Method, device, and computer program product for abnormality detection
The present disclosure relates to a method, a device, and a computer program product for abnormality detection. The method provided by embodiments of the present disclosure includes: acquiring information related to a target request initiated by a client terminal to an application and at least one context request, the information at least indicating the type and initiation time of the target request and the type and initiation time of the at least one context request; converting the acquired information into a vectorized feature representation for the target request; and determining an abnormality detection result of the target request based on the vectorized feature representation and using an abnormality detection model, the abnormality detection result indicating whether the target request is an abnormal request, and the abnormality detection model characterizing a correlation between a vectorized feature representation for a request and an abnormality detection result.
1. A method for abnormality detection, comprising:
acquiring information related to a target request initiated by a client terminal to an application and at least one context request, the information at least indicating the type and initiation time of the target request and the type and initiation time of the at least one context request;
converting the acquired information into a vectorized feature representation for the target request; and
determining an abnormality detection result of the target request based on the vectorized feature representation and using an abnormality detection model, the abnormality detection result indicating whether the target request is an abnormal request, and the abnormality detection model characterizing a correlation between a vectorized feature representation for a request and an abnormality detection result.
2. The method according to claim 1 , wherein converting the acquired information into the vectorized feature representation comprises:
determining, based on a first mapping between a plurality of request types and a first plurality of predetermined values, predetermined values respectively corresponding to the type of the target request and the type of the at least one context request from the plurality of predetermined values; and
determining a part of the vectorized feature representation based on the determined predetermined values.
3. The method according to claim 1 , wherein converting the acquired information into the vectorized feature representation comprises:
determining, from a plurality of time intervals, a first time interval into which the initiation time of the target request falls and at least one second time interval into which the initiation time of the at least one context request falls, the plurality of time intervals being divided from a request time period of the client terminal to the application;
determining, based on a second mapping between the plurality of time intervals and a second plurality of predetermined values, predetermined values respectively corresponding to the first time interval and the at least one second time interval from the second plurality of predetermined values; and
determining the other part of the vectorized feature representation based on the determined predetermined values.
4. The method according to claim 1 , wherein the information further indicates a parameter description associated with the target request, and converting the acquired information into the vectorized feature representation comprises:
converting the parameter description into a one-hot encoding representation; and
determining the other part of the vectorized feature representation based on the one-hot encoding representation.
5. The method according to claim 1 , wherein the vectorized feature representation is configured to comprise context parts corresponding to a predetermined number of context requests, and converting the acquired information into the vectorized feature representation comprises:
setting, if it is determined that the number of the at least one context request indicated by the information is less than the predetermined number, context parts in the vectorized feature representation other than the context part corresponding to the at least one context request to a preset value.
6. The method according to claim 1 , wherein the application comprises a data protection application, and the method further comprises:
selecting the abnormality detection model based on a data protection strategy applied by the client terminal in the data protection application, the abnormality detection model being trained based on training data related to the data protection strategy.
7. The method according to claim 1 , wherein the at least one context request comprises at least one historical request of which the initiation time precedes the initiation time of the target request.
8. An electronic device, comprising:
at least one processor; and
at least one memory storing computer instructions, which when executed by the at least one processor, cause the at least one processor to perform actions comprising:
acquiring information related to a target request initiated by a client terminal to an application and at least one context request, the information at least indicating the type and initiation time of the target request and the type and initiation time of the at least one context request;
converting the acquired information into a vectorized feature representation for the target request; and
determining an abnormality detection result of the target request based on the vectorized feature representation and using an abnormality detection model, the abnormality detection result indicating whether the target request is an abnormal request, and the abnormality detection model characterizing a correlation between a vectorized feature representation for a request and an abnormality detection result.
9. The device according to claim 8 , wherein converting the acquired information into the vectorized feature representation comprises:
determining, based on a first mapping between a plurality of request types and a first plurality of predetermined values, predetermined values respectively corresponding to the type of the target request and the type of the at least one context request from the plurality of predetermined values; and
determining a part of the vectorized feature representation based on the determined predetermined values.
10. The device according to claim 8 , wherein converting the acquired information into the vectorized feature representation comprises:
determining, from a plurality of time intervals, a first time interval into which the initiation time of the target request falls and at least one second time interval into which the initiation time of the at least one context request falls, the plurality of time intervals being divided from a request time period of the client terminal to the application;
determining, based on a second mapping between the plurality of time intervals and a second plurality of predetermined values, predetermined values respectively corresponding to the first time interval and the at least one second time interval from the second plurality of predetermined values; and
determining the other part of the vectorized feature representation based on the determined predetermined values.
11. The device according to claim 8 , wherein the information further indicates a parameter description associated with the target request, and converting the acquired information into the vectorized feature representation comprises:
converting the parameter description into a one-hot encoding representation; and
determining the other part of the vectorized feature representation based on the one-hot encoding representation.
12. The device according to claim 8 , wherein the vectorized feature representation is configured to comprise context parts corresponding to a predetermined number of context requests, and converting the acquired information into the vectorized feature representation comprises:
setting, if it is determined that the number of the at least one context request indicated by the information is less than the predetermined number, context parts in the vectorized feature representation other than the context part corresponding to the at least one context request to a preset value.
13. The device according to claim 8 , wherein the application comprises a data protection application, and the method further comprises:
selecting the abnormality detection model based on a data protection strategy applied by the client terminal in the data protection application, the abnormality detection model being trained based on training data related to the data protection strategy.
14. The device according to claim 8 , wherein the at least one context request comprises at least one historical request of which the initiation time precedes the initiation time of the target request.
15. A computer program product stored on a non-transitory computer-readable medium and comprising computer-executable instructions, which when executed by a processor, cause the processor to perform actions comprising:
acquiring information related to a target request initiated by a client terminal to an application and at least one context request, the information at least indicating the type and initiation time of the target request and the type and initiation time of the at least one context request;
converting the acquired information into a vectorized feature representation for the target request; and
determining an abnormality detection result of the target request based on the vectorized feature representation and using an abnormality detection model, the abnormality detection result indicating whether the target request is an abnormal request, and the abnormality detection model characterizing a correlation between a vectorized feature representation for a request and an abnormality detection result.
16. The computer program product according to claim 15 , wherein converting the acquired information into the vectorized feature representation comprises:
determining, based on a first mapping between a plurality of request types and a first plurality of predetermined values, predetermined values respectively corresponding to the type of the target request and the type of the at least one context request from the plurality of predetermined values; and
determining a part of the vectorized feature representation based on the determined predetermined values.
17. The computer program product according to claim 15 , wherein converting the acquired information into the vectorized feature representation comprises:
determining, from a plurality of time intervals, a first time interval into which the initiation time of the target request falls and at least one second time interval into which the initiation time of the at least one context request falls, the plurality of time intervals being divided from a request time period of the client terminal to the application;
determining, based on a second mapping between the plurality of time intervals and a second plurality of predetermined values, predetermined values respectively corresponding to the first time interval and the at least one second time interval from the second plurality of predetermined values; and
determining the other part of the vectorized feature representation based on the determined predetermined values.
18. The computer program product according to claim 15 , wherein the information further indicates a parameter description associated with the target request, and converting the acquired information into the vectorized feature representation comprises:
converting the parameter description into a one-hot encoding representation; and
determining the other part of the vectorized feature representation based on the one-hot encoding representation.
19. The computer program product according to claim 15 , wherein the vectorized feature representation is configured to comprise context parts corresponding to a predetermined number of context requests, and converting the acquired information into the vectorized feature representation comprises:
setting, if it is determined that the number of the at least one context request indicated by the information is less than the predetermined number, context parts in the vectorized feature representation other than the context part corresponding to the at least one context request to a preset value.
20. The computer program product according to claim 15 , wherein the application comprises a data protection application, and the method further comprises:
selecting the abnormality detection model based on a data protection strategy applied by the client terminal in the data protection application, the abnormality detection model being trained based on training data related to the data protection strategy.