Abnormal transfer detection method and device based on IP address drift, equipment and medium

Abstract

The invention relates to the artificial intelligence technology, and discloses an abnormal transfer detection method and device based on IP address drifting, electronic equipment and a storage medium, and the method comprises the steps: generating an equipment ID of login equipment according to pre-collected Web information, and carrying out the change detection of the login equipment according to a pre-obtained IP address and equipment ID; generating information features of the login device according to a detection result of the change detection and pre-acquired transfer information, and generating an initial risk value of the login device by using a pre-trained risk assessment model and the information features; generating a device fingerprint of the login device according to the Web information, and generating a fingerprint similarity of the login device by using the device fingerprint; and carrying out overflow increasing processing on the initial risk value by utilizing the fingerprint similarity to obtain a final risk value of the login equipment, and carrying out abnormity judgment on the login equipment according to the final risk value and a preset risk threshold value. According to the invention, the accuracy of detecting the abnormal transfer account can be improved.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to a method, device, equipment and medium for detecting abnormal transfer based on IP address drift. Background Art

[0002] Due to the shortage of global IPv4 address resources, many users' network connections rely on the operator's NAT (Network Address Translation) technology, which may cause some users' IP addresses to drift. Specifically, the IP address of a user may correspond to a geographical location when logging in within a short period of time, but the subsequent IP address may be displayed in another location far away, which is actually impossible to achieve in such a short period of time.

[0003] This IP address drift may cause the risk control system of financial institutions to misjudge the user's abnormal behavior. For example, when the system detects that the user's IP address suddenly changes from city A to city B, it may trigger additional identity verification measures, resulting in lower accuracy in detecting abnormal transfer accounts. However, if the user has not actually moved, such frequent and unnecessary verification will not only interrupt the user experience, but may also cause customer dissatisfaction and complaints. Summary of the invention

[0004] The present invention provides a method, device, equipment and medium for detecting abnormal transfer based on IP address drift, the main purpose of which is to solve the problem of low accuracy when detecting abnormal transfer accounts.

[0005] To achieve the above object, the present invention provides a method for detecting abnormal transfer based on IP address drift, comprising:

[0006] Generate a device ID of the login device according to the pre-collected Web information, and perform change detection on the login device according to the pre-acquired IP address and the device ID;

[0007] Generate information features of the login device according to the detection result of the change detection and the pre-acquired transfer information, and generate an initial risk value of the login device using a pre-trained risk assessment model and the information features;

[0008] Generate a device fingerprint of the login device according to the Web information, and generate a fingerprint similarity of the login device using the device fingerprint;

[0009] The initial risk value is increased by using the fingerprint similarity to obtain a final risk value of the login device, and an abnormality judgment is made on the login device based on the final risk value and a preset risk threshold.

[0010] Optionally, generating a device ID of the login device according to the pre-collected Web information includes:

[0011] Filter the pre-collected Web information for target information and obtain the target information of the login device;

[0012] Generate a device ID of the login device according to the target information.

[0013] Optionally, performing change detection on the login device according to the pre-acquired IP address and the device ID includes:

[0014] Extracting features from the pre-collected Web information to obtain Web-side features of the login device;

[0015] Perform device identification on the login device according to the Web-side feature and the device ID, and obtain a device identification result of the login device;

[0016] The login device is detected for changes based on the pre-acquired user IP and the device identification result.

[0017] Optionally, generating the information feature of the login device according to the detection result of the change detection and the pre-acquired transfer information includes:

[0018] Extracting keywords from the pre-acquired transfer information, and generating transfer features of the login device according to the keywords;

[0019] Quantifying the detection result of the change detection to obtain a quantized value of the inspection result;

[0020] The quantified value and the transfer feature are subjected to feature fusion to obtain information features of the login device.

[0021] Optionally, the generating the initial risk value of the login device by using the pre-trained risk assessment model and the information feature includes:

[0022] Using a pre-trained risk assessment model to perform vector conversion on the information feature to obtain an information feature vector;

[0023] Perform multiple decision tree regression on the information feature vector to obtain an initial risk value of the login device.

[0024] Optionally, the using the device fingerprint to generate the fingerprint similarity of the login device includes:

[0025] Performing vectorization conversion on the device fingerprint to obtain a fingerprint vector of the device fingerprint, wherein the device fingerprint includes: the device fingerprint of the last login and the device fingerprint of this login;

[0026] The fingerprint similarity of the login device is calculated according to the fingerprint vector and a preset fingerprint weight.

[0027] Optionally, the using the fingerprint similarity to perform overflow processing on the initial risk value to obtain a final risk value of the login device includes:

[0028] Determine the risk premium value of the initial risk value according to the fingerprint similarity and a preset gain rule;

[0029] The initial risk value is summed according to the risk excess value to obtain a final risk value of the landing device.

[0030] In order to solve the above problem, the present invention also provides an abnormal transfer detection device based on IP address drift, the device comprising:

[0031] A change detection module, used to generate a device ID of a login device according to pre-collected Web information, and perform change detection on the login device according to the pre-acquired IP address and the device ID;

[0032] An initial risk value generating module, used to generate information features of the login device according to the detection result of the change detection and the pre-acquired transfer information, and to generate an initial risk value of the login device using a pre-trained risk assessment model and the information features;

[0033] A fingerprint similarity generation module, used to generate a device fingerprint of the login device according to the Web information, and generate a fingerprint similarity of the login device using the device fingerprint;

[0034] The abnormality judgment module is used to use the fingerprint similarity to increase the initial risk value to obtain the final risk value of the login device, and to judge the abnormality of the login device according to the final risk value and a preset risk threshold.

[0035] In order to solve the above problem, the present invention further provides an electronic device, the electronic device comprising:

[0036] at least one processor; and,

[0037] a memory communicatively connected to the at least one processor; wherein,

[0038] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the above-mentioned abnormal transfer detection method based on IP address drift.

[0039] In order to solve the above problems, the present invention also provides a computer-readable storage medium, in which at least one computer program is stored. The at least one computer program is executed by a processor in an electronic device to implement the above-mentioned abnormal transfer detection method based on IP address drift.

[0040] The present invention performs change detection by generating a unique device ID for the login device and combining it with the IP address, so as to identify whether the login behavior of the device is abnormal, and then uses the information features generated by the change detection results and the transfer information, in conjunction with a pre-trained risk assessment model to calculate an initial risk value, which enables the system to assess transaction risks based on historical data and current behavior patterns; at the same time, by creating device fingerprints and similarity analysis thereof, the consistency of the device can be verified, and the initial risk value can be adjusted accordingly to obtain a final risk value that is closer to the actual risk situation; finally, based on the comparison of this risk value with the preset threshold, an accurate judgment of abnormal transfer behavior can be achieved, thereby improving the accuracy of detection and reducing the false alarms that may be caused by relying solely on IP address positioning. Therefore, the present invention proposes a product recommendation method, device, electronic device and computer-readable storage medium based on user portraits and knowledge graphs, which can solve the problem of low accuracy in detecting abnormal transfer accounts. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 A flow chart of a method for detecting abnormal transfer based on IP address drift provided by an embodiment of the present invention;

[0042] Figure 2 A functional module diagram of an abnormal transfer detection device based on IP address drift provided by an embodiment of the present invention;

[0043] Figure 3 A schematic diagram of the structure of an electronic device for implementing the abnormal transfer detection method based on IP address drift provided by one embodiment of the present invention.

[0044] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0045] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0046] The embodiment of the present application provides an abnormal transfer detection method based on IP address drift. The execution subject of the abnormal transfer detection method based on IP address drift includes but is not limited to at least one of the electronic devices such as a server, a terminal, etc. that can be configured to execute the method provided by the embodiment of the present application. In other words, the abnormal transfer detection method based on IP address drift can be executed by software or hardware installed on a terminal device or a server device, and the software can be a blockchain platform. The server includes but is not limited to: a single server, a server cluster, a cloud server or a cloud server cluster, etc. The server can be an independent server, or it can be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content distribution networks (Content Delivery Network, CDN), and big data and artificial intelligence platforms.

[0047] Reference Figure 1 FIG. 1 is a flow chart of an abnormal transfer detection method based on IP address drift provided by an embodiment of the present invention. In this embodiment, the abnormal transfer detection method based on IP address drift includes:

[0048] S1. Generate a device ID of a login device according to pre-collected Web information, and perform change detection on the login device according to the pre-acquired IP address and the device ID.

[0049] In the embodiment of the present invention, the step of generating a device ID of a login device according to pre-collected Web information includes:

[0050] Filter the pre-collected Web information for target information and obtain the target information of the login device;

[0051] Generate a device ID of the login device according to the target information.

[0052] In detail, the pre-collected web information includes: login time, login channel, user request header, browser plug-in list, generated token, system version, system information, browser version, browser language, screen length, screen width, browser window length, browser window width, color depth, canvasID (canvas ID), etc.

[0053] Furthermore, the following is a detailed explanation of each term in the pre-collected Web information: Login time refers to the specific time point when the user attempts to log in to the system, which is usually recorded in the form of date and time, which helps to analyze user behavior patterns; Login channel refers to the way or device used by the user to log in, such as logging in through a PC browser, mobile application or third-party service, etc., which is used to analyze user preferences and behaviors; User request header refers to a part of the HTTP request, which contains information such as the client environment, browser type, request method, etc., which can be used to identify user device and browser characteristics; Browser plug-in list refers to a list of plug-ins or extensions installed in the user's browser, which can reflect the user's browsing habits and possible security issues; Generated token refers to a dynamically generated security credential, which is usually used for identity authentication and to prevent cross-site request forgery attacks; System version refers to the version information of the user's device operating system, which helps to understand the user's operating environment and judge compatibility and security; System information refers to detailed information including operating system type, architecture, kernel version, etc., which is used A more comprehensive understanding of the user's device environment; browser version refers to the version information of the browser software used by the user, which is crucial for determining compatibility and security; browser language refers to the preferred language set by the user's browser, which reflects the user's language preference and is sometimes used to personalize content display; screen length refers to the vertical screen resolution of the user's device, that is, the number of pixels displayed on the screen from top to bottom; screen width refers to the horizontal screen resolution of the user's device, that is, the number of pixels displayed on the screen from left to right; browser window length refers to the vertical size of the user's browser window, which may be smaller than the screen length because the user may not have maximized the browser window; browser window width refers to the horizontal size of the user's browser window, which may be smaller than the screen width, also because the user may not have maximized the browser window; color depth refers to the number of color bits that can be displayed per pixel of the display device, which affects the display quality and color accuracy; canvasID refers to a unique identifier provided by the browser to identify the user's device or session, commonly used in Web graphics operations and to prevent cross-site scripting attacks.

[0054] Collectively, this information forms a detailed portrait of the user's device, helping the system to more accurately identify and authenticate users while providing data support for security policies.

[0055] Furthermore, the most critical information for device identification is selected from a large amount of Web information as target information.

[0056] In detail, the device ID is an identifier used to uniquely identify the user's login device, which is generated based on the characteristics of the device (such as hardware configuration, software environment, etc.).

[0057] In detail, target information screening is to screen out information that helps to generate a stable and unique device ID. By analyzing Web information, key information that can reflect device characteristics can be selected. This information is usually highly stable and not easily changed by user operations.

[0058] For example, suppose the web information contains the following data: login time, login channel, user request header, browser plug-in list, generated token, system version, system information, browser version, browser language, screen length, screen width, browser window length, browser window width, color depth, canvasID, etc. From this information, we select relatively stable features as target information, such as user request header, browser plug-in list, system information, browser version, browser language, screen size, color depth and canvasID.

[0059] Furthermore, a unique device ID is generated based on the target information to facilitate subsequent device identification. A hash function or other encryption technology can be used to combine the target information to generate a fixed-length string "a9b1e0c7d3f5b7a9d2c3e5a7b1f5c7d3", which is the device ID.

[0060] In an embodiment of the present invention, the step of performing change detection on the login device according to the pre-acquired IP address and the device ID includes:

[0061] Extracting features from the pre-collected Web information to obtain Web-side features of the login device;

[0062] Perform device identification on the login device according to the Web-side feature and the device ID, and obtain a device identification result of the login device;

[0063] The login device is detected for changes based on the pre-acquired user IP and the device identification result.

[0064] In detail, key information is filtered out from the pre-collected Web information, such as user request headers, browser plug-in lists, system information, browser versions, screen sizes, etc., and this key information is cleaned and formatted, such as removing invalid or redundant data and converting the data format for easy processing.

[0065] In detail, features are constructed based on the filtered and preprocessed data, such as calculating the screen resolution, extracting the browser language, encoding the plug-in list, etc.

[0066] Specifically, the extracted features are converted into vector form to facilitate subsequent model processing. This may include one-hot encoding of categorical features, normalization of numerical features, etc.

[0067] Specifically, the extracted web-side features are matched with known device IDs. This typically involves comparing the features of the current session with historical features stored in a database.

[0068] In detail, the similarity between the current feature and the historical feature is calculated, which can be achieved through various distance measurement methods, such as Euclidean distance, cosine similarity, etc.

[0069] Specifically, based on the result of similarity calculation, it is determined whether the currently logged-in device matches the known device ID. If the similarity is higher than a certain threshold, the device is considered to be known; otherwise, it may be considered to be a new device or the device information has been changed.

[0070] In detail, check whether the user's current IP address is significantly different from the user's historical IP address stored in the system.

[0071] Specifically, analyze the similarity results in the device identification step to determine whether the device environment has changed, such as operating system or browser version updates, and use preset logic or algorithms to determine whether the device has changed based on the changes in the IP address and device environment. For example, if both the IP address and the device environment have changed, there may be a high-risk change; if only one has changed, further verification may be required.

[0072] In detail, based on the change detection results, a risk assessment model (such as logistic regression, decision tree, etc.) is used to assess the risk level of the current login attempt, and corresponding security measures are taken based on the results of the risk assessment. For low-risk logins, they can be processed normally; for medium- and high-risk logins, additional verification steps may be required, such as secondary authentication, transaction confirmation, etc.

[0073] Through this series of steps, the system can effectively identify and verify user devices and promptly detect changes in devices and environment, thereby providing a good user experience while ensuring security.

[0074] Specifically, based on the above device ID and collection features, a comprehensive judgment is made as to whether the customer has changed their device. If the user's IP has changed without changing the device, it can be assumed that the customer is still local and has not changed their geographical location. The user's behavior risk can be kept consistent with the above judgment, that is, if the previous behavior hit a high risk, then this time it will also hit a high risk; if this time it did not hit a high risk, then this time it will not hit a high risk either.

[0075] In detail, Web features refer to key features for device identification extracted from pre-collected Web information, such as browser type, operating system, screen resolution, etc.; device identification results refer to the determination of the identity of the login device by analyzing Web features and device ID; change detection refers to detecting whether the login device has changed, such as replacing a new computer or mobile device for logging in.

[0076] In detail, feature extraction refers to extracting key features that can be used for device identification from Web information. By parsing the data packets sent when the user logs in, key information that can reflect the device characteristics is extracted. This information usually includes but is not limited to browser type, operating system, screen resolution, etc.

[0077] In detail, assume that the following information has been collected from the login request: User-Agent: Mozilla / 5.0 (Windows NT 10.0; Win64; x64) AppleWebKit / 537.36 (KHTML, like Gecko) Chrome / 92.0.4515.131 Safari / 537.36, screen resolution: 1920x1080, browser language: en-US, plug-in list: ["Adobe FlashPlayer", "Google Docs Viewer"], canvasID: 1234abcd. From this information, the browser type (Chrome), operating system (Windows 10), screen resolution, etc. can be extracted as web-side features.

[0078] In detail, the identity of the login device is determined based on the Web-side features and the device ID. It is possible to determine whether they are the same device by comparing the Web-side features in the current login request with the previously recorded device ID.

[0079] In detail, assuming that there is already a device ID: a9b1e0c7d3f5b7a9d2c3e5a7b1f5c7d3 and the previously saved Web-side features, now you need to determine whether the device in the current login request is consistent with the previous one. You can compare the Web-side features of the current request with the features in the history records and confirm whether the device ID matches.

[0080] Furthermore, by comparing the IP address of the current login request with the previously saved IP address and combining the device identification result, it is determined whether the device has been changed.

[0081] For example, suppose a user's login information is recorded, including the IP address 192.168.1.100 and the device ID a9b1e0c7d3f5b7a9d2c3e5a7b1f5c7d3. Now the user tries to log in with an IP address of 192.168.1.101 and a device ID of a9b1e0c7d3f5b7a9d2c3e5a7b1f5c7d3. Since the IP address has changed but the device ID remains the same, this may mean that the user logged in on the same device but used a different network connection (such as switching from a home network to a public Wi-Fi). At this point, this behavior can be marked as a potential risk and the user's identity can be further verified.

[0082] S2. Generate information features of the login device according to the detection result of the change detection and the pre-acquired transfer information, and generate an initial risk value of the login device using a pre-trained risk assessment model and the information features.

[0083] In the embodiment of the present invention, the step of generating the information feature of the login device according to the detection result of the change detection and the pre-acquired transfer information includes:

[0084] Extracting keywords from the pre-acquired transfer information, and generating transfer features of the login device according to the keywords;

[0085] Quantifying the detection result of the change detection to obtain a quantized value of the inspection result;

[0086] The quantified value and the transfer feature are subjected to feature fusion to obtain information features of the login device.

[0087] In detail, analyze the transfer information to identify key data elements that may affect risk assessment, such as transfer amount, payer account, recipient account, transfer time, transfer frequency, transaction type (such as shopping, bill payment) and notes or transaction descriptions.

[0088] In detail, constructing features based on the identified keywords may include standardizing the amount (e.g., converting it into a ratio to the average transaction amount), encoding the time and frequency (e.g., converting the transfer time into a time period of the day, calculating the transfer frequency within a certain time period).

[0089] In detail, for text information such as notes or transaction types, natural language processing techniques (such as word segmentation, sentiment analysis, and keyword extraction) can be used to extract useful information and convert it into numerical features.

[0090] Specifically, based on the results of change detection (such as whether the device has changed, whether the IP address is consistent, whether the browser or operating system has been updated), a quantitative strategy is developed to assign a specific value to each result. For example, a device change may be assigned a higher risk value, while a simple IP address change may be considered a lower risk.

[0091] In detail, different weights are assigned to each change type according to the risk level of the change type. A device change may have a greater impact on the risk assessment than an IP address change, so it will have a greater weight in the quantification process.

[0092] In detail, the transfer features and quantitative values ​​of the change detection results obtained above are combined to form a comprehensive feature vector. This vector contains the transfer behavior characteristics and environmental change information of the device, providing a comprehensive input for subsequent risk assessment. If there are a large number of features, feature selection or dimensionality reduction operations may be required to remove redundant features or reduce noise, improve the efficiency and accuracy of the model, and ensure that all features have been properly encoded and standardized to form the final feature vector, which will then be input into the risk scoring model to calculate the risk level of the logged-in device.

[0093] Through these steps, the system can comprehensively consider the user's behavioral characteristics and environmental changes, and conduct a detailed risk assessment of each login attempt, thereby preventing possible fraud or abnormal activities in advance.

[0094] In detail, key information is extracted from the pre-acquired transfer information, and transfer features of the login device are generated based on this information. Natural language processing technology can be used to extract key information from the transfer information, such as transfer amount, recipient account, transfer time, etc., and then a transfer feature vector is generated based on this information.

[0095] Specifically, the result of the change detection is converted into a specific numerical value. For example, if a change in the device or IP address is detected, the quantitative value is high; if no change is detected, the quantitative value is low.

[0096] In detail, assuming that the result of the change detection is that the device has not changed but the IP address has changed, the quantization value can be set to 5 (indicating an IP change). If the device has also changed, the quantization value can be higher, such as 8.

[0097] Furthermore, assuming there is the following information: transfer feature vector: [1000, "user B", "purchase computer"] and quantization value: 5 (representing IP address change), this information can be fused into a vector, such as [1000, "user B", "purchase computer", 5].

[0098] In an embodiment of the present invention, the step of generating the initial risk value of the login device using the pre-trained risk assessment model and the information feature includes:

[0099] Using a pre-trained risk assessment model to perform vector conversion on the information feature to obtain an information feature vector;

[0100] Perform multiple decision tree regression on the information feature vector to obtain an initial risk value of the login device.

[0101] In detail, these features are trained for machine learning using the Xgboost (eXtreme Gradient Boosting, efficient gradient boosting decision tree) + logistic regression model to output a risk value (between 0 and 1).

[0102] In detail, assume that the information feature construction process has been completed, and now we have a feature vector containing transfer features and change detection quantization values, such as [1000, "User B", "Purchase Computer", 5].

[0103] In detail, the information feature vector is: transfer amount: 1000, recipient account: "user B", remarks: "purchase computer" and IP address change quantification value: 5

[0104] Furthermore, non-numerical features are encoded, such as using one-hot encoding to convert account names and notes, and numerical features are standardized or normalized to ensure that the data is in the same order of magnitude. After preprocessing, a new feature vector may be obtained, such as [1000, 0, 1, 0, 0, 1, 0, 5] (here it is assumed that "user B" is encoded as [0, 1] and "buy a computer" is encoded as [0, 0, 1]).

[0105] Furthermore, the processed feature vector [1000, 0, 1, 0, 0, 1, 0, 5] is input into a pre-trained risk assessment model, and the model outputs a risk score, such as 0.75, which indicates that the transfer performed by the login device has a higher potential risk.

[0106] S3. Generate a device fingerprint of the login device according to the Web information, and use the device fingerprint to generate a fingerprint similarity of the login device.

[0107] In the embodiment of the present invention, the device fingerprint includes: browser system version, system information, browser version, browser language, color depth, canvasID, browser plug-in list and the operator to which the IP belongs.

[0108] In detail, it is based on N factors such as browser system version, system information, browser version, browser language, color depth, canvasID, browser plug-in list, operator to which the IP belongs, etc.

[0109] In detail, the device fingerprint refers to a unique identifier constructed by collecting a series of information that can uniquely identify the user's login device. This information can help identify different devices and be used in subsequent risk assessment processes.

[0110] Specifically, the browser system version refers to the version information of the operating system where the user's browser is located; the system information refers to the operating system type and its version, such as Windows 10, macOS11, etc.; the browser version refers to the specific version number of the browser used by the user; the browser language refers to the preferred language set by the browser; the color depth refers to the number of bits of screen color, reflecting the number of color types supported by the display; the canvasID refers to the rendering characteristics of the HTML5 CanvasAPI, which can be used as a fingerprint of the browser, and the browser plug-in list is the list of plug-ins installed in the user's browser; the operator to which the IP belongs refers to the user's Internet service provider (ISP), which can be obtained by querying the IP address. Together, this information constitutes a device fingerprint, which can be used to track and identify specific login devices.

[0111] In the embodiment of the present invention, the step of generating the fingerprint similarity of the login device by using the device fingerprint includes:

[0112] Performing vectorization conversion on the device fingerprint to obtain a fingerprint vector of the device fingerprint, wherein the device fingerprint includes: the device fingerprint of the last login and the device fingerprint of this login;

[0113] The fingerprint similarity of the login device is calculated according to the fingerprint vector and a preset fingerprint weight.

[0114] In detail, the vectorization conversion of device fingerprint refers to converting the attributes of the last login device fingerprint and the current login device fingerprint (such as browser system version, system information, etc.) into numerical form to form a vector. This step usually involves encoding of non-numerical data, such as using one-hot encoding, label encoding and other methods to convert categorical variables into numerical values. Each attribute will have its own vector representation, and finally these vectors are combined to form a complete fingerprint vector. For example: convert the attributes of the last login device fingerprint and the current login device fingerprint into numerical form to form a vector. Assume that there are 8 factors (attributes), represented as F1, F2, ..., F8.

[0115] In detail, for each device fingerprint attribute, convert it into a numerical representation, integrate the numerical representations of all attributes into a vector, namely, the fingerprint vector, and weight each dimension in the fingerprint vector using a preset fingerprint weight.

[0116] In detail, the fingerprint vector obtained above and the preset fingerprint weight are used to calculate the fingerprint similarity. The fingerprint weight can reflect the importance of different attributes to the uniqueness of the device fingerprint, which is usually obtained based on historical data analysis. For example, for each factor, its similarity score a1, a2, ..., a8 is calculated. The similarity score here is in the range of [0, 1], where 1 means exactly the same and 0 means completely different. The initial weight is 1 / N. In this example, N = 8, so the initial weight is 1 / 8.

[0117] Furthermore, the fingerprint similarity score is calculated as:

[0118] Score=a1*1 / N+a2*1 / N+a3*1 / N+…+a8*1 / N

[0119] S4. Perform overflow processing on the initial risk value using the fingerprint similarity to obtain a final risk value of the login device, and perform abnormality judgment on the login device based on the final risk value and a preset risk threshold.

[0120] In the embodiment of the present invention, the method of performing overflow processing on the initial risk value by using the fingerprint similarity to obtain the final risk value of the login device includes:

[0121] Determine the risk premium value of the initial risk value according to the fingerprint similarity and a preset gain rule;

[0122] The initial risk value is summed according to the risk excess value to obtain a final risk value of the landing device.

[0123] In detail, adjust the high-risk threshold according to the business feature scenario. Assuming that the high-risk value set in the transfer scenario is 0.6, if the generated device ID fingerprint similarity is 1, the risk increase value is -0.2 (if the generated device fingerprint similarity is 0, there is no risk increase). If the user transfers this time, the output risk value is 0.65, then the final output risk value is 0.65-0.2=0.45. If the device is similar (this transfer is compared with the last login), even if IP drift occurs this time, through similarity correction, the output value of this model is 0.45, which is less than the threshold value of 0.6, that is, this transfer will not be judged as high risk and will not trigger the verification requirement.

[0124] Specifically, the risk premium value of the initial risk value is first determined according to the fingerprint similarity and the preset gain rule. When the fingerprint similarity is 1, the risk premium value is -0.2. If the fingerprint similarity is 0, there is no risk premium value.

[0125] In detail, the initial risk value is added to the risk premium value to obtain the final risk value. For example, if the initial risk value is 0.65 and the fingerprint similarity is 1, the risk premium value is -0.2, and the final risk value is 0.65-0.2=0.45.

[0126] In this way, even if anomalies such as IP address drift occur, if the device fingerprint similarity is high, the system will consider the login to be credible and will not trigger additional security verification steps.

[0127] In an embodiment of the present invention, the abnormality judgment of the login device based on the final risk value and the preset risk threshold includes: comparing the final risk value with the preset risk threshold, comparing the final risk value with the preset risk threshold, if the final risk value is lower than the preset risk threshold, then the login device is considered normal, if the final risk value is higher than or equal to the preset risk threshold, then the login device is considered to have abnormal behavior.

[0128] Furthermore, a high risk threshold is set, for example, 0.6. If the final risk value is lower than the high risk threshold, the login will not be considered high risk and no additional verification steps need to be triggered.

[0129] For example, if the initial risk value is 0.65 and the fingerprint similarity is 1, the final risk value is 0.45. Assuming the preset risk threshold is 0.6, compare the final risk value with the preset risk threshold. If the final risk value is less than the preset risk threshold, the login device is considered normal; otherwise, it is considered abnormal.

[0130] The present invention performs change detection by generating a unique device ID for the login device and combining it with the IP address, and can identify whether the login behavior of the device is abnormal. Then, the information features generated by the change detection results and the transfer information are used in conjunction with a pre-trained risk assessment model to calculate an initial risk value, which enables the system to assess transaction risks based on historical data and current behavior patterns. At the same time, by creating device fingerprints and similarity analysis, the consistency of the device can be verified, and the initial risk value can be adjusted accordingly to obtain a final risk value that is closer to the actual risk situation. Finally, this risk value is compared with a preset threshold to accurately judge abnormal transfer behavior, thereby improving the accuracy of detection and reducing false alarms that may be caused by relying solely on IP address positioning. Therefore, the present invention proposes a product recommendation method based on user portraits and knowledge graphs, which can solve the problem of low accuracy in detecting abnormal transfer accounts.

[0131] like Figure 2 , which is a functional module diagram of an abnormal transfer detection device based on IP address drift provided by an embodiment of the present invention.

[0132] The abnormal transfer detection device 100 based on IP address drift of the present invention can be installed in an electronic device. According to the functions implemented, the abnormal transfer detection device 100 based on IP address drift can include a change detection module 101, an initial risk value generation module 102, a fingerprint similarity generation module 103 and an abnormality judgment module 104. The module of the present invention can also be called a unit, which refers to a series of computer program segments that can be executed by an electronic device processor and can complete fixed functions, which are stored in the memory of the electronic device.

[0133] In this embodiment, the functions of each module / unit are as follows:

[0134] The change detection module 101 is used to generate a device ID of a login device according to pre-collected Web information, and perform change detection on the login device according to the pre-acquired IP address and the device ID;

[0135] The initial risk value generating module 102 is used to generate information features of the login device according to the detection result of the change detection and the pre-acquired transfer information, and to generate the initial risk value of the login device using a pre-trained risk assessment model and the information features;

[0136] The fingerprint similarity generation module 103 is used to generate a device fingerprint of the login device according to the Web information, and generate a fingerprint similarity of the login device using the device fingerprint;

[0137] The abnormality judgment module 104 is used to perform overflow processing on the initial risk value using the fingerprint similarity to obtain a final risk value of the login device, and perform abnormality judgment on the login device according to the final risk value and a preset risk threshold.

[0138] like Figure 3 , which is a schematic diagram of the structure of an electronic device for implementing an abnormal transfer detection method based on IP address drift provided by an embodiment of the present invention.

[0139] The electronic device may include a processor 10, a memory 11, a communication bus 12, and a communication interface 13, and may also include a computer program stored in the memory 11 and executable on the processor 10, such as an abnormal transfer detection program based on IP address drift.

[0140] In some embodiments, the processor 10 may be composed of an integrated circuit, for example, a single packaged integrated circuit, or a plurality of integrated circuits with the same or different functions, including one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and combinations of various control chips. The processor 10 is the control core (ControlUnit) of the electronic device, and uses various interfaces and lines to connect various components of the entire electronic device, and executes or executes programs or modules stored in the memory 11 (for example, executing an abnormal transfer detection program based on IP address drift, etc.), and calls data stored in the memory 11 to execute various functions of the electronic device and process data.

[0141] The memory 11 includes at least one type of readable storage medium, and the readable storage medium includes a flash memory, a mobile hard disk, a multimedia card, a card-type memory (for example, an SD or DX memory, etc.), a magnetic memory, a disk, an optical disk, etc. In some embodiments, the memory 11 may be an internal storage unit of an electronic device, such as a mobile hard disk of the electronic device. In other embodiments, the memory 11 may also be an external storage device of an electronic device, such as a plug-in mobile hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the electronic device. Further, the memory 11 may also include both an internal storage unit of the electronic device and an external storage device. The memory 11 may not only be used to store application software and various types of data installed in the electronic device, such as the code of an abnormal transfer detection program based on IP address drift, but also be used to temporarily store data that has been output or is to be output.

[0142] The communication bus 12 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. The bus is configured to realize connection and communication between the memory 11 and at least one processor 10, etc.

[0143] The communication interface 13 is used for communication between the above-mentioned electronic device and other devices, including a network interface and a user interface. Optionally, the network interface may include a wired interface and / or a wireless interface (such as a WI-FI interface, a Bluetooth interface, etc.), which is generally used to establish a communication connection between the electronic device and other electronic devices. The user interface may be a display (Display), an input unit (such as a keyboard (Keyboard)), and optionally, the user interface may also be a standard wired interface, a wireless interface. Optionally, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, and an OLED (Organic Light-Emitting Diode, organic light-emitting diode) touch device, etc. Among them, the display may also be appropriately referred to as a display screen or a display unit, which is used to display information processed in the electronic device and to display a visual user interface.

[0144] The figure only shows an electronic device with components. Those skilled in the art will understand that the structure shown in the figure does not constitute a limitation on the electronic device, and may include fewer or more components than shown in the figure, or combine certain components, or arrange the components differently.

[0145] For example, although not shown, the electronic device may also include a power source (such as a battery) for supplying power to each component. Preferably, the power source may be logically connected to the at least one processor 10 through a power management device, so that the power management device can realize functions such as charging management, discharging management, and power consumption management. The power source may also include one or more DC or AC power sources, recharging devices, power failure detection circuits, power converters or inverters, power status indicators, and other arbitrary components. The electronic device may also include a variety of sensors, Bluetooth modules, Wi-Fi modules, etc., which will not be repeated here.

[0146] It should be understood that the embodiment is for illustration only and the scope of the patent application is not limited to this structure.

[0147] The abnormal transfer detection program based on IP address drift stored in the memory 11 of the electronic device is a combination of multiple instructions. When running in the processor 10, it can achieve:

[0148] Right 1

[0149] Specifically, the specific implementation method of the processor 10 for the above instructions can refer to the description of the relevant steps in the corresponding embodiment of the accompanying drawings, which will not be repeated here.

[0150] Furthermore, if the module / unit integrated in the electronic device is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. The computer-readable storage medium can be volatile or non-volatile. For example, the computer-readable medium may include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a mobile hard disk, a magnetic disk, an optical disk, a computer memory, and a read-only memory (ROM).

[0151] The present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor of an electronic device, the computer program can implement:

[0152] Right 1

[0153] In the several embodiments provided by the present invention, it should be understood that the disclosed devices, apparatuses and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of the modules is only a logical function division, and there may be other division methods in actual implementation.

[0154] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0155] In addition, each functional module in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional modules.

[0156] It is obvious to those skilled in the art that the present invention is not limited to the details of the above exemplary embodiments, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0157] Therefore, no matter from which point of view, the embodiments should be regarded as illustrative and non-restrictive, and the scope of the present invention is limited by the appended claims rather than the above description, so it is intended that all changes falling within the meaning and scope of the equivalent elements of the claims are included in the present invention. Any attached figure mark in the claims should not be regarded as limiting the claims involved.

[0158] The blockchain referred to in this invention is a new application mode of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, encryption algorithm, etc. Blockchain is essentially a decentralized database, a string of data blocks generated by cryptographic methods. Each data block contains a batch of network transaction information, which is used to verify the validity of its information (anti-counterfeiting) and generate the next block. Blockchain can include the underlying blockchain platform, platform product service layer, and application service layer.

[0159] The embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Among them, artificial intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0160] In addition, it is clear that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units or devices stated in the system claim can also be implemented by one unit or device through software or hardware. The words first, second, etc. are used to indicate names, and do not indicate any particular order.

[0161] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solution of the present invention can be modified or replaced by equivalents without departing from the spirit and scope of the technical solution of the present invention.

Claims

1. A method for detecting abnormal transfer based on IP address drift, characterized in that: The method comprises: Generate a device ID of the login device according to the pre-collected Web information, and perform change detection on the login device according to the pre-acquired IP address and the device ID; Generate information features of the login device according to the detection result of the change detection and the pre-acquired transfer information, and generate an initial risk value of the login device using a pre-trained risk assessment model and the information features; Generate a device fingerprint of the login device according to the Web information, and generate a fingerprint similarity of the login device using the device fingerprint; The initial risk value is increased by using the fingerprint similarity to obtain a final risk value of the login device, and an abnormality judgment is made on the login device based on the final risk value and a preset risk threshold.

2. The abnormal transfer detection method based on IP address drift according to claim 1, characterized in that: The step of generating a device ID of a login device according to pre-collected Web information includes: Filter the pre-collected Web information for target information and obtain the target information of the login device; Generate a device ID of the login device according to the target information.

3. The abnormal transfer detection method based on IP address drift according to claim 1, characterized in that: The performing change detection on the login device according to the pre-acquired IP address and the device ID includes: Extracting features from the pre-collected Web information to obtain Web-side features of the login device; Perform device identification on the login device according to the Web-side feature and the device ID, and obtain a device identification result of the login device; The login device is detected for changes based on the pre-acquired user IP and the device identification result.

4. The abnormal transfer detection method based on IP address drift according to claim 1, characterized in that: The generating the information feature of the login device according to the detection result of the change detection and the pre-acquired transfer information includes: Extracting keywords from the pre-acquired transfer information, and generating transfer features of the login device according to the keywords; Quantifying the detection result of the change detection to obtain a quantized value of the inspection result; The quantified value and the transfer feature are subjected to feature fusion to obtain information features of the login device.

5. The abnormal transfer detection method based on IP address drift according to claim 1, characterized in that: The generating the initial risk value of the login device by using the pre-trained risk assessment model and the information feature includes: Using a pre-trained risk assessment model to perform vector conversion on the information feature to obtain an information feature vector; Perform multiple decision tree regression on the information feature vector to obtain an initial risk value of the login device.

6. The abnormal transfer detection method based on IP address drift according to claim 1, characterized in that: The step of using the device fingerprint to generate the fingerprint similarity of the login device includes: Performing vectorization conversion on the device fingerprint to obtain a fingerprint vector of the device fingerprint, wherein the device fingerprint includes: the device fingerprint of the last login and the device fingerprint of this login; The fingerprint similarity of the login device is calculated according to the fingerprint vector and a preset fingerprint weight.

7. The abnormal transfer detection method based on IP address drift according to any one of claims 1 to 6, characterized in that: The method of performing overflow processing on the initial risk value by using the fingerprint similarity to obtain a final risk value of the login device includes: Determine the risk premium value of the initial risk value according to the fingerprint similarity and a preset gain rule; The initial risk value is summed according to the risk excess value to obtain a final risk value of the landing device.

8. An abnormal transfer detection device based on IP address drift, characterized in that: The device comprises: A change detection module, used to generate a device ID of a login device according to pre-collected Web information, and perform change detection on the login device according to the pre-acquired IP address and the device ID; An initial risk value generating module, used to generate information features of the login device according to the detection result of the change detection and the pre-acquired transfer information, and to generate an initial risk value of the login device using a pre-trained risk assessment model and the information features; A fingerprint similarity generation module, used to generate a device fingerprint of the login device according to the Web information, and generate a fingerprint similarity of the login device using the device fingerprint; The abnormality judgment module is used to use the fingerprint similarity to increase the initial risk value to obtain the final risk value of the login device, and to judge the abnormality of the login device according to the final risk value and a preset risk threshold.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the abnormal transfer detection method based on IP address drift as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the abnormal transfer detection method based on IP address drift as described in any one of claims 1 to 7 is implemented.

Images