User abnormal operation behavior detection method and system and storage medium

Abstract

The invention discloses a user abnormal operation behavior detection method. The method comprises the following steps: S1, constructing a free agent IP database; and S2, matching the login IP of the account with the free agent IP database, and if the matching is successful, taking the login IP as abnormal login. The beneficial effects of the invention are as follows: the paint has good effects; according to the user abnormal operation behavior detection method provided by the invention, aiming at the characteristic that a normal user does not log in by using a free proxy IP, the account numberof which the IP is the free proxy IP is early warned, so that the accuracy of abnormal login detection of the user can be improved, the false alarm rate is reduced, and the detection rate of malicious login accounts is improved. And a deterrent effect on attacking external personnel to maliciously log in the client account and steal sensitive information behaviors is achieved.

Description

technical field [0001] The present invention relates to the technical field of information security, in particular to a method, system and storage medium for detecting abnormal user operation behavior. Background technique [0002] In the prior art, security detection only detects attack content (such as SQL injection, XSS attack, etc.) on the application layer. For many enterprises, the above security detection items still cannot guarantee the security of information. For example, in the express delivery industry, a large amount of user privacy information and internal top-secret business information with the characteristics of the express delivery industry will be generated during the data interaction process. Most of the information will be sent out through email channels, and whether it contains sensitive information is detected through post-event auditing or through hook-up equipment. If existing security detection equipment or systems are used, it is difficult to reaso...

AI Technical Summary

Problems solved by technology

Most of the information will be sent out through email channels, and whether it contains sensitive information is detected through post-event auditing or through hook-up equipment. If existing security detection equipment or systems are used, it is difficult to give reasonable early warnings based on the characteristics of enterprises and users.

[0003] For the problems in related technologies, no effective solutions have been proposed yet

Images