METHOD, ELECTRONIC DEVICE AND COMPUTER PROGRAM PRODUCT FOR DETECTING ABNORMAL NETWORK REQUEST

1 . A method for detecting abnormal network requests, comprising:

obtaining a network request for accessing a server;

extracting feature data from the network request, the feature data characterizing an access operation of the network request to the server; and

in response to the feature data falling out of a range defined by feature data of a plurality of normal network requests, determining that the network request as the is an abnormal network request.

2 . The method of claim 1 , wherein extracting the feature data from the network request comprises:

processing the network request using predetermined symbols to obtain a processed network request; and

obtaining the feature data from the processed network request.

3 . The method of claim 2 , wherein processing the network request with the predetermined symbols comprises:

replacing an alphabet in the network request with a first symbol; and

replacing a number in the network request with a second symbol.

4 . The method of claim 2 , wherein processing the network request with the predetermined symbols comprises:

replacing an individual alphabet in the network request with a third symbol;

replacing an individual number in the network request with a fourth symbol;

replacing consecutive alphabets in the network request with a fifth symbol; and

replacing consecutive numbers in the network request with a sixth symbol.

5 . The method of claim 2 , wherein extracting the feature data from the network request further comprises:

vectorizing the feature data.

6 . The method of claim 1 , wherein, in response to the feature data falling out of the range defined by the feature data of the plurality of normal network requests, determining that the network request is an abnormal network request comprises:

inputting the feature data of the network request into a classification model, the classification model being obtained by training the feature data of the plurality of normal network requests and being used to determine a boundary of the feature data of the plurality of normal network requests; and

in response to the feature data of the network request being outside the boundary, determining that the network request is an abnormal network request.

7 . The method of claim 1 , wherein obtaining the network request for accessing the server comprises:

determining an Internet Protocol (IP) address of the network request; and

obtaining, from the server, an associated network request having the IP address.

8 . The method of claim 7 , wherein extracting the feature data from the network request comprises:

converting Application Program Interface (API) information of the network request into a first API symbol; and

converting the API information of the associated network request into a second API symbol,

wherein the feature data comprises the first API symbol and the second API symbol.

9 . The method of claim 8 , wherein, in response to the feature data falling out of the range, determining the network request is an abnormal network request comprises:

determining a plurality of combinations of the plurality of normal network requests with API information of respective associated network requests; and

in response to the at least a part of the feature data being absent in the plurality of combinations, determining that the network request is an abnormal network request.

10 . The method of claim 1 , further comprising:

sending the abnormal network request to a further server independent of the server.

11 . The method of claim 1 , wherein the access operation includes at least one of selected from a group consisting of:

an Application Program Interface (API) information of the network request;

parameters of the API information;

address information of the server;

a text length of the network request; and

a request body of the network request.

12 . An electronic device, comprising:

at least one processing unit; and

at least one memory coupled to the at least one processing unit and storing machine-executable instructions, the instructions, when executed by the at least one processing unit, causing the device to perform a method, the method comprising:

obtaining a network request for accessing a server;

extracting feature data from the network request, the feature data characterizing an access operation of the network request to the server; and

in response to the feature data falling out of a range defined by feature data of a plurality of normal network requests, determining that the network request is an abnormal network request.

13 . The device of claim 12 , wherein extracting the feature data from the network request comprises:

processing the network request using predetermined symbols to obtain a processed network request; and

obtaining the feature data from the processed network request.

14 . The device of claim 13 , wherein processing the network request with the predetermined symbols comprises:

replacing alphabets in the network request with a first symbol; and

replacing numbers in the network request with a second symbol.

15 . The device of claim 13 , wherein processing the network request with the predetermined symbols comprises:

replacing an individual alphabet in the network request with a third symbol;

replacing an individual number in the network request with a fourth symbol;

replacing consecutive alphabets in the network request with a fifth symbol; and

replacing consecutive numbers in the network request with a sixth symbol.

16 . The device of claim 13 , wherein extracting the feature data from the network request further comprises:

vectorizing the feature data.

17 . The device of claim 12 , wherein, in response to the feature data falling out of the range defined by the feature data of the plurality of normal network requests, determining that the network request is an abnormal network request comprises:

inputting the feature data of the network request into a classification model, the classification model being obtained by training the feature data of the plurality of normal network requests and being used to determine a boundary of the feature data of the plurality of normal network requests; and

in response to the feature data of the network request being outside the boundary, determining that the network request is an abnormal network request.

18 . The device of claim 12 , wherein obtaining the network request for accessing the server comprises:

determining an Internet Protocol (IP) address of the network request; and

obtaining, from the server, an associated network request having the IP address.

19 . The device of claim 18 , wherein extracting the feature data from the network request comprises:

converting Application Program Interface (API) information of the network request into a first API symbol;

converting API information of the associated network request into a second API symbol; and

wherein the feature data comprises the first API symbol and the second API symbol.

20 . (canceled)

21 . (canceled)

22 . (canceled)

23 . A computer program product tangibly stored on a non-transient computer readable medium and comprising machine executable instructions, which, when executed, cause a machine to perform a method, the method comprising:

obtaining a network request for accessing a server;

extracting feature data from the network request, the feature data characterizing an access operation of the network request to the server; and

in response to the feature data falling out of a range defined by feature data of a plurality of normal network requests, determining that the network request is an abnormal network request.