CN109446789A - Anticollision library method, equipment, storage medium and device based on artificial intelligence - Google Patents
Anticollision library method, equipment, storage medium and device based on artificial intelligence Download PDFInfo
- Publication number
- CN109446789A CN109446789A CN201811233085.2A CN201811233085A CN109446789A CN 109446789 A CN109446789 A CN 109446789A CN 201811233085 A CN201811233085 A CN 201811233085A CN 109446789 A CN109446789 A CN 109446789A
- Authority
- CN
- China
- Prior art keywords
- library
- current
- anticollision
- artificial intelligence
- behavioural characteristic
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/44—Program or device authentication
- G06F21/445—Program or device authentication by mutual authentication, e.g. between devices or programs
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
- G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/2133—Verifying human interaction, e.g., Captcha
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Data Mining & Analysis (AREA)
- Computer Security & Cryptography (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Software Systems (AREA)
- Life Sciences & Earth Sciences (AREA)
- Computer Hardware Design (AREA)
- Artificial Intelligence (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Bioinformatics & Computational Biology (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Evolutionary Biology (AREA)
- Evolutionary Computation (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The invention discloses a kind of anticollision library method, equipment, storage medium and device based on artificial intelligence, the described method includes: whether monitoring current page is login page, when the current page is the login page, obtain the current behavior feature that user carries out register in the login page, the current behavior feature is compared with default classifier, identifies whether the current behavior feature is to hit library behavioural characteristic according to comparing result.The behavioural characteristic data that code acquisition user login page is operated are acquired by presetting behavior in the present invention, current behavior feature is extracted from the behavioural characteristic data, classified by default classifier to the current behavior feature, to identify whether the current behavior feature is to hit library behavioural characteristic, it can be identified before hitting library attacker and logining successfully and hit library attack, it effectively prevent hitting library attack, ensures the network security of real user.
Description
Technical field
The present invention relates to technical field of network security more particularly to a kind of anticollision library method based on artificial intelligence, equipment,
Storage medium and device.
Background technique
As people more and more continually browse web sites, the login of website is safe and also receives the pass of people using safe
Note.Due to many users on different web sites all can register account number, remember for convenience, these general accounts and password are all phase
Together or password is different but there are evident regularities, therefore, a kind of technological means of hacker attack website occurs, hits library, i.e. hacker
It goes to attack other websites by the account information and encrypted message of certain website being collected into, and generally batch logs in, with
Have the function that increase the attack frequency and success rate.
Currently, anticollision library safety measure used by current site network operators, generally in a period of time, if same
The address IP (Internet Protocol), password errors number are more than threshold value, then it is assumed that it is to hit library row that this, which currently logs in behavior,
To forbid logging in for a period of time to the IP address, could be logged in after verification SMS or the close guarantor's problem of answer.However,
It since Agent IP is relatively cheap, hits library attacker and can buy a large amount of Agent IPs and carry out hitting library, hit library behavior from the identification of IP level
It produces little effect.Therefore, the prior art, which there is technical issues that preferably to differentiate, hits library.
Above content is only used to facilitate the understanding of the technical scheme, and is not represented and is recognized that above content is existing skill
Art.
Summary of the invention
The anticollision library method that the main purpose of the present invention is to provide a kind of based on artificial intelligence, equipment, storage medium and
Device, it is intended to which solution cannot preferably differentiate the technical issues of hitting library behavior in the prior art.
To achieve the above object, the present invention provides a kind of anticollision library method based on artificial intelligence, the method includes with
Lower step:
Monitor whether current page is login page；
When the current page is the login page, user is obtained in the login page and carries out working as register
Preceding behavioural characteristic；
The current behavior feature is compared with default classifier, identifies that the current behavior is special according to comparing result
Whether sign is to hit library behavioural characteristic.
Preferably, before whether the monitoring current page is login page, the anticollision library side based on artificial intelligence
Method further include:
Sample data is obtained, the sample data includes sample behavioural characteristic and the corresponding sample of the sample behavioural characteristic
Positive negativity；
Establish fundamental classifier, according to the sample behavioural characteristic and the positive negativity of the sample to the fundamental classifier into
Row training generates default classifier.
Preferably, described to establish fundamental classifier, according to the sample behavioural characteristic and the positive negativity of the sample to described
Fundamental classifier is trained, and is generated default classifier, is specifically included:
Fundamental classifier is established, the sample behavioural characteristic is input in the fundamental classifier, so that the basis
Positive negativity is predicted in classifier output；
When the positive negativity of the prediction and the inconsistent positive negativity of the sample, the parameter of the fundamental classifier is adjusted
It is whole, to generate default classifier.
Preferably, the current behavior feature includes: repeat logon number, the current input speed of log-on message and mouse
The current moving characteristic of cursor；
Correspondingly, described when the current page is the login page, it obtains user and is carried out in the login page
The current behavior feature of register, specifically includes:
When the current page is the login page, the repeat logon time of the login page in unit time period is detected
Number；
Detection user inputs current input speed when log-on message in the login page；
Cursor of mouse is detected in the current moving characteristic of the login page.
Preferably, the current moving characteristic include: cursor of mouse the login page current movement speed, current
Translational acceleration and current motion track.
Preferably, described to compare the current behavior feature with default classifier, institute is identified according to comparing result
State whether current behavior feature is the anticollision library method based on artificial intelligence after hitting library behavioural characteristic further include:
When the current behavior feature is to hit library behavioural characteristic, default identifying code is shown.
Preferably, described when the current behavior feature is to hit library behavioural characteristic, it is described after showing default identifying code
Anticollision library method based on artificial intelligence further include:
Library risk report is hit according to current behavior feature generation；
The library risk report that hits is sent to the corresponding targeted website of the login page, so that the targeted website is held
Row safeguard measure.
In addition, to achieve the above object, the present invention also provides a kind of anticollision library facilities based on artificial intelligence is described to be based on
The anticollision library facilities of artificial intelligence includes: memory, processor and is stored on the memory and can be on the processor
The anticollision library based on artificial intelligence of operation, when the anticollision library based on artificial intelligence is executed by the processor
The step of realizing anticollision library method based on artificial intelligence as described above.
In addition, to achieve the above object, the present invention also provides a kind of storage medium, being stored with and being based on the storage medium
The anticollision library of artificial intelligence is realized as described above when the anticollision library based on artificial intelligence is executed by processor
The step of anticollision library method based on artificial intelligence.
In addition, to achieve the above object, the present invention also provides a kind of anticollision library device based on artificial intelligence is described to be based on
The anticollision library device of artificial intelligence includes:
Page monitoring modular, for monitoring whether current page is login page；
Feature obtains module, for obtaining user in the log in page when the current page is the login page
The current behavior feature of face progress register；
Activity recognition module, for comparing the current behavior feature with default classifier, according to comparing result
Identify whether the current behavior feature is to hit library behavioural characteristic.
It in the present invention, whether is login page by monitoring current page, when the current page is the log in page
When face, the current behavior feature that user carries out register in the login page is obtained, by the current behavior feature and in advance
If classifier compares, identify whether the current behavior feature is to hit library behavioural characteristic according to comparing result.Due to passing through
The behavioural characteristic data that default behavior acquisition code acquisition user login page is operated, mention from the behavioural characteristic data
Current behavior feature is taken out, is classified by default classifier to the current behavior feature, to identify described current
Whether behavioural characteristic is to hit library behavioural characteristic, can identify before hitting library attacker and logining successfully and hit library attack, have
Effect prevents from hitting library attack, ensures the network security of real user.
Detailed description of the invention
Fig. 1 is the anticollision library facilities structure based on artificial intelligence for the hardware running environment that the embodiment of the present invention is related to
Schematic diagram；
Fig. 2 is that the present invention is based on the flow diagrams of the anticollision library method first embodiment of artificial intelligence；
Fig. 3 is that the present invention is based on the flow diagrams of the anticollision library method second embodiment of artificial intelligence；
Fig. 4 is that the present invention is based on the flow diagrams of the anticollision library method 3rd embodiment of artificial intelligence；
Fig. 5 is that the present invention is based on the flow diagrams of the anticollision library method fourth embodiment of artificial intelligence；
Fig. 6 is that the present invention is based on the functional block diagrams of the anticollision library device first embodiment of artificial intelligence.
The embodiments will be further described with reference to the accompanying drawings for the realization, the function and the advantages of the object of the present invention.
Specific embodiment
It should be appreciated that the specific embodiments described herein are merely illustrative of the present invention, it is not intended to limit the present invention.
Referring to Fig.1, Fig. 1 is the anticollision library based on artificial intelligence for the hardware running environment that the embodiment of the present invention is related to
Device structure schematic diagram.
As shown in Figure 1, the anticollision library facilities based on artificial intelligence may include: processor 1001, such as CPU, lead to
Believe bus 1002, user interface 1003, network interface 1004, memory 1005.Wherein, communication bus 1002 is for realizing these
Connection communication between component.User interface 1003 may include display screen (Display), and optional user interface 1003 can be with
Including standard wireline interface and wireless interface.Network interface 1004 optionally may include standard wireline interface and wireless interface
(such as WI-FI interface).Memory 1005 can be high speed RAM memory, be also possible to stable memory (non-volatile
), such as magnetic disk storage memory.Memory 1005 optionally can also be the storage dress independently of aforementioned processor 1001
It sets.
Prevented based on artificial intelligence it will be understood by those skilled in the art that structure shown in Fig. 1 is not constituted described
The restriction for hitting library facilities may include perhaps combining certain components or different components than illustrating more or fewer components
Arrangement.
As shown in Figure 1, as may include operating system, network communication mould in a kind of memory 1005 of storage medium
Block, Subscriber Interface Module SIM and the anticollision library based on artificial intelligence.
In anticollision library facilities based on artificial intelligence shown in Fig. 1, network interface 1004 is mainly used for connection backstage and takes
Business device carries out data communication with the background server；User interface 1003 is mainly used for connecting peripheral hardware；It is described to be based on artificial intelligence
The anticollision library facilities of energy calls the anticollision library based on artificial intelligence stored in memory 1005 by processor 1001, and
Execute the anticollision library method provided in an embodiment of the present invention based on artificial intelligence.
The anticollision library facilities based on artificial intelligence by processor 1001 call memory 1005 in store based on
The anticollision library of artificial intelligence, and execute following operation:
Monitor whether current page is login page；
When the current page is the login page, user is obtained in the login page and carries out working as register
Preceding behavioural characteristic；
The current behavior feature is compared with default classifier, identifies that the current behavior is special according to comparing result
Whether sign is to hit library behavioural characteristic.
Further, processor 1001 can call the anticollision library journey based on artificial intelligence stored in memory 1005
Sequence also executes following operation:
Sample data is obtained, the sample data includes sample behavioural characteristic and the corresponding sample of the sample behavioural characteristic
Positive negativity；
Establish fundamental classifier, according to the sample behavioural characteristic and the positive negativity of the sample to the fundamental classifier into
Row training generates default classifier.
Further, processor 1001 can call the anticollision library journey based on artificial intelligence stored in memory 1005
Sequence also executes following operation:
Fundamental classifier is established, the sample behavioural characteristic is input in the fundamental classifier, so that the basis
Positive negativity is predicted in classifier output；
When the positive negativity of the prediction and the inconsistent positive negativity of the sample, the parameter of the fundamental classifier is adjusted
It is whole, to generate default classifier.
Further, processor 1001 can call the anticollision library journey based on artificial intelligence stored in memory 1005
Sequence also executes following operation:
When the current page is the login page, the repeat logon time of the login page in unit time period is detected
Number；
Detection user inputs current input speed when log-on message in the login page；
Cursor of mouse is detected in the current moving characteristic of the login page.
Further, processor 1001 can call the anticollision library journey based on artificial intelligence stored in memory 1005
Sequence also executes following operation:
When the current behavior feature is to hit library behavioural characteristic, default identifying code is shown.
Further, processor 1001 can call the anticollision library journey based on artificial intelligence stored in memory 1005
Sequence also executes following operation:
Library risk report is hit according to current behavior feature generation；
The library risk report that hits is sent to the corresponding targeted website of the login page, so that the targeted website is held
Row safeguard measure.
It in the present embodiment, whether is login page by monitoring current page, when the current page is the login
When the page, obtain user the login page carry out register current behavior feature, by the current behavior feature with
Default classifier compares, and identifies whether the current behavior feature is to hit library behavioural characteristic according to comparing result.Due to logical
The behavioural characteristic data that default behavior acquisition code acquisition user login page is operated are crossed, from the behavioural characteristic data
Current behavior feature is extracted, is classified by default classifier to the current behavior feature, to identify described work as
Whether preceding behavioural characteristic is to hit library behavioural characteristic, can identify before hitting library attacker and logining successfully and hit library attack,
It effectively prevent hitting library attack, ensures the network security of real user.
Based on above-mentioned hardware configuration, propose that the present invention is based on the embodiments of the anticollision library method of artificial intelligence.
It is that the present invention is based on the flow diagrams of the anticollision library method first embodiment of artificial intelligence referring to Fig. 2, Fig. 2.
In the first embodiment, the anticollision library method based on artificial intelligence the following steps are included:
Step S10: whether monitoring current page is login page.
It should be noted that the executing subject of the present embodiment is the anticollision library facilities based on artificial intelligence, it is described to be based on people
The anticollision library facilities of work intelligence can be the electronic equipments such as PC, server, and the present embodiment is without restriction to this.This reality
The application scenarios for applying example are, when user is when login page logs in, by acquiring current behavior feature, and based on default point
Class device, which is characterized the current line, classifies, and the user characterized by judging to initiate the current line is real user or hits library
Attacker, to take defensive measure when user is to hit library attacker.
It is understood that will be monitored in advance to acquire the current behavior feature that user is operated in login page
Whether current page is login page, when the current page is login page, is adopted to current behavior feature
Collection.
Step S20: it when the current page is the login page, obtains user and is logged in the login page
The current behavior feature of operation.
It is understood that code is acquired embedded with default behavior in the login page, for the behavior to login page
Characteristic is acquired, and the behavioural characteristic data of code acquisition are acquired by obtaining the default behavior, special from the behavior
Current behavior feature is extracted in sign data, judges whether the user is to hit library to attack by the current behavior feature to realize
The person of hitting.
In the concrete realization, the default behavior acquisition code is embedded in the login page by way of event in the ranks
In, specific embedded mode are as follows: < input type=" button " name=" " onclick=" alert (' preset behavior acquisition
Code ')；After the login page insertion default behavior acquisition code, the default behavior acquisition code will acquire " >,
Click event (onclick), mouse immigration event (mouseover) and mouse of the user when the login page operates
Mark removal event (mouseout) etc..
Step S30: the current behavior feature is compared with default classifier, according to comparing result identify described in work as
Whether preceding behavioural characteristic is to hit library behavioural characteristic.
It should be noted that constructing disaggregated model, i.e. classifier on the basis of existing sample data
(Classifier), which can be mapped to the data recording in database some in given classification, so as to
It is predicted with being applied to data.Default classifier in the present embodiment using support vector machines (Support Vector Machine,
SVM) algorithm constructs, and is the classifiers of two classification of one kind, be mainly used for for behavioural characteristic being classified as normally logging in behavioural characteristic with
Hit library behavioural characteristic.
In the concrete realization, the current behavior feature is compared with default classifier, i.e., by the current behavior
Feature is input in the default classifier, so that the default classifier carries out the generic of the current behavior feature
Prediction, output category result, to identify whether the current behavior feature is to hit library behavioural characteristic, in the current behavior
Feature is to take defensive measure when hitting library behavioural characteristic.
It in the present embodiment, whether is login page by monitoring current page, when the current page is the login
When the page, obtain user the login page carry out register current behavior feature, by the current behavior feature with
Default classifier compares, and identifies whether the current behavior feature is to hit library behavioural characteristic according to comparing result.Due to logical
The behavioural characteristic data that default behavior acquisition code acquisition user login page is operated are crossed, from the behavioural characteristic data
Current behavior feature is extracted, is classified by default classifier to the current behavior feature, to identify described work as
Whether preceding behavioural characteristic is to hit library behavioural characteristic, can identify before hitting library attacker and logining successfully and hit library attack,
It effectively prevent hitting library attack, ensures the network security of real user.
It is that the present invention is based on the flow diagram of the anticollision library method second embodiment of artificial intelligence, bases referring to Fig. 3, Fig. 3
In above-mentioned embodiment shown in Fig. 2, propose that the present invention is based on the second embodiments of the anticollision library method of artificial intelligence.
In a second embodiment, before the step S10, the anticollision library method based on artificial intelligence further include:
Step S01: sample data is obtained, the sample data includes sample behavioural characteristic and the sample behavioural characteristic pair
The positive negativity of the sample answered.
It should be noted that the sample data is used to construct the default classifier, and the default classifier is used for
It is classified as behavioural characteristic normally to log in behavioural characteristic and hits library behavioural characteristic, therefore, the sample data includes sample behavior
Feature and the positive negativity of the corresponding sample of the sample behavioural characteristic namely the sample data include positive sample behavioural characteristic and bear
Sample behavioural characteristic, the positive sample behavioural characteristic are normal login behavioural characteristic, and the negative sample behavioural characteristic is to hit library to step on
Record behavioural characteristic.
Step S02: establishing fundamental classifier, according to the sample behavioural characteristic and the positive negativity of the sample to the basis
Classifier is trained, and generates default classifier.
It is understood that the fundamental classifier is the classifier constructed based on algorithm of support vector machine, by described
Positive sample behavioural characteristic and the negative sample behavioural characteristic are trained and test to the fundamental classifier, on the basis point
When the predictablity rate of class device reaches threshold value, as default classifier.
Further, the step S02, specifically includes:
Fundamental classifier is established, the sample behavioural characteristic is input in the fundamental classifier, so that the basis
Positive negativity is predicted in classifier output；
When the positive negativity of the prediction and the inconsistent positive negativity of the sample, the parameter of the fundamental classifier is adjusted
It is whole, to generate default classifier.
It should be noted that the detailed process being trained by the sample behavioural characteristic to the fundamental classifier
For, the sample behavioural characteristic is input in the fundamental classifier, so that positive negativity is predicted in fundamental classifier output,
When the positive negativity of the prediction and the inconsistent positive negativity of the sample, the parameter of the fundamental classifier is adjusted, with life
At default classifier.
In the concrete realization, the positive sample behavioural characteristic is input in the fundamental classifier, so that the basis
Positive negativity is predicted in classifier output, and when the positive negativity of prediction is positive, the fundamental classifier will export " 1 ", described in judgement
Fundamental classifier prediction is correct, and forward direction adjusts the parameter of the fundamental classifier；When the positive negativity of prediction is negative, the base
Plinth classifier will export " ﹣ 1 ", determine the fundamental classifier prediction error, reversely adjust the parameter of the fundamental classifier.It will
The negative sample behavioural characteristic is input in the fundamental classifier, so that positive negativity is predicted in fundamental classifier output, when
When the positive negativity of prediction is positive, the fundamental classifier will export " 1 ", determine the fundamental classifier prediction error, reversely
Adjust the parameter of the fundamental classifier；When the positive negativity of prediction is negative, the fundamental classifier will export " ﹣ 1 ", determine
The fundamental classifier prediction is correct, and forward direction adjusts the parameter of the fundamental classifier.To special by a large amount of positive sample behaviors
Negative sample behavioural characteristic of seeking peace is trained the fundamental classifier, the parameter of fundamental classifier is gradually adjusted, in the base
When the predictablity rate of plinth classifier reaches threshold value, as default classifier.
In the present embodiment, by obtaining sample data, the sample data includes sample behavioural characteristic and the sample
The positive negativity of the corresponding sample of behavioural characteristic；Fundamental classifier is established, the sample behavioural characteristic is input to the base categories
In device, so that positive negativity is predicted in fundamental classifier output；When the positive negativity of the prediction and the positive negativity of the sample are inconsistent
When, the parameter of the fundamental classifier is adjusted, to generate default classifier.Due to acquiring a large amount of positive negative samples, mention
The high predictablity rate of the default classifier, to improve the accuracy rate identified to the current behavior feature.
It is that the present invention is based on the flow diagram of the anticollision library method 3rd embodiment of artificial intelligence, bases referring to Fig. 4, Fig. 4
In above-mentioned embodiment shown in Fig. 3, propose that the present invention is based on the 3rd embodiments of the anticollision library method of artificial intelligence.
In the third embodiment, the current behavior feature includes: the current input speed of repeat logon number, log-on message
The current moving characteristic of degree and cursor of mouse.
Correspondingly, the step S20, specifically includes:
Step S201: when the current page is the login page, the login page in unit time period is detected
Repeat logon number.
It should be noted that when the current page is the login page generation will be acquired by the default behavior
Current behavior feature of the code acquisition user when the login page operates, by described in the default classifier identification
Whether current behavior feature is to hit library behavioural characteristic, wherein the current behavior feature includes repeat logon number, due to true
The login times of user are well below the login times for hitting library, therefore, using repeat logon number as identification behavioural characteristic whether
For one of the feature for hitting library behavioural characteristic, real user behavioural characteristic is distinguished with realization and hits library behavioural characteristic.In the present embodiment
In, the duration of the unit time period is preset, can be 5 minutes, be also possible to other durations, this is not added in the present embodiment
With limitation.When the current page is the login page, repetition of the user in the login page in detection unit time period
Login times.
Step S202: detection user inputs current input speed when log-on message in the login page.
It is understood that the current behavior feature further includes current input speed, due to the input speed of real user
Whether degree generally below hits the input speed in library, be to hit library behavioural characteristic using input speed as identification behavioural characteristic therefore
One of feature, to realize differentiation real user behavioural characteristic and hit library behavioural characteristic.
Step S203: current moving characteristic of the detection cursor of mouse in the login page.
It should be noted that the current behavior feature further includes current moving characteristic, due to real user and library use is hit
The mode of the mobile cursor of mouse in family has biggish difference, and the movement of real user is more slowly and mixed and disorderly, and hits the mouse in library
Whether movement is more quickly and orderly, be to hit library behavior spy using the moving characteristic of cursor of mouse as identification behavioural characteristic therefore
One of feature of sign, to realize differentiation real user behavioural characteristic and hit library behavioural characteristic.
Further, the current moving characteristic include: cursor of mouse the login page current movement speed, when
Preceding translational acceleration and current motion track.
It is understood that the movement due to real user is more slowly and mixed and disorderly, and the mouse movement for hitting library is more fast
It is fast and orderly, therefore, by cursor of mouse in the current movement speed of the login page, current translational acceleration and current movement
Track is as the current moving characteristic, to improve the accuracy distinguished real user behavioural characteristic and hit library behavioural characteristic.
In the present embodiment, by by repeat logon number, the current input speed of log-on message and working as cursor of mouse
The features such as preceding moving characteristic are as current behavior feature, to realize differentiation real user behavioural characteristic and hit library behavioural characteristic, and
Using the features such as the moving characteristic of repeat logon number, the input speed of log-on message and cursor of mouse as sample behavioural characteristic into
The training of row classifier, to improve the recognition accuracy of default classifier.
It is that the present invention is based on the flow diagram of the anticollision library method fourth embodiment of artificial intelligence, bases referring to Fig. 5, Fig. 5
In above-mentioned embodiment shown in Fig. 3, propose that the present invention is based on the fourth embodiments of the anticollision library method of artificial intelligence.
In the fourth embodiment, the current behavior feature includes: the current input speed of repeat logon number, log-on message
The current moving characteristic of degree and cursor of mouse.
Correspondingly, after the step S30, the anticollision library method based on artificial intelligence further include:
Step S40: when the current behavior feature is to hit library behavioural characteristic, default identifying code is shown.
It should be noted that defensive measure prevention will be taken to hit when the current behavior feature is to hit library behavioural characteristic
Library attacker logs in the corresponding targeted website of the login page, in the present embodiment, will show default identifying code, described default
Identifying code is graphical verification code or sliding identifying code etc., have it is more highly difficult, hit library attacker be difficult to by machine directly into
Row verifying.
Step S50: library risk report is hit according to current behavior feature generation.
Step S60: the library risk report that hits is sent to the corresponding targeted website of the login page, so that the mesh
It marks website and executes safeguard measure.
It is understood that, to improve protection effect, the defensive measure further includes root after showing default identifying code
Library risk report is hit according to current behavior feature generation, and the library risk report that hits is sent to the login page correspondence
Targeted website the current login behavior of library attacker is hit described in prevention so that the targeted website executes safeguard measure.
In the present embodiment, by showing default identifying code when the current behavior feature is to hit library behavioural characteristic；Root
Library risk report is hit according to current behavior feature generation；It hits library risk report by described to be sent to the login page corresponding
Targeted website, so that the targeted website executes safeguard measure.Due to the current behavior feature be hit library behavioural characteristic when,
It shows that default identifying code and generation hit library risk report, can prevent to hit the library attacker login targeted website in real time, and
Subsequent defence is carried out by targeted website, improves the defence dynamics of the targeted website.
In addition, the embodiment of the present invention also proposes a kind of storage medium, it is stored on the storage medium based on artificial intelligence
Anticollision library, following operation is realized when the anticollision library based on artificial intelligence is executed by processor:
Monitor whether current page is login page；
When the current page is the login page, user is obtained in the login page and carries out working as register
Preceding behavioural characteristic；
The current behavior feature is compared with default classifier, identifies that the current behavior is special according to comparing result
Whether sign is to hit library behavioural characteristic.
Further, following operation is also realized when the anticollision library based on artificial intelligence is executed by processor:
Sample data is obtained, the sample data includes sample behavioural characteristic and the corresponding sample of the sample behavioural characteristic
Positive negativity；
Establish fundamental classifier, according to the sample behavioural characteristic and the positive negativity of the sample to the fundamental classifier into
Row training generates default classifier.
Further, following operation is also realized when the anticollision library based on artificial intelligence is executed by processor:
Fundamental classifier is established, the sample behavioural characteristic is input in the fundamental classifier, so that the basis
Positive negativity is predicted in classifier output；
When the positive negativity of the prediction and the inconsistent positive negativity of the sample, the parameter of the fundamental classifier is adjusted
It is whole, to generate default classifier.
Further, following operation is also realized when the anticollision library based on artificial intelligence is executed by processor:
When the current page is the login page, the repeat logon time of the login page in unit time period is detected
Number；
Detection user inputs current input speed when log-on message in the login page；
Cursor of mouse is detected in the current moving characteristic of the login page.
Further, following operation is also realized when the anticollision library based on artificial intelligence is executed by processor:
When the current behavior feature is to hit library behavioural characteristic, default identifying code is shown.
Further, following operation is also realized when the anticollision library based on artificial intelligence is executed by processor:
Library risk report is hit according to current behavior feature generation；
The library risk report that hits is sent to the corresponding targeted website of the login page, so that the targeted website is held
Row safeguard measure.
It in the present embodiment, whether is login page by monitoring current page, when the current page is the login
When the page, obtain user the login page carry out register current behavior feature, by the current behavior feature with
Default classifier compares, and identifies whether the current behavior feature is to hit library behavioural characteristic according to comparing result.Due to logical
The behavioural characteristic data that default behavior acquisition code acquisition user login page is operated are crossed, from the behavioural characteristic data
Current behavior feature is extracted, is classified by default classifier to the current behavior feature, to identify described work as
Whether preceding behavioural characteristic is to hit library behavioural characteristic, can identify before hitting library attacker and logining successfully and hit library attack,
It effectively prevent hitting library attack, ensures the network security of real user.
It is that the present invention is based on the functional block diagram of the anticollision library device first embodiment of artificial intelligence, bases referring to Fig. 6, Fig. 6
In the anticollision library method based on artificial intelligence, propose that the present invention is based on the implementations of the first of the anticollision library device of artificial intelligence
Example.
In the present embodiment, the anticollision library device based on artificial intelligence includes:
Page monitoring modular 10, for monitoring whether current page is login page.
It should be noted that the application scenarios of the present embodiment are, when user is when login page logs in, pass through acquisition
Current behavior feature, and the current line is characterized based on default classifier and is classified, it is special to initiate the current behavior with judgement
The user of sign is real user or hits library attacker, to take defensive measure when user is to hit library attacker.
It is understood that will be monitored in advance to acquire the current behavior feature that user is operated in login page
Whether current page is login page, when the current page is login page, is adopted to current behavior feature
Collection.
Feature obtains module 20, for obtaining user in the login when the current page is the login page
The current behavior feature of page progress register.
It is understood that code is acquired embedded with default behavior in the login page, for the behavior to login page
Characteristic is acquired, and the behavioural characteristic data of code acquisition are acquired by obtaining the default behavior, special from the behavior
Current behavior feature is extracted in sign data, judges whether the user is to hit library to attack by the current behavior feature to realize
The person of hitting.
In the concrete realization, the default behavior acquisition code is embedded in the login page by way of event in the ranks
In, specific embedded mode are as follows: < input type=" button " name=" " onclick=" alert (' preset behavior acquisition
Code ')；After the login page insertion default behavior acquisition code, the default behavior acquisition code will acquire " >,
Click event (onclick), mouse immigration event (mouseover) and mouse of the user when the login page operates
Mark removal event (mouseout) etc..
Activity recognition module 30 is tied for comparing the current behavior feature with default classifier according to comparison
Fruit identifies whether the current behavior feature is to hit library behavioural characteristic.
It should be noted that constructing disaggregated model, i.e. classifier on the basis of existing sample data
(Classifier), which can be mapped to the data recording in database some in given classification, so as to
It is predicted with being applied to data.Default classifier in the present embodiment using support vector machines (Support Vector Machine,
SVM) algorithm constructs, and is the classifiers of two classification of one kind, be mainly used for for behavioural characteristic being classified as normally logging in behavioural characteristic with
Hit library behavioural characteristic.
In the concrete realization, the current behavior feature is compared with default classifier, i.e., by the current behavior
Feature is input in the default classifier, so that the default classifier carries out the generic of the current behavior feature
Prediction, output category result, to identify whether the current behavior feature is to hit library behavioural characteristic, in the current behavior
Feature is to take defensive measure when hitting library behavioural characteristic.
It in the present embodiment, whether is login page by monitoring current page, when the current page is the login
When the page, obtain user the login page carry out register current behavior feature, by the current behavior feature with
Default classifier compares, and identifies whether the current behavior feature is to hit library behavioural characteristic according to comparing result.Due to logical
The behavioural characteristic data that default behavior acquisition code acquisition user login page is operated are crossed, from the behavioural characteristic data
Current behavior feature is extracted, is classified by default classifier to the current behavior feature, to identify described work as
Whether preceding behavioural characteristic is to hit library behavioural characteristic, can identify before hitting library attacker and logining successfully and hit library attack,
It effectively prevent hitting library attack, ensures the network security of real user.
In one embodiment, the anticollision library device based on artificial intelligence further include:
Sample collection module, for obtaining sample data, the sample data includes sample behavioural characteristic and the sample
The positive negativity of the corresponding sample of behavioural characteristic.
Model building module, for establishing fundamental classifier, according to the sample behavioural characteristic and the positive negativity of the sample
The fundamental classifier is trained, default classifier is generated.
In one embodiment, the model building module is also used to establish fundamental classifier, by the sample behavioural characteristic
It is input in the fundamental classifier, so that positive negativity is predicted in fundamental classifier output；
When the positive negativity of the prediction and the inconsistent positive negativity of the sample, the parameter of the fundamental classifier is adjusted
It is whole, to generate default classifier.
In one embodiment, the current behavior feature includes: the current input speed of repeat logon number, log-on message
With the current moving characteristic of cursor of mouse；
Correspondingly, the feature obtains module 20, is also used to when the current page is the login page, detection is single
The repeat logon number of the login page in the period of position；
Detection user inputs current input speed when log-on message in the login page；
Cursor of mouse is detected in the current moving characteristic of the login page.
In one embodiment, the current moving characteristic includes: current mobile speed of the cursor of mouse in the login page
Degree, current translational acceleration and current motion track.
In one embodiment, the anticollision library device based on artificial intelligence further include:
Defense module is verified, for showing default identifying code when the current behavior feature is to hit library behavioural characteristic.
In one embodiment, the anticollision library device based on artificial intelligence further include:
Risk-recovery module, for hitting library risk report according to current behavior feature generation；
The library risk report that hits is sent to the corresponding targeted website of the login page, so that the targeted website is held
Row safeguard measure.
The other embodiments or specific implementation of anticollision library device of the present invention based on artificial intelligence can refer to
Each method embodiment is stated, details are not described herein again.
It should be noted that, in this document, the terms "include", "comprise" or its any other variant are intended to non-row
His property includes, so that the process, method, article or the device that include a series of elements not only include those elements, and
And further include other elements that are not explicitly listed, or further include for this process, method, article or device institute it is intrinsic
Element.In the absence of more restrictions, the element limited by sentence "including a ...", it is not excluded that including being somebody's turn to do
There is also other identical elements in the process, method of element, article or device.
The serial number of the above embodiments of the invention is only for description, does not represent the advantages or disadvantages of the embodiments.
The use of word first, second, and third does not indicate any sequence, these words can be construed to title.
Through the above description of the embodiments, those skilled in the art can be understood that above-described embodiment side
Method can be realized by means of software and necessary general hardware platform, naturally it is also possible to by hardware, but in many cases
The former is more preferably embodiment.Based on this understanding, technical solution of the present invention substantially in other words does the prior art
The part contributed out can be embodied in the form of software products, which is stored in a storage medium
In (such as ROM/RAM, magnetic disk, CD), including some instructions are used so that a terminal device (can be mobile phone, computer, clothes
Business device, air conditioner or the network equipment etc.) execute method described in each embodiment of the present invention.
The above is only a preferred embodiment of the present invention, is not intended to limit the scope of the invention, all to utilize this hair
Equivalent structure or equivalent flow shift made by bright specification and accompanying drawing content is applied directly or indirectly in other relevant skills
Art field, is included within the scope of the present invention.
Claims (10)
1. a kind of anticollision library method based on artificial intelligence, which is characterized in that the anticollision library method packet based on artificial intelligence
Include following steps:
Monitor whether current page is login page；
When the current page is the login page, the current line that user carries out register in the login page is obtained
It is characterized；
The current behavior feature is compared with default classifier, identifies that the current behavior is characterized according to comparing result
No is to hit library behavioural characteristic.
2. the anticollision library method based on artificial intelligence as described in claim 1, which is characterized in that the monitoring current page is
It is no for before login page, the anticollision library method based on artificial intelligence further include:
Sample data is obtained, the sample data includes that sample behavioural characteristic and the corresponding sample of the sample behavioural characteristic are positive and negative
Property；
Fundamental classifier is established, the fundamental classifier is instructed according to the sample behavioural characteristic and the sample positive negativity
Practice, generates default classifier.
3. the anticollision library method based on artificial intelligence as claimed in claim 2, which is characterized in that described to establish base categories
Device is trained the fundamental classifier according to the sample behavioural characteristic and the positive negativity of the sample, generates default classification
Device specifically includes:
Fundamental classifier is established, the sample behavioural characteristic is input in the fundamental classifier, so that the base categories
Positive negativity is predicted in device output；
When the positive negativity of the prediction and the inconsistent positive negativity of the sample, the parameter of the fundamental classifier is adjusted,
To generate default classifier.
4. the anticollision library method as claimed in any one of claims 1-3 based on artificial intelligence, which is characterized in that described current
Behavioural characteristic includes: the current moving characteristic of repeat logon number, the current input speed of log-on message and cursor of mouse；
Correspondingly, described when the current page is the login page, it obtains user and is logged in the login page
The current behavior feature of operation, specifically includes:
When the current page is the login page, the repeat logon number of the login page in unit time period is detected；
Detection user inputs current input speed when log-on message in the login page；
Cursor of mouse is detected in the current moving characteristic of the login page.
5. the anticollision library method based on artificial intelligence as claimed in claim 4, which is characterized in that the current moving characteristic packet
Include: cursor of mouse is in the current movement speed of the login page, current translational acceleration and current motion track.
6. the anticollision library method as claimed in any one of claims 1-3 based on artificial intelligence, which is characterized in that described by institute
It states current behavior feature to compare with default classifier, identifies whether the current behavior feature is to hit library according to comparing result
After behavioural characteristic, the anticollision library method based on artificial intelligence further include:
When the current behavior feature is to hit library behavioural characteristic, default identifying code is shown.
7. the anticollision library method based on artificial intelligence as claimed in claim 6, which is characterized in that described to work as the current behavior
Feature is when hitting library behavioural characteristic, to show after presetting identifying code, the anticollision library method based on artificial intelligence further include:
Library risk report is hit according to current behavior feature generation；
The library risk report that hits is sent to the corresponding targeted website of the login page, so that the targeted website executes guarantor
Shield measure.
8. a kind of anticollision library facilities based on artificial intelligence, which is characterized in that the anticollision library facilities packet based on artificial intelligence
It includes: memory, processor and being stored on the memory and can run on the processor anti-based on artificial intelligence
Library is hit, is realized when the anticollision library based on artificial intelligence is executed by the processor as appointed in claim 1 to 7
The step of anticollision library method described in one based on artificial intelligence.
9. a kind of storage medium, which is characterized in that be stored with the anticollision library based on artificial intelligence, institute on the storage medium
State when the anticollision library based on artificial intelligence is executed by processor realize as described in any one of claims 1 to 7 based on
The step of anticollision library method of artificial intelligence.
10. a kind of anticollision library device based on artificial intelligence, which is characterized in that the anticollision library device packet based on artificial intelligence
It includes:
Page monitoring modular, for monitoring whether current page is login page；
Feature obtain module, for when the current page be the login page when, obtain user the login page into
The current behavior feature of row register；
Activity recognition module is identified for comparing the current behavior feature with default classifier according to comparing result
Whether the current behavior feature is to hit library behavioural characteristic.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811233085.2A CN109446789A (en) | 2018-10-22 | 2018-10-22 | Anticollision library method, equipment, storage medium and device based on artificial intelligence |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811233085.2A CN109446789A (en) | 2018-10-22 | 2018-10-22 | Anticollision library method, equipment, storage medium and device based on artificial intelligence |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN109446789A true CN109446789A (en) | 2019-03-08 |
Family
ID=65547296
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811233085.2A Pending CN109446789A (en) | 2018-10-22 | 2018-10-22 | Anticollision library method, equipment, storage medium and device based on artificial intelligence |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109446789A (en) |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110247902A (en) * | 2019-05-30 | 2019-09-17 | 中国工商银行股份有限公司 | Website visiting method of controlling security, apparatus and system |
| CN112069485A (en) * | 2020-06-12 | 2020-12-11 | 完美世界(北京)软件科技发展有限公司 | Safety processing method, device and equipment based on user behaviors |
| CN114710367A (en) * | 2022-06-01 | 2022-07-05 | 武汉极意网络科技有限公司 | Method and device for determining barrier cost of network flow and electronic equipment |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20120159620A1 (en) * | 2010-12-21 | 2012-06-21 | Microsoft Corporation | Scareware Detection |
| CN104811449A (en) * | 2015-04-21 | 2015-07-29 | 深信服网络科技（深圳）有限公司 | Base collision attack detecting method and system |
| CN107992744A (en) * | 2016-10-26 | 2018-05-04 | 珠海市魅族科技有限公司 | Log in the Risk Identification Method and device of behavior |
| CN108566394A (en) * | 2018-04-16 | 2018-09-21 | 新华三信息安全技术有限公司 | A kind of information processing method and device |
| CN108600172A (en) * | 2018-03-23 | 2018-09-28 | 广州广电研究院有限公司 | Hit library attack detection method, device, equipment and computer readable storage medium |
-
2018
- 2018-10-22 CN CN201811233085.2A patent/CN109446789A/en active Pending
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20120159620A1 (en) * | 2010-12-21 | 2012-06-21 | Microsoft Corporation | Scareware Detection |
| CN104811449A (en) * | 2015-04-21 | 2015-07-29 | 深信服网络科技（深圳）有限公司 | Base collision attack detecting method and system |
| CN107992744A (en) * | 2016-10-26 | 2018-05-04 | 珠海市魅族科技有限公司 | Log in the Risk Identification Method and device of behavior |
| CN108600172A (en) * | 2018-03-23 | 2018-09-28 | 广州广电研究院有限公司 | Hit library attack detection method, device, equipment and computer readable storage medium |
| CN108566394A (en) * | 2018-04-16 | 2018-09-21 | 新华三信息安全技术有限公司 | A kind of information processing method and device |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110247902A (en) * | 2019-05-30 | 2019-09-17 | 中国工商银行股份有限公司 | Website visiting method of controlling security, apparatus and system |
| CN112069485A (en) * | 2020-06-12 | 2020-12-11 | 完美世界(北京)软件科技发展有限公司 | Safety processing method, device and equipment based on user behaviors |
| CN112069485B (en) * | 2020-06-12 | 2024-05-14 | 完美世界(北京)软件科技发展有限公司 | Safety processing method, device and equipment based on user behaviors |
| CN114710367A (en) * | 2022-06-01 | 2022-07-05 | 武汉极意网络科技有限公司 | Method and device for determining barrier cost of network flow and electronic equipment |
| CN114710367B (en) * | 2022-06-01 | 2022-08-02 | 武汉极意网络科技有限公司 | Method and device for determining barrier cost of network flow and electronic equipment |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US12079345B2 (en) | Methods, systems, and media for testing insider threat detection systems | |
| US10079853B2 (en) | Differentiating among users based on responses to injected interferences | |
| US9712558B2 (en) | Method, system, and device of protecting a computerized service | |
| Kumar et al. | Practical machine learning for cloud intrusion detection: Challenges and the way forward | |
| CN108282440B (en) | Safety detection method, safety detection device and server | |
| EP3523743B1 (en) | Detection of compromised devices via user states | |
| US9667613B1 (en) | Detecting mobile device emulation | |
| CN109547426B (en) | Service response method and server | |
| CN105302707B (en) | The leak detection method and device of application program | |
| CN109446789A (en) | Anticollision library method, equipment, storage medium and device based on artificial intelligence | |
| Kaur et al. | Browser fingerprinting as user tracking technology | |
| CN109600362A (en) | Zombie host recognition methods, identification equipment and medium based on identification model | |
| Yuan et al. | Mining software component interactions to detect security threats at the architectural level | |
| CN113918898B (en) | Security verification code generation method, system and medium based on track drawing interaction | |
| KR20210064857A (en) | Method For Recommending Security Requirements With Ontology Knowledge Base For Advanced Persistent Threat, Apparatus And System Thereof | |
| Tchakounte et al. | A game theoretical model for anticipating email spear-phishing strategies | |
| CN109460653A (en) | Verification method, verifying equipment, storage medium and the device of rule-based engine | |
| KR101576993B1 (en) | Method and System for preventing Login ID theft using captcha | |
| Zhang | Zhang's CAPTCHA architecture based on intelligent interaction via RIA | |
| Sartea et al. | Active android malware analysis: An approach based on stochastic games | |
| Eusanio | Machine Learning for the Detection of Mobile Malware on Android Devices | |
| CN113420276B (en) | Risk determination method and device based on verification code, electronic equipment and storage medium | |
| CN113868653A (en) | Malicious program identification method and device | |
| Casini et al. | Measuring the Adoption of Device Class Fingerprinting | |
| CN118075753A (en) | Short message bombing identification method and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20190308 |
|
| RJ01 | Rejection of invention patent application after publication |