WO2016138830A1 - 识别风险行为的方法及装置 - Google Patents

识别风险行为的方法及装置 Download PDF

Info

Publication number
WO2016138830A1
WO2016138830A1 PCT/CN2016/074424 CN2016074424W WO2016138830A1 WO 2016138830 A1 WO2016138830 A1 WO 2016138830A1 CN 2016074424 W CN2016074424 W CN 2016074424W WO 2016138830 A1 WO2016138830 A1 WO 2016138830A1
Authority
WO
WIPO (PCT)
Prior art keywords
risk
behavior
link
users
time
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2016/074424
Other languages
English (en)
French (fr)
Inventor
毛仁歆
孙超
李新凯
何帝君
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Alibaba Group Holding Ltd
Original Assignee
Alibaba Group Holding Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Alibaba Group Holding Ltd filed Critical Alibaba Group Holding Ltd
Priority to KR1020177026844A priority Critical patent/KR102125116B1/ko
Priority to PL16758446T priority patent/PL3267348T3/pl
Priority to SG11201707032UA priority patent/SG11201707032UA/en
Priority to ES16758446T priority patent/ES2801273T3/es
Priority to JP2017546734A priority patent/JP6734293B2/ja
Priority to EP16758446.5A priority patent/EP3267348B1/en
Publication of WO2016138830A1 publication Critical patent/WO2016138830A1/zh
Priority to US15/694,030 priority patent/US10601850B2/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/552—Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/577—Assessing vulnerabilities and evaluating computer system security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1433—Vulnerability analysis
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud

Definitions

  • the present application relates to the field of computer technologies, and in particular, to a method and apparatus for identifying network risk behaviors.
  • network behavior refers to the process of each network individual acquiring, transmitting, or transmitting network data in the network, which usually includes: information inquiry, file downloading, and sending of mail.
  • abnormal network behaviors intentionally or unintentionally made by network individuals can cause losses, such as: company employees browsing information irrelevant during work, and network customer service personnel illegally querying users' consumption records.
  • a risk monitoring system for monitoring network risk behavior has emerged.
  • the traditional risk monitoring system adopts the method of constructing a rule engine, and extracts and analyzes the characteristics of the network behaviors that meet the definition of the rules, thereby realizing the risk identification of the network behavior.
  • the rules used by the rules engine usually have loopholes, and it is necessary to constantly increase the rules to fill the loopholes of the rules, which will undoubtedly increase the workload of the developers and is less efficient.
  • the above rule engine itself needs to consume additional computer resources. , thus putting a burden on the computer system.
  • the embodiment of the present invention provides a method and a device for identifying a risk behavior, which solves the problem of inefficiency caused by filling a rule vulnerability in the process of identifying a network behavior risk in the prior art, and the problem that the rule engine consumes additional computer resources. .
  • An acquisition module configured to acquire behavior data of the user
  • a determining module for determining a risk coefficient of the specific behavior link in the behavior data
  • a determining module configured to determine, according to the risk factor, whether the specific behavior link has a risk.
  • the embodiment of the present application determines the risk coefficient of the specific behavior link in the behavior data by obtaining behavior data of the user and selecting a specific behavior link from the behavior data, and finally determining the specificity according to the risk coefficient. Whether the behavioral link is at risk.
  • the above process does not need to manually fill the rule loopholes, thereby improving the efficiency of behavior risk identification; in addition, the above process avoids the disadvantages of the rule engine consuming additional computer resources, thereby reducing the burden on the computer system.
  • FIG. 3 is a process for determining a short-term risk coefficient in a method for identifying a risk behavior according to an embodiment of the present application
  • FIG. 4 is a process for determining a historical risk coefficient in a method for identifying a risk behavior according to an embodiment of the present application
  • FIG. 5 is a process for determining a team risk coefficient in a method for identifying a risk behavior according to an embodiment of the present application
  • FIG. 6 is a method for determining a specific behavior link in a method for identifying risk behavior according to an embodiment of the present application. Risky process;
  • FIG. 7 is a schematic structural diagram of an apparatus for identifying risk behavior according to an embodiment of the present application.
  • FIG. 1 is a flowchart of a method for identifying a risk behavior according to an embodiment of the present application, including the following steps:
  • the behavior data is obtained through a network monitoring system.
  • the network monitoring records and controls the computers in the network to record Internet activities (network behaviors) made by each user in the network in the time dimension.
  • the network monitoring system includes monitoring hardware or monitoring software, and the network includes a local area network, a metropolitan area network, or a wide area network.
  • the above behavior data is stored in a specific storage medium, and corresponding behavior data is extracted from the storage medium for analysis according to actual analysis requirements.
  • This article will take an e-commerce website as an example to introduce the technical solution of this application.
  • the method of identifying risk behaviors is used to monitor whether the network behavior of the customer service personnel of an e-commerce website is at risk.
  • a behavioral link refers to a combination of multiple behaviors sorted according to the time of occurrence. The behavioral link is closer to the user's true behavioral intention, thereby improving the realism of network behavior risk identification.
  • FIG. 2 is a process of selecting a specific behavior link from the behavior data in the method for identifying a risk behavior according to the embodiment of the present application.
  • step S12 specifically includes the following steps:
  • S121 Select segment data in a specific time period from the behavior data.
  • the fragment data of the user M in a certain time period of the D day can be extracted from the storage medium. If the specific time period is 15 minutes, for example, 13:10 to 13:25, the fragment data refers to the behavior data of the user M during the period from 13:10 to 13:25.
  • S122 Acquire various behaviors included in the fragment data.
  • the behavior made by the user M during the period from 13:10 to 13:25 in the day includes the behavior X, the behavior Y, and the behavior Z.
  • S123 Sort each behavior according to the order of occurrence time to obtain a behavior link.
  • the specific behavior link G obtained is: behavior X ⁇ behavior Y ⁇ behavior Z.
  • the risk coefficient is a numerical value for expressing a rare degree of a specific behavior link G.
  • a network behavior has a higher probability, that is, it is more common, it indicates that the network behavior is normal behavior, such as: the behavior of the customer service personnel to view the information of the store; if the probability of sending a network behavior is low, In rare cases, it indicates that the network behavior is a risk behavior, such as: the behavior of the customer service staff to inquire about the consumption records of relatives and friends.
  • This application uses risk factors to determine whether a network behavior is risky.
  • the above risk coefficient includes one or more of a short-term risk coefficient a, a historical risk coefficient b, and a team risk coefficient c.
  • the risk coefficient analyzed may not be limited to the above three.
  • the short-term risk coefficient a refers to the rare degree that the user M operates the above specific behavior link G in the first time period t 1 (eg, one day);
  • the historical risk coefficient b refers to the total time length t 2 of the user M registered in the user.
  • the user group in which M is located operates a rare degree of the above specific behavior link G.
  • FIG. 3 is a process for determining a short-term risk coefficient in a method for identifying a risk behavior according to an embodiment of the present disclosure, which specifically includes the following steps:
  • the number of all behavior links made by the user M in the day can be counted (ie, the total number of operations) s 1 ).
  • the set first time period t 1 is one day, then the number of times the user M operates the specific behavior link G (ie, the number of operations s 2 ) is counted, specifically, t G is 15 Minute, divide the day into several 15-minute time segments, and determine in turn whether there is a specific behavior link G in each 15-minute time segment. If so, the operation times s 2 plus 1 if not If it occurs, the number of operations s 2 is increased by 0 until the number of operations s 2 in the day is obtained.
  • S133 Determine a ratio of the total number of operations s 1 to the number of operations s 2 to obtain a short-term risk coefficient a.
  • the formula for calculating the short-term risk coefficient a is as follows:
  • FIG. 4 is a process for determining a historical risk coefficient in a method for identifying a risk behavior according to an embodiment of the present disclosure, which specifically includes the following steps:
  • S134 Acquire a total time length t 2 of the user M from the registration time t 0 to the current time t a .
  • the step of obtaining the actual time length t 3 of the user M operating the specific behavior link G is calculated in days, and the behavior data of the user M in the above 365 days is split into 365 pieces of data according to the day. And sequentially determine whether there is a specific behavior link G in the segment data of each day, if it occurs, the actual time length t 3 is increased by 1, if not, the actual time length t 3 is added to 0, until actual operation of a particular user behavior link M of G (i.e., the actual length of time t 3).
  • the total time length t 2 is longer (for example, 3 years), and the actual time length of the old user operating the specific behavior link G is assumed. 3 is 2 days, and finally the probability that the old user has operated the specific behavior link G within the total time length t 2 is low; however, for a new user, due to its late registration time, the total The length of time t 2 is short (eg, 5 days), assuming that the actual time length t 3 of the new user operating the specific behavior link G is 2 days, it is finally concluded that the new user has operated the total time length t 2 The probability of a specific behavior link G is higher. It can be seen that the difference between the old and new users affects the true degree of the historical risk coefficient b. In order to smooth the difference between the old and new users, the above step S136 specifically includes:
  • the total time length t 2 and the actual time length t 3 are smoothed to obtain a smooth total time length t 2k and a smoothed actual time length t 3k .
  • the smoothed actual time length t 2k and the smoothed total time length t 3k are calculated to obtain the historical risk coefficient b.
  • the formula for calculating the historical risk coefficient b is as follows:
  • FIG. 5 is a process for determining a team risk coefficient in a method for identifying a risk behavior according to an embodiment of the present application, which specifically includes the following steps:
  • the department where the user M is located is the user group, and the total number of users included in the department is 20.
  • the step S138 is used to count the number of people who have operated the specific behavior link G in one of the 20 departments of the user M (ie, the actual number of users) m). Specifically, the behavior data of 20 people in the department on the day are respectively obtained in advance, and then the above 20 users are sequentially checked whether there is a specific behavior link G in the day, and if so, the actual user number m is increased by one. If not, the actual user number m is incremented by 0 until the actual number m of users who have operated the specific behavior link G during the day is obtained.
  • S139 Determine the team risk coefficient c according to the total number of users n and the actual number of users m.
  • the above step S139 specifically includes:
  • the total number of users n and the actual number of users m are smoothed to obtain a smoothed total number of users p and a smoothed actual number of users q.
  • the smoothed total number of users p and the smoothed actual number of users q are calculated to obtain the team risk coefficient c.
  • the formula for calculating the team risk coefficient c is as follows:
  • the formula for calculating the risk coefficient r is as follows:
  • the risk factor r a + b + c.
  • FIG. 6 is a process of determining whether a specific behavior link has a risk in a method for identifying a risk behavior according to an embodiment of the present application.
  • the foregoing step S14 specifically includes:
  • S141 Sort the risk coefficient r of each behavior link according to high to low.
  • the extracted behavior data is all behavioral links of user M on a certain day D.
  • this behavior data there are 100 monitored behavioral links, and then determine the 100 behaviors according to the above methods.
  • the risk coefficient of the link is r 1 to r 100 , and then the risk coefficients r 1 to r 100 are sorted from high to low.
  • S142 Determine whether the risk coefficient r G corresponding to the specific behavior link G is within the risk ranking.
  • the risk coefficient r G corresponding to the specific behavior link G is in the top 3, it indicates that the specific behavior link G has a risk, and then the specific behavior link G can be announced as a risk behavior to inform an e-commerce.
  • the customer service staff of the website should not operate the behavior link.
  • FIG. 7 is a schematic structural diagram of an apparatus for identifying risk behavior according to an embodiment of the present application. Based on the same idea, the device includes:
  • the obtaining module 10 is configured to acquire behavior data of the user.
  • the module 20 is configured to select a specific behavior link from the behavior data.
  • the determining module 30 is configured to determine a risk coefficient of the specific behavior link in the behavior data.
  • the determining module 40 is configured to determine, according to the risk coefficient, whether the specific behavior link has a risk.
  • the selection module 20 is specifically configured to:
  • the segment data in a specific time period is selected from the behavior data.
  • Each behavior is sorted in order of occurrence time to get a specific behavioral link.
  • the risk coefficient includes one or more of a short-term risk coefficient, a historical risk coefficient, and a team risk coefficient.
  • the determining module 30 includes a short-term risk determining module 31, configured to:
  • the determining module 30 includes a historical risk determining module 32, configured to:
  • the historical risk factor is determined based on the total length of time and the actual length of time.
  • the determining module 30 includes a team risk determining module 33 for:
  • the actual number of users who have operated a particular behavioral link during the second time period is obtained.
  • the historical risk determining module 32 includes a first smoothing processing unit, configured to:
  • the total time length and the actual time length are smoothed to obtain a smooth total time length and a smooth actual time length.
  • the smoothed actual time length and the smoothed total time length are calculated to obtain a historical risk coefficient.
  • the team risk determination module 33 includes a second smoothing processing unit, configured to:
  • the total number of users and the actual number of users are smoothed to obtain the total number of smooth users and the number of smoothed actual users.
  • the smoothed total number of users and the number of smoothed actual users are calculated to obtain the team risk factor.
  • the determining module 30 is specifically configured to: multiply or sum the short-term risk coefficient, the historical risk coefficient, and the team risk coefficient to obtain the risk coefficient.
  • the determining module 40 is specifically configured to:
  • the risk factors for each behavioral link are sorted from high to low.
  • the method and apparatus provided by the embodiments of the present application determine the risk coefficient of the specific behavior link in the behavior data by calculating the behavior data of the user and selecting a specific behavior link from the behavior data. Finally, based on the risk factor, it is determined whether the specific behavior link is at risk.
  • the above process does not need to manually fill the rule loopholes, thereby improving the efficiency of behavior risk identification; in addition, the above process avoids the disadvantages of the rule engine consuming additional computer resources, thereby reducing the burden on the computer system.
  • the embodiments of the present application comprehensively consider three factors of short-term (such as: certain day), history (registration time to current time), and team (user group) to analyze whether the user's behavior is risky, thereby reducing certain protrusions.
  • the change of the factor (such as: the team adjusts the direction of the business, or the user transfer, etc.) affects the user's behavioral link, thereby improving the accuracy and authenticity of the risk behavior identification.
  • the device for identifying risk behaviors disclosed in this paper is based on the above method for identifying risk behaviors, which is generated according to the same idea. Therefore, the method for identifying risk behaviors can follow all the techniques of the above devices for identifying risk behaviors. Features, this article will not repeat them.
  • the risk coefficients of the respective behavior links are sorted from low to high to determine whether the risk coefficient corresponding to the specific behavior link is in the risk ranking.
  • embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or a combination of software and hardware. Moreover, the present invention may employ computer-usable storage media (including but not limited to disk storage, in one or more of the computer-usable program code embodied therein. The form of a computer program product implemented on a CD-ROM, optical memory, or the like.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more blocks of the flowchart or in a block or blocks of the flowchart.
  • a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
  • processors CPUs
  • input/output interfaces network interfaces
  • memory volatile and non-volatile memory
  • the memory may include non-persistent memory, random access memory (RAM), and/or non-volatile memory in a computer readable medium, such as read only memory (ROM) or flash memory.
  • RAM random access memory
  • ROM read only memory
  • Memory is an example of a computer readable medium.
  • Computer readable media includes both permanent and non-persistent, removable and non-removable media.
  • Information storage can be implemented by any method or technology.
  • the information can be computer readable instructions, data structures, modules of programs, or other data.
  • Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory. (ROM), electrically erasable programmable read only Memory (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape storage or other magnetic A storage device or any other non-transportable medium that can be used to store information that can be accessed by the computing device.
  • computer readable media does not include temporary storage of computer readable media, such as modulated data signals and carrier waves.
  • embodiments of the present application can be provided as a method, system, or computer program product.
  • the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment in combination of software and hardware.
  • the application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computing Systems (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
  • Information Transfer Between Computers (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

本申请公开了一种识别风险行为的方法及装置，用以解决现有技术在识别网络行为风险的过程中因填补规则漏洞所带来的低效率问题。该方法包括：获取用户的行为数据；从所述行为数据中选取特定行为链路；确定所述特定行为链路在所述行为数据中的风险系数；根据所述风险系数，判定所述特定行为链路是否具有风险。

Description

识别风险行为的方法及装置 技术领域
本申请涉及计算机技术领域，尤其涉及一种识别网络风险行为的方法及装置。
背景技术
随着互联网的发展，人们的网络行为越来越频繁交织。从概念上讲，网络行为是指每个网络个体在网络中获取、发送或传输网络数据的过程，通常包括：信息查询、文件下载、发送邮件等。除了正常的网络行为外，网络个体有意或无意作出的异常网络行为会带来损失，例如：公司职员在工作期间浏览工作无关的信息、网络客服人员违规查询用户的消费记录等。为应对以上问题，用以监控网络风险行为的风险监控系统应运而生。
目前，传统的风险监控系统采取构建规则引擎的方式，对符合规则定义的网络行为进行特征提取并分析，从而实现网络行为的风险识别。然而，规则引擎所采用的规则通常存在漏洞，需要不断增加规则来填补规则的漏洞，这样无疑会增加开发人员的工作量，且效率较低；此外，以上规则引擎本身需要耗用额外的计算机资源，从而给计算机系统带来负担。
发明内容
本申请实施例提供一种识别风险行为的方法及装置，以解决现有技术在识别网络行为风险的过程中因填补规则漏洞所带来的低效率问题，以及规则引擎耗费额外的计算机资源的问题。
本申请实施例所提供的识别风险行为的方法，包括：
获取用户的行为数据；
确定特定行为链路在所述行为数据中的风险系数；
根据所述风险系数，判定所述特定行为链路是否具有风险。
本申请实施例所提供的识别风险行为的装置，包括：
获取模块，用于获取用户的行为数据；
确定模块，用于确定特定行为链路在所述行为数据中的风险系数；
判定模块，用于根据所述风险系数判定所述特定行为链路是否具有风险。
本申请实施例采用的上述至少一个技术方案能够达到以下有益效果：
本申请实施例通过获取用户的行为数据，并从该行为数据中选取特定行为链路，通过运算来确定所述特定行为链路在所述行为数据中的风险系数，最后根据风险系数来确定特定行为链路是否具有风险。以上过程相较于规则引擎方式，无需人工填补规则漏洞，从而提升了行为风险识别的效率；此外，以上过程避免了规则引擎耗用额外的计算机资源的弊端，从而减轻了计算机系统的负担。
附图说明
此处所说明的附图用来提供对本申请的进一步理解，构成本申请的一部分，本申请的示意性实施例及其说明用以解释本申请，并不构成对本申请的不当限定。在附图中：
图1为本申请实施例提供的识别风险行为的方法的过程；
图2为本申请实施例提供的识别风险行为的方法中从行为数据中选取特定行为链路的过程；
图3为本申请实施例提供的识别风险行为的方法中确定短期风险系数的过程；
图4为本申请实施例提供的识别风险行为的方法中确定历史风险系数的过程；
图5为本申请实施例提供的识别风险行为的方法中确定团队风险系数的过程；
图6为本申请实施例提供的识别风险行为的方法中判定特定行为链路是否 具有风险的过程；
图7为本申请实施例提供的识别风险行为的装置的结构示意图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合本申请具体实施例及相应的附图对本申请技术方案进行清楚、完整地描述。显然，所描述的实施例仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
图1为本申请实施例提供的识别风险行为的方法的过程，包括如下步骤：
S11：获取用户的行为数据。
本申请实施例中，行为数据通过网络监控系统来获得，网络监控通过对网络中的计算机进行监视和控制，以将网络中各个用户在时间维度上所作的互联网活动(网络行为)进行记录。其中，网络监控系统包括监控硬件或监控软件，网络包括局域网、或城域网、或广域网。以上行为数据存储于特定的存储介质中，按照实际分析需求，从所述存储介质中抽取到相应的行为数据进行分析。
本文将以某电商网站为例来介绍本申请的技术方案。则本识别风险行为的方法用于监控某电商网站的客服人员的网络行为是否具有风险。
S12：从行为数据中选取特定行为链路。行为链路是指多个行为按照发生时间先后排序所得的组合，由于行为链路更贴近用户的真实行为意图，从而提升网络行为风险识别的真实度。
图2为本申请实施例提供的识别风险行为的方法中从行为数据中选取特定行为链路的过程，本申请实施例中，步骤S12具体包括如下步骤：
S121：从行为数据中选取特定时间段内的片段数据。
沿用本文实例，假设需要作行为风险分析的网络个体是用户M，则可以从存储介质中提取出该用户M在某一天D中的一个特定时间段的片段数据，假 设该特定时间段是15分钟，比如：13:10～13:25，则所述片段数据是指该用户M在该天中13:10～13:25这段时间内所作的行为数据。
S122：获取片段数据中所包含的各个行为。
在以上实例中，假设在该天中13:10～13:25这段时间内，用户M所作的行为包括行为X、行为Y及行为Z。
S123：将各个行为按照发生时间的先后顺序进行排序，以得到行为链路。
在以上实例中，按照行为X、行为Y及行为Z的发生时间从先到后的顺序进行排序，则得到的特定行为链路G是：行为X→行为Y→行为Z。
S13：确定特定行为链路在行为数据中的风险系数。
本申请实施例中，风险系数是用于表达某个特定行为链路G的罕见程度的数值。通常，若某个网络行为所发生的概率较高，即较为普遍，则表明该网络行为是正常行为，比如：客服人员查看商铺信息的行为；若某个网络行为所发送的概率较低，即在极罕见的情况才会发生，则表明该网络行为是风险行为，比如：客服人员查询亲友的消费记录的行为。本申请通过风险系数来判别某个网络行为是否具有风险。
本申请实施例中，以上风险系数包括短期风险系数a、历史风险系数b、团队风险系数c中的一个或多个。当然，在本申请其他实施例中，所分析的风险系数可不限于以上三种。短期风险系数a是指用户M在第一时间段t1(如：一天)内操作以上特定行为链路G的罕见程度；历史风险系数b是指用户M在该用户注册的总时间长度t2(注册时间到当前时间的间隔)内操作以上特定行为链路G的罕见程度；若定义用户M所在的用户人群为用户组，则该用户组包括多个用户，则团队风险系数c是指用户M所在的用户组操作以上特定行为链路G的罕见程度。
以下将详细介绍以上各风险系数的确定过程：
图3为本申请实施例提供的识别风险行为的方法中确定短期风险系数的过程，具体包括如下步骤：
S131：获取用户M在第一时间段t1内操作所有行为链路的操作总次数s1。
沿用本文实例，假设第一时间段t1是一天，则基于该用户M在该天中的行为数据，可以统计出该用户M在该天中所作的所有行为链路的数目(即操作总次数s1)。本申请实施例中，以单个特定行为链路G所持续的时间间隔tG为基准，来统计用户M在该天中的操作总次数s1，具体地，假设tG是15分钟，则操作总次数s1＝24*60/15＝96。
S132：获取用户M在第一时间段t1内操作特定行为链路G的操作次数s2。
在以上实例中，所设定的第一时间段t1是一天，则统计用户M在该天中操作特定行为链路G的次数(即操作次数s2)，具体地，假设tG是15分钟，则将该天划分成若干个15分钟的时间片段，并依次判断每个15分钟的时间片段内是否有发生特定行为链路G，若有发生，则操作次数s2加1，若没有发生，则操作次数s2加0，直至得到该天中的操作次数s2。
S133：确定操作总次数s1与操作次数s2的比值，以得到短期风险系数a。
本申请实施例中，计算短期风险系数a的公式如下：
a＝s1/s2。
图4为本申请实施例提供的识别风险行为的方法中确定历史风险系数的过程，具体包括如下步骤：
S134：获取用户M从注册时间t0到当前时间ta的总时间长度t2。
沿用本文实例，假设用户M在某电商网站的客服系统中的注册时间t0是：2014年1月1日，当前时间ta是2015年1月1日，则总时间长度t2是：365天。
S135：获取用户M操作特定行为链路G的实际时间长度t3。
本申请实施例中，获取用户M操作特定行为链路G的实际时间长度t3的步骤以天来计算，则将该用户M在以上365天的行为数据，按天拆分成365个片段数据，并依次判断各天的片段数据中是否有发生过特定行为链路G，若有发生，则将实际时间长度t3加1，若没有发生，则将实际时间长度t3加0， 直至得到用户M操作特定行为链路G的实际天数(即实际时间长度t3)。
S136：根据总时间长度t2及实际时间长度t3，确定历史风险系数b。
本申请实施例中，对于某个老用户而言，因其注册时间较早，总时间长度t2较长(如：3年)，假设该老用户操作特定行为链路G的实际时间长度t3是2天，则最终得出该老用户在总时间长度t2内操作过该特定行为链路G的概率较低；然而，对于某个新用户而言，因其注册时间较晚，总时间长度t2较短(如：5天)，假设该新用户操作特定行为链路G的实际时间长度t3是2天，则最终得出该新用户在总时间长度t2内操作过该特定行为链路G的概率较高。可见，新老用户之间的差异会影响历史风险系数b的真实程度，为了平滑处理新老用户之间的差异，以上步骤S136具体包括：
首先，将总时间长度t2及实际时间长度t3作平滑处理，以得到平滑总时间长度t2k和平滑实际时间长度t3k。本申请实施例中，平滑处理的方式可为对数化处理、或取余化处理、或开方化处理等。以对数化处理方式为例，t2k＝lg t2；t3k＝lg t3，当然，对数化处理的底数不受限制。
然后，将平滑实际时间长度t2k及平滑总时间长度t3k进行运算，以得到所述历史风险系数b。本申请实施例中，计算历史风险系数b的公式如下：
b＝(1+t3k)/(1+t2k)＝(1+lgt3)/(1+lgt2)。
图5为本申请实施例提供的识别风险行为的方法中确定团队风险系数的过程，具体包括如下步骤：
S137：确定用户M所在的用户组中包含的用户总数n。
沿用本文实例，假设用户M是某电商网站的客服人员，则以该用户M所在部门为用户组，假设该部门包含的用户总数n是20人。
S138：在所述用户组中，获取在第二时间段t4内操作过特定行为链路G的实际用户数m。
在以上实例中，假设第二时间段t4是一天，则该步骤S138用来统计该用户M所在部门的20人中，在某天中操作过特定行为链路G的人数(即实际用 户数m)。具体地，事先分别获取该部门中20人在该天的行为数据，然后依次查看以上20个用户在该天中是否有操作过特定行为链路G，若有，则将实际用户数m加1，若没有，则将实际用户数m加0，直至得到在该天内操作过特定行为链路G的实际用户数m。
S139：根据用户总数n及实际用户数m，确定团队风险系数c。
本申请实施例中，若所需分析的用户组所包含的用户数量较大(如：n＝1000人)，若得到在某天内操作过特定行为链路G的实际用户数m＝5，则此刻表明特定行为链路G在以上用户组中被操作过的概率较低；然而，若所需分析的用户组所包含的用户数量较小(如：n＝10人)，若得到在某天内操作过特定行为链路G的实际用户数m＝5，则此刻表明特定行为链路G在以上用户组中被操作过的概率较高。可见，不同用户组之间用户数量的差异会影响团队风险系数c的真实程度，为了平滑处理用户组所包含的用户数量的差异，以上步骤S139具体包括：
首先，将用户总数n及实际用户数m作平滑处理，以得到平滑用户总数p和平滑实际用户数q。本申请实施例中，平滑处理的方式可为对数化处理、或取余化处理、或开方化处理等。以对数化处理方式为例，p＝lg n；q＝lg m，当然，对数化处理的底数不受限制。
然后，将平滑用户总数p及平滑实际用户数q进行运算，以得到所述团队风险系数c。本申请实施例中，计算团队风险系数c的公式如下：
c＝(1+p)/(1+q)＝(1+lgn)/(1+lgm)。
S14：根据风险系数r，判定特定行为链路G是否具有风险。
本申请实施例中，计算风险系数r的公式如下：
r＝a×b×c。
当然，在本申请其他实施例中，风险系数r＝a+b+c。
图6为本申请实施例提供的识别风险行为的方法中判定特定行为链路是否具有风险的过程。本申请实施例中，以上步骤S14具体包括：
S141：将各个行为链路的风险系数r按照从高到低进行排序。
继续沿用本文实例，假设所抽取的行为数据是用户M在某一天D的所有行为链路，在此行为数据中，监控到的行为链路有100个，则分别依据以上方法确定这100个行为链路的风险系数r1～r100，之后将风险系数r1～r100按照从高到低进行排序。
S142：判断特定行为链路G所对应的风险系数rG是否处于风险排名内。
本申请实施例中，风险系数的排名越靠前，则表明该行为链路越罕见，其风险系数越高，假设预先设定的风险排名是前3名，则判断特定行为链路G所对应的风险系数rG是否处于前3名内。
S143：若是，则判定该特定行为链路G具有风险。
若特定行为链路G所对应的风险系数rG处于前3名内，则表明该特定行为链路G具有风险，之后可将该特定行为链路G作为风险行为进行公布，以告知某电商网站的客服人员不要操作该行为链路。
S144：若否，则判定该特定行为链路G不具有风险。
若特定行为链路G所对应的风险系数rG不处于前3名内，则表明该特定行为链路G不具有风险。
图7为本申请实施例提供的识别风险行为的装置的结构示意图。基于同样的思路，该装置包括：
获取模块10，用于获取用户的行为数据。
选取模块20，用于从所述行为数据中选取特定行为链路。
确定模块30，用于确定特定行为链路在所述行为数据中的风险系数。
判定模块40，用于根据所述风险系数判定所述特定行为链路是否具有风险。
本申请实施例中，选取模块20具体用于：
从行为数据中选取特定时间段内的片段数据。
获取片段数据中所包含的各个行为。
将各个行为按照发生时间的先后顺序进行排序，以得到特定行为链路。
本申请实施例中，风险系数包括短期风险系数、历史风险系数、团队风险系数中的一个或多个。
本申请实施例中，确定模块30包括短期风险确定模块31，用于：
获取用户在第一时间段内操作所有行为链路的操作总次数。
获取用户在第一时间段内操作特定行为链路的操作次数。
确定操作总次数与操作次数的比值，以得到短期风险系数。
本申请实施例中，确定模块30包括历史风险确定模块32，用于：
获取用户从注册时间到当前时间的总时间长度。
获取用户操作特定行为链路的实际时间长度。
根据总时间长度及实际时间长度，确定历史风险系数。
本申请实施例中，确定模块30包括团队风险确定模块33，用于：
确定用户所在的用户组中包含的用户总数。
在用户组中，获取在第二时间段内操作过特定行为链路的实际用户数。
根据用户总数及实际用户数，确定团队风险系数。
本申请实施例中，历史风险确定模块32包括第一平滑处理单元，用于：
将总时间长度及实际时间长度作平滑处理，以得到平滑总时间长度和平滑实际时间长度。
将平滑实际时间长度及平滑总时间长度进行运算，以得到历史风险系数。
本申请实施例中，团队风险确定模块33包括第二平滑处理单元，用于：
将用户总数及实际用户数作平滑处理，以得到平滑用户总数和平滑实际用户数。
将平滑用户总数及平滑实际用户数进行运算，以得到团队风险系数。
本申请实施例中，确定模块30具体用于：将短期风险系数、历史风险系数及团队风险系数进行乘积或求和，以得到所述风险系数。
本申请实施例中，判定模块40具体用于：
将各个行为链路的风险系数按照从高到低进行排序。
判断特定行为链路所对应的风险系数是否处于风险排名内。
若是，则判定该特定行为链路具有风险，若否，则判定该特定行为链路不具有风险。
本申请实施例所提供的方法及装置，通过获取用户的行为数据，并从该行为数据中选取特定行为链路，通过运算来确定所述特定行为链路在所述行为数据中的风险系数，最后根据风险系数来确定特定行为链路是否具有风险。以上过程相较于规则引擎方式，无需人工填补规则漏洞，从而提升了行为风险识别的效率；此外，以上过程避免了规则引擎耗用额外的计算机资源的弊端，从而减轻了计算机系统的负担。
本申请实施例综合考虑短期(如：某天)、历史(注册时间到当前时间)以及团队(用户所在用户组)这三个因数，来分析用户的行为是否具有风险，从而减小某些突发因数的转变(如：团队调整业务方向、或用户转岗等)对用户的行为链路的影响，进而提升风险行为识别的准确度及真实度。
值得一提的是，本文所披露的识别风险行为的装置是基于以上识别风险行为的方法，按照同样的思路所产生的，故该识别风险行为的方法可沿用以上识别风险行为的装置的所有技术特征，本文不再予以赘述。
另外值得注意的是，本申请中各风险系数的计算公式并不限于所公开的实施例，如：在其他实施例中，短期风险系数a＝s2/s1；历史风险系数b＝(1+lgt2)/(1+lgt3)；团队风险系数c＝(1+lgm)/(1+lgn)。相应地，在后续判定行为链路是否具有风险时，则将各个行为链路的风险系数按照从低到高进行排序，以判断特定行为链路所对应的风险系数是否处于风险排名内。
本领域内的技术人员应明白，本发明的实施例可提供为方法、系统、或计算机程序产品。因此，本发明可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本发明可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、 CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本发明是参照根据本发明实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用以实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用以实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
在一个典型的配置中，计算设备包括一个或多个处理器(CPU)、输入/输出接口、网络接口和内存。
内存可能包括计算机可读介质中的非永久性存储器，随机存取存储器(RAM)和/或非易失性内存等形式，如只读存储器(ROM)或闪存(flash RAM)。内存是计算机可读介质的示例。
计算机可读介质包括永久性和非永久性、可移动和非可移动媒体可以由任何方法或技术来实现信息存储。信息可以是计算机可读指令、数据结构、程序的模块或其他数据。计算机的存储介质的例子包括，但不限于相变内存(PRAM)、静态随机存取存储器(SRAM)、动态随机存取存储器(DRAM)、其他类型的随机存取存储器(RAM)、只读存储器(ROM)、电可擦除可编程只读 存储器(EEPROM)、快闪记忆体或其他内存技术、只读光盘只读存储器(CD-ROM)、数字多功能光盘(DVD)或其他光学存储、磁盒式磁带，磁带磁磁盘存储或其他磁性存储设备或任何其他非传输介质，可用以存储可以被计算设备访问的信息。按照本文中的界定，计算机可读介质不包括暂存电脑可读媒体(transitory media)，如调制的数据信号和载波。
还需要说明的是，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、商品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、商品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、商品或者设备中还存在另外的相同要素。
本领域技术人员应明白，本申请的实施例可提供为方法、系统或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
以上所述仅为本申请的实施例而已，并不用以限制本申请。对于本领域技术人员来说，本申请可以有各种更改和变化。凡在本申请的精神和原理之内所作的任何修改、等同替换、改进等，均应包含在本申请的权利要求范围之内。

Claims (20)

  1. 一种识别风险行为的方法，其特征在于，包括：
    获取用户的行为数据；
    从所述行为数据中选取特定行为链路；
    确定所述特定行为链路在所述行为数据中的风险系数；
    根据所述风险系数，判定所述特定行为链路是否具有风险。
  2. 根据权利要求1所述的方法，其特征在于，从所述行为数据中选取特定行为链路，具体包括：
    从所述行为数据中选取特定时间段内的片段数据；
    获取所述片段数据中所包含的各个行为；
    将各个行为按照发生时间的先后顺序进行排序，以得到所述特定行为链路。
  3. 根据权利要求1所述的方法，其特征在于，所述风险系数包括短期风险系数、历史风险系数、团队风险系数中的一个或多个。
  4. 根据权利要求3所述的方法，其特征在于，确定特定行为链路在所述行为数据中的风险系数，具体包括：
    获取所述用户在第一时间段内操作所有行为链路的操作总次数；
    获取所述用户在第一时间段内操作所述特定行为链路的操作次数；
    确定所述操作总次数与所述操作次数的比值，以得到所述短期风险系数。
  5. 根据权利要求3所述的方法，其特征在于，确定特定行为链路在所述行为数据中的风险系数，具体包括：
    获取所述用户从注册时间到当前时间的总时间长度；
    获取所述用户操作所述特定行为链路的实际时间长度；
    根据所述总时间长度及所述实际时间长度，确定所述历史风险系数。
  6. 根据权利要求3所述的方法，其特征在于，确定特定行为链路在所述行为数据中的风险系数，具体包括：
    确定所述用户所在的用户组中包含的用户总数；
    在所述用户组中，获取在第二时间段内操作过所述特定行为链路的实际用户数；
    根据所述用户总数及所述实际用户数，确定所述团队风险系数。
  7. 根据权利要求5所述的方法，其特征在于，根据所述总时间长度及所述实际时间长度，确定所述历史风险系数，具体包括：
    将所述总时间长度及所述实际时间长度作平滑处理，以得到平滑总时间长度和平滑实际时间长度；
    将所述平滑实际时间长度及所述平滑总时间长度进行运算，以得到所述历史风险系数。
  8. 根据权利要求6所述的方法，其特征在于，根据所述用户总数及所述实际用户数，确定所述团队风险系数，具体包括：
    将所述用户总数及所述实际用户数作平滑处理，以得到平滑用户总数和平滑实际用户数；
    将所述平滑用户总数及所述平滑实际用户数进行运算，以得到所述团队风险系数。
  9. 根据权利要求3所述的方法，其特征在于，确定特定行为链路在所述行为数据中的风险系数，具体包括：
    将短期风险系数、历史风险系数及团队风险系数进行乘积或求和，以得到所述风险系数。
  10. 根据权利要求1所述的方法，其特征在于，根据所述风险系数，判定该目标行为是否具有风险，具体包括：
    将各个行为链路的风险系数按照从高到低进行排序；
    判断所述特定行为链路所对应的风险系数是否处于风险排名内；
    若是，则判定该特定行为链路具有风险，若否，则判定该特定行为链路不具有风险。
  11. 一种识别风险行为的装置，其特征在于，包括：
    获取模块，用于获取用户的行为数据；
    选取模块，用于从所述行为数据中选取特定行为链路；
    确定模块，用于确定特定行为链路在所述行为数据中的风险系数；
    判定模块，用于根据所述风险系数判定所述特定行为链路是否具有风险。
  12. 根据权利要求11所述的装置，其特征在于，所述选取模块具体用于：
    从所述行为数据中选取特定时间段内的片段数据；
    获取所述片段数据中所包含的各个行为；
    将各个行为按照发生时间的先后顺序进行排序，以得到所述特定行为链路。
  13. 根据权利要求11所述的装置，其特征在于，所述风险系数包括短期风险系数、历史风险系数、团队风险系数中的一个或多个。
  14. 根据权利要求13所述的装置，其特征在于，所述确定模块包括短期风险确定模块，用于：
    获取所述用户在第一时间段内操作所有行为链路的操作总次数；
    获取所述用户在第一时间段内操作所述特定行为链路的操作次数；
    确定所述操作总次数与所述操作次数的比值，以得到所述短期风险系数。
  15. 根据权利要求13所述的装置，其特征在于，所述确定模块包括历史风险确定模块，用于：
    获取所述用户从注册时间到当前时间的总时间长度；
    获取所述用户操作所述特定行为链路的实际时间长度；
    根据所述总时间长度及所述实际时间长度，确定所述历史风险系数。
  16. 根据权利要求13所述的装置，其特征在于，所述确定模块包括团队风险确定模块，用于：
    确定所述用户所在的用户组中包含的用户总数；
    在所述用户组中，获取在第二时间段内操作过所述特定行为链路的实际用 户数；
    根据所述用户总数及所述实际用户数，确定所述团队风险系数。
  17. 根据权利要求15所述的装置，其特征在于，所述历史风险确定模块包括第一平滑处理单元，用于：
    将所述总时间长度及所述实际时间长度作平滑处理，以得到平滑总时间长度和平滑实际时间长度；
    将所述平滑实际时间长度及所述平滑总时间长度进行运算，以得到所述历史风险系数。
  18. 根据权利要求16所述的装置，其特征在于，所述团队风险确定模块包括第二平滑处理单元，用于：
    将所述用户总数及所述实际用户数作平滑处理，以得到平滑用户总数和平滑实际用户数；
    将所述平滑用户总数及所述平滑实际用户数进行运算，以得到所述团队风险系数。
  19. 根据权利要求13所述的装置，其特征在于，所述确定模块具体用于：
    将短期风险系数、历史风险系数及团队风险系数进行乘积或求和，以得到所述风险系数。
  20. 根据权利要求11所述的装置，其特征在于，所述判定模块具体用于：
    将各个行为链路的风险系数按照从高到低进行排序；
    判断所述特定行为链路所对应的风险系数是否处于风险排名内；
    若是，则判定该特定行为链路具有风险，若否，则判定该特定行为链路不具有风险。
PCT/CN2016/074424 2015-03-02 2016-02-24 识别风险行为的方法及装置 Ceased WO2016138830A1 (zh)

Priority Applications (7)

Application Number Priority Date Filing Date Title
KR1020177026844A KR102125116B1 (ko) 2015-03-02 2016-02-24 위험성 있는 활동을 인식하기 위한 방법 및 장치
PL16758446T PL3267348T3 (pl) 2015-03-02 2016-02-24 Sposób i urządzenie do rozpoznawania ryzykownego zachowania
SG11201707032UA SG11201707032UA (en) 2015-03-02 2016-02-24 Method and apparatus for identifying risky behavior
ES16758446T ES2801273T3 (es) 2015-03-02 2016-02-24 Método y aparato para reconocer el comportamiento de riesgo
JP2017546734A JP6734293B2 (ja) 2015-03-02 2016-02-24 危険行動を特定するための方法及び装置
EP16758446.5A EP3267348B1 (en) 2015-03-02 2016-02-24 Method and apparatus for recognizing risk behavior
US15/694,030 US10601850B2 (en) 2015-03-02 2017-09-01 Identifying risky user behaviors in computer networks

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510093725.4A CN105989155B (zh) 2015-03-02 2015-03-02 识别风险行为的方法及装置
CN201510093725.4 2015-03-02

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/694,030 Continuation US10601850B2 (en) 2015-03-02 2017-09-01 Identifying risky user behaviors in computer networks

Publications (1)

Publication Number Publication Date
WO2016138830A1 true WO2016138830A1 (zh) 2016-09-09

Family

ID=56848744

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/074424 Ceased WO2016138830A1 (zh) 2015-03-02 2016-02-24 识别风险行为的方法及装置

Country Status (9)

Country Link
US (1) US10601850B2 (zh)
EP (1) EP3267348B1 (zh)
JP (1) JP6734293B2 (zh)
KR (1) KR102125116B1 (zh)
CN (1) CN105989155B (zh)
ES (1) ES2801273T3 (zh)
PL (1) PL3267348T3 (zh)
SG (1) SG11201707032UA (zh)
WO (1) WO2016138830A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107566163A (zh) * 2017-08-10 2018-01-09 北京奇安信科技有限公司 一种用户行为分析关联的告警方法及装置

Families Citing this family (24)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106529288A (zh) * 2016-11-16 2017-03-22 智者四海（北京）技术有限公司 一种帐号风险识别方法及装置
CN108229963B (zh) * 2016-12-12 2021-07-30 创新先进技术有限公司 用户操作行为的风险识别方法及装置
CN108427624B (zh) * 2017-02-13 2021-03-02 创新先进技术有限公司 一种系统稳定性风险的识别方法以及设备
CN108449307B (zh) * 2017-02-16 2020-12-29 上海行邑信息科技有限公司 一种用于识别风险设备的方法
US10917423B2 (en) 2017-05-15 2021-02-09 Forcepoint, LLC Intelligently differentiating between different types of states and attributes when using an adaptive trust profile
US10915644B2 (en) 2017-05-15 2021-02-09 Forcepoint, LLC Collecting data for centralized use in an adaptive trust profile event via an endpoint
US10623431B2 (en) * 2017-05-15 2020-04-14 Forcepoint Llc Discerning psychological state from correlated user behavior and contextual information
US9882918B1 (en) 2017-05-15 2018-01-30 Forcepoint, LLC User behavior profile in a blockchain
US10862927B2 (en) * 2017-05-15 2020-12-08 Forcepoint, LLC Dividing events into sessions during adaptive trust profile operations
US10999296B2 (en) 2017-05-15 2021-05-04 Forcepoint, LLC Generating adaptive trust profiles using information derived from similarly situated organizations
US10999297B2 (en) 2017-05-15 2021-05-04 Forcepoint, LLC Using expected behavior of an entity when prepopulating an adaptive trust profile
US10447718B2 (en) 2017-05-15 2019-10-15 Forcepoint Llc User profile definition and management
US10129269B1 (en) 2017-05-15 2018-11-13 Forcepoint, LLC Managing blockchain access to user profile information
CN107517203B (zh) * 2017-08-08 2020-07-14 奇安信科技集团股份有限公司 一种用户行为基线建立方法及装置
CN108304308A (zh) * 2018-02-07 2018-07-20 平安普惠企业管理有限公司 用户行为监控方法、装置、计算机设备和存储介质
US10997295B2 (en) 2019-04-26 2021-05-04 Forcepoint, LLC Adaptive trust profile reference architecture
US11621974B2 (en) * 2019-05-14 2023-04-04 Tenable, Inc. Managing supersedence of solutions for security issues among assets of an enterprise network
CN110457896A (zh) * 2019-07-02 2019-11-15 北京人人云图信息技术有限公司 在线访问的检测方法及检测装置
US12216791B2 (en) 2020-02-24 2025-02-04 Forcepoint Llc Re-identifying pseudonymized or de-identified data utilizing distributed ledger technology
CN111582722B (zh) * 2020-05-09 2022-06-07 拉扎斯网络科技（上海）有限公司 风险识别方法、装置、电子设备及可读存储介质
CN114764418B (zh) * 2020-12-31 2025-02-28 北京达佳互联信息技术有限公司 风险检测方法、装置、电子设备及存储介质
CN112866230B (zh) * 2021-01-13 2023-05-16 深信服科技股份有限公司 一种风险检测方法、装置及存储介质
CN112927068B (zh) * 2021-03-30 2024-08-20 善诊(上海)信息技术有限公司 业务数据风险分类门限确定方法、装置、设备及存储介质
CN113051560B (zh) * 2021-04-13 2024-05-24 北京安天网络安全技术有限公司 终端行为的安全识别方法和装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130117397A1 (en) * 2005-02-28 2013-05-09 Mcafee Inc. Stopping and remediating outbound messaging abuse
CN103297267A (zh) * 2013-05-10 2013-09-11 河北远东通信系统工程有限公司 一种网络行为的风险评估方法和系统
WO2014088559A1 (en) * 2012-12-04 2014-06-12 Hewlett-Packard Development Company, L.P. Determining suspected root causes of anomalous network behavior
CN104011731A (zh) * 2011-10-18 2014-08-27 迈克菲公司 用户行为风险评估

Family Cites Families (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7574382B1 (en) * 2004-08-03 2009-08-11 Amazon Technologies, Inc. Automated detection of anomalous user activity associated with specific items in an electronic catalog
CA2531410A1 (en) * 2005-12-23 2007-06-23 Snipe Network Security Corporation Behavioural-based network anomaly detection based on user and group profiling
US7574832B1 (en) 2007-01-24 2009-08-18 Lieberman Phillip L Portable telescoping tower assembly
JP2010108469A (ja) * 2008-10-01 2010-05-13 Sky Co Ltd 操作監視システム及び操作監視プログラム
US8356001B2 (en) * 2009-05-19 2013-01-15 Xybersecure, Inc. Systems and methods for application-level security
US8566956B2 (en) 2010-06-23 2013-10-22 Salesforce.Com, Inc. Monitoring and reporting of data access behavior of authorized database users
US8850517B2 (en) 2013-01-15 2014-09-30 Taasera, Inc. Runtime risk detection based on user, application, and system action sequence correlation
US20140359777A1 (en) * 2013-05-31 2014-12-04 Fixmo, Inc. Context-aware risk measurement mobile device management system
US20150039513A1 (en) * 2014-02-14 2015-02-05 Brighterion, Inc. User device profiling in transaction authentications
CN104376266B (zh) * 2014-11-21 2017-09-15 工业和信息化部电信研究院 应用软件安全级别的确定方法及装置
US10075474B2 (en) * 2015-02-06 2018-09-11 Honeywell International Inc. Notification subsystem for generating consolidated, filtered, and relevant security risk-based notifications

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130117397A1 (en) * 2005-02-28 2013-05-09 Mcafee Inc. Stopping and remediating outbound messaging abuse
CN104011731A (zh) * 2011-10-18 2014-08-27 迈克菲公司 用户行为风险评估
WO2014088559A1 (en) * 2012-12-04 2014-06-12 Hewlett-Packard Development Company, L.P. Determining suspected root causes of anomalous network behavior
CN103297267A (zh) * 2013-05-10 2013-09-11 河北远东通信系统工程有限公司 一种网络行为的风险评估方法和系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3267348A4 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107566163A (zh) * 2017-08-10 2018-01-09 北京奇安信科技有限公司 一种用户行为分析关联的告警方法及装置

Also Published As

Publication number Publication date
PL3267348T3 (pl) 2020-11-16
KR20170125864A (ko) 2017-11-15
EP3267348A1 (en) 2018-01-10
US10601850B2 (en) 2020-03-24
JP2018510422A (ja) 2018-04-12
EP3267348B1 (en) 2020-04-08
EP3267348A4 (en) 2018-10-31
CN105989155B (zh) 2019-10-25
US20180013780A1 (en) 2018-01-11
ES2801273T3 (es) 2021-01-08
SG11201707032UA (en) 2017-09-28
CN105989155A (zh) 2016-10-05
KR102125116B1 (ko) 2020-06-22
JP6734293B2 (ja) 2020-08-05

Similar Documents

Publication Publication Date Title
WO2016138830A1 (zh) 识别风险行为的方法及装置
Pacheco et al. Is my transaction done yet? an empirical study of transaction processing times in the ethereum blockchain platform
US20170109657A1 (en) Machine Learning-Based Model for Identifying Executions of a Business Process
CN110546621B (zh) 用于数据存储的垃圾收集
US10073726B2 (en) Detection of outage in cloud based service using usage data based error signals
AU2020203735B2 (en) Automated generation and dynamic update of rules
US20170109639A1 (en) General Model for Linking Between Nonconsecutively Performed Steps in Business Processes
CN113052509B (zh) 模型评估方法、模型评估装置、电子设备和存储介质
Zhang et al. Dynamic risk-aware patch scheduling
JP6707004B2 (ja) 企業のブループリントを生成するシステム及び方法
CN120179509A (zh) 基于因果推断与知识图谱的微服务故障定位方法、设备
US20170109640A1 (en) Generation of Candidate Sequences Using Crowd-Based Seeds of Commonly-Performed Steps of a Business Process
US9444708B2 (en) Detection of outage in cloud based service using synthetic measurements and anonymized usage data
CA3257704A1 (en) CASH FLOW PREDICTION METHODS AND SYSTEMS
CN110675069B (zh) 地产行业客户签约风险预警方法、服务器及存储介质
US20170109637A1 (en) Crowd-Based Model for Identifying Nonconsecutive Executions of a Business Process
Qudsi et al. Predictive data mining of chronic diseases using decision tree: A case study of health insurance company in Indonesia
US20150242866A1 (en) Determination device, determination method, and computer-readable recording medium
US20170109670A1 (en) Crowd-Based Patterns for Identifying Executions of Business Processes
Quinn et al. Process mining is an underutilized clinical research tool in transfusion medicine
JP6714160B2 (ja) データリニエージ検出装置、データリニエージ検出方法、及びデータリニエージ検出プログラム
CN113672800B (zh) 实名认证自然人用户的事项推荐方法及存储介质
Chavan et al. Trust model for cloud data service providers
CN111583037B (zh) 风险关联对象的确定方法、装置和服务器
US20250013924A1 (en) Systems and methods for dynamic data operations modelling

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16758446

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 11201707032U

Country of ref document: SG

ENP Entry into the national phase

Ref document number: 2017546734

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 20177026844

Country of ref document: KR

Kind code of ref document: A

REEP Request for entry into the european phase

Ref document number: 2016758446

Country of ref document: EP