WO2020258505A1

WO2020258505A1 - Network access security determination method and apparatus

Info

Publication number: WO2020258505A1
Application number: PCT/CN2019/103646
Authority: WO
Inventors: 黎立桂
Original assignee: 平安科技（深圳）有限公司
Priority date: 2019-06-28
Filing date: 2019-08-30
Publication date: 2020-12-30
Also published as: CN110417744A; CN110417744B

Abstract

The present application relates to the field of security detection technology, and provides a network access security determination method and apparatus. Said method comprises: obtaining, according to first device parameters of historical network access of a terminal device, feature information thereof to generate a plurality of first non-linear combination feature sets; acquiring, by means of a script program on the terminal device, second device parameters of the current network access of the terminal device, and extracting corresponding feature information to generate a second non-linear combination feature set; calculating, according to clustering of the first non-linear combination feature sets, a local outlier factor of data points of the second non-linear combination feature set by using an unsupervised clustering outlier detection algorithm, and using the value of a maximum steep point of the local outlier factor as a determination threshold; and determining that the network access is a secure access when the value of the local outlier factor of the data points of the second non-linear combination feature set is greater than the determination threshold. Said method facilitates improvement of the security detection capability of the terminal device for a current network access.

Description

Security judgment method and device for network access

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on June 28, 2019, the application number is 201910578479.X, and the invention title is "Network Access Security Judgment Method and Device", the entire content of which is incorporated by reference In this application.

Technical field

This application relates to the technical field of security detection. Specifically, this application relates to a method and device for determining network access security.

Background technique

With the widespread application of network technology, network security has also received attention. One manifestation of network security is that website security is vulnerable to threats. At present, one of the main means of threatening website security is to visit the website through web crawlers, which causes the website to be unable to correctly distinguish normal network access. To solve this problem, the current method is to collect the operation data of the click and drag track generated by the terminal device in the network access to determine whether the network access is safe. The inventor realizes that the method cannot completely accurately identify secure network access, and it is easy to recognize secure network access as non-secure network access, which affects user experience.

Summary of the invention

In order to overcome the above technical problems, especially the problem that the user's usage trace data cannot fully identify secure network access when logging on to the network through terminal equipment in the prior art, the following technical solutions are proposed:

In the first aspect, this application provides a method for determining the security of network access, including the following steps:

Obtain feature information of the first device parameter according to the first device parameter accessed by the historical network of the terminal device, and generate a plurality of first non-linear combination feature sets;

Obtain the second device parameter currently accessed by the terminal device through the script program on the terminal device, extract the characteristic information of the second device parameter, and generate a second nonlinear combination characteristic set;

An outlier detection algorithm using unsupervised clustering is used, the data points of the second nonlinear combination feature set are used as detection parameters, and the second nonlinear combination is calculated according to the clustering of the first nonlinear combination feature set For the local outlier factor of the data point of the feature set, the maximum steep point value of the local outlier factor is used as the judgment threshold;

When the value of the local outlier factor of the data point of the second nonlinear combination feature set is greater than the determination threshold, determine that the network access is a safe access;

Wherein, the first non-linear combination feature set is the non-linear feature information of the terminal device obtained by historical network access; the second non-linear combination feature set is the non-linear feature information of the terminal device obtained by the current network method, the feature The information includes the attribute data and access data of the terminal device; the characteristic information includes the attribute data and access data of the terminal device.

To solve the above technical problems, this application also provides a network access security determination device, which includes:

The first generating module is configured to obtain the characteristic information of the first device parameter according to the first device parameter accessed by the historical network of the terminal device, and generate a plurality of first nonlinear combination characteristic sets;

The second generation module is configured to obtain the second device parameter currently accessed by the terminal device through the script program on the terminal device, extract the characteristic information of the second device parameter, and generate a second nonlinear combination characteristic set;

The calculation module is configured to adopt an outlier detection algorithm of unsupervised clustering, use the data points of the second nonlinear combination feature set as detection parameters, and calculate the said first nonlinear combination feature set according to the clustering The local outlier factor of the data point of the second nonlinear combination feature set, and the maximum steep point value of the local outlier factor is used as the judgment threshold;

A determining module, configured to determine that the network access is a safe access when the value of the local outlier factor of the data point of the second nonlinear combination feature set is greater than the determination threshold;

In order to solve the above problems, this application also provides a server, which includes:

One or more processors;

Memory

One or more computer programs, wherein the one or more computer programs are stored in the memory and configured to be executed by the one or more processors, and the one or more computer programs are configured to execute In the method for determining the security of network access in the foregoing embodiment, the method for determining the security of network access includes:

In order to solve the above problems, this application also provides a computer-readable storage medium having a computer program stored on the computer-readable storage medium, and when the computer program is executed by a processor, the security determination of network access described in the above-mentioned embodiment is realized A method, wherein the method for determining the security of network access includes:

The security judgment method and device for network access provided by the present application are based on the data points that generate multiple first non-linear combination feature sets of the terminal equipment collected in history and the second non-linearity generated by the current network access of the terminal equipment. Combine the spatial positions of the data points of the feature set to obtain the corresponding local outlier factor, and compare the value of the maximum steep point of the curve obtained according to the local outlier factor and multiple local outlier factors to obtain The judgment result of whether the current network access of the terminal device is abnormal access.

Further, the technical solution provided by this application uses an outlier detection algorithm using unsupervised clustering to obtain the value of the judgment basis and obtain the corresponding judgment result, and does not need to perform network access to the characteristic information data of the terminal device. Labeling saves the workload of post-statistics and analysis; moreover, the solution visualizes the corresponding data, the result is intuitive, and the judgment result with higher accuracy can be easily obtained, and finally the judgment effect of the network access security judgment method and device is improved .

The additional aspects and advantages of this application will be partly given in the following description, which will become obvious from the following description, or be understood through the practice of this application.

Description of the drawings

FIG. 1 is a diagram of the application environment of the implementation of the security determination solution for network access in the embodiment of the present application;

FIG. 2 is a flowchart of a method for determining the security of network access according to an embodiment of the present application;

FIG. 3 is a flowchart of a method for determining network access security according to another embodiment of the present application;

4 is a schematic diagram of a device for determining network access security according to an embodiment of the application;

Figure 5 is a schematic structural diagram of a server according to an embodiment of the application.

Detailed ways

The embodiments of the present application are described in detail below. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals indicate the same or similar elements or elements with the same or similar functions. The embodiments described below with reference to the drawings are exemplary, and are only used to explain the present application, and cannot be construed as a limitation to the present application.

As shown in Figure 1, Figure 1 is an application environment diagram of the embodiment of the application; in this embodiment, the technical solution of the application can be implemented on a server. In Figure 1, the

terminal devices

110 and 120 can access the server through the internet 130. The terminal device 110 and/or 120 sends a network request to the server 130, and the server 130 performs data interaction according to the network request. During data exchange, the server 130 obtains the access data and attribute data of the terminal device 110 and/or 120 according to the request information of the terminal device 110 and/or 120, and performs security judgment on the terminal device according to the data.

In order to solve the problem that it is not easy to identify secure network access in current security determination methods, this application provides a security determination method for network access. Refer to FIG. 2, which is a flowchart of a method for determining network access security according to an embodiment. The method includes the following steps:

S210. Obtain feature information of the first device parameter according to the first device parameter accessed by the historical network of the terminal device, and generate a plurality of first nonlinear combination feature sets.

When the server interacts with the terminal device, it obtains the relevant parameters of the terminal device according to the network request sent by the terminal device. In this step, the server obtains the first device parameter from the historical network access request sent by the terminal device, the server analyzes the first device parameter, and obtains and generates a plurality of first nonlinear combination feature sets according to the analysis result .

The first nonlinear combination feature set is a feature set generated by an access record of a terminal device that has interacted with the server, and the first nonlinear combination feature set is nonlinear feature information of the terminal device obtained by historical network access. The characteristic information includes attribute data and access data of the terminal device. For example, the attribute data may include the model of the terminal device, the screen resolution x*y of the terminal device, or the available screen resolution X*Y of the browser, and the access data may include the frequency of the terminal device requesting the server.

The feature information corresponding to the first non-linear combination feature set, in this embodiment, the feature information is specifically a corresponding feature value. Set the corresponding coordinates, and mark the characteristic set or an n-dimensional data point generated by each access record of the historical terminal device on the coordinates. The feature sets formed by different access records form corresponding normal state clusters and abnormal state clusters on the coordinates. According to the consideration that the normal situation is definitely greater than the abnormal situation, the large cluster is the normal cluster, and the small cluster is the abnormal cluster.

Furthermore, in order to eliminate the dimensional relationship between variables and make the data comparable, before labeling the feature values, the feature information values in each feature set are standardized. For example, the feature set of each access record obtained may include a variable with a percentile system and a variable with a value of 5 points. Only when all the data are standardized can they be compared in the same standard.

S220: Obtain the second device parameter currently accessed by the terminal device through a script program on the terminal device, extract characteristic information of the second device parameter, and generate a second nonlinear combination characteristic set.

In order to be able to determine in real time whether the network access of the terminal device is in a secure state, the current state of each access of the terminal device is determined according to the determination needs. In this step, the server provides a script program to the terminal device through a network connection to obtain the second device parameter that the terminal device currently accesses each time. The second device parameter has the same nature as the first device parameter. The second non-linear combination feature set is non-linear feature information of the terminal device obtained by current network access, and the feature information includes attribute data and access data of the terminal device.

The server performs analysis according to the second device parameter, extracts and obtains the characteristic information of the second device parameter, and obtains, according to the characteristic information, a second non-linear combined characteristic set of the terminal device that is currently sending a network request to the server. The feature information included in the second nonlinear combination feature set corresponds to at least the feature information of the first nonlinear combination feature set for subsequent comparison.

S230. Using an unsupervised clustering outlier detection algorithm, using the data points of the second nonlinear combination feature set as detection parameters, and calculating the second non-linear combination feature set according to the clustering of the first nonlinear combination feature set. For the local outlier factor of the data points of the linear combination feature set, the maximum steep point value of the local outlier factor is used as the judgment threshold.

In the method for security determination of network access provided in this application, the security determination method of the second non-linear combination feature set in the network access is used as the sample to be tested, and the corresponding outlier detection algorithm using unsupervised clustering is constructed. In the process of detecting the model, the data points of the second nonlinear combination feature set are used as the detecting parameters.

The data points of the second non-linear combination feature set are discrete, and relative to the data points of the feature information of the first device parameter, there may be a part close to most of the data of the feature information of the first device parameter In comparison, a set of points formed in space will form outliers far away from the set. According to the calculation, the local outlier factor corresponding to the data point of the second nonlinear combination feature set is obtained, so that the second nonlinear combination feature set as a detection sample is used to obtain the difference between the data point and the first nonlinear combination feature set. The spatial position relationship of the data points, so that whether it is a safe state to initiate network access to the terminal device according to the value obtained from the relevant spatial position relationship. In this embodiment, the relevant spatial position relationship is characterized by the value of the maximum steep point of the local outlier factor, and the value of the maximum steep point is used to determine whether the network request currently initiated by the corresponding terminal device is in a normal state.

S240: When the value of the local outlier factor of the data point of the second nonlinear combination feature set is greater than the determination threshold, determine that the network access is a safe access.

In this step, the value of the local outlier factor of the data point of the second non-linear combination feature set is compared with the value of the maximum steep point according to the value obtained in step S230, and the corresponding terminal device is determined according to the comparison result Whether the current network request is normal.

If the value of the data point of the second nonlinear combination feature set is greater than the determination threshold, it is determined that the network access currently initiated by the terminal device is a secure access; otherwise, it is an insecure access.

The method for determining the security of network access provided by this application combines the data points of the second non-linear combination feature set obtained by the network access currently initiated by the terminal device with the historical first non-linear combination feature set of the network access initiated by the terminal device The spatial position of the data points in the cluster, and the local outlier factor of the data point is calculated, and the maximum steep point formed by a single local outlier factor and all local outlier factors is used as the judgment threshold By comparison, the result of determining whether the network access initiated by the terminal device is a secure access is obtained. This application forms the first and second non-linear combination feature sets from the data generated by the terminal device network access, and based on the calculated local outlier factor, whether the network access initiated by the terminal device is an abnormal access Make judgments, so as to avoid the fact that in the prior art, only the use records generated by the user using the terminal equipment, such as the click and drag track during the user authentication process, are used as the basis for security detection, which is easy to distinguish the real user For the safety of users, it can more accurately reflect the status of the current network access request initiated by the terminal device to the server, and obtain the security detection result in a simpler and more intuitive way of data comparison, which is beneficial to improve the security detection of network access effectiveness.

Referring to FIG. 3, FIG. 3 is a flowchart of a method for determining network access security according to another embodiment. Based on the description of the above solution, step S230 may include:

S231. Using an outlier detection algorithm of unsupervised clustering, divide the first nonlinear combination feature set into a large cluster and a small cluster;

S232. According to the data points of the second nonlinear combination feature set, and using the large clusters and small clusters of the first nonlinear combination feature set, calculate the large clusters of data points corresponding to the second nonlinear combination feature set. The first local outlier factor of or the second local outlier factor of a small cluster of data points corresponding to the second nonlinear combination feature set;

Wherein, the large cluster and the small cluster are divided according to the number of data points contained and according to a set ratio value.

According to unsupervised clustering using an outlier detection algorithm of unsupervised clustering, the first nonlinear combination feature set is divided into large clusters and small clusters. Specifically, the clustering method is divided into several clusters according to different categories in the first nonlinear combination feature set, and each cluster has its own center point. After clustering, the clusters are arranged in descending order according to the number of data points contained in each cluster, and large clusters and small clusters are divided according to the set ratio value for the number of data points. In this embodiment, the set ratio value is 90%, that is, the cluster formed by 90% of the data points in the concentration is set as a large cluster, and the rest is set as a large cluster according to the spatial distribution of the data points Small clusters.

Using the foregoing clustering of the first nonlinear combination feature set, the local outlier factor calculation is performed on the data points of the second nonlinear combination feature set obtained from step S230 as the sample to be tested. According to the spatial position relationship between the data points of the second nonlinear combination feature set and the large clusters and small clusters obtained by dividing the first nonlinear combination feature set, the first local outliers of the corresponding large clusters are obtained The point factor or the second local outlier factor corresponding to a small cluster of data points. For the above step S232, the following steps may be specifically included in this embodiment:

A1. According to the data points of the second nonlinear combination feature set, the first distance between the data point and the large cluster and the second distance between the small cluster are respectively obtained;

A2. If the first distance is smaller than the second distance, obtain the first local outlier factor of a large cluster of data points in the second nonlinear combination feature set, wherein the second nonlinear combination The first local outlier factor of the large cluster of data points of the feature set is the product of the size value of the large cluster and the similarity between the data point and the large cluster;

A3. If the first distance is greater than the second distance, obtain a second local outlier factor of a small cluster of data points in the second nonlinear combination feature set, wherein the second nonlinear combination The second local outlier factor of the small cluster of data points of the feature set is the product of the size value of the small cluster and the similarity between the data point and the closest large cluster.

Before calculating the first local outlier factor of the large cluster of the corresponding data point or the second local outlier factor of the small cluster of the corresponding data point, first determine the cluster that the data point is close to, and based on it Calculate the local outlier factor of the corresponding cluster with the related parameters of the clusters that are close to.

Specifically, according to the data points of the second nonlinear combination feature set, the first distance from the large cluster and the second distance from the small cluster are obtained respectively, and the distance is the second nonlinear combination feature The distance between the data points of the set and the center of the large cluster and the small cluster.

When the first distance is smaller than the second distance, that is, the data point of the second nonlinear combination feature set is close to the large cluster, the large cluster of the data point of the second nonlinear combination feature set is calculated The first local outlier factor of the cluster. The first local outlier factor is a product of the size of a large cluster and the similarity between the data points of the second nonlinear combination feature set and the large cluster.

When the first distance is greater than the second distance, that is, the data point of the second nonlinear combination feature set is close to the small cluster, the small cluster of the data point of the second nonlinear combination feature set is calculated The second local outlier factor of the cluster. The second local outlier factor and the first local outlier factor.

For the calculation of the first local outlier factor and the second local outlier factor, the size of the cluster is the size of the large cluster or the size of the small cluster The value can be measured by the number of data points corresponding to the plurality of first nonlinear combination feature sets. For example, the number of data points corresponding to the cluster can be directly taken as the size value of the corresponding cluster, or it can also be the proportion of the number of data points corresponding to the cluster in all the data points of the first nonlinear combination feature set .

At the same time, the similarity of the large cluster can be measured by the distance between the data point of the second nonlinear combination feature set and the center of the large cluster. For example, the distance between the data point of the second nonlinear combination feature set and the center of the large cluster is directly used as the similarity of the large cluster.

By comparing the first local outlier factor of the large cluster of data points in the second nonlinear combination feature set and the second local outlier factor of the small cluster of data points in the second nonlinear combination feature set By calculation, a basis for determining whether the network access corresponding to the terminal device corresponding to the data point of the second nonlinear combination feature set is safe to access is obtained.

Regarding the step of using the maximum steep point value of the local outlier factor as the judgment threshold in step S230, it may be further as follows:

The value of the local outlier factor with the largest slope among the local outlier factors of all the data points is selected as the value of the maximum steep point, and the value of the maximum steep point is used as the judgment threshold.

According to the above-obtained first local outlier factor of the large clusters of data points of the second nonlinear combination feature set and the second local outliers of the small clusters of data points of the second nonlinear combination feature set The cluster point factors respectively form corresponding curves to obtain the maximum steepness corresponding to the respective curves, and the maximum steepness is the maximum local outlier factor with respect to the slope of the curve corresponding to the first or second local outlier factor, And the value of the largest local outlier factor is used as the value of the maximum steep point, and the value of the maximum steep point is used to determine the network access of the terminal device corresponding to the data point of the second nonlinear combination feature set The threshold for determining whether to access security.

Based on the foregoing, step S240 includes:

When the first distance is greater than the second distance, the value of the first local outlier factor of the large cluster of data points in the second nonlinear combination feature set is greater than the determination threshold corresponding to the first local outlier factor时; or,

When the first distance is greater than the second distance, the value of the second local outlier factor of the small cluster of data points in the second nonlinear combination feature set is greater than the determination threshold corresponding to the second local outlier factor When, it is determined that the network access is safe access.

Specifically, for the data points of the second nonlinear combination feature set close to the large cluster, when the corresponding first distance is less than the second distance, if the obtained data points of the second nonlinear combination feature set If the value of the first local outlier factor of the large cluster is greater than the determination threshold obtained by forming the curve of the first local outlier factor, it is determined that the network access corresponding to the terminal device is a safe access.

For the data points of the second nonlinear combination feature set close to the small cluster, when the corresponding first distance is greater than the second distance, if the obtained data points of the second nonlinear combination feature set are small clusters If the value of the second local outlier factor is greater than the determination threshold obtained by forming a curve of the second local outlier factor, it is determined that the network access corresponding to the terminal device is a safe access.

The network request currently initiated by the terminal device is determined to be a secure access request, and the request is directly responded to. Otherwise, the server directly rejects the request or re-requires the terminal device to perform access verification.

The aforementioned first nonlinear combination feature set or the second nonlinear combination feature set respectively include:

Effective derivative feature information for identifying outliers obtained by performing measurement data dispersion calculation on the data points of the first nonlinear combination feature set or the second nonlinear combination feature set.

Specifically, the first non-linear combination feature set or the second non-linear combination feature set may include browser language, pixel ratio, color depth, whether an audio stack fingerprint is provided, parameter information of the audio stack fingerprint, and the system to the user The total number of logical processors available to the agent, whether the browser manufacturer is other, whether the operating system manufacturer is other, and whether the browser type is robot and other primitive types of feature information.

According to the calculation of the metric data distribution, effective derivative features for identifying outliers can be obtained, including whether AdBlock is installed, whether the user has tampered with the language, whether the user has tampered with the screen resolution, whether the user has tampered with the operating system, and browser manufacturer , Operating system manufacturer, access device type, operating system family.

The metric data distribution calculation includes calculating the range, the quartile, the quartile range, and the five-number summary corresponding to the characteristic information data, and the five-number summary is the minimum, the upper quartile, and the median in order. , Lower quartile, maximum value.

Based on the same inventive concept as the foregoing network access security determination method, an embodiment of the present application also provides a network access security determination device, as shown in FIG. 4, including:

The first generating module 410 is configured to obtain characteristic information of the first device parameter according to the first device parameter accessed by the historical network of the terminal device, and generate a plurality of first nonlinear combination characteristic sets;

The second generating module 420 is configured to obtain the second device parameters currently accessed by the terminal device through the script program on the terminal device, extract the characteristic information of the second device parameter, and generate a second nonlinear combination characteristic set;

The calculation module 430 is configured to use an outlier detection algorithm of unsupervised clustering, use the data points of the second nonlinear combination feature set as detection parameters, and calculate the results according to the clustering of the first nonlinear combination feature set. For the local outlier factor of the data points of the second nonlinear combination feature set, the maximum steep point value of the local outlier factor is used as the judgment threshold;

The determination module 440 is configured to determine that the network access is a safe access when the value of the local outlier factor of the data point of the second nonlinear combination feature set is greater than the determination threshold.

Please refer to FIG. 5, which is a schematic diagram of the internal structure of the server in an embodiment. As shown in FIG. 4, the server includes a processor 510, a storage medium 520, a memory 530, and a network interface 540 connected through a system bus. Wherein, the storage medium 520 of the server stores an operating system, a database, and computer-readable instructions. The database may store control information sequences. When the computer-readable instructions are executed by the processor 510, the processor 510 can implement a network In the access security determination method, the processor 510 can implement the functions of the first generation module 410, the second generation module 420, the calculation module 430, and the determination model 440 in a network access security determination device in the embodiment shown in FIG. 4 . The processor 510 of the server is used to provide computing and control capabilities to support the operation of the entire server. The memory 530 of the server may store computer-readable instructions, and when the computer-readable instructions are executed by the processor 510, the processor 510 can make the processor 510 execute a security determination method for network access. The network interface 540 of the server is used to connect and communicate with the terminal. Those skilled in the art can understand that the structure shown in FIG. 5 is only a block diagram of part of the structure related to the solution of the present application, and does not constitute a limitation on the server to which the solution of the present application is applied. The specific server may include More or fewer components are shown in the figure, or some components are combined, or have different component arrangements.

In one embodiment, this application also proposes a non-volatile computer-readable storage medium that stores computer-readable instructions. When the computer-readable instructions are executed by one or more processors, one or more The processor executes the following steps: obtain the characteristic information of the first device parameter according to the first device parameter accessed by the historical network of the terminal device, and generate a plurality of first nonlinear combination characteristic sets; obtain through the script program on the terminal device The second device parameter currently accessed by the terminal device on the network extracts the feature information of the second device parameter, and generates a second non-linear combined feature set; an outlier detection algorithm of unsupervised clustering is adopted to use the first The data points of the second nonlinear combination feature set are detection parameters, and the local outlier factor of the data points of the second nonlinear combination feature set is calculated according to the clustering of the first nonlinear combination feature set, and the local outlier factor is calculated based on the local The maximum steep point value of the outlier factor is used as the judgment threshold; when the value of the local outlier factor of the data points of the second nonlinear combination feature set is greater than the judgment threshold, it is determined that the network access is safe access; Wherein, the first non-linear combination feature set is the non-linear feature information of the terminal device obtained by historical network access; the second non-linear combination feature set is the non-linear feature information of the terminal device obtained by the current network method, the feature The information includes the attribute data and access data of the terminal device; the characteristic information includes the attribute data and access data of the terminal device.

Based on the foregoing embodiments, it can be seen that the greatest beneficial effect of this application lies in:

The security judgment method and device for network access provided by the present application are based on the data points that generate multiple first non-linear combination feature sets of the terminal equipment collected in history and the second non-linearity generated by the current network access of the terminal equipment. Combine the spatial positions of the data points of the feature set to obtain the corresponding local outlier factor, and compare the value of the maximum steep point of the curve obtained according to the local outlier factor and multiple local outlier factors to obtain The judgment result of whether the current network access of the terminal device is a safe access.

The technical solution provided in this application uses an outlier detection algorithm using unsupervised clustering to obtain the value of the judgment basis and obtain the corresponding judgment result, and does not need to mark the characteristic information data of the terminal device to initiate network access, saving The workload of post-statistics and analysis is improved; and the solution enables the visualization of corresponding data, the result is intuitive, the judgment result with higher accuracy can be easily obtained, and the judgment effect of the security judgment method and device for network access is finally improved.

In summary, the security determination method and device for network access in this application directly analyzes the characteristic information data generated by the network access of the terminal device through the outlier detection algorithm of unsupervised clustering, and obtains the determination whether it is a secure access The resulting technical solution solves the problem in the prior art that the user's usage trace data when logging in to the network through a terminal device can easily identify a real user as a safe user, and improves the ability to determine safe access to the terminal device.

A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing relevant hardware through a computer program, which can be stored in a non-volatile computer readable storage medium When the program is executed, it may include the procedures of the above-mentioned method embodiments. Among them, the aforementioned storage medium may be a storage medium such as a magnetic disk, an optical disc, a read-only memory (Read-Only Memory, ROM), or a random access memory (Random Access Memory, RAM), etc.

The technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above-mentioned embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, All should be considered as the scope of this specification.

The above-mentioned embodiments only express several implementation manners of the present application, and their descriptions are relatively specific and detailed, but they should not be understood as a limitation on the patent scope of the present application. It should be pointed out that for those of ordinary skill in the art, without departing from the concept of this application, several modifications and improvements can be made, and these all fall within the protection scope of this application. Therefore, the scope of protection of the patent of this application shall be subject to the appended claims.

Claims

A method for determining the security of network access includes the following steps:

Obtain feature information of the first device parameter according to the first device parameter accessed by the historical network of the terminal device, and generate a plurality of first non-linear combination feature sets;

Obtain the second device parameter currently accessed by the terminal device through the script program on the terminal device, extract the characteristic information of the second device parameter, and generate a second nonlinear combination characteristic set;

An outlier detection algorithm using unsupervised clustering is used, the data points of the second nonlinear combination feature set are used as detection parameters, and the second nonlinear combination is calculated according to the clustering of the first nonlinear combination feature set For the local outlier factor of the data point of the feature set, the maximum steep point value of the local outlier factor is used as the judgment threshold;

When the value of the local outlier factor of the data point of the second nonlinear combination feature set is greater than the determination threshold, determine that the network access is a safe access;

Wherein, the first non-linear combination feature set is the non-linear feature information of the terminal device obtained by historical network access; the second non-linear combination feature set is the non-linear feature information of the terminal device obtained by the current network method, the feature The information includes the attribute data and access data of the terminal device; the characteristic information includes the attribute data and access data of the terminal device.
The method according to claim 1, wherein the outlier detection algorithm using unsupervised clustering uses the numerical points of the second nonlinear combination feature set as detection parameters, and according to the first nonlinear combination feature set The step of clustering and calculating the local outlier factor of the data points of the second nonlinear combination feature set includes:

Using an outlier detection algorithm of unsupervised clustering, divide the first nonlinear combination feature set into a large cluster and a small cluster;

According to the data points of the second non-linear combination feature set, and using the large clusters and small clusters of the first non-linear combination feature set, respectively calculate the second non-linear combination feature set of the data points of the large cluster. A local outlier factor or a second local outlier factor of a small cluster of data points corresponding to the second nonlinear combination feature set;

Wherein, the large cluster and the small cluster are divided according to the number of data points contained and according to a set ratio value.
The method according to claim 2, wherein the large clusters and small clusters of the first nonlinear combination feature set are used to calculate the corresponding second nonlinearity based on the data points of the second nonlinear combination feature set. The step of combining the first local outlier factor of the large cluster of data points of the feature set or the second local outlier factor of the small cluster of data points corresponding to the second nonlinear combination feature set includes:

Obtaining the first distance between the data point and the large cluster and the second distance between the small cluster according to the data points of the second nonlinear combination feature set;

If the first distance is smaller than the second distance, the first local outlier factor of a large cluster of data points of the second nonlinear combination feature set is obtained, wherein the second nonlinear combination feature set The first local outlier factor of the large cluster of data points is the product of the size value of the large cluster and the similarity between the data point and the large cluster;

If the first distance is greater than the second distance, the second local outlier factor of a small cluster of data points in the second nonlinear combination feature set is obtained, wherein the second nonlinear combination feature set The second local outlier factor of the small cluster of data points is the product of the size of the small cluster and the similarity between the data point and the closest large cluster.
The method according to claim 3, wherein the size value of the large cluster or the size value of the small cluster is measured by the number of data points corresponding to the plurality of first nonlinear combination feature sets;

The similarity of the large cluster is measured by the distance between the data point of the second nonlinear combination feature set and the center of the large cluster.
The method according to claim 4, wherein the step of using the maximum steep point value of the local outlier factor as a judgment threshold comprises:

By selecting the value of the local outlier factor with the largest slope among the local outlier factors of the data points of the second nonlinear combination feature set as the value of the maximum steep point, and taking the value of the maximum steep point as the judgment Threshold.
The method according to claim 5, wherein when the value of the data point of the second nonlinear combination feature set is greater than the judgment threshold, the step of judging that the network access is a safe access comprises:

When the first distance is greater than the second distance, the value of the first local outlier factor of the large cluster of data points in the second nonlinear combination feature set is greater than the determination threshold corresponding to the first local outlier factor时; or,

When the first distance is greater than the second distance, the value of the second local outlier factor of the small cluster of data points in the second nonlinear combination feature set is greater than the determination threshold corresponding to the second local outlier factor When, it is determined that the network access is safe access.
The method according to claim 1, wherein the first nonlinear combination feature set or the second nonlinear combination feature set respectively comprise:

Effective derivative feature information for identifying outliers obtained by performing measurement data dispersion calculation on the data points of the first nonlinear combination feature set or the second nonlinear combination feature set.
A security judging device for network access, including:

The first generating module is configured to obtain the characteristic information of the first device parameter according to the first device parameter accessed by the historical network of the terminal device, and generate a plurality of first nonlinear combination characteristic sets;

The second generation module is configured to obtain the second device parameter currently accessed by the terminal device through the script program on the terminal device, extract the characteristic information of the second device parameter, and generate a second nonlinear combination characteristic set;

The calculation module is configured to adopt an outlier detection algorithm of unsupervised clustering, use the data points of the second nonlinear combination feature set as detection parameters, and calculate the said first nonlinear combination feature set according to the clustering The local outlier factor of the data point of the second nonlinear combination feature set, and the maximum steep point value of the local outlier factor is used as the judgment threshold;

A determining module, configured to determine that the network access is a safe access when the value of the local outlier factor of the data point of the second nonlinear combination feature set is greater than the determination threshold;

Wherein, the first non-linear combination feature set is the non-linear feature information of the terminal device obtained by historical network access; the second non-linear combination feature set is the non-linear feature information of the terminal device obtained by the current network method, the feature The information includes the attribute data and access data of the terminal device; the characteristic information includes the attribute data and access data of the terminal device.
A server that includes:

One or more processors;

Memory

One or more computer programs, wherein the one or more computer programs are stored in the memory and configured to be executed by the one or more processors, and the one or more computer programs are configured to execute The security determination method for network access described above, wherein the security determination method for network access includes:

Obtain feature information of the first device parameter according to the first device parameter accessed by the historical network of the terminal device, and generate a plurality of first non-linear combination feature sets;

Obtain the second device parameter currently accessed by the terminal device through the script program on the terminal device, extract the characteristic information of the second device parameter, and generate a second nonlinear combination characteristic set;

An outlier detection algorithm using unsupervised clustering is used, the data points of the second nonlinear combination feature set are used as detection parameters, and the second nonlinear combination is calculated according to the clustering of the first nonlinear combination feature set For the local outlier factor of the data point of the feature set, the maximum steep point value of the local outlier factor is used as the judgment threshold;

When the value of the local outlier factor of the data point of the second nonlinear combination feature set is greater than the determination threshold, determine that the network access is a safe access;

Wherein, the first non-linear combination feature set is the non-linear feature information of the terminal device obtained by historical network access; the second non-linear combination feature set is the non-linear feature information of the terminal device obtained by the current network method, the feature The information includes the attribute data and access data of the terminal device; the characteristic information includes the attribute data and access data of the terminal device.
The server according to claim 9, wherein the outlier detection algorithm using unsupervised clustering uses the numerical points of the second non-linear combination feature set as detection parameters, according to the first non-linear combination feature set The step of clustering and calculating the local outlier factor of the data points of the second nonlinear combination feature set includes:

Using an outlier detection algorithm of unsupervised clustering, divide the first nonlinear combination feature set into a large cluster and a small cluster;

According to the data points of the second non-linear combination feature set, and using the large clusters and small clusters of the first non-linear combination feature set, respectively calculate the second non-linear combination feature set of the data points of the large cluster. A local outlier factor or a second local outlier factor of a small cluster of data points corresponding to the second nonlinear combination feature set;

Wherein, the large cluster and the small cluster are divided according to the number of data points contained and according to a set ratio value.
11. The server according to claim 10, wherein the data points of the second nonlinear combination feature set are used to calculate the corresponding second nonlinearity by using large clusters and small clusters of the first nonlinear combination feature set. The step of combining the first local outlier factor of the large cluster of data points of the feature set or the second local outlier factor of the small cluster of data points corresponding to the second nonlinear combination feature set includes:

Obtaining the first distance between the data point and the large cluster and the second distance between the small cluster according to the data points of the second nonlinear combination feature set;

If the first distance is smaller than the second distance, the first local outlier factor of a large cluster of data points of the second nonlinear combination feature set is obtained, wherein the second nonlinear combination feature set The first local outlier factor of the large cluster of data points is the product of the size value of the large cluster and the similarity between the data point and the large cluster;

If the first distance is greater than the second distance, the second local outlier factor of a small cluster of data points in the second nonlinear combination feature set is obtained, wherein the second nonlinear combination feature set The second local outlier factor of the small cluster of data points is the product of the size of the small cluster and the similarity between the data point and the closest large cluster.
The server according to claim 11, wherein the size value of the large cluster or the size value of the small cluster is measured by the number of data points corresponding to the plurality of first nonlinear combination feature sets;

The similarity of the large cluster is measured by the distance between the data point of the second nonlinear combination feature set and the center of the large cluster.
The server according to claim 12, wherein the step of using the maximum steep point value of the local outlier factor as the judgment threshold comprises:

By selecting the value of the local outlier factor with the largest slope among the local outlier factors of the data points of the second nonlinear combination feature set as the value of the maximum steep point, and taking the value of the maximum steep point as the judgment Threshold.
The server according to claim 13, wherein when the value of the data point of the second non-linear combination feature set is greater than the judgment threshold, the step of judging that the network access is a safe access comprises:

When the first distance is greater than the second distance, the value of the first local outlier factor of the large cluster of data points in the second nonlinear combination feature set is greater than the determination threshold corresponding to the first local outlier factor时; or,

When the first distance is greater than the second distance, the value of the second local outlier factor of the small cluster of data points in the second nonlinear combination feature set is greater than the determination threshold corresponding to the second local outlier factor When, it is determined that the network access is safe access.
A non-volatile computer-readable storage medium with a computer program stored on the computer-readable storage medium, and when the computer program is executed by a processor, the method for determining the security of network access is realized, wherein the security of the network access is Judgment methods include:

Obtaining feature information of the first device parameter according to the first device parameter accessed by the historical network of the terminal device, and generating a plurality of first nonlinear combination feature sets;

Obtain the second device parameter currently accessed by the terminal device through the script program on the terminal device, extract the characteristic information of the second device parameter, and generate a second nonlinear combination characteristic set;

An outlier detection algorithm using unsupervised clustering is used, the data points of the second nonlinear combination feature set are used as detection parameters, and the second nonlinear combination is calculated according to the clustering of the first nonlinear combination feature set For the local outlier factor of the data point of the feature set, the maximum steep point value of the local outlier factor is used as the judgment threshold;

When the value of the local outlier factor of the data point of the second nonlinear combination feature set is greater than the determination threshold, determine that the network access is a safe access;

Wherein, the first non-linear combination feature set is the non-linear feature information of the terminal device obtained by historical network access; the second non-linear combination feature set is the non-linear feature information of the terminal device obtained by the current network method, the feature The information includes the attribute data and access data of the terminal device; the characteristic information includes the attribute data and access data of the terminal device.
The non-volatile computer-readable storage medium according to claim 15, wherein the outlier detection algorithm using unsupervised clustering uses the numerical points of the second non-linear combination feature set as detection parameters, according to the The clustering of the first nonlinear combination feature set and the step of calculating the local outlier factor of the data points of the second nonlinear combination feature set includes:

Using an outlier detection algorithm of unsupervised clustering, divide the first nonlinear combination feature set into a large cluster and a small cluster;

According to the data points of the second non-linear combination feature set, and using the large clusters and small clusters of the first non-linear combination feature set, respectively calculate the second non-linear combination feature set of the data points of the large cluster. A local outlier factor or a second local outlier factor of a small cluster of data points corresponding to the second nonlinear combination feature set;

Wherein, the large cluster and the small cluster are divided according to the number of data points contained and according to a set ratio value.
The non-volatile computer-readable storage medium according to claim 16, wherein the data points of the second nonlinear combination feature set are used and the large clusters and small clusters of the first nonlinear combination feature set are used , The step of respectively calculating the first local outlier factor of the large cluster of data points corresponding to the second nonlinear combination feature set or the second local outlier factor of the small cluster of data points corresponding to the second nonlinear combination feature set ,include:

Obtaining the first distance between the data point and the large cluster and the second distance between the small cluster according to the data points of the second nonlinear combination feature set;

If the first distance is smaller than the second distance, the first local outlier factor of a large cluster of data points of the second nonlinear combination feature set is obtained, wherein the second nonlinear combination feature set The first local outlier factor of the large cluster of data points is the product of the size value of the large cluster and the similarity between the data point and the large cluster;

If the first distance is greater than the second distance, the second local outlier factor of a small cluster of data points in the second nonlinear combination feature set is obtained, wherein the second nonlinear combination feature set The second local outlier factor of the small cluster of data points is the product of the size of the small cluster and the similarity between the data point and the closest large cluster.
The non-volatile computer-readable storage medium according to claim 17, wherein the size value of the large cluster or the size value of the small cluster is determined by the number of data points corresponding to the plurality of first nonlinear combination feature sets Measure

The similarity of the large cluster is measured by the distance between the data point of the second nonlinear combination feature set and the center of the large cluster.
18. The non-volatile computer-readable storage medium according to claim 18, wherein the step of using the maximum steepness value of the local outlier factor as a determination threshold comprises:

By selecting the value of the local outlier factor with the largest slope among the local outlier factors of the data points of the second nonlinear combination feature set as the value of the maximum steep point, and taking the value of the maximum steep point as the judgment Threshold.
The non-volatile computer-readable storage medium according to claim 19,

When the value of the data point of the second non-linear combination feature set is greater than the determination threshold, the step of determining that the network access is safe access includes:

When the first distance is greater than the second distance, the value of the first local outlier factor of the large cluster of data points in the second nonlinear combination feature set is greater than the determination threshold corresponding to the first local outlier factor时; or,

When the first distance is greater than the second distance, the value of the second local outlier factor of the small cluster of data points in the second nonlinear combination feature set is greater than the determination threshold corresponding to the second local outlier factor When, it is determined that the network access is safe access.