CN110489307B - Interface abnormal call monitoring method and device - Google Patents
Interface abnormal call monitoring method and device Download PDFInfo
- Publication number
- CN110489307B CN110489307B CN201910795654.0A CN201910795654A CN110489307B CN 110489307 B CN110489307 B CN 110489307B CN 201910795654 A CN201910795654 A CN 201910795654A CN 110489307 B CN110489307 B CN 110489307B
- Authority
- CN
- China
- Prior art keywords
- behavior
- calling
- data
- interface
- user
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3003—Monitoring arrangements specially adapted to the computing system or computing system component being monitored
- G06F11/3041—Monitoring arrangements specially adapted to the computing system or computing system component being monitored where the computing system component is an input/output interface
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
- G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/23—Clustering techniques
- G06F18/232—Non-hierarchical techniques
- G06F18/2321—Non-hierarchical techniques using statistics or function optimisation, e.g. modelling of probability density functions
- G06F18/23213—Non-hierarchical techniques using statistics or function optimisation, e.g. modelling of probability density functions with fixed number of clusters, e.g. K-means clustering
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/049—Temporal neural networks, e.g. delay elements, oscillating neurons or pulsed inputs
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/04—Forecasting or optimisation specially adapted for administrative or management purposes, e.g. linear programming or "cutting stock problem"
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- Data Mining & Analysis (AREA)
- General Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- Artificial Intelligence (AREA)
- Evolutionary Computation (AREA)
- Life Sciences & Earth Sciences (AREA)
- Computing Systems (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Bioinformatics & Computational Biology (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Business, Economics & Management (AREA)
- Evolutionary Biology (AREA)
- Mathematical Physics (AREA)
- Software Systems (AREA)
- Biophysics (AREA)
- General Health & Medical Sciences (AREA)
- Computational Linguistics (AREA)
- Quality & Reliability (AREA)
- Economics (AREA)
- Molecular Biology (AREA)
- Human Resources & Organizations (AREA)
- Strategic Management (AREA)
- Health & Medical Sciences (AREA)
- Biomedical Technology (AREA)
- Game Theory and Decision Science (AREA)
- Tourism & Hospitality (AREA)
- General Business, Economics & Management (AREA)
- Probability & Statistics with Applications (AREA)
- Operations Research (AREA)
- Marketing (AREA)
- Entrepreneurship & Innovation (AREA)
- Development Economics (AREA)
- Telephonic Communication Services (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The application provides a monitoring method and device for interface abnormal calling, which overcome the problems that the existing method based on blacklist, rule and machine learning is low in detection rate and high in false detection rate, and new abnormal behaviors cannot be found in time. The characteristics of the clustering algorithm are obtained by using a user portrait technology, and users are classified into a plurality of user sub-classes with comparable behaviors, so that the detection rate of abnormal interface calling is higher, and the false detection rate is lower. And learning the behavior pattern of each user subclass by using a neural network model to obtain an envelope of a normal behavior pattern, predicting to obtain a subsequent normal API (application program interface) calling behavior of the client by using the trained neural network, and comparing the predicted behavior with the actual API calling behavior of the client, so that a new abnormal behavior can be discovered in time.
Description
Technical Field
The invention relates to the technical field of interface calling, in particular to a method and a device for monitoring interface abnormal calling.
Background
With the improvement of the informatization level, more and more enterprises open the service capacity of the enterprises in an API mode, and construct the ecosphere of the enterprises on the basis of service opening. With the increase of the calling quantity of the API service interface, the calling safety problem of the interface is more and more urgent and more important. Methods based on blacklists, rules and the like are proposed successively, but the problems of low detection rate and high false detection rate still exist, the methods can only detect known safety problems, and the methods cannot detect new safety problems which have not occurred before.
Disclosure of Invention
In order to solve at least one of the above problems, the present application provides an interface abnormal call monitoring method, including:
calling behavior data according to a historical interface of a user to generate user portrait characteristics;
converting the user portrait characteristics into a data format capable of inputting a preset calling behavior prediction model, and inputting the data format into the calling behavior prediction model to obtain at least one prediction interface calling behavior data;
monitoring the abnormal condition of the subsequent interface calling behavior of the user according to the at least one predicted interface calling behavior data;
and the calling behavior prediction model comprises a mapping relation between the user portrait characteristics and the prediction interface calling behavior data.
In certain embodiments, further comprising:
determining the subcategories to which the users belong according to the historical interface calling behavior data of the users;
and calling the calling behavior prediction model of the corresponding sub-classification.
In certain embodiments, further comprising:
presetting a plurality of sub-classifications;
and establishing a plurality of calling behavior prediction models corresponding to each sub-classification.
In some embodiments, determining the subcategories to which the user belongs based on the historical interface call behavior data of the user includes:
generating a plurality of fact labels of the user according to behavior data called by a plurality of interfaces of the user;
inputting a plurality of fact labels into a preset model label generation model to generate at least one model label;
generating a business label according to a plurality of fact labels and at least one model label;
determining the sub-classification based on a plurality of the service tags.
In certain embodiments, further comprising:
and taking historical interface calling data corresponding to all users in each sub-classification as a training set, and training each calling behavior prediction model.
In some embodiments, the training each call behavior prediction model comprises:
selecting historical interface calling data of a user in each sub-classification, dividing the historical interface calling data into a first part and a second part according to a time sequence, taking the first part of data as input and the second part of data as output, and training a corresponding calling behavior prediction model;
executing iteration operation, dividing historical interface calling data of another user in the sub-classification into a first part and a second part according to a time sequence, further enabling the first part of data of the another user to replace the first part of data of the initial user as input, enabling the second part of data to replace the second part of data of the initial user as output, training the corresponding calling behavior prediction model until the first part of data of any user in the sub-classification is input into the calling behavior prediction model, and finishing the training of the calling behavior prediction model when an output result at least comprises the second part of data of the user;
and obtaining the trained calling behavior prediction model.
In some embodiments, training any one of the call behavior prediction models comprises:
selecting historical interface calling data of all users in the sub-classification corresponding to a calling behavior prediction model, and generating a behavior sequence corresponding to each user one by one according to a time sequence;
mapping all interface calling behaviors in each behavior sequence to obtain a sequence vector, wherein each interface calling behavior is mapped into one behavior vector correspondingly;
splitting each sequence vector into a first behavior vector set with a calling behavior occurring before the preset time point and a second behavior vector set with a calling behavior occurring after the preset time point;
and taking the first behavior vector set in each behavior sequence as an input, correspondingly taking each behavior vector in the second behavior vector set in each behavior sequence as a target vector, and training the calling behavior prediction model.
In some embodiments, determining the subcategories to which the user belongs according to the historical interface call behavior data of the user further comprises:
establishing the model label generation model based on deep learning;
and taking the marked fact labels and the model labels as a group of training sets, and training the model labels to generate models.
In some embodiments, said pre-setting a plurality of said sub-classifications comprises:
and performing service classification on the users according to historical service data of all the users to generate a plurality of sub-classifications, wherein each sub-classification corresponds to a service label.
In some embodiments, said classifying the user according to the historical service data of the user to generate a plurality of said sub-classifications includes:
and clustering the historical service data of all the users to obtain the corresponding sub-classifications.
In some embodiments, the predictive interface call behavior data comprises predicted behavior types and a probability value for each predicted behavior type to be called; monitoring the abnormal condition of the subsequent interface calling behavior of the user according to the at least one piece of predicted interface calling behavior data, wherein the monitoring comprises the following steps:
sequencing each predicted behavior type from large to small according to the probability value to form a predicted behavior sequence;
acquiring interface calling behaviors of a set number of subsequent executions of a user;
and judging whether the acquired interface calling behaviors are all located before the set position of the predicted behavior sequence, and if so, determining that the subsequent interface calling behaviors of the user are normal.
The application also provides an interface abnormal calling monitoring device, which comprises:
the user portrait feature generation module is used for generating user portrait features according to behavior data called by a historical interface of a user;
the input module is used for converting the user portrait characteristics into a data format capable of inputting a preset calling behavior prediction model, inputting the data format into the calling behavior prediction model and obtaining calling behavior data of at least one prediction interface;
the abnormal condition monitoring module is used for monitoring the abnormal condition of the subsequent interface calling behavior of the user according to the at least one predicted interface calling behavior data;
and the calling behavior prediction model comprises a mapping relation between the user portrait characteristics and the prediction interface calling behavior data.
In certain embodiments, further comprising:
the sub-classification determining module is used for determining the sub-classification of the user according to the historical interface calling behavior data of the user;
and the calling behavior prediction model calling module is used for calling the calling behavior prediction model corresponding to the sub-classification.
In certain embodiments, further comprising:
the sub-classification presetting module is used for presetting a plurality of sub-classifications;
and the calling behavior prediction model establishing module is used for establishing a plurality of calling behavior prediction models corresponding to each sub-classification.
In some embodiments, determining the subcategories to which the user belongs based on the historical interface call behavior data of the user comprises:
the fact label generating unit is used for generating a plurality of fact labels of the user according to behavior data called by a plurality of interfaces of the user;
the model label generating unit inputs a plurality of fact labels into a preset model label generating model to generate at least one model label;
a business label generating unit, which generates business labels according to a plurality of the fact labels and at least one model label;
and the sub-classification determining unit is used for determining the sub-classification according to the plurality of service labels.
In certain embodiments, further comprising:
and the training module is used for training each calling behavior prediction model by taking historical interface calling data of all users corresponding to each sub-classification as a training set.
In certain embodiments, the training module comprises:
the training unit is used for selecting historical interface calling data of a user in each sub-classification according to the time sequence to be divided into a first part and a second part, taking the first part of data as input and the second part of data as output, and training the corresponding calling behavior prediction model;
the iteration training unit is used for executing iteration operation, dividing historical interface calling data of another user in the sub-classification into a first part and a second part according to a time sequence, further enabling the first part of data of the another user to replace the first part of data of the initial user as input, enabling the second part of data to replace the second part of data of the initial user as output, training the corresponding calling behavior prediction model until the first part of data of any user in the sub-classification is input into the calling behavior prediction model, and finishing the training of the calling behavior prediction model when an output result at least comprises the second part of data of the user;
and the output unit is used for obtaining the trained calling behavior prediction model.
In certain embodiments, the training module comprises:
the behavior sequence generation unit selects historical interface calling data of all users in the sub-classification corresponding to the calling behavior prediction model, and generates behavior sequences corresponding to all the users one by one according to the time sequence;
the mapping unit is used for mapping all interface calling behaviors in each behavior sequence to obtain a sequence vector, wherein each interface calling behavior is correspondingly mapped into one behavior vector;
the sequence vector splitting unit splits each sequence vector into a first behavior vector set of which the calling behavior occurs before the preset time point and a second behavior vector set of which the calling behavior occurs after the preset time point;
and the training unit is used for taking the first behavior vector set in each behavior sequence as input, correspondingly taking each behavior vector in the second behavior vector set in each behavior sequence as a target vector, and training the calling behavior prediction model.
In some embodiments, the sub-classification determination module further comprises:
a model tag generation model establishing unit that establishes the model tag generation model based on deep learning;
and the model label generation model training unit is used for training the model label generation model by taking the marked fact labels and the model labels as a group of training sets.
In some embodiments, the sub-category presetting module performs service classification on the users according to historical service data of all the users to generate a plurality of sub-categories, where each sub-category corresponds to one service label.
In some embodiments, the sub-category presetting module performs clustering processing on historical service data of all users to obtain the corresponding sub-categories.
In some embodiments, the prediction interface call behavior data includes prediction behavior types and probability values for each prediction behavior type being called, and the abnormal situation monitoring module includes:
the prediction behavior sequence forming unit is used for sequencing each prediction behavior type from large to small according to the probability value to form a prediction behavior sequence;
the subsequent interface calling behavior acquisition unit is used for acquiring the interface calling behaviors of the set number subsequently executed by the user;
and the behavior normal judging unit is used for judging whether the acquired interface calling behaviors are all located before the set position of the predicted behavior sequence, and if so, determining that the subsequent interface calling behaviors of the user are normal.
The present application also provides a computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, the processor implementing the steps of the method as described above when executing the program.
The present application also provides a computer-readable storage medium having stored thereon a computer program which, when being executed by a processor, carries out the steps of the method as set forth above.
The invention has the following beneficial effects:
the invention provides a monitoring method and a monitoring device for interface abnormal calling, which solve the problems that the existing blacklist-based rule-based machine learning-based method is low in detection rate and high in false detection rate, and new abnormal behaviors cannot be found in time. The characteristics of the clustering algorithm are obtained by using a user portrait technology, and users are classified into a plurality of user sub-classes with comparable behaviors, so that the detection rate of abnormal interface calling is higher, and the false detection rate is lower. And learning the behavior pattern of each user subclass by using a neural network model to obtain an envelope of a normal behavior pattern, predicting to obtain a subsequent normal API (application program interface) calling behavior of the client by using the trained neural network, and comparing the predicted behavior with the actual API calling behavior of the client, so that a new abnormal behavior can be discovered in time.
Drawings
In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments of the present invention, and for those skilled in the art, other drawings can be obtained according to the drawings without creative efforts.
Fig. 1 shows a schematic flowchart of an interface abnormal call monitoring method in the present application.
Fig. 2 shows a schematic diagram of a generation process of a behavior vector in the present application.
Fig. 3 shows a training diagram of calling a behavior prediction model in the present application.
Fig. 4 shows a schematic structural diagram of an interface abnormal call monitoring device in the present application.
FIG. 5 illustrates a schematic block diagram of a computer device suitable for use in implementing embodiments of the present application.
Detailed Description
The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
In the prior art, the problems of low detection rate, high false detection rate and the like exist in methods based on blacklist and rules and the like in the process of processing interface call security problems, only known security problems can be detected, and the problem that the security problems which never occur can not be solved.
In view of this, the present application uses the user profile technology to obtain the features of the clustering algorithm, and divides users into a plurality of user sub-classes with comparable behaviors, so that the detection rate of abnormal interface calls is higher and the false detection rate is lower. And learning the behavior pattern of each user subclass by using a neural network model to obtain an envelope of a normal behavior pattern, predicting to obtain a subsequent normal API (application program interface) calling behavior of the client by using the trained neural network, and comparing the predicted behavior with the actual API calling behavior of the client, so that a new abnormal behavior can be discovered in time.
Fig. 1 shows an interface abnormal call monitoring method in an embodiment of the present application, including:
s1: calling behavior data according to a historical interface of a user to generate user portrait characteristics;
s2: converting the user portrait characteristics into a data format capable of inputting a preset calling behavior prediction model, and inputting the data format into the calling behavior prediction model to obtain at least one prediction interface calling behavior data;
s3: monitoring the abnormal condition of the subsequent interface calling behavior of the user according to the at least one piece of predicted interface calling behavior data;
and the calling behavior prediction model comprises a mapping relation between the user portrait characteristics and the prediction interface calling behavior data.
In the application, the calling behavior prediction model is a trained neural network model, and the trained calling behavior prediction model comprises a mapping relation between user portrait characteristics and prediction interface calling behavior data.
The user portrait characteristics refer to characteristic data which can describe a user and is obtained by analyzing the calling behavior of the user interface.
In some embodiments, the attribute characteristics of each user are different, and based on different user profiles, the user group may be divided into a plurality of classes, and each class corresponds to one calling behavior prediction model.
Certainly, each calling behavior prediction model is consistent when initially established, corresponding user data are adopted for training, the trained calling behavior prediction models are inevitably different pairwise due to different training data, and accurate prediction effects are only achieved for corresponding user classification.
Obviously, in this embodiment, the method further includes:
s01: determining the sub-classification of the user according to the historical interface calling behavior data of the user;
s02: and calling the calling behavior prediction model of the corresponding sub-classification.
Correspondingly, the method further comprises the following steps:
presetting a plurality of sub-classifications;
and establishing a plurality of calling behavior prediction models corresponding to each sub-classification.
In some embodiments, user classification is based on a clustering algorithm, such as a k-means clustering algorithm, to cluster all users.
In specific implementation, a corresponding service tag needs to be generated for each user, and then the users are classified according to the service tags.
Specifically, in some embodiments, the user classification may be performed based on the service tag, and step S01 specifically includes:
s011: generating a plurality of fact labels of the user according to behavior data called by a plurality of interfaces of the user;
s012: inputting a plurality of fact labels into a preset model label generation model to generate at least one model label;
s013: generating a business label according to a plurality of fact labels and at least one model label;
s014: determining the sub-classification based on a plurality of the service tags.
The model tag generation model may also be built based on deep learning, and the model tag generation model may be built online or offline, taking online building as an example, that is, step S01 further includes:
s0101: establishing the model label generation model based on deep learning;
s0102: and taking the marked fact labels and the model labels as a group of training sets, and training the model labels to generate models.
The service tag is a tag label corresponding to each sub-category, and the sub-categories are generated according to historical service data of all users, for example, according to past historical data, the sub-categories are classified into robustness, aggressive types, asset values greater than 100w, available asset values greater than 30w, and the like, and are not exhaustive here.
The establishment of the sub-classification needs to perform clustering processing on all historical data, before the clustering processing, the historical data can be converted into numerical characteristics, and then the clustering processing is performed on all users by adopting a k-means clustering algorithm.
In the present application, the invoking behavior prediction model may be based on a neural network. In particular, in some embodiments, an LSTM neural network is exemplified.
And numbering each calling behavior of the user in a limited calling behavior space, wherein N kinds of behavior behaviors are totally shared in the calling space of the user, and each calling behavior is assigned with a behavior number. For example, if there are five behaviors in the behavior space, which are querying for gas, paying for gas, querying for water, paying for water and paying for fees, each behavior is numbered as 0, 1, 2, 3 and 4 in sequence.
For the user subclass determined by calling behavior data through the historical interface of the user, mapping each obtained behavior number into a behavior vector with the length of M, wherein the initial value of the vector can be generated randomly or according to a certain distribution, as shown in FIG. 2.
And obtaining the behavior sequence of the user in each user subclass from the database, and numbering and mapping each behavior in the behavior sequence to obtain a behavior sequence vector. Each current behavior vector in the sequence vectors is used as a target vector, the behavior vectors at all moments before the current moment are used as input sequences, and a neural network model composed of an LSTM neural network is trained, as shown in FIG. 3.
In the present application, the model training may be performed on-line or off-line, that is, the step of model training may be included in the method steps executed in the present application, or the trained model may be called in a pre-stored manner without departing from the method steps executed in the present application. Taking an online training model as an example, in this embodiment, the step of training the model includes:
s021: selecting historical interface calling data of all users in the sub-classification corresponding to a calling behavior prediction model, and generating a behavior sequence corresponding to each user one by one according to a time sequence;
s022: mapping all interface calling behaviors in each behavior sequence to obtain a sequence vector, wherein each interface calling behavior is correspondingly mapped into one behavior vector;
s023: splitting each sequence vector into a first behavior vector set of which the calling behavior occurs before the preset time point and a second behavior vector set of which the calling behavior occurs after the preset time point;
s024: and taking the first behavior vector set in each behavior sequence as an input, correspondingly taking each behavior vector in the second behavior vector set in each behavior sequence as a target vector, and training the calling behavior prediction model.
In some embodiments, the data format into which the predetermined calling behavior model is input is a numeric format, the user portrait feature is a character data, and the character data can be converted into the numeric data and then input into the predetermined calling behavior prediction model.
The prediction interface call behavior data includes prediction behavior types and probability values for each prediction behavior type to be called.
For example, each behavior type corresponds to a certain binary character, and the probability value is represented by a hexadecimal character.
In this embodiment, step S3 specifically includes:
s31: sequencing each prediction behavior type from large to small according to the probability value to form a prediction behavior sequence;
s32: acquiring interface calling behaviors of a set number of subsequent executions of a user;
s33: and judging whether the acquired interface calling behaviors are all located before the set position of the predicted behavior sequence, and if so, determining that the subsequent interface calling behaviors of the user are normal.
In the embodiment, the reliability and the accuracy of monitoring are improved by packaging and judging the plurality of calling behaviors. Of course, in other embodiments, an independent determination may be made for each subsequently occurring interface call behavior.
For example, whether the subsequent interface calling behavior of the user belongs to one of the at least one predicted interface calling behavior data output by the calling behavior prediction model is judged, if so, the user interface calling behavior is determined to be normal, otherwise, the user interface calling behavior is abnormal.
In this embodiment, the model training is also based on the similar manner described above, and the model training specifically includes:
aiming at each sub-classification, selecting historical interface calling data of a user in the sub-classification, dividing the historical interface calling data into a first part and a second part according to a time sequence, taking the first part of data as input and the second part of data as output, and training a corresponding calling behavior prediction model;
executing iteration operation, dividing historical interface calling data of another user in the sub-classification into a first part and a second part according to a time sequence, further enabling the first part of data of the another user to replace the first part of data of the initial user as input, enabling the second part of data to replace the second part of data of the initial user as output, training the corresponding calling behavior prediction model until the first part of data of any user in the sub-classification is input into the calling behavior prediction model, and finishing the training of the calling behavior prediction model when an output result at least comprises the second part of data of the user;
and obtaining the trained calling behavior prediction model.
Because the preset calling interface behavior data are converted into numerical format data or stored according to the numerical format data, the mapping of each behavior (each behavior type corresponds to a numerical value) can be realized through a binary system, a hexadecimal system and other recording modes without mapping into sequence vectors and the like.
The method for monitoring the abnormal interface calling can be used for judging whether each subsequently sent interface calling behavior is abnormal or not independently, and comprehensively judging a plurality of subsequently generated interface calling behaviors, so that the judgment speed is increased, the comprehensive judgment can be realized, and the judgment accuracy is improved.
In addition, the method and the device solve the problems that the existing method based on the blacklist, the rule and the machine learning is low in detection rate and high in false detection rate, and new abnormal behaviors cannot be found in time. The characteristics of the clustering algorithm are obtained by using a user portrait technology, and users are classified into a plurality of user sub-classes with comparable behaviors, so that the detection rate of abnormal interface calling is higher, and the false detection rate is lower. And learning the behavior pattern of each user subclass by using a neural network model to obtain an envelope of a normal behavior pattern, predicting to obtain a subsequent normal API (application program interface) calling behavior of the client by using the trained neural network, and comparing the predicted behavior with the actual API calling behavior of the client, so that a new abnormal behavior can be discovered in time.
Based on the same inventive concept, fig. 4 shows an interface abnormal call monitoring device in the embodiment of the present application, which specifically includes: the user portrait feature generation module 1 is used for generating user portrait features according to behavior data called by a historical interface of a user; the input module 2 is used for converting the user portrait characteristics into a data format capable of inputting a preset calling behavior prediction model and inputting the data format into the calling behavior prediction model to obtain at least one prediction interface calling behavior data; the abnormal condition monitoring module 3 is used for monitoring the abnormal condition of the subsequent interface calling behavior of the user according to the at least one predicted interface calling behavior data; and the calling behavior prediction model comprises a mapping relation between the user portrait characteristics and the prediction interface calling behavior data.
Based on the same inventive concept, in some embodiments, the interface abnormal call monitoring apparatus further includes: the sub-classification determining module is used for determining the sub-classification of the user according to the historical interface calling behavior data of the user;
and the calling behavior prediction model calling module is used for calling the calling behavior prediction model corresponding to the sub-classification.
Based on the same inventive concept, in some embodiments, the interface abnormal call monitoring apparatus further includes: the sub-classification presetting module is used for presetting a plurality of sub-classifications; and the calling behavior prediction model building module is used for building a plurality of calling behavior prediction models corresponding to each sub-classification.
Based on the same inventive concept, in some embodiments, determining the sub-classification to which the user belongs according to the historical interface call behavior data of the user includes: the fact label generating unit is used for generating a plurality of fact labels of the user according to behavior data called by a plurality of interfaces of the user; the model label generating unit is used for inputting a plurality of fact labels into a preset model label generating model and generating at least one model label; a business label generating unit, which generates business labels according to a plurality of the fact labels and at least one model label; and the sub-classification determining unit is used for determining the sub-classification according to the plurality of service labels.
Based on the same inventive concept, in some embodiments, the interface abnormal call monitoring apparatus further includes: and the training module is used for training each calling behavior prediction model by taking historical interface calling data of all users corresponding to each sub-classification as a training set.
Based on the same inventive concept, in some embodiments, the training module comprises: the training unit is used for selecting historical interface calling data of one user in each sub-classification according to the time sequence to be divided into a first part and a second part, taking the first part of data as input and the second part of data as output, and training the corresponding calling behavior prediction model; the iteration training unit is used for executing iteration operation, dividing historical interface calling data of another user in the sub-classification into a first part and a second part according to a time sequence, further enabling the first part of data of the another user to replace the first part of data of the initial user as input, enabling the second part of data to replace the second part of data of the initial user as output, training the corresponding calling behavior prediction model until the first part of data of any user in the sub-classification is input into the calling behavior prediction model, and finishing the training of the calling behavior prediction model when an output result at least comprises the second part of data of the user; and the output unit is used for obtaining the trained calling behavior prediction model.
Based on the same inventive concept, in some embodiments, the training module comprises: the behavior sequence generation unit selects historical interface calling data of all users in the sub-classification corresponding to the calling behavior prediction model, and generates behavior sequences corresponding to the users one by one according to the time sequence; the mapping unit is used for mapping all interface calling behaviors in each behavior sequence to obtain a sequence vector, wherein each interface calling behavior is mapped into one behavior vector correspondingly; the sequence vector splitting unit splits each sequence vector into a first behavior vector set of which the calling behavior occurs before the preset time point and a second behavior vector set of which the calling behavior occurs after the preset time point; and the training unit is used for taking the first behavior vector set in each behavior sequence as input, correspondingly taking each behavior vector in the second behavior vector set in each behavior sequence as a target vector, and training the calling behavior prediction model.
Based on the same inventive concept, in some embodiments, the sub-classification determining module further includes: a model tag generation model establishing unit that establishes the model tag generation model based on deep learning; and the model label generation model training unit takes the marked fact labels and the model labels as a group of training sets to train the model label generation model.
Based on the same inventive concept, in some embodiments, the sub-category presetting module performs service classification on users according to historical service data of all users to generate a plurality of sub-categories, where each sub-category corresponds to one service label.
Based on the same inventive concept, in some embodiments, the sub-category presetting module performs clustering processing on historical service data of all users to obtain corresponding sub-categories.
Based on the same inventive concept, in some embodiments, the prediction interface invocation behavior data includes prediction behavior types and probability values of invocation of each prediction behavior type, and the abnormal situation monitoring module includes: the predicted behavior sequence forming unit is used for sequencing each predicted behavior type from large to small according to the probability value to form a predicted behavior sequence; the subsequent interface calling behavior acquisition unit is used for acquiring the interface calling behaviors of the set number subsequently executed by the user; and the behavior normal judging unit is used for judging whether the acquired interface calling behaviors are all located before the set position of the predicted behavior sequence, and if so, determining that the subsequent interface calling behaviors of the user are normal.
The monitoring device for interface abnormal calling provided by the application can be understood to overcome the problems that the detection rate is low, the false detection rate is high and new abnormal behaviors cannot be found in time based on the existing blacklist, rule and machine learning-based methods. The characteristics of the clustering algorithm are obtained by using a user portrait technology, and users are classified into a plurality of user sub-classes with comparable behaviors, so that the detection rate of abnormal interface calling is higher, and the false detection rate is lower. And learning the behavior pattern of each user subclass by using a neural network model to obtain an envelope of a normal behavior pattern, predicting to obtain a subsequent normal API (application program interface) calling behavior of the client by using the trained neural network, and comparing the predicted behavior with the actual API calling behavior of the client, so that a new abnormal behavior can be discovered in time.
The systems, apparatuses, modules or units described in the above embodiments may be specifically implemented by a computer chip or an entity, or implemented by a product with certain functions. A typical implementation device is a computer device, which may be, for example, a personal computer, a laptop computer, a cellular telephone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.
In a typical example, the computer device specifically comprises a memory, a processor and a computer program stored on the memory and executable on the processor, the processor implementing the method performed by the client as described above when executing the program, or the processor implementing the method performed by the server as described above when executing the program.
Reference is now made to FIG. 5, which illustrates a block diagram of a computer device suitable for use in implementing embodiments of the present application.
As shown in fig. 5, the computer apparatus 600 includes a Central Processing Unit (CPU) 601 that can perform various appropriate jobs and processes according to a program stored in a Read Only Memory (ROM) 602 or a program loaded from a storage section 608 into a Random Access Memory (RAM)) 603. In the RAM603, various programs and data necessary for the operation of the system 600 are also stored. The CPU601, ROM602, and RAM603 are connected to each other via a bus 604. An input/output (I/O) interface 605 is also connected to bus 604.
The following components are connected to the I/O interface 605: an input portion 606 including a keyboard, a mouse, and the like; an output portion 607 including a display such as a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), and the like, and a speaker; a storage section 608 including a hard disk and the like; and a communication section 609 including a network interface card such as a LAN card, a modem, or the like. The communication section 609 performs communication processing via a network such as the internet. The driver 610 is also connected to the I/O interface 606 as needed. A removable medium 611 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is mounted on the drive 610 as necessary, so that a computer program read out therefrom is mounted as necessary on the storage section 608.
In particular, according to an embodiment of the present invention, the processes described above with reference to the flowcharts may be implemented as computer software programs. For example, embodiments of the invention include a computer program product comprising a computer program tangibly embodied on a machine-readable medium, the computer program comprising program code for performing the method illustrated in the flow chart. In such an embodiment, the computer program may be downloaded and installed from a network through the communication section 609, and/or installed from the removable medium 611.
Computer-readable media, including both non-transitory and non-transitory, removable and non-removable media, may implement information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static Random Access Memory (SRAM), dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), read Only Memory (ROM), electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), digital Versatile Discs (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information that can be accessed by a computing device. As defined herein, a computer readable medium does not include a transitory computer readable medium such as a modulated data signal and a carrier wave.
For convenience of description, the above devices are described as being divided into various units by function, respectively. Of course, the functionality of the units may be implemented in one or more software and/or hardware when implementing the present application.
The present invention has been described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
It should also be noted that the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrases "comprising a," "8230," "8230," or "comprising" does not exclude the presence of other like elements in a process, method, article, or apparatus comprising the element.
As will be appreciated by one skilled in the art, embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The application may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The application may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including memory storage devices.
The embodiments in the present specification are described in a progressive manner, and the same and similar parts among the embodiments are referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, for the system embodiment, since it is substantially similar to the method embodiment, the description is simple, and for the relevant points, reference may be made to the partial description of the method embodiment.
The above description is only an example of the present application and is not intended to limit the present application. Various modifications and changes may occur to those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.
Claims (20)
1. An interface abnormal call monitoring method is characterized by comprising the following steps:
calling behavior data according to a historical interface of a user to generate user portrait characteristics;
converting the user portrait characteristics into a data format capable of inputting a preset calling behavior prediction model, and inputting the data format into the calling behavior prediction model to obtain at least one prediction interface calling behavior data;
monitoring the abnormal condition of the subsequent interface calling behavior of the user according to the at least one piece of predicted interface calling behavior data;
the calling behavior prediction model comprises a mapping relation between user portrait characteristics and prediction interface calling behavior data;
determining the subcategories to which the users belong according to the historical interface calling behavior data of the users;
calling the calling behavior prediction model of the corresponding sub-classification;
determining the subcategories to which the users belong according to the historical interface calling behavior data of the users, wherein the subcategories comprise the following steps:
generating a plurality of fact labels of the user according to behavior data called by a plurality of interfaces of the user;
inputting a plurality of fact labels into a preset model label generation model to generate at least one model label;
generating a business label according to a plurality of the fact labels and at least one model label;
determining the sub-classification based on a plurality of the service tags.
2. The interface exception call monitoring method of claim 1, further comprising:
presetting a plurality of sub-classifications;
and establishing a plurality of calling behavior prediction models corresponding to each sub-classification.
3. The interface exception call monitoring method of claim 2, further comprising:
and taking historical interface calling data of all users corresponding to each sub-classification as a training set, and training each calling behavior prediction model.
4. The interface exception call monitoring method of claim 3, wherein said training each call behavior prediction model comprises:
aiming at each sub-classification, selecting historical interface calling data of a user in the sub-classification, dividing the historical interface calling data into a first part and a second part according to a time sequence, taking the first part of data as input and the second part of data as output, and training a corresponding calling behavior prediction model;
executing iteration operation, dividing historical interface calling data of another user in the sub-classification into a first part and a second part according to a time sequence, further enabling the first part of data of the another user to replace the first part of data of the initial user as input, enabling the second part of data to replace the second part of data of the initial user as output, training the corresponding calling behavior prediction model until the first part of data of any user in the sub-classification is input into the calling behavior prediction model, and finishing the training of the calling behavior prediction model when an output result at least comprises the second part of data of the user;
and obtaining the trained calling behavior prediction model.
5. The interface abnormal call monitoring method according to claim 3, wherein training any one of the call behavior prediction models comprises:
selecting historical interface calling data of all users in the sub-classification corresponding to a calling behavior prediction model, and generating behavior sequences corresponding to the users one by one according to a time sequence;
mapping all interface calling behaviors in each behavior sequence to obtain a sequence vector, wherein each interface calling behavior is correspondingly mapped into one behavior vector;
splitting each sequence vector into a first behavior vector set of which the calling behavior occurs before a preset time point and a second behavior vector set of which the calling behavior occurs after the preset time point;
and taking the first behavior vector set in each behavior sequence as an input, correspondingly taking each behavior vector in the second behavior vector set in each behavior sequence as a target vector, and training the calling behavior prediction model.
6. The method for monitoring interface abnormal call of claim 1, wherein the sub-classification to which the user belongs is determined according to historical interface call behavior data of the user, and further comprising:
establishing the model label generation model based on deep learning;
and taking the marked fact labels and the model labels as a group of training sets, and training the model labels to generate models.
7. The interface abnormal call monitoring method according to claim 2, wherein the presetting of the plurality of sub-classifications includes:
and performing service classification on the users according to historical service data of all the users to generate a plurality of sub-classifications, wherein each sub-classification corresponds to a service label.
8. The method for monitoring interface abnormal call according to claim 7, wherein said classifying the user's traffic according to the user's historical traffic data to generate a plurality of said sub-classifications includes:
and clustering the historical service data of all the users to obtain the corresponding sub-classifications.
9. The interface exception call monitoring method of claim 1, wherein the predicted interface call behavior data comprises predicted behavior types and a probability value for each predicted behavior type to be called; monitoring the abnormal condition of the subsequent interface calling behavior of the user according to the at least one piece of predicted interface calling behavior data, wherein the monitoring comprises the following steps:
sequencing each prediction behavior type from large to small according to the probability value to form a prediction behavior sequence;
acquiring interface calling behaviors of a set number of subsequent executions of a user;
and judging whether the acquired interface calling behaviors are all located before the set position of the predicted behavior sequence, and if so, determining that the subsequent interface calling behaviors of the user are normal.
10. An interface abnormal call monitoring device, comprising:
the user portrait feature generation module is used for generating user portrait features according to behavior data called by a historical interface of a user;
the input module is used for converting the user portrait characteristics into a data format capable of inputting a preset calling behavior prediction model, inputting the data format into the calling behavior prediction model and obtaining calling behavior data of at least one prediction interface;
the abnormal condition monitoring module is used for monitoring the abnormal condition of the subsequent interface calling behavior of the user according to the at least one predicted interface calling behavior data;
the calling behavior prediction model comprises a mapping relation between user portrait characteristics and prediction interface calling behavior data;
the sub-classification determining module is used for determining the sub-classification of the user according to the historical interface calling behavior data of the user;
a calling behavior prediction model calling module calls the calling behavior prediction model of the corresponding sub-classification;
determining the subcategories to which the users belong according to the historical interface calling behavior data of the users, wherein the subcategories comprise:
the fact label generating unit is used for generating a plurality of fact labels of the user according to behavior data called by a plurality of interfaces of the user;
the model label generating unit inputs a plurality of fact labels into a preset model label generating model to generate at least one model label;
a business label generating unit, which generates business labels according to a plurality of the fact labels and at least one model label;
and the sub-classification determining unit is used for determining the sub-classification according to the plurality of service labels.
11. The interface exception call monitoring device of claim 10, further comprising:
the sub-classification presetting module is used for presetting a plurality of sub-classifications;
and the calling behavior prediction model establishing module is used for establishing a plurality of calling behavior prediction models corresponding to each sub-classification.
12. The interface exception call monitoring device of claim 11, further comprising:
and the training module is used for training each calling behavior prediction model by taking historical interface calling data of all users corresponding to each sub-classification as a training set.
13. The interface exception call monitoring device of claim 12, wherein the training module comprises:
the training unit is used for selecting historical interface calling data of one user in each sub-classification according to the time sequence to be divided into a first part and a second part, taking the first part of data as input and the second part of data as output, and training the corresponding calling behavior prediction model;
the iteration training unit is used for executing iteration operation, dividing historical interface calling data of another user in the sub-classification into a first part and a second part according to a time sequence, further enabling the first part of data of the another user to replace the first part of data of the initial user as input, enabling the second part of data to replace the second part of data of the initial user as output, training the corresponding calling behavior prediction model until the first part of data of any user in the sub-classification is input into the calling behavior prediction model, and finishing the training of the calling behavior prediction model when an output result at least comprises the second part of data of the user;
and the output unit is used for obtaining the trained calling behavior prediction model.
14. The interface abnormal call monitoring device according to claim 12, wherein the training module comprises:
the behavior sequence generation unit selects historical interface calling data of all users in the sub-classification corresponding to the calling behavior prediction model, and generates behavior sequences corresponding to the users one by one according to the time sequence;
the mapping unit is used for mapping all interface calling behaviors in each behavior sequence to obtain a sequence vector, wherein each interface calling behavior is mapped into one behavior vector correspondingly;
the sequence vector splitting unit is used for splitting each sequence vector into a first behavior vector set of which the calling behavior occurs before a preset time point and a second behavior vector set of which the calling behavior occurs after the preset time point;
and the training unit is used for taking the first behavior vector set in each behavior sequence as input, correspondingly taking each behavior vector in the second behavior vector set in each behavior sequence as a target vector, and training the calling behavior prediction model.
15. The interface exception call monitoring device of claim 10, wherein the sub-classification determining module further comprises:
a model label generation model establishing unit that establishes the model label generation model based on deep learning;
and the model label generation model training unit is used for training the model label generation model by taking the marked fact labels and the model labels as a group of training sets.
16. The device for monitoring interface abnormal call according to claim 11, wherein the sub-category presetting module performs service classification on users according to historical service data of all users to generate a plurality of sub-categories, wherein each sub-category corresponds to a service label.
17. The device for monitoring interface abnormal call according to claim 16, wherein the sub-category presetting module performs clustering processing on historical service data of all users to obtain the corresponding sub-categories.
18. The interface abnormal call monitoring device according to claim 10, wherein the predicted interface call behavior data includes predicted behavior types and a probability value that each predicted behavior type is called, and the abnormal situation monitoring module includes:
the predicted behavior sequence forming unit is used for sequencing each predicted behavior type from large to small according to the probability value to form a predicted behavior sequence;
the subsequent interface calling behavior acquisition unit is used for acquiring the interface calling behaviors of the set number subsequently executed by the user;
and the behavior normal judging unit is used for judging whether the acquired interface calling behaviors are all positioned in front of the set position of the predicted behavior sequence, and if so, determining that the subsequent interface calling behaviors of the user are normal.
19. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the processor implements the method of any of claims 1 to 9 when executing the program.
20. A computer-readable storage medium, on which a computer program is stored, which, when being executed by a processor, carries out the method of any one of claims 1 to 9.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910795654.0A CN110489307B (en) | 2019-08-27 | 2019-08-27 | Interface abnormal call monitoring method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910795654.0A CN110489307B (en) | 2019-08-27 | 2019-08-27 | Interface abnormal call monitoring method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN110489307A CN110489307A (en) | 2019-11-22 |
| CN110489307B true CN110489307B (en) | 2023-04-07 |
Family
ID=68554522
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910795654.0A Active CN110489307B (en) | 2019-08-27 | 2019-08-27 | Interface abnormal call monitoring method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110489307B (en) |
Families Citing this family (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111901347B (en) * | 2020-07-29 | 2022-12-06 | 南方电网科学研究院有限责任公司 | Dynamic identity authentication method and device under zero trust |
| CN112527601A (en) * | 2020-12-17 | 2021-03-19 | 航天信息股份有限公司 | Monitoring early warning method and device |
| CN112989332B (en) * | 2021-04-08 | 2024-06-11 | 北京安天网络安全技术有限公司 | Abnormal user behavior detection method and device |
| CN113537616A (en) * | 2021-07-28 | 2021-10-22 | 北京达佳互联信息技术有限公司 | Account prediction model training method and device, electronic equipment and storage medium |
| CN115292081B (en) * | 2022-08-10 | 2023-10-20 | 朴道征信有限公司 | Information sending method, device, electronic equipment and medium |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20150222504A1 (en) * | 2014-02-03 | 2015-08-06 | Apigee Corporation | System and method for monitoring and reporting data in api processing systems |
| CN108846520A (en) * | 2018-06-22 | 2018-11-20 | 北京京东金融科技控股有限公司 | Overdue loan prediction technique, device and computer readable storage medium |
| CN110166422A (en) * | 2019-04-01 | 2019-08-23 | 腾讯科技（深圳）有限公司 | Domain name Activity recognition method, apparatus, readable storage medium storing program for executing and computer equipment |
-
2019
- 2019-08-27 CN CN201910795654.0A patent/CN110489307B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20150222504A1 (en) * | 2014-02-03 | 2015-08-06 | Apigee Corporation | System and method for monitoring and reporting data in api processing systems |
| CN108846520A (en) * | 2018-06-22 | 2018-11-20 | 北京京东金融科技控股有限公司 | Overdue loan prediction technique, device and computer readable storage medium |
| CN110166422A (en) * | 2019-04-01 | 2019-08-23 | 腾讯科技（深圳）有限公司 | Domain name Activity recognition method, apparatus, readable storage medium storing program for executing and computer equipment |
Also Published As
| Publication number | Publication date |
|---|---|
| CN110489307A (en) | 2019-11-22 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110489307B (en) | Interface abnormal call monitoring method and device | |
| CN109685647B (en) | Credit fraud detection method and training method and device of model thereof, and server | |
| CN108418825B (en) | Risk model training and junk account detection methods, devices and equipment | |
| CN111553488B (en) | Risk recognition model training method and system for user behaviors | |
| CN110929799B (en) | Method, electronic device, and computer-readable medium for detecting abnormal user | |
| CN110689084B (en) | Abnormal user identification method and device | |
| GB2303275A (en) | Detecting mobile telephone misuse | |
| CN110287316A (en) | A kind of Alarm Classification method, apparatus, electronic equipment and storage medium | |
| CN110798426A (en) | Method and system for detecting flood DoS attack behavior and related components | |
| CN114201278A (en) | Task processing method, task processing device, electronic device, and storage medium | |
| CN113094560A (en) | Data label library construction method, device, equipment and medium based on data middlebox | |
| CN110830504A (en) | Network intrusion behavior detection method and system | |
| CN112750038B (en) | Transaction risk determination method, device and server | |
| CN112100619A (en) | Malicious file detection method, system, equipment and computer storage medium | |
| CN109684837A (en) | A kind of mobile application malware detection method and system towards electric power enterprise | |
| CN116560794A (en) | Exception handling method and device for virtual machine, medium and computer equipment | |
| CN115208938B (en) | User behavior control method and device and computer readable storage medium | |
| CN110830515A (en) | Flow detection method and device and electronic equipment | |
| CN115953080A (en) | Engineer service level determination method, apparatus and storage medium | |
| CN114841267A (en) | Real-time prediction method and device, electronic equipment and computer program product | |
| CN114445682A (en) | Method, device, electronic equipment, storage medium and product for training model | |
| CN114520775A (en) | Application control method and device, electronic equipment and storage medium | |
| CN111798237A (en) | Abnormal transaction diagnosis method and system based on application log | |
| US10832419B2 (en) | Cognitive search analytics for multi-dimensional objects | |
| EP3940626A1 (en) | Information processing method and information processing system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |