Behavior risk detection method, clustering model construction method and device

Abstract

The invention relates to a behavior risk detection method and device and a clustering model construction method and device. The method comprises the steps that behavior log data are input into a pre-established clustering model, prediction points and clustering results corresponding to the prediction points are obtained, and the behavior log data comprise log data generated by behaviors of a using system; calculating a deviation degree according to the prediction point, the total number of the clustering points in the clustering result and the clustering centroid in the clustering result; and determining a risk level corresponding to the behavior according to the deviation degree and a preset evaluation probability. By adopting the method, the deviation degree can be calculated by using the clustering model without depending on expert experience, and the finally determined risk level can feed back a real risk condition in an actual application scene.

Description

technical field [0001] The present disclosure relates to the field of security technologies, and in particular, to a behavior risk detection method, a cluster model construction method, and an apparatus. Background technique [0002] In order to ensure the security of the user account during the login process, the corresponding login risk control logic will be preset to perform risk detection during login. [0003] The current risk detection methods are usually experts through their experience to create corresponding risk models one by one for each dimension of the login operation, such as login time, login location, etc., and set corresponding risk detection standards. [0004] However, when the current risk model performs risk detection in the user's login behavior, it completely relies on the preset risk detection standards for detection, and does not use the previous historical data. In the actual application scenario, the actual situation may deviate from the predicted...

AI Technical Summary

Problems solved by technology

[0004] However, when the current risk model detects risks in user login behavior, it completely relies on pre-set risk detection standards for detection, and does not use previous historical data

In the actual application scenario, the actual situation may deviate from the predicted result, and the real risk situation in the actual application scenario cannot be fed back

Images