Method, device, equipment and medium for monitoring operation behavior

Abstract

The embodiment of the present application is applicable to the field of information security technology, and provides a method, device, equipment and medium for monitoring operation behavior, the method comprising: when receiving the login information of an entity account, determining the target virtual account associated with the entity account; wherein the entity account is associated with multiple virtual accounts, the target virtual account is the virtual account that performs the current login operation, and the target virtual account is configured with corresponding risk control information; obtaining the account information of the target virtual account, the account information includes the current access method of the target virtual account; according to the access method, generating an operation interface that matches the target virtual account; according to the risk control information, monitoring the operation behavior of the target virtual account in the operation interface. The above method can reduce the risk of user operation behavior and improve the safety of operation.

Description

Technical Field

[0001] The embodiments of the present application belong to the field of information security technology, and in particular, relate to a method, device, equipment and medium for monitoring operation behavior. Background Art

[0002] Generally, users need to register on any platform to operate on that platform, and log in to the platform and perform related operations using the account information obtained after registration.

[0003] In some business scenarios, different users may share account information when operating on the platform. For example, in the public business of banking, securities and other industries, account information may be registered based on a certain institution, and different business processing processes may need to be operated by multiple employees in the institution. There are great risks when different employees use the same account information to perform business operations. Summary of the invention

[0004] In view of this, the embodiments of the present application provide a method, apparatus, device and medium for monitoring operation behavior, so as to reduce the risk of user operation behavior and improve the safety of operation.

[0005] A first aspect of an embodiment of the present application provides a method for monitoring an operation behavior, the method comprising:

[0006] When receiving login information of an entity account, determining a target virtual account associated with the entity account; wherein the entity account is associated with multiple virtual accounts, the target virtual account is a virtual account that performs a current login operation, and the target virtual account is configured with corresponding risk control information;

[0007] Acquire account information of the target virtual account, wherein the account information includes a current access method of the target virtual account;

[0008] According to the access method, generating an operation interface matching the target virtual account;

[0009] The operation behavior of the target virtual account in the operation interface is monitored according to the risk control information.

[0010] A second aspect of an embodiment of the present application provides a monitoring device for operation behavior, the device comprising:

[0011] A determination module, configured to determine a target virtual account associated with the entity account upon receiving login information of the entity account; wherein the entity account is associated with a plurality of virtual accounts, the target virtual account is a virtual account for performing a current login operation, and the target virtual account is configured with corresponding risk control information;

[0012] An acquisition module, configured to acquire account information of the target virtual account, wherein the account information includes a current access mode of the target virtual account;

[0013] A generating module, used to generate an operation interface matching the target virtual account according to the access method;

[0014] A monitoring module is used to monitor the operation behavior of the target virtual account in the operation interface according to the risk control information.

[0015] A third aspect of an embodiment of the present application provides a terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method for monitoring the operating behavior as described in the first aspect above is implemented.

[0016] A fourth aspect of an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method for monitoring the operating behavior as described in the first aspect above is implemented.

[0017] A fifth aspect of an embodiment of the present application provides a computer program product. When the computer program product is run on a terminal device, the terminal device executes the method for monitoring the operating behavior described in the first aspect above.

[0018] Compared with the prior art, the embodiments of the present application have the following advantages:

[0019] In the embodiment of the present application, for the situation where multiple users in the system share the same physical account, a virtual account can be assigned to each user respectively, and the access method available to each user can be limited. When a user logs in to the system, an operation interface matching the target virtual user and its access method bound to the user can be generated, and the operations allowed for the user are limited to the types assigned to it in the operation interface. In this way, multiple users sharing the same physical account can be isolated. Each executed operation can be located to a specific user according to the different virtual users, so that the operation behavior can be traced. Secondly, the embodiment of the present application can also configure corresponding risk control information for each virtual account, and the terminal device can monitor the operation behavior of the virtual user according to the configured risk control information, so as to further ensure the security of the account operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the embodiments or prior art descriptions. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 This is a schematic diagram of the steps of a method for monitoring an operation behavior according to an embodiment of the present application;

[0022] Figure 2 This is a schematic diagram of a process of configuring a virtual account according to an embodiment of the present application;

[0023] Figure 3 It is a schematic diagram of the steps of another method for monitoring operation behavior according to an embodiment of the present application;

[0024] Figure 4 It is a schematic diagram of a monitoring device for an operation behavior according to an embodiment of the present application;

[0025] Figure 5 It is a schematic diagram of a configuration device of a virtual account according to an embodiment of the present application;

[0026] Figure 6 It is a schematic diagram of a terminal device according to an embodiment of the present application. DETAILED DESCRIPTION

[0027] In the following description, specific details such as specific system structures, technologies, etc. are proposed for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application can also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from hindering the description of the present application.

[0028] The technical solution of the present application is described below through specific embodiments.

[0029] Reference Figure 1 , shows a schematic flow chart of a method for monitoring an operation behavior according to an embodiment of the present application, which may specifically include the following steps:

[0030] S101. When receiving login information of an entity account, determine a target virtual account associated with the entity account; wherein the entity account is associated with multiple virtual accounts, the target virtual account is a virtual account that performs a current login operation, and the target virtual account is configured with corresponding risk control information.

[0031] It should be noted that the method can be applied to terminal devices, such as mobile phones, tablet computers, desktop computers, etc. The embodiments of the present application do not limit the specific type of terminal devices.

[0032] In the embodiment of the present application, the entity account may be an account registered in the system, and the entity account may be obtained based on the application registration of an individual user or an institutional user. For example, an individual, enterprise or other unit may register an account in a system such as a bank or a stock exchange. Based on the account, operations may be performed within the system to implement corresponding services. For example, an individual user may perform fund subscription, redemption and other services based on a registered account, and an institutional user may perform operations such as the payment of employee wages based on a registered account.

[0033] Usually, a registered account may be used by multiple people. For example, for an account registered by a user of an organization, multiple employees in the organization may have the authority to use the account and can use the account to perform operations on the system.

[0034] In order to improve the security of different users when using registered physical accounts to perform operations and ensure that each user can only perform operations that match their own permissions, after completing the registration of the physical account, the terminal device can allocate multiple virtual accounts to the physical account according to actual needs and associate multiple virtual accounts with the physical account. In this way, the operations that each virtual account can perform in the system can be isolated from each other and do not interfere with each other.

[0035] In the embodiment of the present application, the process of configuring multiple virtual accounts for the registered entity account by the terminal device should be performed before the above step S101. Figure 2 FIG. 2 is a schematic diagram of a process of configuring a virtual account according to an embodiment of the present application. The process may include the following steps S201-S204:

[0036] S201. Determine a plurality of operating users bound to the entity account.

[0037] In the embodiment of the present application, the operating user may be a user who has the authority to use the entity account. For example, for an entity account registered by a user of an organization, employees A, B, and C of the organization can all use the entity account to complete corresponding work at work. Then, it can be considered that employees A, B, and C are three operating users bound to the entity account.

[0038] S202: Allocate a number of virtual accounts equal to the number of the multiple operating users to the physical account.

[0039] Generally, in order to match the operations performed using the physical account with the specific operating users, a corresponding number of virtual accounts can be allocated according to the number of determined operating users. For example, in the above example, if there is a single operating user bound to the physical account, three virtual accounts can be allocated to the physical account, namely virtual account 1, virtual account 2 and virtual account 3. In this way, each operating user can use a separate virtual account to independently complete various operations in the system. For example, employee A can use virtual account 1 to operate in the system, while employee B and employee C can use virtual account 2 and virtual account 3 respectively.

[0040] S203: Acquire at least one access method available to each operating user and user authority of each operating user when using the at least one access method.

[0041] In an embodiment of the present application, the system can provide multiple access methods, which may refer to the terminal device used by the user when logging into the system, such as a mobile phone, tablet computer, desktop computer, etc.; the access method may also be a communication method for establishing a connection between the terminal and the system background server, such as a wired connection, a wireless connection, etc.; or, the access method may also be a specific operation type implemented based on an entity account according to different actual business, such as in the process of financial transactions, various different entrustment methods such as ordinary, quantitative, and strategy, which are not limited in the embodiment of the present application.

[0042] In the embodiment of the present application, for each operating user, an available access method can be allocated in advance. On this basis, the specific user authority of each operating user when using the access method can also be determined.

[0043] It should be noted that each operating user may be assigned one access method or multiple access methods. Different operating users may have different or the same user rights when using the same access method, which is not specifically limited in the embodiments of the present application.

[0044] S204: Associating the virtual account with the at least one access method and user rights when using the at least one access method.

[0045] After obtaining the access methods available to each operating user and the user rights of each operating user when using the access methods respectively, the allocated virtual account can be associated with the above access methods and the user rights under the access methods.

[0046] As shown in Table 1, it is an example of association between a virtual account, an access method and a user authority. In the example of Table 1, the access method may refer to a specific access terminal.

[0047] Operation User Virtual Account Access method User Permissions Employee A Virtual Account 1 Access terminal 1 Permission 1 Employee B Virtual Account 2 Access port 2 Permission 1 Employee C Virtual Account 3 Access port 2 Permission 2 …… …… …… ……

[0048] Of course, in the above example, permission 1 and permission 2 can be a permission set consisting of multiple different types of permissions, not just a specific operation permission. For example, permission 1 can include permissions for multiple businesses such as entrustment, withdrawal, and transfer in financial services.

[0049] Therefore, when receiving the login information of the physical account, the terminal device can first determine which virtual account is performing the current login operation, that is, the target virtual account.

[0050] In the embodiment of the present application, the target virtual account can be determined by means of secondary verification.

[0051] In a specific implementation, after the terminal device receives the login information of the physical account, a verification interface may be displayed, and the verification interface may be used to receive the verification information of the target virtual account.

[0052] Exemplarily, the terminal device may display a verification interface on the screen, and the verification interface may include information such as a user account and password of the target virtual user that needs to be input by the operating user.

[0053] After receiving the verification information input by the operating user, the terminal device can verify the verification information. If the verification information is verified, the target virtual account can be determined based on the user account therein.

[0054] For example, if an operating user enters the user account and password corresponding to virtual account 1 in the verification interface, and the verification information entered by the operating user is verified, it can be determined that virtual account 1 is the target virtual account, that is, the virtual account currently logged in to the system.

[0055] Usually, after completing the verification of the target virtual account, the terminal device can receive a login token generated by the server according to the user account and password. In this way, when the target virtual account performs operations on the terminal device later, it only needs to carry the token without having to enter the verification information again. However, the login token generated solely by the user account and password is easy to be stolen due to its low security, affecting the security of the operation. In order to solve the above problem, in a possible implementation method of the embodiment of the present application, after completing the verification of the target virtual account, the terminal device can send the user rights of the target virtual account to the server, and the server generates a more secure login token based on various information such as the user account, password, and user rights.

[0056] A login token generally includes a header, raw data, and a dynamic key. In an embodiment of the present application, a variety of information such as a user account, password, and user permissions can be combined in a predefined splicing method and splicing order to obtain a key plaintext, and the raw data plaintext can be generated based on the token expiration time. The above token expiration time can indicate when the currently generated login token should expire or become unavailable. Then, an encryption algorithm can be used to encrypt the key plaintext and the raw data plaintext to obtain a dynamic key and raw data. By combining the pre-generated header with the dynamic key and raw data, a more secure login token can be obtained.

[0057] It should be noted that in the above process of encrypting the key plaintext and the original data plaintext, the same encryption algorithm may be used, or different encryption algorithms may be used. For example, the key plaintext and the original data plaintext are both encrypted using the BASE64 algorithm; or the key plaintext is encrypted using the BASE64 algorithm, and the original data plaintext is encrypted using the HmacSHA256 algorithm, which is not limited in the embodiments of the present application.

[0058] Since the user authority information is integrated into the process of generating the above login token, not only the difficulty of cracking the login token is increased, but also when the user authority of the target virtual user changes, the login token will also be invalidated synchronously.

[0059] S102: Acquire account information of the target virtual account, where the account information includes a current access method of the target virtual account.

[0060] In the embodiment of the present application, a virtual account can be uniquely bound to an operating user. Therefore, the account information of the target virtual account can include the personal information of the operating user who uses the target virtual account to log in, and can also include the access method when the operating user uses the target virtual account to log in to the system.

[0061] Since different virtual accounts and different access methods may correspond to different user permissions, after determining the target virtual account, the specific operations that the operating user can perform can be determined by obtaining the account information of the target virtual account including the access method.

[0062] S103: Generate an operation interface matching the target virtual account according to the access method.

[0063] In an embodiment of the present application, after determining the target virtual account and obtaining the account information of the target virtual account including the access method, the terminal device can generate an operation interface matching the current target virtual account according to the access method.

[0064] For example, if the access mode refers to different access terminals, after logging into the system using different access terminals, the operation interface that each operating user can see may be different. The operation interface may be personalized and generated according to the user authority corresponding to the current target virtual account.

[0065] S104: Monitor the operation behavior of the target virtual account in the operation interface according to the risk control information.

[0066] In an embodiment of the present application, each virtual account may be configured with different risk control information, and the above risk control information may be used to indicate which operations the operating user is allowed to perform, or which operations are prohibited from performing, when using the virtual account.

[0067] For example, for the virtual account 1 shown in the above Table 1, if its risk control information includes that the maximum transfer amount allowed when performing a transfer operation is 200,000 yuan, then when the operating user (employee A) bound to the virtual account 1 logs into the system using the virtual account 1, the virtual account 1 is identified as the target virtual account. Thereafter, if employee A performs a transfer operation in the operation interface, the terminal device can monitor the transfer amount of employee A according to the above risk control information to ensure that the maximum transfer amount does not exceed 200,000 yuan, thereby ensuring the financial security of the system.

[0068] In an embodiment of the present application, in view of the situation where multiple users in the system share the same physical account, a virtual account can be assigned to each user respectively, and the access method available to each user can be limited. When a user logs in to the system, an operation interface matching the target virtual user and its access method bound to the user can be generated, and the operations allowed for the user are limited to the types assigned to it in the operation interface. In this way, multiple users sharing the same physical account can be isolated. Each executed operation can be located to a specific user according to the different virtual users, so that the operation behavior can be traced. Secondly, the embodiment of the present application can also configure corresponding risk control information for each virtual account, and the terminal device can monitor the operation behavior of the virtual user according to the configured risk control information, so as to further ensure the security of the account operation.

[0069] Reference Figure 3 , shows a schematic flow chart of another method for monitoring operation behavior according to an embodiment of the present application, which may specifically include the following steps:

[0070] S301. Allocate multiple virtual accounts to a physical account.

[0071] In the embodiment of the present application, the entity account may be an account registered in the system, the entity account may be a personal account or an institutional account, and the system may be various business systems, data processing systems, etc. For example, a financial transaction system for implementing securities transactions such as stocks and funds

[0072] Exemplarily, the entity account may be an institutional account registered by a certain enterprise or other types of units in the financial transaction system, and authorized enterprise employees may act as operating users and use the entity account to perform securities market trading operations.

[0073] In the embodiment of the present application, multiple virtual accounts can be allocated to the entity account according to the number of operating users who can use the entity account, and each operating user can be bound to a virtual user.

[0074] The specific process of allocating multiple virtual accounts to a physical account can be found in the introduction of S201-S204 in the above-mentioned embodiment, which will not be repeated in this embodiment.

[0075] S302: When receiving the login information of the physical account, determine the target virtual account associated with the physical account, the target virtual account is the virtual account that performs the current login operation, and the target virtual account is configured with corresponding risk control information.

[0076] In an embodiment of the present application, an operating user can enter the login information of an entity account in a terminal device to log in to a corresponding system, such as the above-mentioned financial transaction system.

[0077] When the terminal device receives the login information of the physical account, it can determine the target virtual user bound to the current operating user through secondary verification.

[0078] S303: Acquire account information of the target virtual account, where the account information includes a current access method of the target virtual account.

[0079] In the embodiments of the present application, the access method may refer to the terminal device used by the user when logging into the system, or it may be the communication method for establishing a connection between the terminal and the system backend server, or it may be the specific operation type implemented based on the entity account according to the actual business. The embodiments of the present application do not limit this.

[0080] S304: Determine the user authority of the target virtual account when using the access method.

[0081] In an embodiment of the present application, since different virtual accounts and different access methods may correspond to different user permissions, after determining the target virtual account and the currently used access method, the user permissions of the target virtual account under the current access method can be further determined.

[0082] For example, the target virtual account is virtual account 1, and the current access method is to use access terminal 1 to connect to the financial transaction system. In this case, the user authority of the operating user bound to virtual account 1 is authority 1. For example, authority 1 may include the authority to execute operation behavior 2, operation behavior 4, and operation behavior 5.

[0083] S305: According to the user authority, a matching operation interface is configured for the target virtual account.

[0084] In the embodiment of the present application, the operation behaviors under different permissions can be implemented based on specific business modules. Therefore, when the user permission is permission 1, one or more business modules corresponding to the user permission can be called. For example, permission 1 includes permissions to execute operation behaviors 2, 4, and 5, and operation behavior 2 is implemented by business module 2, operation behavior 4 is implemented by business module 4, and operation behavior 5 is implemented by business module 5.

[0085] Then, the terminal device can configure the above one or more business modules to obtain an operation interface matching the target virtual account.

[0086] S306: Monitor whether the operation behavior of the target virtual account in the operation interface meets the requirements of the risk control information.

[0087] In the personalized operation interface generated according to the user rights of the virtual account, the business functions provided in the operation interface may include only the operations that the target virtual user is allowed to perform. For example, for the target virtual user, the operations allowed may include fund subscription, redemption, and transfer, etc. On the other hand, for a specific operation, the degree and scope of execution of different virtual accounts may also be different.

[0088] For example, for a specific operation of transferring money, both virtual user 1 and virtual user 2 have the right to transfer money, so in the personalized operation interface generated for virtual user 1 and virtual user 2, both virtual user 1 and virtual user 2 should be able to perform the transfer operation. However, the transfer limits for virtual user 1 and virtual user 2 may be different.

[0089] Therefore, in the embodiment of the present application, the terminal device can monitor the operation behavior of the target virtual account in the operation interface to confirm whether the monitored operation behavior meets the requirements of the risk control information corresponding to the target virtual account. If the operation behavior meets the requirements of the risk control information, the terminal device can execute S307, otherwise, the terminal device can execute S308.

[0090] S307: Execute an action corresponding to the operation behavior, and synchronously update the account information of the physical account and other virtual accounts according to the operation behavior.

[0091] In the embodiment of the present application, if the target virtual user's operation behavior in the operation interface that matches its user authority meets the requirements of its own risk control information, the terminal device can execute the action corresponding to the operation behavior. For example, the target virtual user's risk control information sets a limit of 200,000 yuan for its transfer operation. If the target virtual user currently plans to transfer 150,000 yuan, this amount meets the requirements of the risk control information. Then, the terminal device can execute and complete the above transfer operation.

[0092] In the embodiment of the present application, any operation behavior of a virtual account will be associated with the corresponding physical account and may affect other virtual accounts. Therefore, after a virtual account performs a corresponding operation behavior, the terminal device can synchronously update the account information of the physical account and other virtual accounts according to the operation behavior.

[0093] S308: Terminate the response to the operation behavior, and generate risk operation statistical information according to the operation behavior.

[0094] If the target virtual user's operation behavior does not meet the requirements of its own risk control information, for example, if the risk control information sets a limit of 200,000 yuan for the transfer operation, and the target virtual user currently plans to transfer 250,000 yuan, the amount exceeds the transfer limit and does not meet the requirements of the risk control information. Then, the terminal device can terminate the response to the operation behavior and generate risk operation statistics based on the operation behavior that does not meet the requirements of the risk control information. The above risk operation statistics can be sent to the terminal device or other subject bound to the physical account. For example, the risk operation statistics can be counted on a daily basis and sent once a day to the email bound to the physical account for analysis and processing by relevant supervisors.

[0095] In a possible implementation of the embodiment of the present application, the number of the above-mentioned target virtual accounts can be multiple. For example, the target virtual accounts include a first target virtual account and a second target virtual account. Since the target virtual account is the virtual account currently performing the login operation, the above-mentioned first target virtual account and the second target virtual account can be considered as virtual accounts that are online at the same time. That is to say, in the embodiment of the present application, multiple different virtual accounts can be online at the same time.

[0096] In an embodiment of the present application, if the first target virtual account has the authority to perform the target operation behavior, for example, the first target virtual account has the authority to perform the target operation behavior of fund subscription, when the terminal device monitors the first target virtual account to perform the above-mentioned target operation behavior, it can decide whether to respond to the operation of the first target virtual account based on the level of authority of multiple target virtual accounts online at the same time for the target operation behavior.

[0097] In a specific implementation, when the first target virtual account is monitored to perform a target operation, the terminal device can determine whether there is a second target virtual account among the multiple target virtual accounts currently online. The second target virtual account can be an account that also has the authority to perform the target operation, and the authority of the second target virtual account for the above target operation is the virtual account with the highest authority among the multiple target virtual accounts currently online.

[0098] If there is such a second target virtual account, the terminal device can feed back the information of the first target virtual account executing the target operation behavior to the terminal used by the second target virtual account, so as to request the second target virtual account to approve the target operation behavior. The above-mentioned information of the first target virtual account executing the target operation behavior can be information requesting the second target virtual account to approve the target operation behavior. In this way, when there are multiple virtual accounts online at the same time, the virtual account with higher authority can approve the operation behavior of the virtual account with lower authority to further ensure the security of the operation.

[0099] For example, if target virtual account A, target virtual account B, target virtual account C and target virtual account D are four virtual accounts currently online at the same time, when target virtual account A is performing an operation of subscribing to a fund with a high risk level, when the terminal device monitors the operation behavior, it can first determine whether the other three target virtual accounts currently online, namely target virtual account B, target virtual account C and target virtual account D, have the authority to perform the above-mentioned operation behavior. If target virtual account B and target virtual account D have the authority to perform the above-mentioned subscription of the fund with a high risk level, and target virtual account C does not have the authority, then the terminal device can further compare the authority levels of target virtual account A, target virtual account B and target virtual account D. For example, if the authority level of target virtual account B to perform the above-mentioned operation is higher than the authority level of target virtual account A, and the authority level of target virtual account A is higher than the authority level of target virtual account D, then the terminal device can send the information that target virtual account A performs the operation behavior to target virtual account B, requesting target virtual account B to approve the operation behavior. If the target virtual account B agrees with the target virtual account A to perform the operation, the terminal device can respond to the operation of the target virtual account, for example, submitting a request to subscribe to the fund to the trading market; otherwise, if the target virtual account B does not agree with the target virtual account A to perform the operation, the terminal device can reject the target virtual account A's request to subscribe to the fund.

[0100] It should be noted that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0101] Reference Figure 4 , shows a schematic diagram of a monitoring device for operation behavior according to an embodiment of the present application, which may specifically include a determination module 401, an acquisition module 402, a generation module 403, and a monitoring module 404, wherein:

[0102] The determination module 401 is used to determine a target virtual account associated with the entity account when receiving login information of the entity account; wherein the entity account is associated with multiple virtual accounts, the target virtual account is the virtual account performing the current login operation, and the target virtual account is configured with corresponding risk control information;

[0103] An acquisition module 402 is used to acquire account information of the target virtual account, wherein the account information includes a current access mode of the target virtual account;

[0104] A generating module 403, configured to generate an operation interface matching the target virtual account according to the access method;

[0105] The monitoring module 404 is used to monitor the operation behavior of the target virtual account in the operation interface according to the risk control information.

[0106] like Figure 5 As shown, a schematic diagram of a virtual account configuration device according to an embodiment of the present application is shown. Multiple virtual accounts can be configured by calling the following modules:

[0107] A determination module 501 is used to determine multiple operating users bound to the entity account;

[0108] An allocation module 502, configured to allocate a number of virtual accounts equal to the number of the plurality of operating users to the entity account;

[0109] The acquisition module 503 is used to acquire at least one access method that each operating user can use, and the user authority of each operating user when using the at least one access method respectively;

[0110] The association module 504 associates the virtual account with the at least one access method and the user authority when using the at least one access method.

[0111] In an embodiment of the present application, the determination module 401 can be specifically used to: display a verification interface of the virtual account, the verification interface is used to receive verification information of the virtual account, the verification information includes a user account of the virtual account; after receiving the verification information, verify the verification information; if the verification information is verified, determine the target virtual account based on the user account.

[0112] In the embodiment of the present application, the generation module 403 can be specifically used to: determine the user authority of the target virtual account when using the access method; and configure a matching operation interface for the target virtual account according to the user authority.

[0113] In the embodiment of the present application, the generation module 403 can also be used to: call one or more business modules corresponding to the user authority; configure the one or more business modules to obtain an operation interface matching the target virtual account.

[0114] In an embodiment of the present application, the monitoring module 404 can be specifically used to: monitor whether the operating behavior of the target virtual account in the operating interface meets the requirements of the risk control information; if the operating behavior meets the requirements of the risk control information, execute the action corresponding to the operating behavior, and synchronously update the account information of the physical account and other virtual accounts according to the operating behavior; if the operating behavior does not meet the requirements of the risk control information, terminate the response to the operating behavior, and generate risk operation statistical information based on the operating behavior.

[0115] In an embodiment of the present application, the target virtual account includes a first target virtual account and a second target virtual account, the first target virtual account and the second target virtual account are virtual accounts that are online at the same time, the first target virtual account and the second target virtual account both have the authority to perform the target operation behavior, the authority of the first target virtual account to perform the target operation behavior is lower than the authority of the second target virtual account to perform the target operation behavior, and the monitoring device for the operation behavior may also include:

[0116] The approval module is used to feed back information about the first target virtual account executing the target operation behavior to the terminal used by the second target virtual account when monitoring the first target virtual account executing the target operation behavior, so as to request the second target virtual account to approve the target operation behavior.

[0117] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiment part.

[0118] Reference Figure 6 , shows a schematic diagram of a terminal device according to an embodiment of the present application. Figure 6 As shown, the terminal device 600 of this embodiment includes: a processor 610, a memory 620, and a computer program 621 stored in the memory 620 and executable on the processor 610. When the processor 610 executes the computer program 621, the steps of each embodiment of the monitoring method of the above-mentioned operation behavior are implemented, for example Figure 1 Alternatively, when the processor 610 executes the computer program 621, the functions of each module / unit in the above-mentioned device embodiments are realized, for example Figure 4 Functions of modules 401 to 404 are shown.

[0119] Exemplarily, the computer program 621 may be divided into one or more modules / units, which are stored in the memory 620 and executed by the processor 610 to complete the present application. The one or more modules / units may be a series of computer program instruction segments capable of completing specific functions, which may be used to describe the execution process of the computer program 621 in the terminal device 600. For example, the computer program 621 may be divided into a determination module, an acquisition module, a generation module, and a monitoring module, and the specific functions of each module are as follows:

[0120] A determination module, configured to determine a target virtual account associated with the entity account upon receiving login information of the entity account; wherein the entity account is associated with a plurality of virtual accounts, the target virtual account is a virtual account for performing a current login operation, and the target virtual account is configured with corresponding risk control information;

[0121] An acquisition module, configured to acquire account information of the target virtual account, wherein the account information includes a current access mode of the target virtual account;

[0122] A generating module, used to generate an operation interface matching the target virtual account according to the access method;

[0123] A monitoring module is used to monitor the operation behavior of the target virtual account in the operation interface according to the risk control information.

[0124] The terminal device 600 may be a terminal device in the aforementioned embodiments, and the terminal device may be a computing device such as a desktop computer, a cloud terminal device, etc. The terminal device 600 may include, but is not limited to, a processor 610 and a memory 620. Those skilled in the art will appreciate that Figure 6 It is only an example of the terminal device 600 and does not constitute a limitation of the terminal device 600. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the terminal device 600 may also include input and output devices, network access devices, buses, etc.

[0125] The processor 610 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0126] The memory 620 may be an internal storage unit of the terminal device 600, such as a hard disk or memory of the terminal device 600. The memory 620 may also be an external storage device of the terminal device 600, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the terminal device 600. Further, the memory 620 may also include both an internal storage unit of the terminal device 600 and an external storage device. The memory 620 is used to store the computer program 621 and other programs and data required by the terminal device 600. The memory 620 may also be used to temporarily store data that has been output or is to be output.

[0127] An embodiment of the present application also discloses a terminal device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method for monitoring the operating behavior as described in the aforementioned embodiments is implemented.

[0128] The embodiments of the present application further disclose a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method for monitoring the operating behavior as described in the aforementioned embodiments is implemented.

[0129] The embodiment of the present application further discloses a computer program product. When the computer program product is executed on a terminal device, the terminal device executes the monitoring method of the operation behavior described in the above-mentioned embodiments.

[0130] The above-described embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application is described in detail with reference to the above-mentioned embodiments, a person skilled in the art should understand that the technical solutions described in the above-mentioned embodiments can still be modified, or some of the technical features can be replaced by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application.

Claims

1. A method for monitoring operation behavior, characterized in that: The method comprises: When receiving login information of an entity account, determining a target virtual account associated with the entity account; wherein the entity account is associated with multiple virtual accounts, the target virtual account is a virtual account that performs a current login operation, and the target virtual account is configured with corresponding risk control information; Acquire account information of the target virtual account, wherein the account information includes a current access method of the target virtual account; According to the access method, generating an operation interface matching the target virtual account; Monitoring the operation behavior of the target virtual account in the operation interface according to the risk control information; Wherein, determining the target virtual account associated with the physical account includes: Displaying a verification interface to determine the target virtual account by secondary verification, the verification interface being used to receive verification information of the target virtual account, the verification information including a user account number of the target virtual account; After receiving the verification information, verifying the verification information; If the verification information is verified successfully, determining the target virtual account according to the user account; The number of the target virtual accounts includes multiple, the multiple target virtual accounts are virtual accounts that are online at the same time, the multiple target virtual accounts include at least a first target virtual account, and the first target virtual account has the authority to execute the target operation behavior, and the method further includes: When the first target virtual account is monitored to execute the target operation behavior, determining whether there is a second target virtual account among the multiple target virtual accounts currently online, wherein the second target virtual account is a virtual account with authority to execute the target operation behavior and the highest authority; If the second target virtual account exists, the information that the first target virtual account executes the target operation behavior is fed back to the terminal used by the second target virtual account to request the second target virtual account to approve the target operation behavior.

2. The method according to claim 1, characterized in that Before the step of determining the target virtual account associated with the entity account, the method further includes: Determining multiple operating users bound to the entity account; Allocating a number of virtual accounts equal to the number of the multiple operating users to the entity account; Acquire at least one access method available to each operating user, and user authority of each operating user when using the at least one access method respectively; The virtual account is associated with the at least one access method and user rights when using the at least one access method.

3. The method according to any one of claims 1 to 2, characterized in that: The step of generating an operation interface matching the target virtual account according to the access method includes: Determining user rights of the target virtual account when using the access method; According to the user authority, a matching operation interface is configured for the target virtual account.

4. The method according to claim 3, characterized in that: The configuring a matching operation interface for the target virtual account according to the user authority includes: Calling one or more business modules corresponding to the user authority; The one or more business modules are configured to obtain an operation interface matching the target virtual account.

5. The method according to any one of claims 1 to 2 or 4, characterized in that: The monitoring of the operation behavior of the target virtual account in the operation interface according to the risk control information includes: Monitoring whether the operation behavior of the target virtual account in the operation interface meets the requirements of the risk control information; If the operation behavior meets the requirements of the risk control information, the action corresponding to the operation behavior is executed, and the account information of the physical account and other virtual accounts are synchronously updated according to the operation behavior; If the operation behavior does not meet the requirements of the risk control information, the response to the operation behavior is terminated, and risk operation statistical information is generated according to the operation behavior.

6. A monitoring device for operating behavior, characterized in that: The device comprises: A determination module, configured to determine a target virtual account associated with the entity account upon receiving login information of the entity account; wherein the entity account is associated with a plurality of virtual accounts, the target virtual account is a virtual account for performing a current login operation, and the target virtual account is configured with corresponding risk control information; An acquisition module, configured to acquire account information of the target virtual account, wherein the account information includes a current access mode of the target virtual account; A generating module, used to generate an operation interface matching the target virtual account according to the access method; A monitoring module, used to monitor the operation behavior of the target virtual account in the operation interface according to the risk control information; The determination module is specifically used to: display a verification interface of a virtual account to determine the target virtual account by means of secondary verification, wherein the verification interface is used to receive verification information of the virtual account, wherein the verification information includes a user account number of the virtual account; after receiving the verification information, verify the verification information; if the verification information passes the verification, determine the target virtual account according to the user account number; The number of the target virtual accounts includes multiple, the multiple target virtual accounts are virtual accounts that are online at the same time, the multiple target virtual accounts include at least a first target virtual account, and the first target virtual account has the authority to execute the target operation behavior, and the device also includes: When the first target virtual account is monitored to execute the target operation behavior, determining whether there is a second target virtual account among the multiple target virtual accounts currently online, wherein the second target virtual account is a virtual account with authority to execute the target operation behavior and the highest authority; If the second target virtual account exists, the information that the first target virtual account executes the target operation behavior is fed back to the terminal used by the second target virtual account to request the second target virtual account to approve the target operation behavior.

7. A terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method for monitoring the operating behavior as described in any one of claims 1 to 5 is implemented.

8. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method for monitoring the operating behavior as described in any one of claims 1 to 5 is implemented.

Images