Unlock instant, AI-driven research and patent intelligence for your innovation.

Method for detecting account abnormal logging based on HMM model

A technology of abnormal logging and detection methods, applied in digital transmission systems, electrical components, transmission systems, etc., can solve problems such as interference with abnormal event detection, multiple abnormal false positives, multiple normal false positives, etc.

Inactive Publication Date: 2017-05-17
上海万雍科技股份有限公司
View PDF7 Cites 11 Cited by
  • Summary
  • Abstract
  • Description
  • Claims
  • Application Information

AI Technical Summary

Problems solved by technology

[0006] However, the detection method of this HMM model has been affected by the deviation of user behavior from the established pattern, and the fluctuation of user behavior will interfere with the detection of abnormal events.
For this reason, there may be more abnormal false negatives, or more normal false positives

Method used

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View more

Image

Smart Image Click on the blue labels to locate them in the text.
Viewing Examples
Smart Image
  • Method for detecting account abnormal logging based on HMM model
  • Method for detecting account abnormal logging based on HMM model
  • Method for detecting account abnormal logging based on HMM model

Examples

Experimental program
Comparison scheme
Effect test

Embodiment Construction

[0046] as the picture shows,

[0047] In order to make the design of the present invention clearer, the present invention will be further described below in conjunction with the accompanying drawings.

[0048] The example of the present invention provides an HMM model-based abnormal account login detection system, which adds a timing detection strategy on the basis of real-time detection, and avoids the disturbance influence of user behavior. Such as figure 1 shown. The system stores the user login information locally, and preprocesses the data to determine the training parameters of the HMM model, and finally adjusts the training parameters through the training of the HMM model, and finally applies the actual detection output detection results.

[0049] The specific implementation steps of each part are as follows:

[0050] 1) Data collection part:

[0051] Step 1: Using the login information of a certain system user as the data source, analyze the IP address and access fun...

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

PUM

No PUM Login to View More

Abstract

The invention discloses a method for detecting account abnormally logging based on HMM model. The method regularly checks the logging data within a period of time t instead of the the real-time detection commonly used, eliminating the disturbance of the normal behavior pattern fluctuating to the accuracy of the detection, and achieving a more accurate detection for account anomaly logging. The method includes the following three steps: data collecting, data pretreating, and HMM model training and applying thereof, which is capable of detecting the account abnormal logging section. The method classifies the IP in order to determine the number of observation symbols at the data pretreating part. The method determines the number of state set according to the logging hidden states of the user and the packet length according to observation symbols flowing capacity; existing logging date of the users are trained and tested with actual flow at the HMM model training and testing section.

Description

technical field [0001] The invention relates to a user abnormal login detection method in the field of computer network security, in particular to a timing detection method based on an HMM hidden Markov chain. Background technique [0002] With the rise and development of network applications, more and more people begin to use network accounts to manage related information and data. Especially in today's popularization of online consumption, electronic business, online office and other functions, using related services through personal accounts has become an important part of people's work and life. Personal accounts have become a window for people to obtain network services. However, account security issues are becoming more and more serious. Personal accounts are stolen and embezzled, and relevant information in the accounts is leaked, tampered with, destroyed and other incidents occur frequently, which will cause users to be unable to use related services normally and h...

Claims

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

Application Information

Patent Timeline
no application Login to View More
Patent Type & Authority Applications(China)
IPC IPC(8): H04L29/06H04L12/24
CPCH04L63/1425H04L41/142H04L63/08
Inventor 龚旭东宋长权伍冲
Owner 上海万雍科技股份有限公司