WO2021012509A1

WO2021012509A1 - Method, device, and computer storage medium for detecting abnormal account

Info

Publication number: WO2021012509A1
Application number: PCT/CN2019/117581
Authority: WO
Inventors: 侯明远
Original assignee: 平安科技（深圳）有限公司
Priority date: 2019-07-23
Filing date: 2019-11-12
Publication date: 2021-01-28
Also published as: CN110460587A; CN110460587B

Abstract

Disclosed by the embodiments of the present application are a method, device, and computer storage medium for detecting an abnormal account, used for the technical field of computers. The method comprises: obtaining N sets of access data for N accounts to access a target URL within a preset time, each of the N groups of access data being M-dimensional data, N and M both being positive integers; using a Gaussian kernel function to map the data of the N groups of access data in each dimension to the interval [0,1]; determining to be an abnormal account an account corresponding to abnormally distributed access data in the interval [0,1], said abnormally distributed access data being access data which is different from the access data distribution of at least half of the N accounts. Implementing the embodiments of the present application can accurately and efficiently detect abnormally accessed accounts.

Description

Method, device and computer storage medium for detecting abnormal account

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on July 23, 2019, the application number is 201910669346.3, and the application name is "An abnormal account detection method, device and computer storage medium", the entire content of which is by reference Incorporated in this application.

Technical field

This application relates to the field of Internet technology, and in particular to an abnormal account detection method, device and computer storage medium.

Background technique

How to avoid the leakage of the company's key data and ensure the company's information security has always been a major concern of the information security department. At present, there are two traditional ways to prevent the theft of key company data. The first method is to manually set up a cordon. If an account accesses the company’s key uniform resource locator (URL) for more than this cordon, the account’s permissions will be cancelled or pulled into the black Among the list. The limitation of this method is that it is difficult to set a "correct" warning line, resulting in some illegal accounts that cannot be found. The second method is to use machine learning to generate classifiers using supervised learning methods by labeling "violation" and "non-violation" labels. The disadvantage of this approach is that in actual operation, it is impossible to clearly mark whether the account is "violating". In addition, accounts that actually violate the rules account for a very small proportion of all accounts, which has a great impact on the effect of supervised learning. The method of monitoring illegal accounts in the prior art has poor effect and low accuracy, and cannot effectively find abnormally accessed accounts or illegal accounts.

Summary of the invention

The embodiments of the present application provide an abnormal account detection method, device, and computer storage medium, which can accurately and efficiently detect abnormally accessed accounts.

The embodiment of the present application also provides an abnormal account detection method, including:

Acquire N sets of access data for N accounts to access the target website within a preset time, each of the N sets of access data is M-dimensional data, and N and M are both positive integers;

Using Gaussian kernel function to map the data of the N groups of access data in each dimension to the interval [0,1];

The account corresponding to the abnormally distributed access data in the [0,1] interval is determined to be an abnormal account, and the abnormally distributed access data is an access that is different from the access data distribution of at least half of the N accounts data.

The embodiment of the present application also provides an abnormal account detection device, including:

The obtaining unit is configured to obtain N sets of access data for N accounts to access the target website within a preset time, each of the N sets of access data is M-dimensional data, and N and M are both positive integers;

A mapping unit for mapping the data of the N groups of access data in each dimension to the interval [0,1] by using a Gaussian kernel function;

The determining unit is configured to determine the account corresponding to the abnormally distributed access data in the [0,1] interval as the abnormal account, and the abnormally distributed access data is access to at least half of the N accounts The data is distributed with different access data.

The embodiment of the present application also provides a computer device for executing the abnormal account detection method provided in the first aspect. The computer device may include a processor, a communication interface and a memory, and the processor, the communication interface and the memory are connected to each other. The communication interface is used to communicate with other network devices (such as terminals), the memory is used to store the implementation code of the above abnormal account detection method, and the processor is used to execute the program code stored in the memory, that is, the above abnormal account detection method is executed.

The embodiment of the present application also provides a computer non-volatile readable storage medium, the non-volatile readable storage medium stores instructions, and when it runs on the processor, the processor executes the above abnormal account detection method .

The embodiment of the present application also provides a computer program product containing instructions, which when running on a processor, causes the processor to execute the above abnormal account detection method.

To implement the embodiments of this application, there is no need to manually set a "warning line", nor to provide "abnormal" samples in advance, and it is possible to automatically identify accounts with abnormal access behaviors. The traditional method of monitoring abnormal behaviors has been changed. The Gaussian kernel algorithm is used to automatically identify the abnormal accounts in an unsupervised way, and for a certain access data, it can be layered from different time dimensions (for example, statistics for one minute). The number of internal visits, the number of visits in an hour, the number of visits in a day), a feature is divided into multiple dimensions according to the time dimension, and then high-dimensional space mapping is performed to find the abnormal account more accurately.

The additional aspects and advantages of this application will be partly given in the following description, which will become obvious from the following description, or be understood through the practice of this application.

Description of the drawings

The above and/or additional aspects and advantages of the present application will become obvious and easy to understand from the following description of the embodiments in conjunction with the accompanying drawings, in which:

FIG. 1 is a schematic diagram of the hardware structure of a computer device provided by an embodiment of the present application;

2 is a schematic flowchart of an abnormal account detection method provided by an embodiment of the present application;

FIG. 3A is a schematic diagram of a one-dimensional space provided by an embodiment of the present application;

3B is a schematic diagram of another multi-dimensional space provided by an embodiment of the present application;

Fig. 4 is a schematic diagram of the logical structure of a computer device provided by an embodiment of the present application.

Detailed ways

The embodiments of the present application are described in detail below. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals indicate the same or similar elements or elements with the same or similar functions. The embodiments described below with reference to the drawings are exemplary, and are only used to explain the present application, and cannot be construed as a limitation to the present application.

Those skilled in the art can understand that, unless specifically stated, the singular forms "a", "an", "said" and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of this application refers to the presence of the described features, integers, steps, and operations, but does not exclude the presence or addition of one or more other features, integers, steps, and operations.

Those skilled in the art can understand that, unless otherwise defined, all terms (including technical terms and scientific terms) used herein have the same meaning as those commonly understood by those of ordinary skill in the art to which this application belongs. It should also be understood that terms such as those defined in general dictionaries should be understood to have a meaning consistent with the meaning in the context of the prior art, and unless specifically defined as here, they will not be idealized or overly Explain the formal meaning.

Those skilled in the art should understand that the concepts of “application”, “application”, “application software” and similar expressions referred to in this application are the same concepts well known by those skilled in the art, and refer to a series of computer instructions and related concepts. Data resources are organically constructed computer software suitable for electronic operation. Unless specifically specified, this naming itself is not restricted by the type and level of programming language, nor the operating system or platform on which it runs. Of course, such concepts are not restricted by any form of terminal.

First, the computer equipment involved in the embodiments of the present application is introduced. Please refer to FIG. 1, which shows a computer device provided by an embodiment of the present application. The computer device 100 may include a memory 101, a communication interface 102, and one or more processors 103. These components can be connected through the bus 104 or in other ways. FIG. 1 uses the bus connection as an example. among them:

The memory 101 may be coupled with the processor 103 through a bus 104 or an input/output port, and the memory 101 may also be integrated with the processor 103. The memory 101 is used to store various software programs and/or multiple sets of instructions. Specifically, the memory 101 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic disk storage devices, flash memory devices, or other non-volatile solid-state storage devices. The memory 101 may also store a network communication program, which may be used to communicate with one or more additional devices, one or more terminals, and one or more network devices.

The processor 103 may be a general-purpose processor, such as a central processing unit (CPU), a digital signal processing (DSP), an application specific integrated circuit (ASIC), or One or more integrated circuits configured to implement the embodiments of the present application. The processor 103 can process data received through the communication interface 102.

The communication interface 102 is used for the computer device 100 to communicate with other network devices, such as a terminal for communication. The communication interface 102 may be a transceiver, a transceiver circuit, etc., where the communication interface is a general term and may include one or more interfaces, such as an interface between a terminal and a server. The communication interface 102 may include a wired interface and a wireless interface, such as a standard interface, Ethernet, and a multi-machine synchronization interface.

The processor 103 can be used to read and execute computer-readable instructions. Specifically, the processor 103 may be used to call data stored in the memory 101. Optionally, when the processor 103 sends any message or data, it specifically drives or controls the communication interface 102 to do the sending. Optionally, when the processor 103 receives any message or data, it specifically drives or controls the communication interface 102 to make the reception. Therefore, the processor 103 can be regarded as a control center that performs sending or receiving, and the communication interface 102 is a specific performer of sending and receiving operations.

In the embodiment of the present application, the communication interface 102 is specifically configured to perform the data transceiving steps involved in the following method embodiments, and the processor 103 is specifically configured to implement data processing steps other than data transceiving.

In the embodiment of the present application, the computer device 100 may be a server or terminal device with computing or processing capabilities.

Based on the structure of the computer device shown in FIG. 1, FIG. 2 provides an abnormal account detection method related to an embodiment of the present application. The abnormal account detection method includes but is not limited to the following steps S201-S203.

Step S201: Obtain N sets of access data for N accounts to access the target website within a preset time, each of the N sets of access data is M-dimensional data, and N and M are both positive integers.

Optionally, the access data includes one or more of access time or access times.

For example, for insurance products, the type of access to the target website may include, but is not limited to: one or more of login, inquiry, retrieval, or insurance tracking. The target website can be, for example, the insurance system website (or URL) that is logged in, the insurance system website (or URL) corresponding to the inquiry, the corresponding insurance system website (or URL), or the insurance system website (or URL) corresponding to insurance tracking, etc. . If the access type is login, the access data may be the access time and/or the number of accesses to a certain website (or URL). If the access type is an inquiry, the access data may be the access time and/or the number of times of access to a certain inquiry website (or URL) for inquiry. If the access type is retrieval, the access data may be the access time and/or the number of times of access to a certain retrieval website (or URL) for retrieval. If the access type is insurance tracking, the access data may be the access time and/or the number of visits to a certain insurance tracking website (or URL) for insurance tracking.

The aforementioned N accounts may be all accounts that access the target website. The preset time can be one second, one minute, one hour, one day or one week, etc. You can also set the preset time of the working period and the preset time of the non-working period respectively. For example, the working time period includes 7:00-23:59, and the non-working time period includes 00:00-6:59. The preset time corresponding to the working time period and the preset time corresponding to the non-working time period may be different. For example, the preset time corresponding to the working time period may be 1 second, and the preset time corresponding to the non-working time period is 1 minute. The preset time can be one or multiple. And the statistical time periods corresponding to the same preset time of different accounts can be the same or different.

For a certain type of access, count the access data of N accounts within a preset time. For example, if the access type is the login target URL (such as the website of a certain insurance system), then the statistics (such as the number of visits) of the N accounts logged in to the target URL within a preset time (such as one minute) are counted. In the statistics, the corresponding minute of each account can be different, and the minute that an account has the most access times in a day can be confirmed as the account's statistical time. For example, suppose that account 1 has the most number of visits to the target URL within a minute of 10:00-10:01 in a day, then the number of times that account 1 visits the target URL within a minute of 10:00-10:01 is used as the account 1 statistics. Assuming that account 2 has the most access to the target URL within a minute of 11:00-11:01 in a day, the number of times that account 2 accesses the target URL within a minute of 11:00-11:01 is taken as account 2’s Statistical data. For different access types, the aforementioned methods can be used to obtain access data of each account within a preset time. For example, count the number of inquiries made by N accounts in one minute, count the number of searches made by N accounts in one minute, and so on.

For the same access type, it is also possible to count the access data of each account within multiple preset times, and each preset time may be different. For example, you can count the number of times N accounts log in to the target URL in one second, the number of times N accounts log in to the target URL in one minute, the number of times N accounts log in to UPR in one hour, and the number of times N accounts log in in one day. The number of target URLs.

Optionally, the preset time can be different for different access types. For example, for the access type of login, the preset time can be one second, for the access type of inquiry, the preset time can be one hour, for the access type of insurance tracking, the preset time can be one day, etc. Wait.

Among them, the access data may be data stored in the system database, or statistics based on the received access request. Among them, the user can use the account to access the related URL link, and a certain account will carry the corresponding access address when requesting access. When the system receives an access request from an account, it records the access time, access address, and the identification of the account.

Step S202: Use a Gaussian kernel function to map the data of the N groups of access data in each dimension to the interval [0,1].

Among them, the Gaussian kernel is a non-linear mathematical method for measuring similarity. By using the Gaussian kernel, in each feature dimension, anomalous points in the corresponding dimension can be identified. Here, the characteristic dimensions include: access time, number of visits, ratio of inquiring orders, retrieval orders, or insurance tracking orders, etc.

In this application, a Gaussian check is used to classify N accounts. Since the access data of N accounts is not linearly separable, a Gaussian kernel needs to be used to map the data set to a high-dimensional space. In this way, the data is linearly separable in the high-dimensional space.

Optionally, the access data can be one-dimensional or multi-dimensional. When the access data is one-dimensional data, the use of a Gaussian kernel function to map the data of the N groups of access data in each dimension to the interval [0,1] includes:

A hinge function is used to perform a preliminary transformation on the N sets of access data. If the target access data in the N sets of access data is greater than the mode of the N access data, the value of the target access data is set to all The difference between the target access data and the mode;

If the target access data in the N sets of access data is less than or equal to the mode in the N access data, then the value of the target access data is set to 0;

Determining the central value of the Gaussian kernel transformation according to the mode in the N sets of access data after the preliminary transformation;

Determining the scale parameter of the Gaussian kernel transformation according to the product of the difference between the maximum value and the minimum value in the N sets of access data after the preliminary transformation and a first preset value;

Performing Gaussian kernel transformation processing according to the central value and the scale parameter to obtain a one-dimensional space, in which the N groups of access data are all distributed between 0-1 values;

The determining the account corresponding to the abnormally distributed access data in the interval [0,1] as the abnormal account includes:

The account number corresponding to the access data whose distance from the zero value in the one-dimensional space is less than or equal to the first preset distance is determined as the abnormal account number.

Wherein, the mode refers to the numerical value that appears most frequently among the N access data. The first preset value may be, for example, one-half or one-third. Optionally, the first preset distance can be set manually or set by default.

That is, for N access data of a certain index, take the mode with the most occurrences among the N access data as the benchmark. If a certain access data is greater than the mode, then set the value of the access data to the value of the access data. If the difference between the numbers is less than the mode, it is set to 0. Perform Gaussian kernel transformation again. The process of Gaussian kernel transformation involves center value and scale parameters. Take the mode of the processed value as the center value, and take the difference between the maximum and minimum values of the processed values * 1/2 (Or one-third) get the scale parameter of the Gaussian kernel transform, and after these two parameters are obtained, the Gaussian kernel transform can be processed. After Gaussian kernel transformation processing, a one-dimensional space map is obtained. All values will be distributed between 0-1. The farther away from the mode, the closer to 0 in the one-dimensional space. Therefore, the abnormal point can be judged according to the distance of the target point from 0. The closer to 0, the greater the probability of being an abnormal point, and the closer to 1, the smaller the probability of being an abnormal point.

When the access data is multi-dimensional data, the use of Gaussian kernel function to map the data of the N groups of access data in each dimension to the interval [0,1] includes:

A hinge function is used to perform a preliminary transformation of the N sets of access data in each dimension, if the value of the target access data in the N sets of access data in the target dimension is greater than the value of the N access data in the target dimension The mode of the target access data, the value of the target access data in the target dimension is set as the difference between the value of the target access data in the target dimension and the mode;

If the target access data in the N sets of access data in the target dimension is less than or equal to the mode of the N access data in the target dimension, then the target access data in the target dimension The value is set to 0;

Determining the central value of the Gaussian kernel transformation according to the mode of the N sets of access data in the target dimension after each dimension has undergone a numerical change;

Determine the scale parameter of the Gaussian kernel transformation according to the product of the difference between the maximum value and the minimum value of the N sets of access data in the target dimension and a second preset value after each dimension has undergone a numerical change;

Performing Gaussian kernel transformation processing according to the central value and the scale parameter to obtain a multi-dimensional space, in which the data of the N groups of access data in each dimension are distributed between 0-1 values, wherein, A multi-dimensional space is a hypercube composed of multiple [0,1] intervals, that is, the N groups of access data are all distributed between the values [0,...,0] and [1,...,1], the [0, …,0] and the [1,…,1] are all M-dimensional data;

The account corresponding to the access data whose Euclidean distance between the Euclidean distance and the space base point is greater than or equal to the second preset distance in the multidimensional space is determined as an abnormal account, and the space base point is a point with a value of [1,...,1], The [1,...,1] is M-dimensional data.

Optionally, the second preset value may be, for example, one-half or one-third. Optionally, the second preset distance can be manually set, or the device can be set by default.

For multi-dimensional data, after constructing a multi-dimensional space according to the aforementioned one-dimensional data for all dimensions, calculate the Euclidean distance between the target point and the space base point (ie [1,...,1]) to determine the probability of abnormal points. The length is used as the criterion. The longer the distance, the greater the probability that the corresponding account is an abnormal account, and the shorter the distance, the smaller the probability that the corresponding account is an abnormal account.

Taking the number of visits as an example, the number of visits of N accounts to a certain URL within 1 minute is obtained, and the number of visits of N accounts is checked by Gaussian to obtain a one-dimensional space. As shown in FIG. 3A, it is a schematic diagram of a one-dimensional space provided by an embodiment of the present application. One coordinate axis of the one-dimensional space represents the distribution value, and the distribution value can normalize the original data (that is, the number of logins obtained by statistics) to an interval of 0-1.

For multiple access types, the access data corresponding to the multiple access types of N accounts can be mapped to a multidimensional space. For example, the number of times N accounts have logged in (visited) the target URL in 1 minute and the number of times N accounts have inquired in 1 minute (for example, it can be the number of times the insurance system website (or URL) corresponding to the inquiry has been logged in) These two dimensions create a two-dimensional space. One axis in the two-dimensional space represents the number of logins to the target URL within 1 minute, and the other axis represents the number of inquiries within 1 minute. The two-dimensional space may be as shown in FIG. 3B, for example. In Figure 3B, the number of logins and the number of inquiries are both normalized to the 0-1 interval. For another example, the number of times that N accounts log in to the target URL within 1 minute, the number of times that N accounts have inquired in 1 minute (for example, the number of times that the insurance system website (or URL) corresponding to the inquiry is logged in), and N The three dimensions of the number of times that an account is retrieved within 1 minute (for example, the number of times that the corresponding insurance system website (or URL) is logged in and retrieved) are used to establish a three-dimensional space. One axis in the three-dimensional space represents the number of logins to the target URL within 1 minute, the other axis represents the number of inquiries within 1 minute, and the other axis represents the number of retrievals within 1 minute. The more access types are set, the more dimensions of the multidimensional space that can be mapped.

Optionally, for the access data of the same access type in different preset times, the access data of N accounts in different preset times may also be mapped into a multi-dimensional space. For example, the two dimensions of the number of times N accounts have logged in to the target URL in 1 second and the number of times N accounts have logged in to the target URL in 1 minute can be used to establish a multidimensional space. One axis in the multidimensional space represents the number of logins to the target URL in 1 second, and the other axis represents the number of logins to the target URL in 1 minute. The two-dimensional space may be as shown in FIG. 3B, for example. In FIG. 3B, the number of logins to the target URL within 1 second and the number of logins to the target URL within 1 minute are both normalized to a range of 0-1. For another example, the number of times N accounts log in to the target URL in 1 second, the number of times N accounts log in to the target URL in 1 minute, and the number of times N accounts log in to the target URL in 1 hour to build a multi-dimensional space. One axis in the multidimensional space represents the number of logins to the target URL within 1 second, the other axis represents the number of logins to the target URL within 1 minute, and the other axis represents the number of logins to the target URL within 1 hour. The more the number of preset times is set, the more the number of dimensions of the multidimensional space that can be mapped.

Optionally, it is also possible to map the access data of multiple access types in multiple preset times to a multidimensional space. For example, the number of times N accounts log in to the target URL in 1 second, the number of times N accounts log in to the target URL in 1 minute, and the number of times N accounts have inquired in 1 minute (for example, can be corresponding to login inquiry The four dimensions of the number of insurance system URLs (or URLs) and the number of inquiries for N accounts within 1 hour (for example, the number of times the insurance system URLs (or URLs) corresponding to the inquiries are logged in) are four dimensions to create a multidimensional space. The multi-dimensional space can be four-dimensional. One axis represents the number of logins to the target URL within 1 second, the other axis represents the number of logins to the target URL within 1 minute, the other axis represents the number of inquiries within 1 minute, and the fourth axis represents 1 The number of inquiries in an hour.

Step S203: Determine the account corresponding to the abnormally distributed access data in the [0,1] interval as the abnormal account, and the abnormally distributed access data is the distribution of the access data of at least half of the N accounts Different access data.

As shown in Figure 3A, in Figure 3A, the number of times the N accounts have logged in to the target URL within 1 minute are all within the range of 0-1. Among them, the closer the account is to 0, the more abnormal, the closer the account is to 1, the more Normally, as shown in Figure 3A, the access times of most accounts are distributed around 1 (for example, the access times of most accounts do not exceed 10,000 times, distributed around 1), while the access times of a few accounts are Distributed near 0 (for example, a small number of accounts have been accessed more than 100,000 times, distributed near 0), it can be characterized that accounts distributed near 0 are abnormal accounts.

Similarly, for multi-dimensional access data, a multi-dimensional space is obtained, and for each dimension, points with abnormal distribution can be identified. For example, if each account is an M-dimensional vector (for example, the M-dimensional vector includes: the number of logins to a key URL in one minute during working hours, the maximum number of logins to a key URL in one minute during non-working hours, and work One-minute inquiry quantity within time, one-minute inquiry quantity during non-working hours, one-minute retrieval quantity during working hours, one-minute retrieval quantity within non-working hours, one-minute insurance tracking quantity within working hours, and non-working hours Any number of insurance tracking quantity in one minute during working hours), then N accounts have a total of N*M access data, these N accounts are distributed in the M-dimensional space coordinate system, according to the target point and the space base point The Euclidean distance between ([1,...,1]) determines the anomalous point. The greater the Euclidean distance from the space base point (1,1,1,...,1), the greater the probability that the anomalous point is, The smaller the Euclidean distance from the base point (1,1,1,...,1) is, the smaller the probability of being an abnormal point is. A threshold can be set, and if the Euclidean distance from the space base point exceeds the threshold, it is determined to be an abnormal account. As shown in Figure 3B, assuming that most (more than half) of the accounts are distributed near (1,1,1,...,1), and a small number of accounts are distributed near (0,0,0,...,0), The accounts distributed near (0,0,0,...,0) are the accounts accessed abnormally. Or only consider the Euclidean distance of each account from the space base point (1,1,1,...,1). The larger the distance, the higher the anomaly score.

In an alternative embodiment, for a certain type of access, it may also be subdivided based on the time dimension. For example, for the access type of login times, you can sequentially count the number of times N accounts log in to a URL within 1 second, the number of times N accounts log in to a URL within 1 minute, and the number of times N accounts log in to a URL within 1 day. Number of times, the number of times that N accounts log in to a certain URL in a week, and 4 sets of visit times are obtained. The 4 sets of visit times are used to establish a 4-dimensional space coordinate to obtain a multidimensional space of N accounts. The respective abnormal points in the 4-dimensional space coordinates are determined as the accounts of abnormal access. For each type of access data, it can be divided into multiple sets of data based on the time dimension, and finally a multi-dimensional space is created based on multiple sets of data divided into multiple access data, and abnormal points in the multi-dimensional space are confirmed as abnormal accounts. For example, each account is a 5-dimensional vector, and data in two time periods are selected for each feature, for example, within 1 second and within 1 minute, a total of 10*5*2 visits for 10 accounts Data, these 10 accounts are distributed in a 10-dimensional space coordinate system, determined according to the Euclidean distance between the target point and the space base point (1,1,1,1,1,1,1,1,1,1) For the abnormal account corresponding to the abnormal point, the longer the distance is, the greater the probability of the abnormal point.

After the abnormal account is determined, the abnormal account can be added to the blacklist. When the access request initiated by the abnormal account is received next time, the access request is rejected.

Optionally, after detecting the abnormal account, identify the IP address or domain name of the abnormal account, and set other accounts whose IP address and the IP address of the abnormal account are in the same network segment or the domain name of the abnormal account are the same as the abnormal account Add to the blacklist. Or, set other accounts whose IP address and the IP address of the abnormal account are in the same network segment or whose domain name is the same as the domain name of the abnormal account as the suspected abnormal account, count the suspected abnormal account, and generate a table for output. The operator can Focus on accounts that are suspected of being abnormal.

In specific implementation, the process of detecting abnormal accounts can be performed periodically. For example, testing once a week, or testing once a month. In each abnormal account detection, Gaussian distribution can be performed based on the latest data in the system. For example, if abnormal account detection is performed on January 8, the access data of each account during the week from January 1 to January 7 can be found in the system. Gaussian distribution and abnormal account detection based on the latest access data can be monitored in time The abnormal accounts in the recent period can prevent the privacy data in the system from being stolen or leaked in time.

Compared with the prior art, the embodiment of the present application does not need to manually set a "warning line", nor does it need to provide "abnormal" samples in advance, and can automatically identify accounts with abnormal access behaviors. The traditional method of monitoring abnormal behaviors has been changed. The Gaussian kernel algorithm is used to automatically identify the abnormal accounts in an unsupervised way, and for a certain access data, it can be layered from different time dimensions (for example, statistics for one minute). The number of internal visits, the number of visits in an hour, the number of visits in a day), a feature is divided into multiple dimensions according to the time dimension, and then high-dimensional space mapping is performed to find the abnormal account more accurately.

Referring to FIG. 4, FIG. 4 shows a schematic structural diagram of an abnormal account detection device. As shown in FIG. 4, the abnormal account detection device 400 includes: an acquisition unit 401, a mapping unit 402 and a determination unit 403.

Wherein, the obtaining unit 401 obtains N sets of access data for N accounts to access the target website within a preset time, each of the N sets of access data is M-dimensional data, and N and M are both positive integers;

The mapping unit 402 is configured to map the data of the N groups of access data in each dimension to the interval [0,1] by using a Gaussian kernel function;

The determining unit 403 is configured to determine the account corresponding to the abnormally distributed access data in the [0,1] interval as the abnormal account, and the abnormally distributed access data is related to at least half of the N accounts Access data is distributed with different access data.

In a possible design, M is equal to 1, that is, the access data is one-dimensional data; the mapping unit 402 is specifically configured to:

The determining unit 403 is specifically configured to:

The account corresponding to the access data whose distance from the value 0 in the one-dimensional space is less than or equal to the first preset distance is determined as an abnormal account.

In a possible design, M is greater than or equal to 2, that is, the access data is multi-dimensional data; the mapping unit 402 is specifically configured to:

Performing Gaussian kernel transformation processing according to the central value and the scale parameter to obtain a multi-dimensional space, in which the data of the N groups of access data in each dimension are distributed between 0-1 values;

The determining unit 403 is specifically configured to:

In a possible design, the device 400 further includes:

The adding unit is used to add the abnormal account to the blacklist after the determining unit 403 determines that the account corresponding to the abnormally distributed access data in the interval [0,1] is the abnormal account, and the abnormal account is received next time When the access request is initiated by the abnormal account, the access request is rejected.

In a possible design, the device 400 further includes:

The adding unit is configured to identify the Internet Protocol IP address or domain name of the abnormal account after the determining unit 403 determines the account corresponding to the abnormally distributed access data in the interval [0,1] as the abnormal account, Setting other accounts whose IP address and the IP address of the abnormal account are on the same network segment or whose domain name is the same as the domain name of the abnormal account as abnormal accounts and added to the blacklist;

Or, set other accounts whose IP address and the IP address of the abnormal account are in the same network segment or whose domain name is the same as the domain name of the abnormal account as the suspected abnormal account, collect statistics on the suspected abnormal account, and generate a table Perform output.

In a possible design, the preset time includes multiple, and the M-dimensional data corresponding to the target account in the N accounts includes that the target account accesses the target website within the multiple preset times Access data.

In a possible design, the preset time includes a preset time corresponding to a working time period and/or a preset time corresponding to a non-working time period; the preset time includes one second, one minute, and one hour , One day or one week.

In one possible design, the access type includes inquiry, retrieval or insurance tracking.

In a possible design, the acquiring unit 401 is configured to access the access data of the N accounts of the target website within a preset time, including:

Obtain access data for N accounts to access the target website within a preset time according to a preset period.

It should be noted that, for the specific implementation process of the abnormal account detection device 400, reference may be made to the related description of the method embodiment shown in FIG. 2, which will not be repeated here.

In another embodiment of the present application, a computer non-volatile readable storage medium is provided. The computer non-volatile readable storage medium stores a computer program. The computer program includes program instructions. Realized when executed by the processor.

If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer non-volatile readable storage medium. Based on this understanding, the technical solution of this application is essentially or the part that contributes to the existing technology, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium It includes several instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disk and other media that can store program code .

In the above embodiments, it may be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in the form of a computer program product in whole or in part. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer non-volatile readable storage medium, or transmitted from one computer non-volatile readable storage medium to another computer non-volatile readable storage medium, for example, the computer instructions It can be from one website site, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL) or wireless (such as infrared, wireless, microwave, etc.) to another website site, Computer, server or data center for transmission. The computer non-volatile readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or data center integrated with one or more available media. The usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, and a magnetic tape), an optical medium (for example, a digital versatile disc (DVD), a semiconductor medium (for example, a solid state disk, SSD), etc.

The specific implementations described above further describe the purpose, technical solutions and beneficial effects of the embodiments of this application in further detail. It should be understood that the above descriptions are only specific implementations of the embodiments of this application and are not intended to To limit the protection scope of the embodiments of the application, any modification, equivalent replacement, improvement, etc. made on the basis of the technical solutions of the embodiments of the application shall be included in the protection scope of the embodiments of the application.

Claims

An abnormal account detection method, characterized by comprising:

Acquire N sets of access data for N accounts to access the target website within a preset time, each of the N sets of access data is M-dimensional data, and N and M are both positive integers;

Using Gaussian kernel function to map the data of the N groups of access data in each dimension to the interval [0,1];

The account corresponding to the abnormally distributed access data in the [0,1] interval is determined to be an abnormal account, and the abnormally distributed access data is an access that is different from the access data distribution of at least half of the N accounts data.
The method according to claim 1, characterized in that M is equal to 1; said using a Gaussian kernel function to map the data of the N groups of access data in each dimension to the interval [0,1] comprises:

A hinge function is used to perform a preliminary transformation on the N sets of access data. If the target access data in the N sets of access data is greater than the mode of the N access data, the value of the target access data is set to all The difference between the target access data and the mode;

If the target access data in the N sets of access data is less than or equal to the mode in the N access data, then the value of the target access data is set to 0;

Determining the central value of the Gaussian kernel transformation according to the mode in the N sets of access data after the preliminary transformation;

Determining the scale parameter of the Gaussian kernel transformation according to the product of the difference between the maximum value and the minimum value in the N sets of access data after the preliminary transformation and a first preset value;

Performing Gaussian kernel transformation processing according to the central value and the scale parameter to obtain a one-dimensional space, in which the N groups of access data are all distributed between 0-1 values;

The determining the account corresponding to the abnormally distributed access data in the interval [0,1] as the abnormal account includes:

The account corresponding to the access data whose distance from the value 0 in the one-dimensional space is less than or equal to the first preset distance is determined as an abnormal account.
The method according to claim 1, wherein M is greater than or equal to 2; said using a Gaussian kernel function to map the data of the N groups of access data in each dimension to the interval [0,1] comprises:

A hinge function is used to perform a preliminary transformation of the N sets of access data in each dimension, if the value of the target access data in the N sets of access data in the target dimension is greater than the value of the N access data in the target dimension The mode of the target access data, the value of the target access data in the target dimension is set as the difference between the value of the target access data in the target dimension and the mode;

If the target access data in the N sets of access data in the target dimension is less than or equal to the mode of the N access data in the target dimension, then the target access data in the target dimension The value is set to 0;

Determining the central value of the Gaussian kernel transformation according to the mode of the N sets of access data in the target dimension after each dimension has undergone a numerical change;

Determine the scale parameter of the Gaussian kernel transformation according to the product of the difference between the maximum value and the minimum value of the N sets of access data in the target dimension and a second preset value after each dimension has undergone a numerical change;

Performing Gaussian kernel transformation processing according to the central value and the scale parameter to obtain a multi-dimensional space, in which the data of the N groups of access data in each dimension are distributed between 0-1 values;

The determining the account corresponding to the abnormally distributed access data in the interval [0,1] as the abnormal account includes:

The account corresponding to the access data whose Euclidean distance between the Euclidean distance and the space base point is greater than or equal to the second preset distance in the multidimensional space is determined as an abnormal account, and the space base point is a point with a value of [1,...,1], The [1,...,1] is M-dimensional data.
The method according to any one of claims 1 to 3, wherein the preset time includes multiple, and the M-dimensional data corresponding to the target account in the N accounts includes the target account in the multiple Access data for accessing the target website within a preset time.
The method according to claim 4, wherein the obtaining N sets of access data for N accounts to access the target website within a preset time comprises:

Obtaining access data of the N accounts for accessing the target website within the multiple preset times.
The method according to any one of claims 1 to 3, wherein after determining the account corresponding to the abnormally distributed access data in the interval [0,1] as the abnormal account, the method further comprises:

The abnormal account is added to the blacklist, and the access request is rejected when the access request initiated by the abnormal account is received next time.
The method according to any one of claims 1 to 3, wherein after determining the account corresponding to the abnormally distributed access data in the interval [0,1] as the abnormal account, the method further comprises:

The Internet Protocol IP address or domain name of the abnormal account is identified, and other accounts whose IP address and the IP address of the abnormal account are in the same network segment or whose domain name is the same as the domain name of the abnormal account are set as abnormal accounts and added to Blacklist

Or, set other accounts whose IP address and the IP address of the abnormal account are in the same network segment or whose domain name is the same as the domain name of the abnormal account as the suspected abnormal account, collect statistics on the suspected abnormal account, and generate a table Perform output.
The method according to any one of claims 1 to 3, wherein the preset time includes a preset time corresponding to a working time period and/or a preset time corresponding to a non-working time period; the preset time Including any of one second, one minute, one hour, one day, or one week.
The method according to any one of claims 1 to 3, wherein the obtaining N sets of access data for N accounts to access the target website within a preset time includes:

Obtain access data for the N accounts to access the target website within the preset time according to a preset period.
An abnormal account detection device, characterized by comprising:

The obtaining unit is configured to obtain N sets of access data for N accounts to access the target website within a preset time, each of the N sets of access data is M-dimensional data, and N and M are both positive integers;

A mapping unit for mapping the data of the N groups of access data in each dimension to the interval [0,1] by using a Gaussian kernel function;

The determining unit is configured to determine the account corresponding to the abnormally distributed access data in the [0,1] interval as the abnormal account, and the abnormally distributed access data is access to at least half of the N accounts The data is distributed with different access data.
The device according to claim 10, wherein M is equal to 1, and the mapping unit is specifically configured to:

A hinge function is used to perform a preliminary transformation on the N sets of access data. If the target access data in the N sets of access data is greater than the mode of the N access data, the value of the target access data is set to all The difference between the target access data and the mode;

If the target access data in the N sets of access data is less than or equal to the mode in the N access data, then the value of the target access data is set to 0;

Determining the central value of the Gaussian kernel transformation according to the mode in the N sets of access data after the preliminary transformation;

Determining the scale parameter of the Gaussian kernel transformation according to the product of the difference between the maximum value and the minimum value in the N sets of access data after the preliminary transformation and a first preset value;

Performing Gaussian kernel transformation processing according to the central value and the scale parameter to obtain a one-dimensional space, in which the N groups of access data are all distributed between 0-1 values;

The determining unit is specifically used for:

The account corresponding to the access data whose distance from the value 0 in the one-dimensional space is less than or equal to the first preset distance is determined as an abnormal account.
The apparatus according to claim 10, wherein M is greater than or equal to 2; and the mapping unit is specifically configured to:

A hinge function is used to perform a preliminary transformation of the N sets of access data in each dimension, if the value of the target access data in the N sets of access data in the target dimension is greater than the value of the N access data in the target dimension The mode of the target access data, the value of the target access data in the target dimension is set as the difference between the value of the target access data in the target dimension and the mode;

If the target access data in the N sets of access data in the target dimension is less than or equal to the mode of the N access data in the target dimension, then the target access data in the target dimension The value is set to 0;

Determining the central value of the Gaussian kernel transformation according to the mode of the N sets of access data in the target dimension after each dimension has undergone a numerical change;

Determine the scale parameter of the Gaussian kernel transformation according to the product of the difference between the maximum value and the minimum value of the N sets of access data in the target dimension and a second preset value after each dimension has undergone a numerical change;

Performing Gaussian kernel transformation processing according to the central value and the scale parameter to obtain a multi-dimensional space, in which the data of the N groups of access data in each dimension are distributed between 0-1 values;

The determining unit is specifically used for:

The account corresponding to the access data whose Euclidean distance between the Euclidean distance and the space base point is greater than or equal to the second preset distance in the multidimensional space is determined as an abnormal account, and the space base point is a point with a value of [1,...,1], The [1,...,1] is M-dimensional data.
The device according to any one of claims 10 to 12, wherein the preset time includes multiple, and the M-dimensional data corresponding to the target account in the N accounts includes the target account in the multiple Access data for accessing the target website within a preset time.
The device according to claim 13, wherein the acquiring unit is specifically configured to:

Obtaining access data of the N accounts for accessing the target website within the multiple preset times.
The device according to any one of claims 10 to 12, wherein after the determining unit determines that the account corresponding to the abnormally distributed access data in the interval [0,1] is an abnormal account, the method further comprises:

The adding unit is configured to add the abnormal account to the blacklist, and reject the access request when the access request initiated by the abnormal account is received next time.
The device according to any one of claims 10 to 12, wherein after the determining unit determines that the account corresponding to the abnormally distributed access data in the interval [0,1] is an abnormal account, the method further comprises:

The adding unit is configured to identify the Internet Protocol IP address or domain name of the abnormal account, and locate the IP address and the IP address of the abnormal account in the same network segment or other accounts whose domain name is the same as the domain name of the abnormal account Set it as an abnormal account and add it to the blacklist;

Alternatively, it is used to set other accounts whose IP address is in the same network segment as the IP address of the abnormal account or whose domain name is the same as the domain name of the abnormal account as a suspected abnormal account, perform statistics on the suspected abnormal account, and Generate a table for output.
The device according to any one of claims 10 to 12, wherein the preset time includes a preset time corresponding to a working time period and/or a preset time corresponding to a non-working time period; the preset time Including any of one second, one minute, one hour, one day, or one week.
The device according to any one of claims 10 to 12, wherein the acquiring unit is specifically configured to:

Obtain access data for the N accounts to access the target website within the preset time according to a preset period.
A computer non-volatile readable storage medium, wherein a computer program is stored on the computer non-volatile readable storage medium. The abnormal account detection method described above.
A computer device, characterized by comprising: one or more processors; a memory; one or more application programs, wherein the one or more application programs are stored in the memory and configured to be used by the One or more processors are executed, and the one or more application programs are configured to execute the abnormal account detection method according to any one of claims 1 to 9.