Interface access processing method, computer device and storage medium

A computer device of detecting an abnormal behavior and intercepting a request for accessing a network interface by monitoring and analyzing network traffic data, comprising a processor and a memory, wherein the memory stores machine-readable instructions executable by the processor, the machine-readable instructions, when executed by the processor, cause the processor to perform operations comprising:

• acquiring interface traffic data associated with the network interface;
• identifying target access behavior sequences of an access party within a first specified time range from the interface traffic data, the target access behavior sequences comprising an access action behavior sequence and an access time interval sequence, the access action behavior sequence recording interface access action behaviors of the access party in achronological order of accessing the network interface, and the access time interval sequence recording time intervals between adjacent interface access action behaviors in the access action behavior sequence;
• inputting the access action behavior sequence and the access time interval sequence into a trained neural network model, wherein the trained neural network model comprises an end-to-end active machine learning model;
• generating a plurality of first feature vectors by the trained neural network model performing feature vectorization processing on each of the interface access action behaviors in the access action behavior sequence;
• generating a plurality of second feature vectors by the trained neural network model performing feature vectorization on each of the time intervals in the access time interval sequence;
• generating a first sequence tensor corresponding to the access action behavior sequence based on a length of the access action behavior sequence and the plurality of first feature vectors,
• generating a second sequence tensor corresponding to the access time interval sequence based on a length of the access time interval sequence and the plurality of second feature vectors;
• generating target sequence fusion information by the trained neural network model fusing the first sequence tensor and the second sequence tensor;
• generating a sequence feature by the trained neural network model learning from the target sequence fusion information, wherein the sequence feature comprises a unified characterization vector characterizing a feature learned from the target sequence fusion information;
• generating an identification result based on the sequence feature by the trained neural network model, wherein the identification result comprises a classification probability of a presence of the abnormal behavior;
• and
• intercepting the request for accessing the network interface within a second specified time range of the access party in response to determining that the classification probability is greater than a threshold, a start time of the second specified time range being later than an end time of the first specified time range.

A non-transitory computer-readable storage medium, wherein a computer program is stored on the computer-readable storage medium, and the computer program, when executed by a computer device, causes the computer device to perform operations comprising:

• acquiring interface traffic data associated with a network interface;
• identifying target access behavior sequences of an access party within a first specified time range from the interface traffic data, the target access behavior sequences comprising an access action behavior sequence and an access time interval sequence, the access action behavior sequence recording interface access action behaviors of the access party in a chronological order of accessing the network interface, and the access time interval sequence recording time intervals between adjacent interface access action behaviors in the access action behavior sequence;
• inputting the access action behavior sequence and the access time interval sequence into a trained neural network model, wherein the trained neural network model comprises an end-to-end active machine learning model;
• generating a plurality of first feature vectors by the trained neural network model performing feature vectorization processing on each of the interface access action behaviors in the access action behavior sequence;
• generating a plurality of second feature vectors by the trained neural network model performing feature vectorization on each of the time intervals in the access time interval sequence;
• generating a first sequence tensor corresponding to the access action behavior sequence based on a length of the access action behavior sequence and the plurality of first feature vectors,
• generating a second sequence tensor corresponding to the access time interval sequence based on a length of the access time interval sequence and the plurality of second feature vectors;
• generating target sequence fusion information by the trained neural network model fusing the first sequence tensor and the second sequence tensor;
• generating a sequence feature by the trained neural network model learning from the target sequence fusion information, wherein the sequence feature comprises a unified characterization vector characterizing a feature learned from the target sequence fusion information;
• generating an identification result based on the sequence feature by the trained neural network model, wherein the identification result comprises a classification probability of a presence of an abnormal behavior;
• and
• intercepting a request for accessing the network interface within a second specified time range of the access party in response to determining that the classification probability is greater than a threshold, a start time of the second specified time range being later than an end time of the first specified time range.