WO2023109046A1

WO2023109046A1 - Anomaly detection method and apparatus, electronic device, and storage medium

Info

Publication number: WO2023109046A1
Application number: PCT/CN2022/098734
Authority: WO
Inventors: 杨春保; 卢道和; 谢波; 朱敏毅
Original assignee: 深圳前海微众银行股份有限公司
Priority date: 2021-12-14
Filing date: 2022-06-14
Publication date: 2023-06-22
Also published as: CN114386025A

Abstract

The present application discloses an anomaly detection method and apparatus, an electronic device, and a storage medium. The method comprises: on the basis of a first access log, determining a first feature value corresponding to a first access address, and determining a first number of occurrences corresponding to the first feature value in each set dimension among at least one set dimension, the first access address representing an access address in any access information in the first access log and being used for accessing any set service system among at least two set service systems, and the first access log being used for recording, in real time, access information of an access request via a built-in application program interface (API) gateway within a unit duration; and on the basis of the first number of occurrences corresponding to the first feature value in each set dimension, and on the basis of a historical number of occurrences corresponding to the first feature value in each set dimension corresponding to each unit duration within a set statistical period, determining whether the first access address is abnormal.

Description

Abnormality detection method, device, electronic device and storage medium

Cross References to Related Applications

This application is based on the Chinese patent application with application number 202111526821.5 and the filing date is December 14, 2021, and claims the priority of the above-mentioned Chinese patent application. The entire content of the above-mentioned Chinese patent application is hereby incorporated by reference into this application.

technical field

The present application relates to the field of computer technology, and in particular to an anomaly detection method, device, electronic equipment and storage medium.

Background technique

With the development of computer technology, more and more technologies, such as blockchain (Blockchain), big data, distributed and other technologies are applied in the financial field, and the traditional financial industry is gradually transforming into financial technology. However, due to financial The security and real-time requirements of the industry, and financial technology also put forward higher requirements for technology. In the field of financial technology, in the scenario of tracking cross-system user behavior, when each business system detects that the user visits the corresponding system page, it records the user's operation and integrates it into the business system to collect user behavior. The log software development kit (SDK, Software Development Kit) reports user behavior logs to the log server; the log server analyzes the user behavior logs reported by each business system, determines the abnormal behavior corresponding to each business system, and determines the The abnormal behavior is sent to the corresponding system so that the corresponding business system can handle the abnormal behavior. However, in related technologies, the determined abnormal behavior is inaccurate and has poor timeliness.

Contents of the invention

To solve related technical problems, embodiments of the present application provide an anomaly detection method, device, electronic equipment, and storage medium.

The embodiment of the present application provides an anomaly detection method, including:

Based on the first access log, determine the first feature value corresponding to the first access address, and determine the first number of occurrences of the first feature value corresponding to each set dimension in at least one set dimension; An access address represents an access address in any access information in the first access log, and is used to access any one of at least two set business systems; the first access log is used for real-time recording The access information of the access request via the built-in application programming interface (Application Programming Interface, API) gateway within the unit time;

Based on the first number of occurrences corresponding to the first feature value in each set dimension, and based on the historical number of occurrences of the first feature value corresponding to each unit duration in the set statistical period in each set dimension , to determine whether the first access address is abnormal; wherein, the first feature value corresponding to each unit time length in the set statistical period is determined based on the history log corresponding to the corresponding unit time length.

In the above solution, the access information at least includes user identification, access time and access address; determining the characteristic value corresponding to the access address includes:

Based on the access information in the second access log, determine the first sequence corresponding to the first user; wherein, the second access log includes the first access log or the historical access corresponding to each unit duration within the set statistical period log; the first sequence includes all access addresses corresponding to the first user in the second access log;

In the first sequence corresponding to the first user, determine the second sequence corresponding to the first user; the second sequence includes at least one access address;

Based on the second sequence corresponding to the first user, the hash value is calculated to obtain the feature value corresponding to the access address at the set position in the second sequence corresponding to the first user.

In the above scheme, the calculation of the hash value includes:

In the case that the time interval between the third access address and the second access address is greater than or equal to the set duration, the third access address in the second sequence is replaced with the set character string; wherein, the second access address represents the first The access address at the set position in the second sequence, the third access address represents any access address adjacent to the second access address in the second sequence;

A hash value is calculated based on the updated second sequence.

In the above solution, the second sequence includes three access addresses, and the set position represents an intermediate position.

In the above solution, the access information also includes the department to which the user belongs, the position of the user, and the identification of the terminal device sending the access address;

The at least one set dimension includes at least one of the following:

The first dimension represents the number of occurrences of statistical feature values by user;

The second dimension represents the number of occurrences of statistical feature values by department;

The third dimension represents the number of occurrences of statistical feature values by position;

The fourth dimension represents the statistics of the number of occurrences of the same feature value based on the terminal equipment used by the user.

In the above solution, the determining whether the first access address is abnormal includes:

Based on the first number of occurrences corresponding to the first feature value in each set dimension, and based on the historical number of occurrences of the first feature value corresponding to each unit duration in the set statistical period in each set dimension , determining the first score corresponding to the first feature value in each set dimension within each unit duration;

A plurality of second scores corresponding to the first access address are determined based on the first score corresponding to the first feature value of each unit duration in each set dimension; wherein each second score is based on each The first eigenvalues within the unit duration are determined by the first scores corresponding to all the set dimensions;

Based on the plurality of second scores corresponding to the first access address, it is determined whether the first access address is abnormal.

In the above solution, the determination of the first score corresponding to the first feature value in each set dimension within each unit duration includes:

Based on the historical occurrence times of the first feature value corresponding to the first unit time length in the first set dimension, determine the second occurrence of the first feature value corresponding to the first set dimension within the first unit time length The number of times; the first set dimension represents any set dimension in the at least one set dimension; the first unit duration represents any unit duration in the set statistical cycle;

Based on the first number of occurrences of the first feature value corresponding to the first set dimension and the second number of occurrences of the first feature value corresponding to the first set dimension within the first unit duration, and based on the first set dimension The maximum historical number of occurrences of a feature value in the set statistical period and the second number of occurrences of the first feature value in the first set dimension corresponding to the first unit time length are determined to determine The first score corresponding to the first feature value in the first set dimension.

In the above solution, the determination of the second occurrence times corresponding to the first feature value in the first set dimension within the first unit duration includes one of the following:

The first characteristic value of the first unit duration is determined based on the ratio of the historical occurrence times of the first characteristic value corresponding to the first set dimension in the first unit duration to the total number of the unit duration within the set statistical period The second number of occurrences corresponding to the first set dimension;

Based on the historical occurrence times corresponding to the first feature value in the first set dimension in each unit time length, and the weight corresponding to the first feature value in each unit time length, determine all the first feature values in the first unit time length The second number of occurrences corresponding to the first feature value in the first set dimension; wherein,

In a case where the time corresponding to the first unit duration is later than the time corresponding to the second unit duration, the weight corresponding to the first unit duration is greater than the weight corresponding to the second unit duration.

In the above solution, the determination of the first score corresponding to the first feature value in the first set dimension within the first unit duration includes one of the following:

In the case where the first difference is equal to zero, a first score corresponding to the first feature value in the first set dimension within the first unit time length is determined based on the set score;

In the case where the first difference is not equal to zero, based on the ratio of the second difference to the first difference, determine the first score corresponding to the first feature value in the first set dimension within the first unit time length;

Wherein, the first difference represents the maximum number of historical occurrences corresponding to the first feature value in the set statistical period and the first feature value corresponding to the first set dimension within the first unit duration the difference between the second occurrences;

The second difference represents the first number of appearances corresponding to the first feature value in the first set dimension and the second number of appearances corresponding to the first feature value in the first set dimension within the first unit duration Difference.

In the above solution, the determination of the first score corresponding to the first feature value in the first set dimension within the first unit time length based on the set score includes one of the following:

In the case where the maximum number of historical occurrences corresponding to the first feature value is greater than zero, the first set score corresponding to the first set dimension is determined as the first feature value within the first unit time length within the first Set the first score corresponding to the dimension;

In the case that the maximum number of historical occurrences corresponding to the first feature value is equal to zero and the first access address exists, the second set score is determined as the first feature value within the first unit duration within the first Set the first score corresponding to the dimension.

In the above solution, the determination of the first score corresponding to the first feature value in the first set dimension within the first unit duration based on the ratio of the second difference to the first difference includes one of the following:

In the case where the ratio of the second difference to the first difference is less than or equal to zero, it is determined that the first fraction corresponding to the first feature value in the first set dimension within the first unit time length is zero;

In the case where the ratio of the second difference to the first difference is greater than zero, the quotient of the second difference to the first difference is determined as the first characteristic value within the first unit time length in the first setting The first fraction corresponding to the dimension.

In the above scheme, the multiple second scores corresponding to the first access address are determined based on the first scores corresponding to the first feature value in each set dimension within each unit duration, including:

In the case where the number of dimensions is set to 1, the first score corresponding to the first feature value in the first set dimension within the first unit duration is determined as the first access address in the first unit duration the corresponding second fraction;

When the number of set dimensions is greater than 1, based on the first score corresponding to the first feature value in each set dimension within the first unit time length and the set weight of each set dimension, determine the The second fraction corresponding to the first access address in the first unit duration.

In the above scheme, the method also includes:

In the case that the first access address is abnormal, the access operation corresponding to the first access address is blocked, and/or, access restriction is performed on the terminal device sending the first access address.

The embodiment of the present application also provides an abnormality detection device, including:

The first determination unit is configured to determine the first feature value corresponding to the first access address based on the first access log, and determine the first feature value corresponding to each set dimension in at least one set dimension. A number of occurrences; the first access address represents the access address in any access information in the first access log, and is used to access any one of the at least two set service systems; the first An access log is used to record the access information of the access request via the built-in application program interface API gateway in real time within the unit duration;

The second determining unit is configured to be based on the first occurrence times corresponding to the first feature value in each set dimension, and based on the first feature value corresponding to each unit time length in the set statistical period in each set Determine whether the first access address is abnormal by determining the number of historical occurrences corresponding to the dimension; wherein, the first characteristic value corresponding to each unit time length in the set statistical period is determined based on the historical log corresponding to the corresponding unit time length.

An embodiment of the present application also provides an electronic device, including: a processor and a memory configured to store a computer program that can run on the processor,

Wherein, the processor is configured to execute the steps of the above abnormality detection method when running the computer program.

The embodiment of the present application also provides a storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above abnormality detection method are implemented.

In this embodiment of the present application, based on the first access log, the first feature value corresponding to the first access address is determined, and the first feature value corresponding to each set dimension in at least one set dimension is determined. The number of occurrences; based on the first occurrences corresponding to the first feature value in each set dimension, and based on the first feature value corresponding to each unit duration in the set statistical period in each set dimension The number of historical occurrences determines whether the first access address is abnormal. In this way, the access request to the business system via the built-in API gateway can be directly detected, and the first access log is generated based on the access information of the detected access request. Since there is no need for each business system to report the access log, the timeliness of collecting the access log is improved Therefore, the timeliness of anomaly detection is improved; since the number of occurrences corresponding to the first eigenvalue can reflect the user's behavior habits, this solution can improve the accuracy of anomaly detection results.

Description of drawings

FIG. 1 is a schematic diagram of an implementation process of an anomaly detection method in the related art;

FIG. 2 is a schematic diagram of the implementation flow of the abnormality detection method provided by the embodiment of the present application;

FIG. 3 is a schematic diagram of an implementation flow for determining a characteristic value corresponding to an access address provided in an embodiment of the present application;

FIG. 4 is a schematic diagram of an implementation flow for determining whether the first access address is abnormal according to an embodiment of the present application;

FIG. 5 is a schematic diagram of an implementation process for determining the first score provided by the embodiment of the present application;

FIG. 6 is a schematic diagram of the implementation flow of the abnormality detection method provided by the application embodiment of the present application;

FIG. 7 is a schematic diagram of an abnormality detection system provided by an embodiment of the present application;

FIG. 8 is a schematic structural diagram of an abnormality detection device provided in an embodiment of the present application;

FIG. 9 is a schematic diagram of a hardware composition structure of an electronic device provided by an embodiment of the present application.

Detailed ways

As shown in Figure 1, in related technologies, each business system needs to integrate an SDK for collecting user behavior logs, which makes the cost of collecting user behavior logs relatively high; each business system needs to report user behavior to the log server through its own integrated SDK. Behavior logs, which makes the timeliness of collecting user behavior logs poor. In addition, the log server analyzes the user behavior logs reported by various business systems based on rules set according to human experience, so as to determine abnormal behaviors, which leads to low accuracy in determining the analyzed abnormal behaviors.

Based on this, the present application provides an anomaly detection method. Based on the first access log, the first feature value corresponding to the first access address is determined, and each of the first feature values in at least one set dimension is determined. Set the first number of occurrences corresponding to the dimension; based on the first number of occurrences corresponding to the first feature value in each set dimension, and based on the first feature value corresponding to each unit duration in the set statistical period in The historical occurrence times corresponding to each set dimension determine whether the first access address is abnormal. In this way, the access request to the business system via the built-in API gateway can be directly detected, and the first access log is generated based on the access information of the detected access request. Since there is no need for each business system to report the access log, the timeliness of collecting the access log is improved Therefore, the timeliness of anomaly detection is improved; since the number of occurrences corresponding to the first eigenvalue can reflect the user's behavior habits, this solution can improve the accuracy of anomaly detection results.

In order to make the purpose, technical solution and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present application, and are not intended to limit the present application.

FIG. 2 is a schematic diagram of an implementation flow of an anomaly detection method provided by an embodiment of the present application, wherein the execution subject of the flow is electronic equipment such as a terminal device and a server. As shown in Figure 2, the anomaly detection method includes:

Step 201: Based on the first access log, determine the first feature value corresponding to the first access address, and determine the first occurrence times of the first feature value corresponding to each set dimension in at least one set dimension; Wherein, the first access address is an access address in any access information in the first access log, and is used to access any one of the at least two set business systems; the first access The log is used to record the access information of the access request via the built-in application program interface API gateway in real time within a unit time.

Here, the electronic device is provided with an API gateway, and the user triggers a login request or an access request related to the setting service system through the terminal device, and reaches the server managing the corresponding setting service system through the API gateway. The access request may be a cross-system access request, or a non-cross-system access request. That is to say, the access request triggered on the interactive interface of any set business system can be used to request access to related functions in the set business system, or to request access to other devices other than the set business system. Determine the relevant functions of the business system. In actual application, the API gateway can be APISIX.

After logging in to the setting business system, the user may click on a relevant function or button on the interactive page of the setting business system to trigger an access request. When the electronic device detects an access request via the API gateway, it writes the access information of the access request into a first access log, and the first access log is used to record in real time the access information carried in the access request via the API gateway within a unit duration, The access information in the first access log is updated in real time. Wherein, the access information includes at least user identification, access time and access address.

In actual application, the unit duration is one day. That is to say, the electronic device creates an access log every day, which is used to record the access information carried in all the access requests detected on that day.

In this embodiment of the application, based on the first access log, the implementation of determining the first feature value corresponding to the first access address includes:

1) Implementation mode 1: If the user behavior of the current business system is tracked:

The electronic device determines a first sequence corresponding to each user identifier based on the access information in the first access log, and the first sequence corresponding to each user identifier includes all access addresses corresponding to the user identifier; The first sequence of the first sequence, determine the feature value corresponding to each access address in the first sequence corresponding to each user identifier. The feature value corresponding to each access address corresponding to each user identifier may be determined based on the corresponding access address, or may be determined based on the corresponding access address, and based on at least one access address adjacent to the corresponding access address in the first sequence out. In practical applications, except for the first access address in the first sequence, based on each of the three adjacent access addresses in the first sequence, it is determined that each of the three adjacent access addresses is in the middle The characteristic value corresponding to the access address of the location. When calculating the eigenvalue corresponding to the first access address in the first sequence, use the set empty string to replace the missing access address, or determine the first access address based on the first access address and the access addresses adjacent to the first access address. The characteristic value corresponding to each access address. It should be noted that the characteristic value represents the characteristic of the access address. Exemplarily, the feature value corresponding to the access address includes a hash value.

The electronic device determines the first feature value corresponding to the first access address from the determined feature values corresponding to the access address; based on the first feature value corresponding to each user, determines that the first feature value is in at least one set dimension The number of first occurrences corresponding to each dimension in .

In practical applications, the first data table can be used to record the access information corresponding to each user, the feature value corresponding to the access address in the access information, and the occurrence times of each feature value within a unit time length. Exemplarily, the first data table is as follows:

In order to increase the number of occurrences corresponding to the counted feature values, thereby improving the accuracy of abnormal detection results, in some embodiments, the access information also includes the department to which the user belongs, the position of the user, and the identification of the terminal device that sends the access address;

The at least one set dimension includes at least one of the following:

The first dimension represents the number of occurrences of feature values by user statistics; that is, based on all feature values corresponding to each user, the number of occurrences of each feature value corresponding to each user is counted;

The second dimension represents the number of occurrences of feature values by department; that is, counts the number of occurrences of each feature value based on all feature values corresponding to each department;

The third dimension represents the number of occurrences of feature values by post; that is, counts the number of occurrences of each feature value based on all feature values corresponding to each post;

The fourth dimension represents the number of occurrences of feature values based on the terminal devices used by users; that is, based on all feature values corresponding to each terminal device, the number of occurrences of each feature value corresponding to each terminal device is counted.

Of course, in actual application, other dimensions can also be set according to actual needs.

2) Embodiment 2: Considering that in the application scenario of tracking the user's cross-system user behavior, the access address sequence corresponding to any function in any business system when the user accesses it is fixed, in order to more accurately determine the abnormality Request, as shown in Figure 3, in some embodiments, the following steps 301 to 303 are used to determine the characteristic value corresponding to each access address:

Step 301: Based on the access information in the second access log, determine the first sequence corresponding to the first user; wherein, the second access log includes the first access log or each unit duration corresponding to the set statistical period historical access logs; the first sequence includes all access addresses corresponding to the first user in the second access log.

Here, the electronic device determines the first sequence corresponding to the first user in the second access log based on the user identifier and access time included in each access information in the second access log. The first user refers to any user in the second access log.

Step 302: From the first sequence corresponding to the first user, determine the second sequence corresponding to the first user; the second sequence includes at least one access address.

Here, the number of access addresses included in the first sequence corresponding to the first user is greater than or equal to the number of access addresses included in the corresponding second sequence.

Step 303: Calculate the hash value based on the second sequence corresponding to the first user, and obtain the characteristic value corresponding to the access address at the set position in the second sequence corresponding to the first user.

Here, the electronic device can calculate a hash value based on each access address in the second sequence corresponding to the first user through a setting algorithm, and obtain the corresponding access address at the set position in the second sequence corresponding to the first user. eigenvalues of . Set the algorithm as the algorithm used to calculate the hash value, including information digest algorithm or hash algorithm. In actual application, the access address includes a domain name and a service system identifier, and may also include a function identifier. Exemplarily, the access address may be http://xxxx/1/2. Among them, xxxx represents the domain name, 1 represents the service system identification, and 2 represents the function identification.

It should be noted that, when the second access log is the first access log, the electronic device determines the first characteristic value corresponding to the first access address by performing steps 301 to 303 . Wherein, the first access address is the access address at the set position in the second sequence.

When the second access log is the historical access log corresponding to each unit duration within the set statistical period, the electronic device determines the corresponding access address corresponding to each unit duration within the set statistical period by performing steps 301 to 303 Eigenvalues.

Considering that in practical applications, if the time interval between two consecutive access requests triggered by the user is long, the access addresses in the two consecutive access requests may be accessed by the user to different functions. Therefore, in order to improve the abnormality detection results The accuracy, in some embodiments, said calculating the hash value includes:

In the case that the time interval between the third access address and the second access address is greater than or equal to the set duration, the third access address in the second sequence is replaced with the set character string; wherein, the second access address represents the second An access address at a set position in the sequence, the third access address represents an access address adjacent to the second access address in the second sequence;

A hash value is calculated based on each access address in the updated second sequence.

Here, the electronic device determines the time interval between the third access address and the second access address based on the access time corresponding to the third access address and the access time corresponding to the second access address; when the calculated time interval is greater than or equal to the set In the case of a fixed length, the third access address in the second sequence is replaced with a set string; and a hash value is calculated based on each updated access address and set string in the second sequence. In actual application, the set string is an empty string set according to the format of the access address. Exemplarily, the set duration is 5 minutes, of course, the set duration can also be set according to the actual situation in actual application.

In actual application, the second sequence includes three access addresses, and the set position represents an intermediate position. In this way, both the calculation amount for calculating the feature value and the accuracy of the abnormality detection result can be taken into account.

Exemplarily, the electronic device may use the formula Vs=MD5(V ₁ +V ₂ +V ₃ ) to calculate the feature value corresponding to the access address V ₂ at the middle position in the second sequence. Wherein, the second sequence is V ₁ V ₂ V ₃ ; MD5 (V ₁ +V ₂ +V ₃ ) represents the characteristic value corresponding to the access address V ₂ calculated through the message digest algorithm 5 (MD5, Message-Digest Algorithm 5).

It should be noted that the API gateway can also be used to call related plug-ins or related services in the electronic device to verify the login request or access request of the set business system. When the access request is verified and passed, the access information carried in the access request is written into the access log.

For example, in the scenario where a user logs in to the first business system using a terminal device, the user enters information such as user name and password on the login interface of the first business system to trigger a login request; when the electronic device detects a login request via the API gateway, , call the first plug-in or the first service in the electronic device through the API gateway, so as to authenticate the login request through the first plug-in or the first service; when the identity verification is passed, the user is allowed to log in to the first business system, and the login The request is sent to the server that manages the first business system; when the identity verification fails, the user is not allowed to log in to the first business system, and a prompt message representing the failure of the identity verification is returned to the terminal device that sent the login request. Wherein, the first service system generally refers to any set service system in at least one set service system; the first plug-in represents a plug-in used for identity verification, and the first service represents a service used for identity verification.

After the user logs in to the first business system, the user can click a relevant function or button on the interactive page of the first business system to trigger an access request. When the electronic device detects an access request via the API gateway, it invokes a second plug-in or a second service in the electronic device through the API gateway, and performs permission verification on the detected access request through the second plug-in or the second service; When the authority verification passes, the user is allowed to access the corresponding function of the first business system, and the access request is sent to the server that manages the first business system; when the authority verification fails, the user is not allowed to access the corresponding function of the first business system, and the The terminal device that sends the access request returns prompt information indicating that there is no access right. The second plug-in represents a plug-in for authorization verification; the second service represents a service for authorization verification.

Wherein, the electronic device stores the user's set access path corresponding to each set business system, the set access path refers to the access path with access authority, and the set access path can be dynamically updated. The process of verifying the authority of the detected access request can be as follows:

Judging whether the detected access request includes the access address, and obtaining a first judgment result; when the first judgment result indicates that the access request includes the access address, search for the set access path corresponding to the user identification included in the access request, and Searching for a set access path that matches the access address included in the access request among the found set access paths; if a matched set access path is found, it is determined that the authority verification is passed. If the first judgment result indicates that the access address is not included in the access request, or no matching set access path is found, it is determined that the authorization verification fails. If the access address is not included in the access request, it indicates that the business system has been attacked by hackers.

Step 202: Based on the first number of occurrences corresponding to the first feature value in each set dimension, and based on the first feature value corresponding to each unit duration in the set statistical period in each set dimension The number of historical occurrences determines whether the first access address is abnormal; wherein, the first characteristic value corresponding to each unit time length in the set statistical period is determined based on the history log corresponding to the corresponding unit time length.

Here, the electronic device determines the first sequence corresponding to each user identifier in each unit duration based on the access information in the historical access log corresponding to each unit duration in the set statistical period; The first sequence corresponding to the duration determines the characteristic value corresponding to each access address of each user ID in the first sequence corresponding to each unit duration; based on each user identifier in the first sequence corresponding to each unit duration, each feature value corresponding to each access address, and determine the historical occurrence times of each feature value corresponding to each set dimension in each unit time length; each feature value in each unit time length corresponds to each set dimension Among the historical occurrence times of the first feature value in each unit time period, the historical occurrence times corresponding to each set dimension are determined.

The electronic device determines whether the first access address is abnormal.

Wherein, when the history occurrence times corresponding to the first characteristic value in any set dimension is zero, it is determined that the first access address is abnormal. Alternatively, when the first feature value corresponding to the first set dimension has a large difference between the first number of occurrences and the corresponding historical number of occurrences, it is determined that the first access address is abnormal. The electronic device may also calculate the first visit based on the first number of appearances corresponding to the first feature value in each set dimension, and based on the historical number of occurrences of the first feature value in each set dimension within each unit of time. The score corresponding to the address, and based on the score corresponding to the first access address, determine whether the first access address is an abnormal address. For example, if the score corresponding to the first access address is greater than or equal to the set threshold, it is determined that the first access address is an abnormal address. If the score corresponding to the first access address is less than the set threshold, it is determined that the first access address is not an abnormal address. The setting threshold is set based on the abnormal access address.

It should be noted that the method for determining the characteristic value corresponding to the access address based on the historical access log is the same as the method for determining the characteristic value corresponding to the access address based on the first access log, and details are not described here.

In order to improve the accuracy of determining the abnormality detection result, as shown in FIG. 4, in some embodiments, the determining whether the first access address is abnormal includes the following steps 401 to 403:

Step 401: Based on the first occurrence times corresponding to the first feature value in each set dimension, and based on the first feature value corresponding to each unit duration in the set statistical period in each set dimension The number of historical occurrences determines the first score corresponding to the first feature value in each set dimension within each unit duration.

Here, the electronic device determines that the first feature value in the set statistical period corresponds to The maximum number of historical occurrences; based on the historical occurrences of the first eigenvalue corresponding to each unit time in each set dimension in the set statistical period, determine the first eigenvalue in each unit time in each set The second number of occurrences corresponding to the given dimension; based on the first number of occurrences corresponding to the first feature value in each set dimension, the maximum historical number of occurrences of the first feature value corresponding to the first set dimension within the set statistical period, and The second occurrence times corresponding to the first feature value of each unit time length in each set dimension determine the first score corresponding to the first feature value in each set dimension within each unit time length.

Wherein, the first set dimension is any set dimension in at least one set dimension.

The second number of occurrences is related to the total number of unit time lengths included in the set statistical period, and/or, the weight corresponding to each unit time length of the first feature value. The later the time corresponding to the unit duration in the set statistical period, the greater the weight corresponding to the unit duration.

In order to determine the first score more accurately, thereby improving the accuracy of the abnormality detection result, as shown in FIG. 5 , in some embodiments, the determined first feature value within each unit time length is The first score corresponding to a set dimension includes the following steps 501 to 502:

Step 501: Based on the historical occurrence times of the first feature value corresponding to the first unit time length in the first set dimension, determine the number of the first feature value corresponding to the first set dimension within the first unit time length The second number of occurrences; the first set dimension characterizes any set dimension in the at least one set dimension; the first unit duration represents any unit time length in the set statistical cycle.

Here, the electronic device determines the first feature value within the first unit time length based on the historical occurrence times corresponding to the first feature value corresponding to the first unit time length in the first set dimension and the total number of unit time lengths included in the set statistical period. The second occurrence count corresponding to the feature value in the first set dimension.

In order to more accurately determine the second number of occurrences, in some embodiments, the determination of the second number of occurrences corresponding to the first feature value in the first set dimension within the first unit duration includes one of the following :

Based on the ratio of the historical occurrence times of the first feature value corresponding to the first set dimension in the first unit time length to the total number of the unit time length in the set statistical period, determine the first feature value in the first unit time length The second number of occurrences corresponding to the value in the first set dimension;

Here, the electronic device determines the ratio of the historical occurrence times corresponding to the first feature value in the first set dimension within the first unit time length to the total number of unit time lengths included in the set statistical period, and based on the determined ratio, determines The second number of occurrences corresponding to the first feature value in the first set dimension within the first unit duration is calculated.

In practical application, it can be based on the formula

Calculate the second number of occurrences corresponding to the first feature value in the first set dimension within the first unit time length.

Among them, C represents the second occurrence number corresponding to the first feature value in the first set dimension within the first unit duration; _Cn represents the historical occurrence number corresponding to the first feature value of the first unit duration in the first set dimension ;m represents the total number of unit duration included in the set statistical period. Of course, in some embodiments, the calculated C may also be adjusted by adjusting parameters, so as to obtain the adjusted C.

The electronic device may also determine the second number of occurrences corresponding to the first feature value in the first set dimension within the first unit duration according to the following method:

The electronic device determines that the first characteristic value corresponding to the first unit duration corresponds to The historical occurrence times of ; based on the historical occurrence times of the first feature value corresponding to the first unit time length in the first set dimension, and the weight corresponding to the first feature value in the first unit time length, determine the The third occurrence times corresponding to the first characteristic value in the first setting dimension; according to this method, the third occurrence times corresponding to the first characteristic value in each unit time length in the first setting dimension are determined.

In the case of determining the third occurrence times corresponding to the first feature value corresponding to each unit duration in the set statistical period in the first set dimension, calculate the sum of all the third occurrence times corresponding to the first feature value, Get the first sum.

The electronic device determines that the first characteristic value within the first unit duration is in the first Sets the second occurrence count corresponding to the dimension. in,

The electronic device may determine the quotient of the third number of appearances corresponding to the first set dimension of the first feature value within the first unit time length and the calculated third sum as the first feature value within the first unit time length. The second number of occurrences corresponding to the set dimension; the electronic device can also use the set adjustment parameters to adjust the determined quotient, and obtain the first characteristic value within the first unit time length corresponding to the second set dimension. The number of occurrences.

Exemplarily, the following formula can be used to determine the second number of occurrences corresponding to the first characteristic value of the first unit duration in the first set dimension:

Among them, C represents the second occurrence number corresponding to the first feature value in the first set dimension within the first unit time length; C _n represents the history corresponding to the first feature value in the first set dimension within the nth unit time length The number of occurrences; g represents the weight corresponding to the first feature value at the nth unit time length; m represents the total number of unit time lengths included in the set statistical period. It should be noted that, in actual application, the above formula can be adjusted by setting coefficients or constants.

Step 502: Based on the first number of occurrences corresponding to the first feature value in the first set dimension and the second number of occurrences of the first feature value corresponding to the first unit duration in the first set dimension, and based on the The maximum historical number of occurrences of the first feature value in the set statistical period and the second number of occurrences of the first feature value in the first set dimension corresponding to the first unit duration, determine the first unit The first score corresponding to the first characteristic value within the duration in the first set dimension.

Here, the electronic device determines the maximum number of historical occurrences corresponding to the first feature value in the set statistical period based on the historical occurrence times corresponding to the first characteristic value corresponding to each unit duration in the first set dimension within the set statistical period .

The electronic device determines the first difference based on the maximum number of historical occurrences corresponding to the first characteristic value in the set statistical period and the second occurrence number corresponding to the first characteristic value in the first set dimension within the first unit duration ;Based on the first number of occurrences corresponding to the first feature value in the first set dimension, and the second number of occurrences corresponding to the second number of occurrences corresponding to the first feature value in the first set dimension within the first unit duration, determine calculating the second difference; based on the determined first difference and the determined second difference, determining the first score corresponding to the first feature value in the first set dimension within the first unit time length.

Wherein, the first difference represents the difference between the maximum historical number of occurrences corresponding to the first feature value in the set statistical period and the second number of occurrences corresponding to the first feature value in the first set dimension within the first unit duration.

The second difference represents the difference between the first number of appearances corresponding to the first feature value in the first set dimension and the second number of appearances corresponding to the first feature value in the first set dimension within the first unit time length.

In order to improve the accuracy of the determined first score, and further improve the accuracy of abnormality detection results, in some embodiments, the determined first feature value within the first unit time corresponds to the first set dimension The first fraction of , consisting of one of the following:

In the case where the first difference is not equal to zero, based on the ratio of the second difference to the first difference, determine the first score corresponding to the first feature value in the first set dimension within the first unit time length; in,

The first difference represents the maximum number of historical occurrences corresponding to the first feature value in the set statistical period and the second value corresponding to the first feature value in the first set dimension within the first unit time length. difference in number of occurrences;

Here, when the electronic device calculates the first difference, it judges whether the first difference is equal to zero, and if the first difference is equal to zero, based on the maximum historical occurrence times corresponding to the first characteristic value in the set statistical period , determine the corresponding set score, and determine the determined set score as the first score corresponding to the first feature value in the first set dimension. Wherein, the setting scores corresponding to different maximum historical occurrence times may be different.

When the electronic device calculates the second difference, it judges whether the second difference is equal to zero, and if the second difference is not equal to zero, determines the ratio of the second difference to the first difference, and based on the determined The ratio of is determined to determine the first score corresponding to the first feature value in the first set dimension within the first unit time length. Wherein, the first scores corresponding to different ratios may be different.

In order to accurately determine the first score, thereby improving the accuracy of abnormality detection results, in some embodiments, when the first difference is equal to zero, the determination of the first unit time period based on the set score The first score corresponding to the first feature value in the first set dimension, including one of the following:

In the case that the maximum number of historical occurrences corresponding to the first feature value is greater than zero, the first set score corresponding to the first set dimension is determined as the first feature value within the first unit time length - setting the first score corresponding to the dimension;

Here, when the first difference is equal to zero and the maximum historical occurrence times corresponding to the first characteristic value is greater than zero, it indicates that there is a first access address in the historical access log, and the maximum historical occurrence times corresponding to the first characteristic value is equal to the first The second occurrence count corresponding to the feature value in the first set dimension. At this time, the electronic device determines the first set score corresponding to the first set dimension as the first score corresponding to the first feature value within the first unit time duration in the first set dimension. The first set score is a default score corresponding to the first set dimension. In practice, this default score is zero.

When the first difference is equal to zero and the maximum historical occurrence times corresponding to the first feature value is equal to zero, it indicates that there is no first access address in the historical access log. At this time, it is judged whether there is The first access address; in the case where there is a first access address in any access address corresponding to the service system, it is used to characterize that the first access address is used to access the new function in the set service system, and the second set score is determined as The first score corresponding to the first feature value in the first set dimension within the first unit duration. The second set score represents the initial score corresponding to the new access address.

In order to accurately determine the first score, thereby improving the accuracy of the abnormality detection result, in some embodiments, in the case where the first difference is not equal to zero, based on the ratio of the second difference to the first difference, Determining the first score corresponding to the first feature value in the first set dimension within the first unit duration includes one of the following:

Here, in the case that the first difference is not equal to zero, it is judged whether the second difference is equal to zero. In the case where the second difference is equal to zero, it is determined that the first fraction corresponding to the first feature value in the first set dimension within the first unit time length is zero. In the case that the second difference is not equal to zero, it is judged whether the ratio of the second difference to the first difference is greater than zero; in the case that the ratio of the second difference to the first difference is less than zero, the first characteristic value is determined The first score corresponding to the first set dimension is zero; when the ratio of the second difference to the first difference is greater than zero, the quotient of the second difference to the first difference (that is, the second difference value/first difference), which is determined as the first fraction corresponding to the first feature value in the first set dimension within the first unit time length. In practical application, use the following formula to calculate the first score corresponding to the first feature value in each set dimension within the first unit duration:

Among them, S _j represents the first score corresponding to the j-th set dimension within the first unit duration; C _ij represents the first number corresponding to the first feature value in the j-th set dimension; C _uj represents the first feature The value is the second number of occurrences corresponding to the j-th setting dimension; C _jmax represents the maximum historical number of occurrences of the first feature value corresponding to the j-th setting dimension.

Step 402: Determine a plurality of second scores corresponding to the first access address based on the first score corresponding to the first feature value of each unit duration in each set dimension; wherein, each second score It is determined based on the first scores corresponding to the first feature value in each unit time period in all set dimensions.

Here, the electronic device determines the second score corresponding to the first access address in the first unit duration based on the first scores corresponding to the first characteristic value of the first unit duration in all set dimensions. In the same way, the second score corresponding to each unit duration of the first access address within the set statistical period may be calculated, so as to obtain a plurality of second scores corresponding to the first access address.

Wherein, the first unit duration is any unit duration within the set statistical period. The quantity of the first score is the same as the quantity of the unit time in the set statistical period.

Considering that in practical applications, the number of dimensions can be set to 1 or greater than 1, in order to improve the accuracy of the determined second score, thereby improving the accuracy of abnormality detection results, in some embodiments, the A plurality of second scores corresponding to the first access address are determined based on the first scores corresponding to the first feature value in each set dimension within each unit duration, including:

Here, when the number of dimensions is set to 1, the first fraction corresponding to the first characteristic value within the first unit time length in the first set dimension is determined as the first access address corresponding to the first unit time length of the second score.

When the number of set dimensions is greater than 1, weighted summation is performed based on the first score corresponding to each set dimension and the set weight corresponding to each set dimension based on the first feature value within the first unit time length, A second score corresponding to the first access address in the first unit duration is obtained.

According to the above method, the electronic device can determine the second fraction corresponding to the first access address within each unit duration within the set statistical period.

Exemplarily, when the number of dimensions is set to be 4, the electronic device may use the following formula to calculate the second score corresponding to the first access address in the first unit duration:

S＝S ₁ W ₁ +S ₂ W ₂ +S ₃ W ₃ +S ₄ W ₄

Among them, S represents the second score corresponding to the first access address in the first unit duration; S ₁ represents the first score corresponding to the first dimension, W ₁ represents the setting weight corresponding to the first dimension; S ₂ represents the corresponding W ₂ represents the set weight corresponding to the second dimension; S ₃ represents the first score corresponding to the third dimension, W ₃ represents the set weight corresponding to the third dimension; S ₄ represents the set weight corresponding to the fourth dimension A score, W ₄ represents the setting weight corresponding to the fourth dimension.

Step 403: Based on the plurality of second scores corresponding to the first access address, determine whether the first access address is abnormal.

Here, the electronic device can compare each second score with a set threshold to obtain a comparison result; if any comparison result indicates that the second score is greater than or equal to the set threshold, it is determined that the first access address is abnormal; The results all indicate that when the second score is less than the set threshold, it is determined that the first access address is not an abnormal address.

In actual application, the set threshold may be 400.

In order to improve the timeliness of exception handling, in some embodiments, after determining that the first access address is abnormal, the method further includes:

Here, when the electronic device determines that the first access address is abnormal, it blocks the access operation corresponding to the first access address, thereby preventing the terminal device sending the first access address from continuing to access the corresponding setting service system. Restricting access to the terminal sending the first access address refers to restricting the access operation of the terminal device sending the first access address, thereby prohibiting the corresponding terminal device from accessing the corresponding service system or the corresponding function of the corresponding service system. Because, when the electronic device determines that the first access address is abnormal, it can directly perform exception processing on the first access address, and does not need to notify the corresponding business system to perform exception processing on the first access address, which can reduce the number of exceptions to the business system. The time consumed by early warning improves the timeliness of exception handling.

FIG. 6 is a schematic diagram of an implementation flow of an anomaly detection method provided by an application embodiment of the present application. As shown in Figure 6, the anomaly detection method includes:

Step 601: Determine the characteristic value corresponding to each historical access address based on the historical access log corresponding to each unit duration in the set statistical period, and determine the characteristic value corresponding to each unit duration in the set statistical period in each Set the historical occurrences corresponding to the dimension.

As shown in Figure 7, in actual application, there are API gateway, login plug-in, permission plug-in and log plug-in in the electronic device, and the electronic device supports rights management service, log storage service, rights management service, user behavior analysis service and user history behavior analysis services, etc. in,

The API gateway can call login plug-ins, permission plug-ins and log plug-ins, etc. The login plug-in is used for the API gateway to authenticate the login request; the permission plug-in is used for the API gateway to verify the permission of the access request, and the log plug-in is used for the API gateway to write the access information in the access request into the access log.

The authority management service is used to update and store the user's corresponding setting access address in each business system, as well as the access address of synchronization exception. The user behavior analysis service is used to detect abnormal access addresses based on the first access log, for example, to implement steps 101 to 102; the user historical behavior analysis service is used to determine the characteristic value corresponding to each access address in each device based on the historical access log. The number of historical occurrences corresponding to a given dimension. Setting dimensions include: user dimension, department dimension, post dimension and setting dimension, corresponding to the first dimension, second dimension, third dimension and fourth dimension above respectively.

Wherein, for the implementation process of step 601, please refer to the relevant description above, and details will not be repeated here.

Step 602: Based on the first access log, determine the first feature value corresponding to the first access address, and determine the first occurrence times of the first feature value corresponding to each set dimension in at least one set dimension; The first access address represents an access address in any access information in the first access log, and is used to access any one of the at least two set service systems; the first access log uses The access information of the access request through the built-in API gateway is recorded in real time within the unit duration.

Wherein, step 602 is the same as step 101, please refer to the relevant description of step 101 for the implementation process, and details are not repeated here.

Step 603: Based on the first number of occurrences corresponding to the first feature value in each set dimension, and based on the first feature value corresponding to each unit duration in the set statistical period in each set dimension The number of historical occurrences determines whether the first access address is abnormal.

Wherein, step 603 is the same as step 102, please refer to the relevant description of step 102 for the implementation process, and details are not repeated here.

Step 604: When the first access address is abnormal, block the access operation corresponding to the first access address, and/or restrict access to the terminal device sending the first access address.

In order to implement the method of the embodiment of the present application, the embodiment of the present application also provides an abnormality detection device, as shown in Figure 8, the abnormality detection device includes:

The first determining unit 81 is configured to determine the first feature value corresponding to the first access address based on the first access log, and determine the corresponding value of the first feature value in each set dimension in at least one set dimension The first number of occurrences; the first access address represents the access address in any access information in the first access log, and is used to access any one of the at least two set service systems; the The first access log is used to record the access information of the access request via the built-in application program interface API gateway in real time within the unit duration;

The second determination unit 82 is configured to be based on the first occurrence times corresponding to the first feature value in each set dimension, and based on the first feature value corresponding to each unit time length in the set statistical period in each Set the number of historical occurrences corresponding to the dimension to determine whether the first access address is abnormal; wherein, the first feature value corresponding to each unit duration in the set statistical period is determined based on the historical log corresponding to the corresponding unit duration .

In some embodiments, the access information includes at least user identification, access time and access address, and the first determining unit 81 is further configured to:

In some embodiments, the first determining unit 81 is specifically configured as:

In the case that the time interval between the third access address and the second access address is greater than or equal to the set duration, the third access address in the second sequence is replaced with the set character string; wherein, the second access address represents the first The access address at the set position in the second sequence, the third access address represents the access address adjacent to the second access address in the second sequence;

A hash value is calculated based on the updated second sequence.

In some embodiments, the second sequence includes three access addresses, the set position representing an intermediate position.

In some embodiments, the access information also includes the department to which the user belongs, the position of the user, and the identification of the terminal device sending the access address;

The at least one set dimension includes at least one of the following:

In some embodiments, the second determination unit 82 is specifically configured as:

In some embodiments, the anomaly detection device also includes:

The exception processing unit is configured to block the access operation corresponding to the first access address when the first access address is abnormal, and/or restrict access to the terminal device sending the first access address.

In actual application, the first determining unit 81, the second determining unit 82 and the abnormality processing unit can pass through a processor in the abnormality detection device, such as a central processing unit (CPU, Central Processing Unit), a digital signal processor (DSP, Digital Signal Processor), Microcontroller Unit (MCU, Microcontroller Unit) or Programmable Gate Array (FPGA, Field-Programmable Gate Array) and other implementations.

It should be noted that: when the abnormality detection device provided by the above-mentioned embodiments performs abnormality detection, it only uses the division of the above-mentioned program modules as an example. In practical applications, the above-mentioned processing can be allocated by different program modules according to needs. That is, the internal structure of the device is divided into different program modules to complete all or part of the processing described above. In addition, the anomaly detection device and the anomaly detection method embodiment provided by the above embodiment belong to the same idea, and the specific implementation process thereof is detailed in the method embodiment, and will not be repeated here.

Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiment of the present application, the embodiment of the present application further provides an electronic device. FIG. 9 is a schematic diagram of the hardware composition structure of the electronic device provided by the embodiment of the present application. As shown in FIG. 9, the electronic device 9 includes:

Communication interface 91, capable of information exchange with other devices such as network devices;

The processor 92 is connected to the communication interface 91 to implement information interaction with other devices, and is configured to execute the methods provided by one or more of the above technical solutions when running a computer program. Instead, the computer program is stored on the memory 93 .

Of course, in actual application, various components in the electronic device 9 are coupled together through the bus system 94 . It will be appreciated that the bus system 94 is configured to enable connection communication between these components. In addition to the data bus, the bus system 94 also includes a power bus, a control bus and a status signal bus. However, the various buses are labeled as bus system 94 in FIG. 9 for clarity of illustration.

The memory 93 in the embodiment of the present application is configured to store various types of data to support the operation of the electronic device 9 . Examples of such data include: any computer program configured to operate on electronic device 9 .

It can be understood that the memory 93 may be a volatile memory or a non-volatile memory, and may also include both volatile and non-volatile memories. Among them, the non-volatile memory can be read-only memory (ROM, Read Only Memory), programmable read-only memory (PROM, Programmable Read-Only Memory), erasable programmable read-only memory (EPROM, Erasable Programmable Read-Only Memory) Only Memory), Electrically Erasable Programmable Read-Only Memory (EEPROM, Electrically Erasable Programmable Read-Only Memory), Magnetic Random Access Memory (FRAM, ferromagnetic random access memory), Flash Memory (Flash Memory), Magnetic Surface Memory , CD, or CD-ROM (Compact Disc Read-Only Memory); magnetic surface storage can be disk storage or tape storage. The volatile memory may be random access memory (RAM, Random Access Memory), which is used as an external cache. By way of illustration and not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM, Static Random Access Memory), Synchronous Static Random Access Memory (SSRAM, Synchronous Static Random Access Memory), Dynamic Random Access Memory Memory (DRAM, Dynamic Random Access Memory), synchronous dynamic random access memory (SDRAM, Synchronous Dynamic Random Access Memory), double data rate synchronous dynamic random access memory (DDRSDRAM, Double Data Rate Synchronous Dynamic Random Access Memory), enhanced Synchronous Dynamic Random Access Memory (ESDRAM, Enhanced Synchronous Dynamic Random Access Memory), Synchronous Link Dynamic Random Access Memory (SLDRAM, SyncLink Dynamic Random Access Memory), Direct Memory Bus Random Access Memory (DRRAM, Direct Rambus Random Access Memory ). The memory 93 described in the embodiments of the present application is intended to include but not limited to these and any other suitable types of memory.

The methods disclosed in the foregoing embodiments of the present application may be applied to the processor 92 or implemented by the processor 92 . The processor 92 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor 92 or instructions in the form of software. The aforementioned processor 92 may be a general-purpose processor, DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, and the like. The processor 92 may implement or execute various methods, steps, and logic block diagrams disclosed in the embodiments of the present application. A general purpose processor may be a microprocessor or any conventional processor or the like. The steps of the method disclosed in the embodiments of the present application may be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, the storage medium is located in the memory 93, and the processor 92 reads the program in the memory 93, and completes the steps of the foregoing method in combination with its hardware.

Optionally, when the processor 92 executes the program, it implements a corresponding process implemented by the terminal in each method of the embodiment of the present application. For the sake of brevity, details are not repeated here.

In an exemplary embodiment, the embodiment of the present application also provides a storage medium, that is, a computer storage medium, specifically a computer-readable storage medium, for example, including a first memory 93 storing a computer program, and the above-mentioned computer program can be processed by the terminal 92 to complete the steps described in the foregoing method. The computer-readable storage medium can be memories such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disk, or CD-ROM.

In the several embodiments provided in this application, it should be understood that the disclosed devices and methods may be implemented in other ways. The device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods, such as: multiple units or components can be combined, or May be integrated into another system, or some features may be ignored, or not implemented. In addition, the coupling, or direct coupling, or communication connection between the components shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be electrical, mechanical or other forms of.

The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or distributed to multiple network units; Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application can be integrated into one processing module, or each unit can be used as a single unit, or two or more units can be integrated into one unit; the above-mentioned integration The unit can be realized in the form of hardware or in the form of hardware plus software functional unit.

Those of ordinary skill in the art can understand that all or part of the steps to realize the above method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the Including the steps of the foregoing method embodiments; and the foregoing storage medium includes: a removable storage device, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, etc. A medium on which program code can be stored.

It should be noted that "first", "second", etc. are used to distinguish similar objects, and not necessarily used to describe a specific sequence or sequence. The technical solutions described in the embodiments of the present application may be combined arbitrarily if there is no conflict.

It should be noted that the term "and/or" in the embodiments of the present application is only an association relationship describing associated objects, which means that there may be three kinds of relationships, for example, A and/or B, which may mean that A exists alone , both A and B exist, and B exists alone. In addition, the term "at least one" herein means any combination of any one or more of at least two of a plurality, for example, including at least one of A, B, and C, which may mean including from A, Any one or more elements selected from the set formed by B and C.

The above is only a specific implementation of the application, but the scope of protection of the application is not limited thereto. Anyone familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the application. Should be covered within the protection scope of this application. Therefore, the protection scope of the present application should be determined by the protection scope of the claims.

Claims

An anomaly detection method comprising:

Based on the first access log, determine the first feature value corresponding to the first access address, and determine the first number of occurrences of the first feature value corresponding to each set dimension in at least one set dimension; An access address represents an access address in any access information in the first access log, and is used to access any one of at least two set business systems; the first access log is used for real-time recording Access information of access requests via the built-in application programming interface API gateway within the unit duration;

Based on the first number of occurrences corresponding to the first feature value in each set dimension, and based on the historical number of occurrences of the first feature value corresponding to each unit duration in the set statistical period in each set dimension , to determine whether the first access address is abnormal; wherein, the first feature value corresponding to each unit time length in the set statistical period is determined based on the history log corresponding to the corresponding unit time length.
The method according to claim 1, wherein the access information includes at least user identification, access time and access address; determining the characteristic value corresponding to the access address includes:

Based on the access information in the second access log, determine the first sequence corresponding to the first user; wherein, the second access log includes the first access log or the historical access corresponding to each unit duration within the set statistical period log; the first sequence includes all access addresses corresponding to the first user in the second access log;

In the first sequence corresponding to the first user, determine the second sequence corresponding to the first user; the second sequence includes at least one access address;

Based on the second sequence corresponding to the first user, the hash value is calculated to obtain the feature value corresponding to the access address at the set position in the second sequence corresponding to the first user.
The method according to claim 2, wherein said calculating the hash value comprises:

In the case that the time interval between the third access address and the second access address is greater than or equal to the set duration, the third access address in the second sequence is replaced with the set character string; wherein, the second access address represents the first The access address at the set position in the second sequence, the third access address represents the access address adjacent to the second access address in the second sequence;

A hash value is calculated based on the updated second sequence.
The method of claim 2, wherein the second sequence includes three access addresses, the set position representing an intermediate position.
The method according to claim 2, wherein the access information further includes the department to which the user belongs, the position of the user, and the identification of the terminal device sending the access address;

The at least one set dimension includes at least one of the following:

The first dimension represents the number of occurrences of statistical feature values by user;

The second dimension represents the number of occurrences of statistical feature values by department;

The third dimension represents the number of occurrences of statistical feature values by position;

The fourth dimension represents the statistics of the number of occurrences of the same feature value based on the terminal equipment used by the user.
The method according to claim 1, wherein the determining whether the first access address is abnormal comprises:

Based on the first number of occurrences corresponding to the first feature value in each set dimension, and based on the historical number of occurrences of the first feature value corresponding to each unit duration in the set statistical period in each set dimension , determining the first score corresponding to the first feature value in each set dimension within each unit duration;

A plurality of second scores corresponding to the first access address are determined based on the first score corresponding to the first characteristic value of each unit duration in each set dimension; wherein each second score is based on each The first eigenvalues within the unit duration are determined by the first scores corresponding to all the set dimensions;

Based on the plurality of second scores corresponding to the first access address, it is determined whether the first access address is abnormal.
The method according to claim 6, wherein said determining the first score corresponding to each set dimension of the first feature value within each unit duration includes:

Based on the historical occurrence times of the first feature value corresponding to the first unit time length in the first set dimension, determine the second occurrence of the first feature value corresponding to the first set dimension within the first unit time length The number of times; the first set dimension represents any set dimension in the at least one set dimension; the first unit duration represents any unit duration in the set statistical cycle;

Based on the first number of occurrences of the first feature value corresponding to the first set dimension and the second number of occurrences of the first feature value corresponding to the first set dimension within the first unit duration, and based on the first set dimension The maximum historical number of occurrences of a feature value in the set statistical period and the second number of occurrences of the first feature value in the first set dimension corresponding to the first unit time length are determined to determine The first score corresponding to the first feature value in the first set dimension.
The method according to claim 7, wherein said determining the second number of occurrences corresponding to the first feature value in the first set dimension within the first unit duration includes one of the following:

The first characteristic value of the first unit duration is determined based on the ratio of the historical occurrence times of the first characteristic value corresponding to the first set dimension in the first unit duration to the total number of the unit duration within the set statistical period The second number of occurrences corresponding to the first set dimension;

Based on the historical occurrence times corresponding to the first feature value in the first set dimension in each unit time length, and the weight corresponding to the first feature value in each unit time length, determine all the first feature values in the first unit time length The second number of occurrences corresponding to the first feature value in the first set dimension; wherein,

In a case where the time corresponding to the first unit duration is later than the time corresponding to the second unit duration, the weight corresponding to the first unit duration is greater than the weight corresponding to the second unit duration.
The method according to claim 7, wherein said determining the first score corresponding to the first feature value in the first set dimension within the first unit duration includes one of the following:

In the case where the first difference is equal to zero, a first score corresponding to the first feature value in the first set dimension within the first unit time length is determined based on the set score;

In the case where the first difference is not equal to zero, based on the ratio of the second difference to the first difference, determine the first score corresponding to the first feature value in the first set dimension within the first unit time length;

Wherein, the first difference represents the maximum number of historical occurrences corresponding to the first feature value in the set statistical period and the first feature value corresponding to the first set dimension within the first unit duration the difference between the second occurrences;

The second difference represents the first number of appearances corresponding to the first feature value in the first set dimension and the second number of appearances corresponding to the first feature value in the first set dimension within the first unit duration Difference.
The method according to claim 9, wherein the determining the first score corresponding to the first feature value in the first set dimension within the first unit time length based on the set score includes one of the following:

In the case where the maximum number of historical occurrences corresponding to the first feature value is greater than zero, the first set score corresponding to the first set dimension is determined as the first feature value within the first unit time length within the first Set the first score corresponding to the dimension;

In the case that the maximum number of historical occurrences corresponding to the first feature value is equal to zero and the first access address exists, the second set score is determined as the first feature value within the first unit duration within the first Set the first score corresponding to the dimension.
The method according to claim 9, wherein, based on the ratio of the second difference to the first difference, the first characteristic value corresponding to the first feature value in the first set dimension within the first unit time length is determined. Score, including one of the following:

In the case where the ratio of the second difference to the first difference is less than or equal to zero, it is determined that the first fraction corresponding to the first feature value in the first set dimension within the first unit time length is zero;

In the case where the ratio of the second difference to the first difference is greater than zero, the quotient of the second difference to the first difference is determined as the first characteristic value within the first unit time length in the first setting The first fraction corresponding to the dimension.
The method according to claim 6, wherein, based on the first score corresponding to each set dimension of the first characteristic value within each unit duration, a plurality of corresponding to the first access address is determined. Second score, including:

In the case where the number of dimensions is set to 1, the first score corresponding to the first feature value in the first set dimension within the first unit duration is determined as the first access address in the first unit duration the corresponding second fraction;

When the number of set dimensions is greater than 1, based on the first score corresponding to the first feature value in each set dimension within the first unit time length and the set weight of each set dimension, determine the The second fraction corresponding to the first access address in the first unit duration.
The method according to any one of claims 1 to 12, wherein the method further comprises:

In the case that the first access address is abnormal, the access operation corresponding to the first access address is blocked, and/or, access restriction is performed on the terminal device sending the first access address.
An anomaly detection device, comprising:

The first determination unit is configured to determine the first feature value corresponding to the first access address based on the first access log, and determine the first feature value corresponding to each set dimension in at least one set dimension. A number of occurrences; the first access address represents the access address in any access information in the first access log, and is used to access any one of the at least two set service systems; the first An access log is used to record the access information of the access request via the built-in application program interface API gateway in real time within the unit duration;

The second determining unit is configured to be based on the first occurrence times corresponding to the first feature value in each set dimension, and based on the first feature value corresponding to each unit time length in the set statistical period in each set Determine whether the first access address is abnormal by determining the number of historical occurrences corresponding to the dimension; wherein, the first characteristic value corresponding to each unit time length in the set statistical period is determined based on the historical log corresponding to the corresponding unit time length.
An electronic device comprising: a processor and a memory configured to store a computer program capable of running on the processor,

Wherein, the processor is configured to execute the steps of the method according to any one of claims 1 to 13 when running the computer program.
A storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 13 are implemented.