WO2020258672A1

WO2020258672A1 - Network access anomaly detection method and device

Info

Publication number: WO2020258672A1
Application number: PCT/CN2019/118437
Authority: WO
Inventors: 黎立桂
Original assignee: 平安科技（深圳）有限公司
Priority date: 2019-06-28
Filing date: 2019-11-14
Publication date: 2020-12-30
Also published as: CN110392046A; CN110392046B

Abstract

The present application relates to the technical field of security checking, and provides a network access anomaly detection method and a device. The method comprises: receiving a network access request sent by a terminal apparatus, acquiring, according to the network access request, multiple non-linear features of parameters related to the terminal apparatus, and forming multiple candidate feature sets; performing, according to the candidate feature sets, hierarchical comparison on the candidate feature sets in an ascending order of the number of features therein, obtaining a support level of a feature co-occurence frequency of each of the candidate feature sets, and setting a candidate feature set having a support level greater than or equal to a minimum support level as a frequent feature set; obtaining a corresponding inverse confidence level according to a confidence level of the frequent feature set; and if the inverse confidence level of the frequent feature set is greater than an anomaly threshold, determining a corresponding network access as an anomalous access. The method improves an anomaly detection capability of current network access for terminal apparatuses.

Description

Method and device for detecting abnormality of network access To

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on June 28, 2019, the application number is 201910580036.4, and the invention title is "Network Access Anomaly Detection Method and Device", the entire content of which is incorporated into the application by reference .

Technical field

The present application relates to the technical field of security detection. Specifically, the present application relates to a method and device for detecting abnormality of network access.

Background technique

With the widespread use of the Internet, in order to ensure normal users’ online experience on the corresponding website, in addition to the website design, the safety and maintenance of the website has also attracted everyone’s attention. At present, one of the main means to threaten website security is to visit the website through web crawlers, which causes the website to fail to make correct judgments, which can easily cause incorrect responses. In response to this problem, the current method is to collect data such as click time and mouse drag trajectory during the user verification process to identify the user type based on this behavior data. This type of method has a high error rate and is easy to identify a real user as an abnormal user. The accuracy is low.

Summary of the invention

In order to overcome the above technical problems, especially the problem in the prior art that the user's usage trace data when logging in to the network through a terminal device can easily identify a real user as an abnormal user, the following technical solutions are proposed:

In the first aspect, this application provides an abnormality detection method for network access, which includes the following steps:

Receiving a network access request sent by a terminal device, acquiring multiple non-linear characteristics of relevant parameters of the terminal device according to the network access request, and forming multiple candidate feature sets;

According to the candidate feature set, the feature number of each candidate feature set is compared in the order of the smallest to the most, and the support for the simultaneous appearance frequency of the features in each candidate feature set is obtained, and the candidate features that are greater than or equal to the minimum support are obtained The set is set as a frequent feature set;

Obtain the corresponding inverse confidence degree according to the confidence degree of the frequent feature set;

When the reverse confidence of the frequent feature set is greater than the abnormal threshold, it is determined that the corresponding network access is an abnormal access.

In one of the embodiments, before the step of receiving the network access request sent by the terminal device, acquiring multiple non-linear characteristics of the relevant parameters of the terminal device according to the network access request, and forming multiple candidate feature sets ,Also includes:

For the characteristics that can be obtained by receiving the network access request sent by the terminal device, a corresponding characteristic list is formed.

In one of the embodiments, the feature type of the feature list includes the necessary information type generated by the terminal device initiating a network access request.

In one of the embodiments, the step of receiving a network access request sent by a terminal device, acquiring multiple non-linear characteristics of relevant parameters of the terminal device according to the network access request, and forming multiple candidate feature sets includes :

Receive each network access request sent by the terminal device, according to the corresponding multiple non-linear characteristics acquired;

Corresponding to the feature list, extract some or all of the acquired nonlinear features to form multiple candidate feature sets.

In one of the embodiments, according to the candidate feature set, the feature number of each candidate feature set is compared hierarchically in ascending order to obtain the support for the simultaneous appearance frequency of features in each candidate feature set, respectively, And before the step of setting candidate feature sets greater than or equal to the minimum support as frequent feature sets, it also includes:

Determine whether the acquired operating system feature of the terminal device corresponds to the maximum number of touch points supported by the terminal device.

In one of the embodiments, the step of obtaining the corresponding inverse confidence degree according to the confidence degree of the frequent feature set includes:

Compare according to the confidence of each frequent feature set, and the frequent feature set with the highest confidence in the comparison result is the best frequent feature set;

The inverse confidence of the best frequent feature set is used as an abnormality threshold.

In one of the embodiments, the minimum support degree is the upper quartile of all candidate feature sets formed within a set time period.

In the second aspect, the present application also provides an abnormality detection device for network access, which includes:

A forming module, configured to receive a network access request sent by a terminal device, obtain multiple non-linear characteristics of relevant parameters of the terminal device according to the network access request, and form multiple candidate feature sets; To

The setting module is used to compare the feature numbers of each candidate feature set in order from small to many according to the candidate feature set, and obtain the support degree of the simultaneous appearance frequency of the features in each candidate feature set respectively, and it is greater than or equal to The candidate feature set with the minimum support is set as a frequent feature set;

An obtaining module, configured to obtain a corresponding inverse confidence degree according to the confidence degree of the frequent feature set;

The judging module is used for judging that the corresponding network access is abnormal when the reverse confidence of the frequent feature set is greater than the abnormal threshold.

In the third aspect, this application also provides a server, which includes:

One or more processors;

Memory

One or more computer-readable instructions, wherein the one or more computer-readable instructions are stored in the memory and configured to be executed by the one or more processors, and the one or more computers may The read instruction configuration is used to execute the network access abnormality detection method described in the embodiment of the first aspect.

In a fourth aspect, the present application also provides a computer-readable storage medium having computer-readable instructions stored on the computer-readable storage medium. When the computer-readable instructions are executed by a processor, the computer-readable instructions described in the embodiments of the first aspect are implemented. Anomaly detection method for network access.

The method and device for detecting anomaly of network access provided by the present application are based on the candidate feature set formed by several features obtained according to the network request, and the support and confidence of the candidate feature set are obtained as the decision point. According to the basis of whether the network access is abnormal, the result of determining whether the corresponding network access request is abnormal is finally obtained.

The technical solution provided by this application forms multiple candidate feature sets from the features acquired in the network access request, and compares the support and confidence values, avoiding the identification and reprocessing of the corresponding features, and the transformation of the detection object , Simplifies the processing of detection data, improves detection efficiency, and ultimately improves the ability to detect abnormal access to terminal equipment.

The additional aspects and advantages of this application will be partly given in the following description, which will become obvious from the following description, or be understood through the practice of this application.

Description of the drawings

The above and/or additional aspects and advantages of the present application will become obvious and easy to understand from the following description of the embodiments in conjunction with the accompanying drawings, in which:

FIG. 1 is an application environment diagram of the anomaly detection solution for network access in an embodiment of the present application;

FIG. 2 is a flowchart of a method for detecting anomaly of network access according to an embodiment of the present application;

FIG. 3 is a schematic diagram of an abnormality detection device for network access according to an embodiment of this application;

FIG. 4 is a schematic structural diagram of a server according to an embodiment of the application.

Detailed ways

The embodiments of the present application are described in detail below. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals indicate the same or similar elements or elements with the same or similar functions. The embodiments described below with reference to the drawings are exemplary, and are only used to explain the present application, and cannot be construed as a limitation to the present application.

Those skilled in the art can understand that, unless specifically stated, the singular forms "a", "an", "said" and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of this application refers to the presence of the described features, integers, steps, operations, elements, and/or components, but does not exclude the presence or addition of one or more other features, Integers, steps, operations, elements, components, and/or groups thereof. It should be understood that when we refer to an element as being "connected" or "coupled" to another element, it can be directly connected or coupled to the other element, or intervening elements may also be present. In addition, “connected” or “coupled” used herein may include wireless connection or wireless coupling. The term "and/or" as used herein includes all or any unit and all combinations of one or more associated listed items.

Those skilled in the art can understand that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meanings as those commonly understood by those of ordinary skill in the art to which this application belongs. It should also be understood that terms such as those defined in general dictionaries should be understood to have a meaning consistent with the meaning in the context of the prior art, and unless specifically defined as here, they will not be idealized or overly Explain the formal meaning.

Those skilled in the art can understand that the term "terminal" and "terminal equipment" used herein include both wireless signal receiver equipment, equipment that only has wireless signal receivers without transmitting capability, and equipment receiving and transmitting hardware. A device with a receiving and transmitting hardware device capable of performing two-way communication on a two-way communication link. Such equipment may include: cellular or other communication equipment, which has a single-line display or multi-line display or cellular or other communication equipment without a multi-line display; PCS (Personal Communications Service, personal communication system), which can combine voice, data processing, fax and/or data communication capabilities; PDA (Personal Digital Assistant, personal digital assistant), which can include radio frequency receivers, pagers, Internet/Intranet access, web browsers, notepads, calendars, and/or GPS (Global Positioning System (Global Positioning System) receiver; conventional laptop and/or palmtop computer or other device, which has and/or includes a radio frequency receiver, conventional laptop and/or palmtop computer or other device. The "terminal" and "terminal equipment" used here may be portable, transportable, installed in vehicles (aviation, sea and/or land), or suitable and/or configured to operate locally, and/or In a distributed form, it runs on the earth and/or any other location in space. The "terminal" and "terminal equipment" used here can also be communication terminals, Internet terminals, music/video playback terminals, such as PDA, MID (Mobile Internet Device, mobile Internet device) and/or mobile phone with music/video playback function, it can also be a smart TV, set-top box and other devices.

Those skilled in the art can understand that the remote network device used here includes but is not limited to a computer, a network host, a single network server, a set of multiple network servers, or a cloud composed of multiple servers. Here, cloud is based on cloud computing (Cloud Computing) consists of a large number of computers or network servers. Among them, cloud computing is a type of distributed computing, a super virtual computer composed of a group of loosely coupled computer sets. In the embodiments of this application, the remote network equipment, terminal equipment and WNS server can communicate through any communication method, including but not limited to mobile communication based on 3GPP, LTE, WIMAX, and TCP/IP, UDP protocol-based mobile communications. Computer network communication and short-range wireless transmission based on Bluetooth and infrared transmission standards.

As shown in Figure 1, Figure 1 is an application environment diagram of the embodiment of the application; in this embodiment, the technical solution of the application can be implemented on a server. In Figure 1, the terminal devices 110 and 120 can access the server through the internet 130. The terminal device 110 and/or 120 sends a network request to the server 130, and the server 130 performs data interaction according to the network request. During data exchange, the server 130 obtains the access data and attribute data of the terminal device 110 and/or 120 according to the request information of the terminal device 110 and/or 120, and performs abnormality detection on the terminal device according to the data.

S210: Receive a network access request sent by a terminal device, obtain multiple nonlinear features of relevant parameters of the terminal device according to the network access request, and form multiple candidate feature sets.

When the server interacts with the terminal device, it obtains the relevant parameters of the terminal device according to the network request sent by the terminal device. Regarding the acquisition of the feature, relevant information can be extracted according to processing needs, and the related information can be analyzed to obtain the corresponding feature, and the multiple nonlinear features obtained in the foregoing manner.

In this step, the user sends registration and verification requests, and the front-end uses JavaScript scripts to obtain the relevant characteristics of the terminal device, including device type (IPone, Mac, Andriod), system information (OS type, version, resolution), and device Multiple features such as the maximum number of touchable points and IP supported in a touch screen event, and the features are in a non-linear relationship with each other. Several features may be extracted or randomly selected as needed to form multiple candidate feature sets to perform abnormality detection on the network access request sent by the terminal device.

S220. According to the candidate feature set, the feature numbers of the candidate feature sets are compared hierarchically in ascending order to obtain the support for the simultaneous appearance frequency of features in each candidate feature set, and the support is greater than or equal to the minimum support. The candidate feature set is set as a frequent feature set.

According to all the candidate feature sets obtained in step S210, and according to the feature layout of each candidate feature set, the support of each candidate feature set is calculated separately, and the frequency of simultaneous appearance of each candidate feature set.

In this embodiment, the feature may include a certain system version information of the terminal device, and the terminal device supports touch control. Wherein, the feature of a certain system version information of the terminal device can be obtained by obtaining the user_agent of the device through JS, and obtained by analyzing the user_agent. The features of the terminal device supporting touch control can be directly obtained through JS.

The support of all candidate feature sets is compared with the minimum support, and the candidate feature set greater than or equal to the minimum support is set as a frequent feature set.

In this embodiment, in order to reduce the amount of calculation for the support comparison, the hierarchical comparison is performed in the order of the feature number of each candidate feature set from small to large, and the specific method of hierarchical comparison is as follows:

For the convenience of description, the features are described with numerical serial numbers 1, 2, 3, 4, and 5:

If there is a feature set I={1, 2, 3, 4, 5}, there is a feature set T:

1,2,3

1,2,4

1,3,4

1,2,3,5

1,3,5

2,4,5

1,2,3,4

Set the minimum support to 3/7.

First, generate a candidate feature set containing only one feature:

{1}, {2}, {3}, {4}, {5}

Generate a candidate feature set containing two features:

According to the above-mentioned generation of candidate feature sets containing only one feature, all candidate feature sets containing two features are generated: so the generated candidate feature sets are as follows:

　{1, 2}, {1, 3}, {1, 4}, {1, 5}

　 {2, 3}, {2, 4}, {2, 5}

　 {3, 4}, {3, 5}

　 {4, 5}

Calculating their support, it is found that only {1, 2}, {1, 3}, {1, 4}, {2, 3}, {2, 4}, {2, 5} supports the requirements, so Find a candidate feature set containing two features:

{1, 2}, {1, 3}, {1, 4}, {2, 3}, {2, 4}

Generate a candidate feature set containing three features: 　　

According to the union of candidate feature sets containing two features, {1, 2, 3}, {1, 2, 4}, {1, 3, 4} are obtained.

But since the subset {3, 4} of {1, 3, 4} is not in the 2-frequent feature set, we need to remove {1, 3, 4}

Then calculate the support of {1, 2, 3} and {1, 2, 4} and find that the support of {1, 2, 3} is 3/7 , The support of {1, 2, 4} is 2/7, so {1, 2, 4} needs to be eliminated.

Therefore, the candidate feature set with three features is only: {1, 2, 3}.

That is, in the process of level comparison, when the support degree of the candidate feature set is equal to or greater than the minimum support degree, the frequent feature set generation process ends.

In this way, it is avoided that all candidate feature sets need to be traversed and compared with the minimum support.

S230: Obtain a corresponding inverse confidence degree according to the confidence degree of the frequent feature set.

From the frequent feature set obtained in the above step S220, the confidence of each frequent feature set is calculated. According to the confidence, the inverse confidence of the corresponding frequent feature set is obtained.

S240: When the reverse confidence of the sample to be inspected is greater than the abnormal threshold, determine that the corresponding network access is an abnormal access.

In this step, the sample to be inspected is the corresponding frequent feature set of a certain network access request initiated by the terminal device obtained according to the above steps S210-S230. When the reverse confidence of the sample to be checked is greater than the abnormal threshold, it is determined that the corresponding network access is an abnormal access. The abnormal threshold may be set for the network access request sent by the terminal device, and the set abnormal threshold may be 70%. The abnormal threshold may also be obtained based on the obtained frequent feature set.

The anomaly detection method for network access provided by this application is based on multiple nonlinear features obtained from a network access request, and combining several features into multiple candidate feature sets, and comparing the corresponding support degree with the minimum support degree, The corresponding frequent feature set is obtained, and finally, according to the confidence of the above frequent feature set, the detection result of whether the network access request is abnormal is obtained by comparing with the abnormal threshold. The technical solution of the present application uses the support and confidence calculation of the candidate feature set formed by the features obtained by the network access request initiated by the terminal device to generate a distinguished feature set, which is faster, and use this as whether to respond The basis of the request. Compared with the prior art method for determining abnormal access only through the surface phenomenon of the use track when the user initiates a network access request, the feature engineering and machine learning algorithms are used in this application to independently learn the distinguishing rules in user data , With strong interpretability, can identify diverse abnormal scenes, and as the sample size grows, it can cover more and more complex situations.

Before step S210, it further includes:

In this embodiment, corresponding features can be obtained from the network access request initiated by the terminal device according to preset feature items, and the preset feature items are aggregated to form a feature list. The feature item in the feature list may be specific information about a certain category, for example, the operating system of the terminal device may be specifically IOS system or windows system; the model of the terminal device may be specific It is a mac computer or a windows computer; for the touch screen events of the terminal device, different features can be set according to the specific touch points supported by the current main terminal device and/or operating system. In this way, after different features are combined, abnormal situations can be found more accurately from the correspondence between features.

On this basis, the feature type of the feature list includes the necessary information type generated by the terminal device initiating a network access request.

The necessary information type is the type of the feature that must be generated in the process of the terminal device initiating the network access request, and can be obtained without secondary calculation or statistics. Such as information about the model of the terminal device, operating system version number information, IP information or touch screen events.

In this way, the fundamental feature information generated by the abnormal access can be directly processed and the result of the data processing can be judged, so that the data can be processed as little as possible, and the accuracy rate can be easily improved.

For step S210, it includes:

A1. Receive each network access request sent by the terminal device, and obtain multiple non-linear characteristics according to the corresponding network access request;

A2. Corresponding to the feature list, extract some or all of the acquired nonlinear features to form multiple candidate feature sets.

In this embodiment, the characteristics obtained from the terminal device are obtained for each network access request initiated by the terminal device. The acquired features can be correspondingly acquired and collected corresponding to the feature items in the feature list. According to the needs of abnormal detection of network access, some or all of the feature items are extracted from the collected feature items, and a plurality of candidate feature sets are formed correspondingly, so as to provide corresponding data for the network access anomaly detection of the terminal device.

In this embodiment, before step S220, it may further include:

For example, the maximum number of touch points supported in the touch screen event of a computer running a windows system obtained through JS is 255. However, under normal circumstances, computers running mac or windows operating systems generally do not support touch. If the touch screen event information obtained through JS supports touch, it is likely to be an abnormal user.

Conversely, mobile terminal devices running Android generally support touch control. If the touch screen event information obtained by JS does not support touch control, it is likely to be an abnormal user.

According to the aforementioned non-correspondence, the corresponding server is started to run the operation of step S220, and the support degree of each candidate feature set is calculated. In particular, it includes the operating system characteristics of the terminal device and the characteristics of the maximum number of touch points supported by the terminal device. In order to further increase the accuracy of detection, the device model feature of the terminal device may be added to the candidate feature set.

The step of obtaining the corresponding inverse confidence based on the confidence of the frequent feature set in step S230 includes:

B1. Compare according to the confidence of each frequent feature set, and the frequent feature set with the highest confidence in the comparison result is the best frequent feature set;

B2. The inverse confidence of the best frequent feature set is used as an abnormality threshold.

From the frequent feature set obtained in step S220, the confidence of each frequent feature set is performed, and the confidence of each frequent feature set is compared. According to the comparison result, the frequent feature set with the highest confidence is obtained as the best frequent feature set. The inverse confidence degree is calculated for the highest confidence degree, that is, the inverse confidence degree of the best frequent feature set is used as the abnormal threshold.

According to the abnormal threshold, abnormal detection is performed on the corresponding network access request.

If a new feature set is added to the network access request of the terminal device, the support and confidence are updated to obtain the corresponding best frequent feature set at this time, and based on the inverse confidence of the best frequent feature set The degree is used as the judgment basis for abnormal detection.

In this way, the corresponding parameters can be updated and adjusted at any time according to the obtained data changes regarding the characteristics of the terminal equipment, so as to adjust the judgment standard according to the data changes.

If the network request currently initiated by the terminal device is determined to be an abnormal access request, the server directly rejects the request or re-requires the terminal device to perform access verification; if the network request currently initiated by the terminal device is determined to be a normal access request, then Respond directly to requests.

In addition, the minimum support degree mentioned in step S220 may be set.

In this embodiment, the minimum support degree is the upper quartile of all candidate feature sets formed within a set time period.

In this way, the minimum support can be adjusted according to the acquired features and changes in the candidate feature set composed of the features, to ensure that the frequent feature set is more accurately acquired, and to ensure the accuracy and flexibility of anomaly detection results Sex.

Based on the same inventive concept as the above-mentioned network access abnormality detection method, an embodiment of the present application also provides an abnormality detection device for network access, as shown in FIG. 3, including:

The forming module 310 is configured to receive a network access request sent by a terminal device, obtain multiple nonlinear characteristics of relevant parameters of the terminal device according to the network access request, and form multiple candidate feature sets; To

The setting module 320 is configured to compare the number of features of each candidate feature set in order from small to many according to the candidate feature set, and obtain the support degree of the simultaneous appearance frequency of the features in each candidate feature set, and set it to be greater than The candidate feature set equal to the minimum support is set as a frequent feature set;

The obtaining module 330 is configured to obtain the corresponding inverse confidence according to the confidence of the frequent feature set;

The determining module 340 is configured to determine that the corresponding network access is an abnormal access when the reverse confidence of the frequent feature set is greater than the abnormal threshold.

Please refer to FIG. 4, which is a schematic diagram of the internal structure of the server in an embodiment. As shown in FIG. 4, the server includes a processor 410, a storage medium 420, a memory 430, and a network interface 440 connected through a system bus. Wherein, the storage medium 420 of the server stores an operating system, a database, and computer-readable instructions. The database may store control information sequences. When the computer-readable instructions are executed by the processor 410, the processor 410 can implement a network In the access abnormality detection method, the processor 410 can implement the functions of the feature formation module 310, the setting module 320, the acquisition module 330, and the determination module 340 in a network access abnormality detection device in the embodiment shown in FIG. The processor 410 of the server is used to provide computing and control capabilities to support the operation of the entire server. The memory 430 of the server may store computer-readable instructions, and when the computer-readable instructions are executed by the processor 410, the processor 410 can execute a method for detecting abnormality of network access. The network interface 440 of the server is used to connect and communicate with the terminal. Those skilled in the art can understand that the structure shown in FIG. 4 is only a block diagram of part of the structure related to the solution of the present application, and does not constitute a limitation on the server to which the solution of the present application is applied. The specific server may include More or fewer components are shown in the figure, or some components are combined, or have different component arrangements.

In one embodiment, the present application also proposes a storage medium storing computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors perform the following steps: receiving The network access request sent by the terminal device acquires multiple nonlinear features of the relevant parameters of the terminal device according to the network access request, and forms multiple candidate feature sets; according to the candidate feature set, each candidate feature The feature number of the set is compared in the order from small to most, and the support for the simultaneous appearance frequency of features in each candidate feature set is obtained, and the candidate feature set with the minimum support is set as a frequent feature set; according to the frequent features The confidence of the set is obtained, and the corresponding inverse confidence is obtained; when the inverse confidence of the frequent feature set is greater than the abnormal threshold, the corresponding network access is determined to be an abnormal access.

Based on the foregoing embodiments, it can be seen that the greatest beneficial effect of this application lies in:

In summary, the anomaly detection method and device of the present application through network access uses the candidate feature set formed by the combination of features that embody normal network access verification, and based on the comparison result of its support and confidence, the judgment is obtained Whether network access is the result of abnormal access. The technical solution provided in this application can convert characteristic information into parameter information that is convenient for comparison, reducing the difficulty of obtaining information by the terminal device, and is similar to the surface phenomenon of the use track in the prior art when the user initiates a network access request. The comparison of methods for determining abnormal access also improves the accuracy of detection.

A person of ordinary skill in the art can understand that all or part of the processes in the methods of the foregoing embodiments can be implemented by instructing relevant hardware through computer-readable instructions, which can be stored in a computer-readable storage medium. When the readable instruction is executed, it may include the procedures of the above-mentioned method embodiments. Among them, the aforementioned storage medium may be a magnetic disk, an optical disk, a read-only storage memory (Read-Only Memory, ROM) and other storage media. The storage medium may be a non-volatile storage medium, or a random access memory (Random Access Memory, RAM).

The technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above-mentioned embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, All should be considered as the scope of this specification.

The above-mentioned embodiments only express several implementation manners of the present application, and their descriptions are relatively specific and detailed, but they should not be understood as a limitation on the patent scope of the present application. It should be pointed out that for those of ordinary skill in the art, without departing from the concept of this application, several modifications and improvements can be made, and these all fall within the protection scope of this application. Therefore, the scope of protection of the patent of this application shall be subject to the appended claims.

Claims

An anomaly detection method for network access is characterized by including the following steps:

Receiving a network access request sent by a terminal device, acquiring multiple non-linear characteristics of relevant parameters of the terminal device according to the network access request, and forming multiple candidate feature sets; To

According to the candidate feature set, the feature number of each candidate feature set is compared in the order of the smallest to the most, and the support for the simultaneous appearance frequency of the features in each candidate feature set is obtained, and the candidate features that are greater than or equal to the minimum support are obtained The set is set as a frequent feature set;

Obtain the corresponding inverse confidence degree according to the confidence degree of the frequent feature set;

When the reverse confidence of the frequent feature set is greater than the abnormal threshold, it is determined that the corresponding network access is an abnormal access.
The method according to claim 1, wherein:

Before the step of receiving the network access request sent by the terminal device, acquiring multiple non-linear characteristics of the relevant parameters of the terminal device according to the network access request, and forming multiple candidate feature sets, the method further includes:

For the characteristics that can be obtained by receiving the network access request sent by the terminal device, a corresponding characteristic list is formed.
The method according to claim 2, wherein:

The feature type of the feature list includes the necessary information type generated by the terminal device initiating a network access request.
The method according to one of claims 2 or 3, characterized in that:

The step of receiving a network access request sent by a terminal device, acquiring multiple non-linear characteristics of relevant parameters of the terminal device according to the network access request, and forming multiple candidate feature sets includes:

Receive each network access request sent by the terminal device, according to the corresponding multiple non-linear characteristics acquired;

Corresponding to the feature list, extract some or all of the acquired nonlinear features to form multiple candidate feature sets.
The method of claim 4, wherein:

According to the candidate feature set, the feature number of each candidate feature set is compared in order from small to many, and the support for the simultaneous appearance frequency of features in each candidate feature set is obtained, and the support is greater than or equal to the minimum support Before the step of setting candidate feature sets as frequent feature sets, it also includes:

Determine whether the acquired operating system feature of the terminal device corresponds to the maximum number of touch points supported by the terminal device.
The method according to claim 1, wherein:

The step of obtaining the corresponding inverse confidence degree according to the confidence degree of the frequent feature set includes:

Compare according to the confidence of each frequent feature set, and the frequent feature set with the highest confidence in the comparison result is the best frequent feature set;

The inverse confidence of the best frequent feature set is used as an abnormality threshold.
The method according to claim 1, wherein:

The minimum support degree is the upper quartile of all candidate feature sets formed within the set time period.
An abnormality detection device for network access, which is characterized in that it comprises:

A forming module, configured to receive a network access request sent by a terminal device, obtain multiple non-linear characteristics of the terminal device according to the network access request, and form multiple candidate feature sets; To

A setting module, configured to obtain the support of each candidate feature set according to the candidate feature set, and set the candidate feature set that is greater than or equal to the minimum support as a frequent feature set;

An obtaining module, configured to obtain a corresponding inverse confidence degree according to the confidence degree of the frequent feature set;

The judging module is used for judging that the corresponding network access is abnormal when the reverse confidence of the frequent feature set is greater than the abnormal threshold.
The abnormality detection device according to claim 8, wherein the abnormality detection device further comprises:

The list acquisition module is used to form a corresponding feature list for the features that can be acquired by receiving the network access request sent by the terminal device.
The abnormality detection device according to claim 9, wherein the characteristic type of the characteristic list includes the necessary information type generated by the terminal device initiating a network access request.
The abnormality detection device according to one of claims 8 or 9, wherein the forming module comprises:

The receiving unit is configured to receive each network access request sent by the terminal device, and obtain multiple non-linear characteristics according to the corresponding said;

The acquiring unit is configured to extract part or all of the acquired nonlinear features corresponding to the feature list to form multiple candidate feature sets.
The abnormality detection device according to claim 11, wherein the abnormality detection device further comprises:

The judging module is used to judge whether the acquired operating system feature of the terminal device corresponds to the maximum number of touch points supported by the terminal device.
The abnormality detection device according to claim 8, wherein the acquisition module comprises:

The comparison is performed according to the confidence of each frequent feature set, the frequent feature set with the highest confidence in the comparison result is taken as the best frequent feature set, and the inverse confidence of the best frequent feature set is taken as the abnormality threshold.
The abnormality detection device according to claim 8, wherein the minimum support degree is an upper quartile of all candidate feature sets formed in a set time period.
A server, characterized by comprising: one or more processors; memory;

One or more computer-readable instructions, wherein the one or more computer-readable instructions are stored in the memory and configured to be executed by the one or more processors, and the one or more computers may The read command configuration is used to perform the following steps:

Receiving a network access request sent by a terminal device, acquiring multiple non-linear characteristics of relevant parameters of the terminal device according to the network access request, and forming multiple candidate feature sets; To

According to the candidate feature set, the feature number of each candidate feature set is compared in the order of the smallest to the most, and the support for the simultaneous appearance frequency of the features in each candidate feature set is obtained, and the candidate features that are greater than or equal to the minimum support are obtained The set is set as a frequent feature set;

Obtain the corresponding inverse confidence degree according to the confidence degree of the frequent feature set;

When the reverse confidence of the frequent feature set is greater than the abnormal threshold, it is determined that the corresponding network access is an abnormal access.
The server according to claim 15, wherein the receiving network access request sent by the terminal device acquires multiple non-linear characteristics of the relevant parameters of the terminal device according to the network access request, and forms multiple Before the step of candidate feature set, it also includes:

For the characteristics that can be obtained by receiving the network access request sent by the terminal device, a corresponding characteristic list is formed.
The server according to claim 16, wherein the characteristic type of the characteristic list includes the necessary information type generated by the terminal device initiating a network access request.
The server according to claim 16 or 17, wherein the receiving network access request sent by the terminal device acquires multiple nonlinear characteristics of the relevant parameters of the terminal device according to the network access request, and forms multiple The steps of a candidate feature set include:

Receive each network access request sent by the terminal device, according to the corresponding multiple non-linear characteristics acquired;

Corresponding to the feature list, extract some or all of the acquired nonlinear features to form multiple candidate feature sets.
The server according to claim 18, characterized in that,

According to the candidate feature set, the feature number of each candidate feature set is compared in order from small to many, and the support degree of the simultaneous appearance frequency of each candidate feature set is obtained, and the support is greater than or equal to the minimum support Before the step of setting candidate feature sets as frequent feature sets, it also includes:

Determine whether the acquired operating system feature of the terminal device corresponds to the maximum number of touch points supported by the terminal device.
A computer-readable storage medium, wherein the computer-readable storage medium stores computer-readable instructions, and the computer-readable instructions are executed by a processor in the following steps:

Receiving a network access request sent by a terminal device, acquiring multiple non-linear characteristics of relevant parameters of the terminal device according to the network access request, and forming multiple candidate feature sets; To

According to the candidate feature set, the feature number of each candidate feature set is compared in the order of the smallest to the most, and the support for the simultaneous appearance frequency of the features in each candidate feature set is obtained, and the candidate features that are greater than or equal to the minimum support are obtained The set is set as a frequent feature set;

Obtain the corresponding inverse confidence degree according to the confidence degree of the frequent feature set;

When the reverse confidence of the frequent feature set is greater than the abnormal threshold, it is determined that the corresponding network access is an abnormal access.