的正常用户访问量与预设正常访问量阈值比较。服务器确定小于预设正常访问量阈值的正常用户访问量，查询确定的正常用户访问量对应的接口标识，查询到的接口标识为异常接口的接口标识。服务器将检测到的异常接口关闭，或者拒绝异常接口的访问请求。
本实施例中，获取各接口标识对应的历史访问数据，对于每个接口标识对应的历史访问数据，提取每条历史访问数据中的特征信息，将提取到的特征信息输入预先训练好的正常访问检测模型进行检测，得到各接口标识分别对应的用户访问检测结果，根据正常访问检测模型对历史访问数据进行检测，提高了用户访问检测结果的准确率。直接根据准确率较高的各接口标识分别对应的用户访问检测结果，确定异常接口的接口标识，提高了异常接口的检测准确率。
在另一些实施例中，如图3所示，提供了一种异常接口检测方法，该方法包括以下内容：
S302，获取各接口标识对应的历史访问数据。
具体地，服务器中存储着各接口标识分别对应的历史访问数据表。服务器从存储的历史访问数据表中读取各接口标识对应的历史访问数据。
S304，对于每个接口标识所对应的历史访问数据，提取每条历史访问数据中的特征信息。
具体地，服务器对于每个接口标识所对应的历史访问数据中，逐条读取历史访问数据，并从读取到的历史访问数据中提取每个字段对应的信息作为特征信息。
S306，将提取到的特征信息输入到预先训练好的正常访问检测模型，得到读取到的历史访问数据是否为正常用户访问数据的检测结果。
具体地，服务器将提取到的特征信息进行处理，通过处理将提取到的特征向量转换为特征向量，将转换得到的特征向量输入到预先训练好的正常访问检测模型，得到正常访问检测模型输出的与读取到的历史访问数据对应的检测结果。检测结果中包括判定读取到的历史访问数据是否为正常用户访问数据的内容，例如，读取到的历史访问数据的检测结果为真实用户访问接口产生的访问数据。
S308，根据得到的检测结果统计每个接口标识对应的正常用户访问量和异常访问量，以统计到正常用户访问量和异常用户访问量作为每个接口标识对应的用户访问检测结果。
具体地，服务器将检测结果对应于接口标识存储。服务器根据每条历史访问数据对应的检测结果，统计每个接口标识对应的被判定为正常用户访问数据的条数和被判定为异常用户访问数据条数，以统计到的正常用户访问数据的条数作为正常用户访问量，同时以统 计到的异常用户访问数据的条数作为异常用户访问量，以正常用户访问量和异常用户访问量作为用户访问检测结果。
S310，根据每个接口标识对应的用户访问检测结果，统计每个接口标识分别对应的正常访问比例。
具体地，服务器提取每个接口标识对应的用户访问检测结果中的正常用户访问量和异常用户访问量，将提取到的正常用户访问量和异常用户访问量相加得到用户访问总量，以正常用户访问量除以用户访问总量得到正常访问比例，得到每个接口标识分别对应的正常访问比例。
S312，确定低于预设比例阈值的正常访问比例所对应的接口标识，以确定的接口标识对应的接口为异常接口。
具体地，服务器将每个接口标识对应的正常访问比例与预设比例阈值进行比较，从所有的接口标识中筛选低于预设比例阈值的正常访问比例所对应的接口标识，则判定筛选到的接口标识对应的接口为异常接口。
在其中一个实施例中，服务器以异常访问量除以用户访问总量得到异常访问比例。服务器将每个接口标识对应的异常访问比例与预设比例阈值进行比较，通过比较从接口标识中筛选到异常访问比例高于预设比例阈值的接口标识，则判定筛选到的接口标识对应的接口为异常接口。
本实施例中，通过预先训练好的正常访问检测模型对每条历史访问数据进行检测，以检测每条历史访问数据对应的用户是否为真实用户，根据每个接口标识对应历史访问数据的检测结果，统计每个接口标识对应的正常访问比例来确定异常接口的标识，即根据每个接口标识对应的真实用户访问量，来确定接口是否异常，从而提高了对异常接口的检测准确率。
在其中一个实施例中，如图4所示，S208之后具体还包括生成检测报告的步骤，该步骤具体包括以下内容：
S402，定期根据各接口标识对应的用户访问检测结果，统计各接口标识对应的正常访问量和异常访问量。
具体地，服务器定期获取各接口标识对应的用户访问检测结果，对于每个接口标识对应的用户访问检测结果，统计各接口标识对应的正常访问量和异常访问量。
S404，根据统计到的正常访问量和异常访问量生成检测报告。
具体地，服务器根据统计到的正常访问量和异常访问量相加得到用户访问总量，将统计到的正常访问量除以用户访问总量得到正常访问比例，将统计到的异常访问量除以用户访问总量得到异常访问比例，根据统计时间、接口标识、正常访问量、异常访问量、用户访问总量、正常访问比例和异常访问比例生成检测报告，将生成的检测报告与相应的接口标识对应存储。
本实施例中，定期根据各接口标识对应的用户访问检测结果，统计各接口标识对应的 正常访问量和异常访问量，根据正常访问量和异常访问量生成相应的检测报告，以通过检测报告了解各接口标识对应的接口的访问情况。
在其中一个实施例中，如图5所示，S208之后具体还包括替换正常访问检测模型的步骤，该步骤具体包括以下内容：
S502，根据每个接口标识对应的用户访问检测结果，从历史访问数据中提取正常用户访问数据。
具体地，服务器获取每个接口标识对应的用户访问检测结果，根据用户访问检测结果，从历史访问数据中提取被判定为正常用户访问数据的历史访问数据。
在其中一个实施例中，服务器将判定为正常用户访问数据的历史访问数据添加标记，服务器直接从历史访问数据中提取添加有标记的历史访问数据，提取到的历史访问数据为被判定为正常用户访问数据的历史访问数据。
S504，统计提取到的正常用户访问数据量。
具体地，服务器提取到正常用户访问数据后，对提取到的正常用户访问数据的数据量进行统计，经过统计得到正常用户访问数据量。
S506，将统计到的正常用户访问数据量减去预设训练样本数据量，得到样本数据量差。
预设训练样本数据量为预先训练正常访问检测模型所用到的训练样本的数据量。
具体地，服务器将统计到的正常用户访问数据量减去预设训练数据量，以所得到的数据量差为样本数据量差。
S508，若样本数据量差大于预设数据量差，以提取到正常用户访问数据作为训练样本重新训练正常访问检测模型。
具体地，服务器将计算得到的样本数据量差与预设数据量差进行比较，若样本数据量差大于预设数据量差，则以提取到的正常用户访问数据作为训练样本，提取训练样本中每条用户访问数据中的特征信息，以提取到的特征信息作为输入，以判定为正常用户访问数据作为输出，重新训练正常访问检测模型。
在其中一个实施例中，服务器在重新训练正常访问检测模型后，将预设样本数据量更改为统计到的正常用户访问数据量。使得后续用来训练正常访问检测模型的样本数据量越来越大。
S510，将预先训练好的正常访问检测模型替换为重新训练的正常访问检测模型。
具体地，服务器将预先训练好的正常访问检测模型进行替换，替换为重新训练的正常访问检测模型。当服务器再次获取到各接口标识对应的历史访问数据后，提取每条历史访问数据中的特征信息，将提取到的特征信息输入重新训练的正常访问检测模型，得到每个接口标识对应的用户访问检测结果。
本实施例中，当历史访问数据中被判定为正常用户访问数据的数据量，超出预设训练样本数据量的差值大于预设数据量差时，以被判定为正常用户访问数据作为训练样本重新训练正常访问检测模型，将预先训练好的正常访问检测模型更新为重新训练的正常访问检 测模型，从而提高了正常访问检测模型的检测准确性。
在其中一个实施例中，如图6所示，异常接口检测方法还包括生成正常访问检测模型的步骤，具体包括以下内容：
S602，获取模型训练指令。
具体地，终端检测到模型训练页面中的模型训练按钮被点击时，触发模型训练指令，将模型训练指令发送至服务器。服务器接收终端发送的模型训练指令。模型训练指令用于指示服务器开始训练正常访问检测模型的指令。
S604，根据模型训练指令从数据库中获取模型样本数据。
具体地，服务器提取模型训练指令中的样本数据存储地址，根据样本数据存储地址从数据库中提取模型样本数据。模型样本数据中包括被标记为正常用户访问数据的访问数据。
S606，提取模型样本数据中每条正常用户访问数据中的特征信息。
具体地，服务器逐条读取模型样本数据中的正常用户访问数据，对读取到的正常用户访问数据进行解析，通过解析提取正常用户访问数据中的特征信息。
S608，以提取到的特征信息作为输入，以正常用户访问作为输出训练正常访问检测模型，得到预先训练好的正常访问检测模型。
具体地，服务器以从每条正常用户访问数据中提取到的特征信息作为输入，以正常用户访问作为输出训练正常访问检测模型，以训练得到的正常访问检测模型作为预先训练好的正常访问检测模型。
本实施例中，根据模型训练指令从数据库中获取模型样本数据，根据模型样本数据训练正常访问检测模型，以通过正常访问检测模型来检测各接口标识对应历史访问数据，提高了历史访问数据的检测效率，从而提高了检测异常接口的效率。
应该理解的是，虽然图2-6的流程图中的各个步骤按照箭头的指示依次显示，但是这些步骤并不是必然按照箭头指示的顺序依次执行。除非本文中有明确的说明，这些步骤的执行并没有严格的顺序限制，这些步骤可以以其它的顺序执行。而且，图2-6中的至少一部分步骤可以包括多个子步骤或者多个阶段，这些子步骤或者阶段并不必然是在同一时刻执行完成，而是可以在不同的时刻执行，这些子步骤或者阶段的执行顺序也不必然是依次进行，而是可以与其它步骤或者其它步骤的子步骤或者阶段的至少一部分轮流或者交替地执行。
在其中一个实施例中，如图7所示，提供了一种异常接口检测装置700，包括：历史数据获取模块702、特征信息提取模块704、检测结果得到模块706和异常接口确定模块708，其中：
历史数据获取模块702，用于获取各接口标识对应的历史访问数据。
特征信息提取模块704，用于对于每个接口标识所对应的历史访问数据，提取每条历 史访问数据中的特征信息。
检测结果得到模块706，用于将提取到的特征信息输入预先训练好的正常访问检测模型进行检测，得到每个接口标识对应的用户访问检测结果。
异常接口确定模块708，用于根据每个接口标识对应的用户访问检测结果，确定异常接口的接口标识。
本实施例中，获取各接口标识对应的历史访问数据，对于每个接口标识对应的历史访问数据，提取每条历史访问数据中的特征信息，将提取到的特征信息输入预先训练好的正常访问检测模型进行检测，得到各接口标识分别对应的用户访问检测结果，根据正常访问检测模型对历史访问数据进行检测，提高了用户访问检测结果的准确率。直接根据准确率较高的各接口标识分别对应的用户访问检测结果，确定异常接口的接口标识，提高了异常接口的检测准确率。
在其中一个实施例中，特征信息提取模块704还用于对于每个接口标识所对应的历史访问数据，读取每条历史访问数据；根据预设特征信息标识从读取到的历史访问数据中提取特征信息。
检测结果得到模块706还用于将提取到的特征信息输入到预先训练好的正常访问检测模型，得到读取到的历史访问数据是否为正常用户访问数据的检测结果；根据得到的检测结果统计每个接口标识对应的正常用户访问量和异常访问量，以统计到正常用户访问量和异常用户访问量作为每个接口标识对应的用户访问检测结果。
异常接口确定模块708还用于根据每个接口标识对应的用户访问检测结果，统计每个接口标识分别对应的正常访问比例；确定低于预设比例阈值的正常访问比例所对应的接口标识，以确定的接口标识对应的接口为异常接口。
本实施例中，通过预先训练好的正常访问检测模型对每条历史访问数据进行检测，以检测每条历史访问数据对应的用户是否为真实用户，根据每个接口标识对应历史访问数据的检测结果，统计每个接口标识对应的正常访问比例来确定异常接口的标识，即根据每个接口标识对应的真实用户访问量，来确定接口是否异常，从而提高了对异常接口的检测准确率。
在其中一个实施例中，异常接口检测装置700具体还包括检测报告生成模块。
检测报告生成模块还用于定期根据各接口标识对应的用户访问检测结果，统计各接口标识对应的正常访问量和异常访问量；根据统计到的正常访问量和异常访问量生成检测报告。
本实施例中，定期根据各接口标识对应的用户访问检测结果，统计各接口标识对应的正常访问量和异常访问量，根据正常访问量和异常访问量生成相应的检测报告，以通过检测报告了解各接口标识对应的接口的访问情况。
在其中一个实施例中，如图8所示，异常接口检测装置700具体还包括：访问数据提取模块710、数据量统计模块712、数据量差得到模块714、模型重新训练模块716和检 测模型替换模块718。
访问数据提取模块710，用于根据每个接口标识对应的用户访问检测结果，从历史访问数据中提取正常用户访问数据。
数据量统计模块712，用于统计提取到的正常用户访问数据量。
数据量差得到模块714，用于将统计到的正常用户访问数据量减去预设训练样本数据量，得到样本数据量差。
模型重新训练模块716，用于若样本数据量差大于预设数据量差，以提取到正常用户访问数据作为训练样本重新训练正常访问检测模型。
检测模型替换模块718，用于将预先训练好的正常访问检测模型替换为重新训练的正常访问检测模型。
在本实施例中，当历史访问数据中被判定为正常用户访问数据的数据量，超出预设训练样本数据量的差值大于预设数据量差时，以被判定为正常用户访问数据作为训练样本重新训练正常访问检测模型，将预先训练好的正常访问检测模型更新为重新训练的正常访问检测模型，从而提高了正常访问检测模型的检测准确性。
在其中一个实施例中，如图9所示，异常接口检测装置700具体还包括以下内容：训练指令获取模块720、样本数据获取模块722、特征信息提取模块724和检测模型训练模块726。
训练指令获取模块720，用于获取模型训练指令。
样本数据获取模块722，用于根据模型训练指令从数据库中获取模型样本数据。
特征信息提取模块724，用于提取模型样本数据中每条正常用户访问数据中的特征信息。
检测模型训练模块726，用于以提取到的特征信息作为输入，以正常用户访问作为输出训练正常访问检测模型，得到预先训练好的正常访问检测模型。
本实施例中，根据模型训练指令从数据库中获取模型样本数据，根据模型样本数据训练正常访问检测模型，以通过正常访问检测模型来检测各接口标识对应历史访问数据，提高了历史访问数据的检测效率，从而提高了检测异常接口的效率。
关于异常接口检测装置的具体限定可以参见上文中对于异常接口检测方法的限定，在此不再赘述。上述异常接口检测装置中的各个模块可全部或部分通过软件、硬件及其组合来实现。上述各模块可以硬件形式内嵌于或独立于计算机设备中的处理器中，也可以以软件形式存储于计算机设备中的存储器中，以便于处理器调用执行以上各个模块对应的操作。
在其中一个实施例中，提供了一种计算机设备，该计算机设备可以是服务器，其内部结构图可以如图10所示。该计算机设备包括通过系统总线连接的处理器、存储器、网络接口和数据库。该计算机设备的处理器用于提供计算和控制能力。该计算机设备的存储器包括非易失性存储介质、内存储器。该非易失性存储介质存储有操作系统、计算机可读指 令和数据库。该内存储器为非易失性存储介质中的操作系统和计算机可读指令的运行提供环境。该计算机设备的数据库用于存储各接口标识对应的历史访问数据。该计算机设备的网络接口用于与外部的终端通过网络连接通信。该计算机可读指令被处理器执行时以实现一种异常接口检测方法。
本领域技术人员可以理解，图10中示出的结构，仅仅是与本申请方案相关的部分结构的框图，并不构成对本申请方案所应用于其上的计算机设备的限定，具体的计算机设备可以包括比图中所示更多或更少的部件，或者组合某些部件，或者具有不同的部件布置。
一种计算机设备，包括存储器和一个或多个处理器，存储器中储存有计算机可读指令，计算机可读指令被一个或多个处理器执行时，使得一个或多个处理器实现本申请任意一个实施例中提供的异常接口检测方法的步骤。
一个或多个存储有计算机可读指令的非易失性计算机可读存储介质，计算机可读指令被一个或多个处理器执行时，使得一个或多个处理器实现本申请任意一个实施例中提供的异常接口检测方法的步骤。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，是可以通过计算机可读指令来指令相关的硬件来完成，所述的计算机可读指令可存储于一非易失性计算机可读取存储介质中，该计算机可读指令在执行时，可包括如上述各方法的实施例的流程。其中，本申请所提供的各实施例中所使用的对存储器、存储、数据库或其它介质的任何引用，均可包括非易失性和/或易失性存储器。非易失性存储器可包括只读存储器(ROM)、可编程ROM(PROM)、电可编程ROM(EPROM)、电可擦除可编程ROM(EEPROM)或闪存。易失性存储器可包括随机存取存储器(RAM)或者外部高速缓冲存储器。作为说明而非局限，RAM以多种形式可得，诸如静态RAM(SRAM)、动态RAM(DRAM)、同步DRAM(SDRAM)、双数据率SDRAM(DDRSDRAM)、增强型SDRAM(ESDRAM)、同步链路(Synchlink)DRAM(SLDRAM)、存储器总线(Rambus)直接RAM(RDRAM)、直接存储器总线动态RAM(DRDRAM)、以及存储器总线动态RAM(RDRAM)等。
以上实施例的各技术特征可以进行任意的组合，为使描述简洁，未对上述实施例中的各个技术特征所有可能的组合都进行描述，然而，只要这些技术特征的组合不存在矛盾，都应当认为是本说明书记载的范围。
以上所述实施例仅表达了本申请的几种实施方式，其描述较为具体和详细，但并不能因此而理解为对发明专利范围的限制。应当指出的是，对于本领域的普通技术人员来说，在不脱离本申请构思的前提下，还可以做出若干变形和改进，这些都属于本申请的保护范围。因此，本申请专利的保护范围应以所附权利要求为准。

Claims (20)

  1. 一种异常接口检测方法包括：
    获取各接口标识对应的历史访问数据；
    对于每个接口标识所对应的历史访问数据，提取每条历史访问数据中的特征信息；
    将提取到的特征信息输入预先训练好的正常访问检测模型进行检测，得到所述每个接口标识对应的用户访问检测结果；及
    根据所述每个接口标识对应的用户访问检测结果，确定异常接口的接口标识。
  2. 根据权利要求1所述的方法，其特征在于，所述对于每个接口标识所对应的历史访问数据，提取每条历史访问数据中的特征信息，包括：
    对于每个接口标识所对应的历史访问数据，读取每条历史访问数据；及
    根据预设特征信息标识从读取到的历史访问数据中提取特征信息。
  3. 根据权利要求2所述的方法，其特征在于，所述将提取到的特征信息输入预先训练好的正常访问检测模型进行检测，得到所述每个接口标识对应的用户访问检测结果，包括：
    将提取到的特征信息输入到预先训练好的正常访问检测模型，得到所述读取到的历史访问数据是否为正常用户访问数据的检测结果；及
    根据得到的检测结果统计所述每个接口标识对应的正常用户访问量和异常访问量，以统计到正常用户访问量和异常用户访问量作为所述每个接口标识对应的用户访问检测结果。
  4. 根据权利要求3所述的方法，其特征在于，所述根据所述每个接口标识对应的用户访问检测结果，确定异常接口的接口标识，包括：
    根据所述每个接口标识对应的用户访问检测结果，统计所述每个接口标识分别对应的正常访问比例；及
    确定低于预设比例阈值的正常访问比例所对应的接口标识，以确定的接口标识对应的接口为异常接口。
  5. 根据权利要求1所述的方法，其特征在于，所述根据所述每个接口标识对应的用户访问检测结果，确定异常接口的接口标识之后，所述方法还包括：
    定期根据各接口标识对应的用户访问检测结果，统计各接口标识对应的正常访问量和异常访问量；及
    根据统计到的正常访问量和异常访问量生成检测报告。
  6. 根据权利要求1所述的方法，其特征在于，所述根据所述每个接口标识对应的用户访问检测结果，确定异常接口的接口标识之后，所述方法还包括：
    根据所述每个接口标识对应的用户访问检测结果，从所述历史访问数据中提取正常用户访问数据；
    统计提取到的正常用户访问数据量；
    将统计到的正常用户访问数据量减去预设训练样本数据量，得到样本数据量差；
    若所述样本数据量差大于预设数据量差，以提取到正常用户访问数据作为训练样本重新训练正常访问检测模型；及
    将预先训练好的正常访问检测模型替换为重新训练的正常访问检测模型。
  7. 根据权利要求1所述的方法，其特征在于，所述预先训练好的正常访问检测模型的生成过程包括：
    获取模型训练指令；
    根据所述模型训练指令从数据库中获取模型样本数据；
    提取所述模型样本数据中每条正常用户访问数据中的特征信息；及
    以提取到的特征信息作为输入，以正常用户访问作为输出训练正常访问检测模型，得到预先训练好的正常访问检测模型。
  8. 一种异常接口检测装置，包括：
    历史数据获取模块，用于获取各接口标识对应的历史访问数据；
    特征信息提取模块，用于对于每个接口标识所对应的历史访问数据，提取每条历史访问数据中的特征信息；
    检测结果得到模块，用于将提取到的特征信息输入预先训练好的正常访问检测模型进行检测，得到所述每个接口标识对应的用户访问检测结果；及
    异常接口确定模块，用于根据所述每个接口标识对应的用户访问检测结果，确定异常接口的接口标识。
  9. 一种计算机设备，包括存储器和一个或多个处理器，所述存储器中储存有计算机可读指令，所述计算机可读指令被所述一个或多个处理器执行时，使得所述一个或多个处理器执行以下步骤：
    获取各接口标识对应的历史访问数据；
    对于每个接口标识所对应的历史访问数据，提取每条历史访问数据中的特征信息；
    将提取到的特征信息输入预先训练好的正常访问检测模型进行检测，得到所述每个接口标识对应的用户访问检测结果；及
    根据所述每个接口标识对应的用户访问检测结果，确定异常接口的接口标识。
  10. 根据权利要求9所述的计算机设备，其特征在于，所述对于每个接口标识所对应的历史访问数据，提取每条历史访问数据中的特征信息，包括：
    对于每个接口标识所对应的历史访问数据，读取每条历史访问数据；及
    根据预设特征信息标识从读取到的历史访问数据中提取特征信息。
  11. 根据权利要求10所述的计算机设备，其特征在于，所述将提取到的特征信息输入预先训练好的正常访问检测模型进行检测，得到所述每个接口标识对应的用户访问检测结果，包括：
    将提取到的特征信息输入到预先训练好的正常访问检测模型，得到所述读取到的历史 访问数据是否为正常用户访问数据的检测结果；及
    根据得到的检测结果统计所述每个接口标识对应的正常用户访问量和异常访问量，以统计到正常用户访问量和异常用户访问量作为所述每个接口标识对应的用户访问检测结果。
  12. 根据权利要求11所述的计算机设备，其特征在于，所述根据所述每个接口标识对应的用户访问检测结果，确定异常接口的接口标识，包括：
    根据所述每个接口标识对应的用户访问检测结果，统计所述每个接口标识分别对应的正常访问比例；及
    确定低于预设比例阈值的正常访问比例所对应的接口标识，以确定的接口标识对应的接口为异常接口。
  13. 根据权利要求9所述的计算机设备，其特征在于，所述计算机可读指令被所述处理器执行时，使得所述处理器在执行所述根据所述每个接口标识对应的用户访问检测结果，确定异常接口的接口标识之后，还执行以下步骤：
    定期根据各接口标识对应的用户访问检测结果，统计各接口标识对应的正常访问量和异常访问量；及
    根据统计到的正常访问量和异常访问量生成检测报告。
  14. 根据权利要求9所述的计算机设备，其特征在于，所述计算机可读指令被所述处理器执行时，使得所述处理器在执行所述根据所述每个接口标识对应的用户访问检测结果，确定异常接口的接口标识之后，还执行以下步骤：
    根据所述每个接口标识对应的用户访问检测结果，从所述历史访问数据中提取正常用户访问数据；
    统计提取到的正常用户访问数据量；
    将统计到的正常用户访问数据量减去预设训练样本数据量，得到样本数据量差；
    若所述样本数据量差大于预设数据量差，以提取到正常用户访问数据作为训练样本重新训练正常访问检测模型；及
    将预先训练好的正常访问检测模型替换为重新训练的正常访问检测模型。
  15. 一个或多个存储有计算机可读指令的非易失性计算机可读存储介质，所述计算机可读指令被一个或多个处理器执行时，使得所述一个或多个处理器执行以下步骤：
    获取各接口标识对应的历史访问数据；
    对于每个接口标识所对应的历史访问数据，提取每条历史访问数据中的特征信息；
    将提取到的特征信息输入预先训练好的正常访问检测模型进行检测，得到所述每个接口标识对应的用户访问检测结果；及
    根据所述每个接口标识对应的用户访问检测结果，确定异常接口的接口标识。
  16. 根据权利要求15所述的存储介质，其特征在于，所述对于每个接口标识所对应的历史访问数据，提取每条历史访问数据中的特征信息，包括：
    对于每个接口标识所对应的历史访问数据，读取每条历史访问数据；及
    根据预设特征信息标识从读取到的历史访问数据中提取特征信息。
  17. 根据权利要求16所述的存储介质，其特征在于，所述将提取到的特征信息输入预先训练好的正常访问检测模型进行检测，得到所述每个接口标识对应的用户访问检测结果，包括：
    将提取到的特征信息输入到预先训练好的正常访问检测模型，得到所述读取到的历史访问数据是否为正常用户访问数据的检测结果；及
    根据得到的检测结果统计所述每个接口标识对应的正常用户访问量和异常访问量，以统计到正常用户访问量和异常用户访问量作为所述每个接口标识对应的用户访问检测结果。
  18. 根据权利要求17所述的存储介质，其特征在于，所述根据所述每个接口标识对应的用户访问检测结果，确定异常接口的接口标识，包括：
    根据所述每个接口标识对应的用户访问检测结果，统计所述每个接口标识分别对应的正常访问比例；及
    确定低于预设比例阈值的正常访问比例所对应的接口标识，以确定的接口标识对应的接口为异常接口。
  19. 根据权利要求15所述的存储介质，其特征在于，所述计算机可读指令被所述处理器执行时，使得所述处理器在执行所述根据所述每个接口标识对应的用户访问检测结果，确定异常接口的接口标识之后，还执行以下步骤：
    定期根据各接口标识对应的用户访问检测结果，统计各接口标识对应的正常访问量和异常访问量；及
    根据统计到的正常访问量和异常访问量生成检测报告。
  20. 根据权利要求15所述的存储介质，其特征在于，所述计算机可读指令被所述处理器执行时，使得所述处理器在执行所述根据所述每个接口标识对应的用户访问检测结果，确定异常接口的接口标识之后，还执行以下步骤：
    根据所述每个接口标识对应的用户访问检测结果，从所述历史访问数据中提取正常用户访问数据；
    统计提取到的正常用户访问数据量；
    将统计到的正常用户访问数据量减去预设训练样本数据量，得到样本数据量差；
    若所述样本数据量差大于预设数据量差，以提取到正常用户访问数据作为训练样本重新训练正常访问检测模型；及
    将预先训练好的正常访问检测模型替换为重新训练的正常访问检测模型。
PCT/CN2018/088563 2018-02-07 2018-05-27 异常接口检测方法、装置、计算机设备和存储介质 WO2019153581A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810124338.6 2018-02-07
CN201810124338.6A CN108377240B (zh) 2018-02-07 2018-02-07 异常接口检测方法、装置、计算机设备和存储介质

Publications (1)

Publication Number Publication Date
WO2019153581A1 true WO2019153581A1 (zh) 2019-08-15

Family

ID=63017593

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/088563 WO2019153581A1 (zh) 2018-02-07 2018-05-27 异常接口检测方法、装置、计算机设备和存储介质

Country Status (2)

Country Link
CN (1) CN108377240B (zh)
WO (1) WO2019153581A1 (zh)

Cited By (28)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111258852A (zh) * 2020-01-16 2020-06-09 深圳鼎盛电脑科技有限公司 异常数据监控方法、装置、电子设备、及存储介质
US10769283B2 (en) 2017-10-31 2020-09-08 Forcepoint, LLC Risk adaptive protection
US10776708B2 (en) 2013-03-01 2020-09-15 Forcepoint, LLC Analyzing behavior in light of social time
US10832153B2 (en) 2013-03-01 2020-11-10 Forcepoint, LLC Analyzing behavior in light of social time
US10949428B2 (en) 2018-07-12 2021-03-16 Forcepoint, LLC Constructing event distributions via a streaming scoring operation
US11025659B2 (en) 2018-10-23 2021-06-01 Forcepoint, LLC Security system using pseudonyms to anonymously identify entities and corresponding security risk related behaviors
US11025638B2 (en) * 2018-07-19 2021-06-01 Forcepoint, LLC System and method providing security friction for atypical resource access requests
US11080032B1 (en) 2020-03-31 2021-08-03 Forcepoint Llc Containerized infrastructure for deployment of microservices
US11080109B1 (en) 2020-02-27 2021-08-03 Forcepoint Llc Dynamically reweighting distributions of event observations
US11132461B2 (en) 2017-07-26 2021-09-28 Forcepoint, LLC Detecting, notifying and remediating noisy security policies
US11171980B2 (en) 2018-11-02 2021-11-09 Forcepoint Llc Contagion risk detection, analysis and protection
US11190589B1 (en) 2020-10-27 2021-11-30 Forcepoint, LLC System and method for efficient fingerprinting in cloud multitenant data loss prevention
US11223646B2 (en) 2020-01-22 2022-01-11 Forcepoint, LLC Using concerning behaviors when performing entity-based risk calculations
US11314787B2 (en) 2018-04-18 2022-04-26 Forcepoint, LLC Temporal resolution of an entity
US11411973B2 (en) 2018-08-31 2022-08-09 Forcepoint, LLC Identifying security risks using distributions of characteristic features extracted from a plurality of events
US11429697B2 (en) 2020-03-02 2022-08-30 Forcepoint, LLC Eventually consistent entity resolution
US11436512B2 (en) 2018-07-12 2022-09-06 Forcepoint, LLC Generating extracted features from an event
US11516206B2 (en) 2020-05-01 2022-11-29 Forcepoint Llc Cybersecurity system having digital certificate reputation system
US11516225B2 (en) 2017-05-15 2022-11-29 Forcepoint Llc Human factors framework
US11544390B2 (en) 2020-05-05 2023-01-03 Forcepoint Llc Method, system, and apparatus for probabilistic identification of encrypted files
US11568136B2 (en) 2020-04-15 2023-01-31 Forcepoint Llc Automatically constructing lexicons from unlabeled datasets
US11630901B2 (en) 2020-02-03 2023-04-18 Forcepoint Llc External trigger induced behavioral analyses
US11704387B2 (en) 2020-08-28 2023-07-18 Forcepoint Llc Method and system for fuzzy matching and alias matching for streaming data sets
US11755584B2 (en) 2018-07-12 2023-09-12 Forcepoint Llc Constructing distributions of interrelated event features
US11810012B2 (en) 2018-07-12 2023-11-07 Forcepoint Llc Identifying event distributions using interrelated events
US11836265B2 (en) 2020-03-02 2023-12-05 Forcepoint Llc Type-dependent event deduplication
US11888859B2 (en) 2017-05-15 2024-01-30 Forcepoint Llc Associating a security risk persona with a phase of a cyber kill chain
US11895158B2 (en) 2020-05-19 2024-02-06 Forcepoint Llc Cybersecurity system having security policy visualization

Families Citing this family (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109194539B (zh) * 2018-08-13 2022-01-28 中国平安人寿保险股份有限公司 数据管控方法、装置、计算机设备及存储介质
CN109189622A (zh) * 2018-08-21 2019-01-11 上海起作业信息科技有限公司 接口测试方法及装置、电子设备、存储介质
CN109450869B (zh) * 2018-10-22 2022-02-08 杭州安恒信息技术股份有限公司 一种基于用户反馈的业务安全防护方法
CN110177075B (zh) * 2019-04-15 2023-08-22 深圳壹账通智能科技有限公司 异常访问拦截方法、装置、计算机设备及存储介质
CN110138669B (zh) * 2019-04-15 2023-02-07 中国平安人寿保险股份有限公司 接口访问处理方法、装置、计算机设备及存储介质
CN110445808A (zh) * 2019-08-26 2019-11-12 杭州迪普科技股份有限公司 异常流量攻击防护方法、装置、电子设备
CN110688406A (zh) * 2019-09-06 2020-01-14 平安医疗健康管理股份有限公司 数据处理方法、装置、计算机设备和存储介质
CN111274291B (zh) * 2020-01-20 2024-04-05 中国平安人寿保险股份有限公司 用户访问数据的查询方法、装置、设备及介质
CN111526119B (zh) * 2020-03-19 2022-06-14 北京三快在线科技有限公司 异常流量检测方法、装置、电子设备和计算机可读介质
CN111600880A (zh) * 2020-05-14 2020-08-28 深信服科技股份有限公司 异常访问行为的检测方法、系统、存储介质和终端
CN113949525A (zh) * 2021-09-07 2022-01-18 中云网安科技有限公司 异常访问行为的检测方法、装置、存储介质及电子设备
CN116647572B (zh) * 2023-07-26 2023-11-14 腾讯科技（深圳）有限公司 访问端点切换方法、装置、电子设备及存储介质
CN117195273B (zh) * 2023-11-07 2024-02-06 闪捷信息科技有限公司 基于时序数据异常检测的数据泄露检测方法及装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102026230A (zh) * 2010-12-20 2011-04-20 中兴通讯股份有限公司 Cdma网络数据业务质量监控的方法及装置
CN105553740A (zh) * 2015-12-25 2016-05-04 北京奇虎科技有限公司 数据接口监控方法和装置
CN106060681A (zh) * 2015-11-02 2016-10-26 深圳市恒扬数据股份有限公司 一种光网络设备保护方法及装置
CN106301995A (zh) * 2015-06-24 2017-01-04 北京京东尚科信息技术有限公司 一种自动检测接口服务异常的方法和装置

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8751414B2 (en) * 2011-05-04 2014-06-10 International Business Machines Corporation Identifying abnormalities in resource usage
CN104935600B (zh) * 2015-06-19 2019-03-22 中国电子科技集团公司第五十四研究所 一种基于深度学习的移动自组织网络入侵检测方法与设备
CN106991072B (zh) * 2016-01-21 2022-12-06 杭州海康威视数字技术股份有限公司 在线自学习事件检测模型更新方法及装置
CN107563194A (zh) * 2017-09-04 2018-01-09 杭州安恒信息技术有限公司 潜伏性盗取用户数据行为检测方法及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102026230A (zh) * 2010-12-20 2011-04-20 中兴通讯股份有限公司 Cdma网络数据业务质量监控的方法及装置
CN106301995A (zh) * 2015-06-24 2017-01-04 北京京东尚科信息技术有限公司 一种自动检测接口服务异常的方法和装置
CN106060681A (zh) * 2015-11-02 2016-10-26 深圳市恒扬数据股份有限公司 一种光网络设备保护方法及装置
CN105553740A (zh) * 2015-12-25 2016-05-04 北京奇虎科技有限公司 数据接口监控方法和装置

Cited By (59)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10832153B2 (en) 2013-03-01 2020-11-10 Forcepoint, LLC Analyzing behavior in light of social time
US11783216B2 (en) 2013-03-01 2023-10-10 Forcepoint Llc Analyzing behavior in light of social time
US10776708B2 (en) 2013-03-01 2020-09-15 Forcepoint, LLC Analyzing behavior in light of social time
US10860942B2 (en) 2013-03-01 2020-12-08 Forcepoint, LLC Analyzing behavior in light of social time
US11888860B2 (en) 2017-05-15 2024-01-30 Forcepoint Llc Correlating concerning behavior during an activity session with a security risk persona
US11888862B2 (en) 2017-05-15 2024-01-30 Forcepoint Llc Distributed framework for security analytics
US11902294B2 (en) 2017-05-15 2024-02-13 Forcepoint Llc Using human factors when calculating a risk score
US11902293B2 (en) 2017-05-15 2024-02-13 Forcepoint Llc Using an entity behavior catalog when performing distributed security operations
US11902295B2 (en) 2017-05-15 2024-02-13 Forcepoint Llc Using a security analytics map to perform forensic analytics
US11902296B2 (en) 2017-05-15 2024-02-13 Forcepoint Llc Using a security analytics map to trace entity interaction
US11888863B2 (en) 2017-05-15 2024-01-30 Forcepoint Llc Maintaining user privacy via a distributed framework for security analytics
US11546351B2 (en) 2017-05-15 2023-01-03 Forcepoint Llc Using human factors when performing a human factor risk operation
US11888859B2 (en) 2017-05-15 2024-01-30 Forcepoint Llc Associating a security risk persona with a phase of a cyber kill chain
US11843613B2 (en) 2017-05-15 2023-12-12 Forcepoint Llc Using a behavior-based modifier when generating a user entity risk score
US11563752B2 (en) 2017-05-15 2023-01-24 Forcepoint Llc Using indicators of behavior to identify a security persona of an entity
US11601441B2 (en) 2017-05-15 2023-03-07 Forcepoint Llc Using indicators of behavior when performing a security operation
US11621964B2 (en) 2017-05-15 2023-04-04 Forcepoint Llc Analyzing an event enacted by a data entity when performing a security operation
US11528281B2 (en) 2017-05-15 2022-12-13 Forcepoint Llc Security analytics mapping system
US11516225B2 (en) 2017-05-15 2022-11-29 Forcepoint Llc Human factors framework
US11838298B2 (en) 2017-05-15 2023-12-05 Forcepoint Llc Generating a security risk persona using stressor data
US11888864B2 (en) 2017-05-15 2024-01-30 Forcepoint Llc Security analytics mapping operation within a distributed security analytics environment
US11888861B2 (en) 2017-05-15 2024-01-30 Forcepoint Llc Using an entity behavior catalog when performing human-centric risk modeling operations
US11132461B2 (en) 2017-07-26 2021-09-28 Forcepoint, LLC Detecting, notifying and remediating noisy security policies
US11379608B2 (en) 2017-07-26 2022-07-05 Forcepoint, LLC Monitoring entity behavior using organization specific security policies
US11379607B2 (en) 2017-07-26 2022-07-05 Forcepoint, LLC Automatically generating security policies
US11250158B2 (en) 2017-07-26 2022-02-15 Forcepoint, LLC Session-based security information
US11244070B2 (en) 2017-07-26 2022-02-08 Forcepoint, LLC Adaptive remediation of multivariate risk
US10769283B2 (en) 2017-10-31 2020-09-08 Forcepoint, LLC Risk adaptive protection
US10803178B2 (en) 2017-10-31 2020-10-13 Forcepoint Llc Genericized data model to perform a security analytics operation
US11314787B2 (en) 2018-04-18 2022-04-26 Forcepoint, LLC Temporal resolution of an entity
US11810012B2 (en) 2018-07-12 2023-11-07 Forcepoint Llc Identifying event distributions using interrelated events
US11755585B2 (en) 2018-07-12 2023-09-12 Forcepoint Llc Generating enriched events using enriched data and extracted features
US11436512B2 (en) 2018-07-12 2022-09-06 Forcepoint, LLC Generating extracted features from an event
US11755586B2 (en) 2018-07-12 2023-09-12 Forcepoint Llc Generating enriched events using enriched data and extracted features
US10949428B2 (en) 2018-07-12 2021-03-16 Forcepoint, LLC Constructing event distributions via a streaming scoring operation
US11544273B2 (en) 2018-07-12 2023-01-03 Forcepoint Llc Constructing event distributions via a streaming scoring operation
US11755584B2 (en) 2018-07-12 2023-09-12 Forcepoint Llc Constructing distributions of interrelated event features
US11025638B2 (en) * 2018-07-19 2021-06-01 Forcepoint, LLC System and method providing security friction for atypical resource access requests
US11811799B2 (en) 2018-08-31 2023-11-07 Forcepoint Llc Identifying security risks using distributions of characteristic features extracted from a plurality of events
US11411973B2 (en) 2018-08-31 2022-08-09 Forcepoint, LLC Identifying security risks using distributions of characteristic features extracted from a plurality of events
US11025659B2 (en) 2018-10-23 2021-06-01 Forcepoint, LLC Security system using pseudonyms to anonymously identify entities and corresponding security risk related behaviors
US11595430B2 (en) 2018-10-23 2023-02-28 Forcepoint Llc Security system using pseudonyms to anonymously identify entities and corresponding security risk related behaviors
US11171980B2 (en) 2018-11-02 2021-11-09 Forcepoint Llc Contagion risk detection, analysis and protection
CN111258852B (zh) * 2020-01-16 2024-02-23 深圳市乐信信息服务有限公司 异常数据监控方法、装置、电子设备、及存储介质
CN111258852A (zh) * 2020-01-16 2020-06-09 深圳鼎盛电脑科技有限公司 异常数据监控方法、装置、电子设备、及存储介质
US11489862B2 (en) 2020-01-22 2022-11-01 Forcepoint Llc Anticipating future behavior using kill chains
US11223646B2 (en) 2020-01-22 2022-01-11 Forcepoint, LLC Using concerning behaviors when performing entity-based risk calculations
US11570197B2 (en) 2020-01-22 2023-01-31 Forcepoint Llc Human-centric risk modeling framework
US11630901B2 (en) 2020-02-03 2023-04-18 Forcepoint Llc External trigger induced behavioral analyses
US11080109B1 (en) 2020-02-27 2021-08-03 Forcepoint Llc Dynamically reweighting distributions of event observations
US11836265B2 (en) 2020-03-02 2023-12-05 Forcepoint Llc Type-dependent event deduplication
US11429697B2 (en) 2020-03-02 2022-08-30 Forcepoint, LLC Eventually consistent entity resolution
US11080032B1 (en) 2020-03-31 2021-08-03 Forcepoint Llc Containerized infrastructure for deployment of microservices
US11568136B2 (en) 2020-04-15 2023-01-31 Forcepoint Llc Automatically constructing lexicons from unlabeled datasets
US11516206B2 (en) 2020-05-01 2022-11-29 Forcepoint Llc Cybersecurity system having digital certificate reputation system
US11544390B2 (en) 2020-05-05 2023-01-03 Forcepoint Llc Method, system, and apparatus for probabilistic identification of encrypted files
US11895158B2 (en) 2020-05-19 2024-02-06 Forcepoint Llc Cybersecurity system having security policy visualization
US11704387B2 (en) 2020-08-28 2023-07-18 Forcepoint Llc Method and system for fuzzy matching and alias matching for streaming data sets
US11190589B1 (en) 2020-10-27 2021-11-30 Forcepoint, LLC System and method for efficient fingerprinting in cloud multitenant data loss prevention

Also Published As

Publication number Publication date
CN108377240A (zh) 2018-08-07
CN108377240B (zh) 2020-05-15

Similar Documents

Publication Publication Date Title
WO2019153581A1 (zh) 异常接口检测方法、装置、计算机设备和存储介质
CN109032829B (zh) 数据异常检测方法、装置、计算机设备及存储介质
WO2021042843A1 (zh) 告警信息的决策方法、装置、计算机设备及存储介质
WO2021174694A1 (zh) 基于数据中心的运维监控方法、装置、设备及存储介质
WO2019218699A1 (zh) 欺诈交易判断方法、装置、计算机设备和存储介质
WO2020211299A1 (zh) 数据清理方法
CN110457302B (zh) 一种结构化数据智能清洗方法
WO2017215370A1 (zh) 构建决策模型的方法、装置、计算机设备及存储设备
CN109783785B (zh) 生成实验检测报告的方法、装置和计算机设备
WO2019148706A1 (zh) web入侵检测方法、装置、计算机设备和存储介质
EP3890333A1 (en) Video cutting method and apparatus, computer device and storage medium
WO2021012382A1 (zh) 配置聊天机器人的方法、装置、计算机设备和存储介质
CN110990390B (zh) 数据协同处理方法、装置、计算机设备和存储介质
WO2020056968A1 (zh) 数据降噪方法、装置、计算机设备和存储介质
WO2021043076A1 (zh) 网络发布数据处理方法、装置、计算机设备和存储介质
WO2019148712A1 (zh) 钓鱼网站检测方法、装置、计算机设备和存储介质
WO2018192432A1 (zh) 工作信息处理方法、装置、计算机设备和存储介质
WO2020034801A1 (zh) 医疗特征筛选方法、装置、计算机设备和存储介质
WO2021164205A1 (zh) 基于身份识别的数据审核方法、装置和计算机设备
CN109766474A (zh) 审讯信息审核方法、装置、计算机设备和存储介质
WO2021012861A1 (zh) 数据查询耗时评估方法、装置、计算机设备和存储介质
CN108009740B (zh) 一种烟用香精香料智能化精细识别系统及方法
CN110310127B (zh) 录音获取方法、装置、计算机设备及存储介质
WO2020232883A1 (zh) 脚本缺陷扫描方法、装置、计算机设备和存储介质
CN110796039B (zh) 一种面部瑕疵检测方法、装置、电子设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18905212

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 03/11/2020)

122 Ep: pct application non-entry in european phase

Ref document number: 18905212

Country of ref document: EP

Kind code of ref document: A1