Access security control method, device, equipment and storage medium

Abstract

This disclosure provides an access security control method, apparatus, device, and storage medium, relating to the field of data mining technology. The method includes: acquiring user behavior data, the user behavior data including the Internet Protocol (IP) addresses used by multiple users when performing predetermined network access behaviors and the occurrence time of the predetermined network access behaviors; acquiring the predetermined behavior time; obtaining, based on the user behavior data, the number of times each of the multiple users performed the predetermined network access behavior using each IP address at the predetermined behavior time; determining, from the multiple users, a first user and a second user who performed the predetermined network access behavior using the same IP address at the predetermined behavior time; and obtaining a relationship credibility index based on the number of times the first user and the second user performed the predetermined network access behavior using the same IP address at the predetermined behavior time, thereby obtaining the relationship between the multiple users.

Description

Technical Field

[0001] The present disclosure relates to the field of data mining technology, and in particular to an access security control method, device, equipment and readable storage medium. Background Art

[0002] In recent years, with the rise of the Internet, the rapid development of e-commerce and Internet finance, there are more and more cases of profiteering through fraud and stealing user accounts through business loopholes of e-commerce enterprises. Some related technologies use data mining methods to train models based on existing risk data, and use the trained models for data analysis, which is difficult to achieve the effect of accurate identification and risk prevention. Other related technologies analyze from the perspective of social networks, establish connections from the perspective of "relationships", deeply mine risk characteristics, and conduct risk prevention and accurate identification by building relationship clusters. In addition, it is necessary to obtain the authorization and consent of the subject of personal information in advance before obtaining the corresponding data.

[0003] As mentioned above, how to accurately obtain user relationships becomes a problem that needs to be solved urgently.

[0004] The above information disclosed in this Background section is only for enhancement of understanding of the background of the present disclosure and therefore it may contain information that does not constitute the prior art that is already known to one of ordinary skill in the art. Summary of the invention

[0005] The purpose of the present disclosure is to provide an access security control method, apparatus, device and readable storage medium, which at least to some extent overcome the problem of low accuracy of data analysis through models.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0007] According to one aspect of the present disclosure, there is provided an access security control method, comprising: obtaining user behavior data, the user behavior data including Internet Protocol addresses used by multiple users when performing predetermined network access behaviors and the time at which the predetermined network access behaviors occur; obtaining the predetermined behavior time; obtaining, based on the user behavior data, the number of times the multiple users respectively use each Internet Protocol address to perform the predetermined network access behaviors at the predetermined behavior time; determining, from among the multiple users, a first user and a second user who use the same Internet Protocol address to perform the predetermined network access behaviors at the predetermined behavior time; obtaining a relationship credibility index based on the number of times the first user and the second user respectively use the same Internet Protocol address to perform the predetermined network access behaviors at the predetermined behavior time, so as to obtain the relationship between the multiple users.

[0008] According to one embodiment of the present disclosure, the scheduled behavior time includes a first scheduled behavior time and a second scheduled behavior time; determining the first user and the second user from the multiple users who use the same Internet Protocol address to perform the scheduled network access behavior at the scheduled behavior time includes: determining the first user and the second user from the multiple users who use the same Internet Protocol address to perform the scheduled network access behavior at the first scheduled behavior time.

[0009] According to an embodiment of the present disclosure, obtaining the relationship credibility index based on the number of times the first user and the second user respectively use the same Internet Protocol address to perform the scheduled network access behavior at the scheduled behavior time includes: obtaining the same Internet Protocol address used by the first user and the second user to perform the scheduled network access behavior at the first scheduled behavior time; obtaining the first behavior number of the first user and the second user using the same Internet Protocol address to perform the scheduled network access behavior at the first scheduled behavior time; obtaining the second behavior number of the first user and the second user using the same Internet Protocol address to perform the scheduled network access behavior at the second scheduled behavior time; obtaining a first weight coefficient for the first scheduled behavior time and a second weight coefficient for the second scheduled behavior time; and obtaining the relationship credibility index based on the first behavior number, the second behavior number, the first weight coefficient, and the second weight coefficient.

[0010] According to one embodiment of the present disclosure, the user behavior data also includes ports used by multiple users when performing predetermined network access behaviors; determining the first user and the second user from the multiple users who use the same Internet Protocol address to perform the predetermined network access behavior at the predetermined behavior time includes: determining the first user and the second user from the multiple users who use the same Internet Protocol address and the same port to perform the predetermined network access behavior at the predetermined behavior time.

[0011] According to an embodiment of the present disclosure, obtaining the number of times that the multiple users respectively use each Internet Protocol address to perform the predetermined network access behavior at the predetermined behavior time according to the user behavior data includes: obtaining the number of times that the multiple users respectively use each Internet Protocol address and each port to perform the predetermined network access behavior at the predetermined behavior time according to the user behavior data; obtaining the relationship credibility index according to the number of times that the first user and the second user respectively use the same Internet Protocol address to perform the predetermined network access behavior at the predetermined behavior time includes: obtaining the relationship credibility index according to the number of times that the first user and the second user respectively use the same Internet Protocol address and the same port to perform the predetermined network access behavior at the predetermined behavior time.

[0012] According to an embodiment of the present disclosure, the method further includes: based on a tracking program in the network business system, extracting data through a data warehouse system to obtain behavioral data of terminal users in the network business system.

[0013] According to an embodiment of the present disclosure, the method further includes: clearing the behavior data of the terminal user using a proxy Internet Protocol address and an invalid Internet Protocol address in the behavior data of the network business system to obtain the user behavior data.

[0014] According to another aspect of the present disclosure, an access security control device is provided, including: a behavior data acquisition module, used to acquire user behavior data, the user behavior data including Internet Protocol addresses used by multiple users when performing predetermined network access behaviors and the time at which the predetermined network access behaviors occur; a sliding window type acquisition module, used to acquire the predetermined behavior time; a data sliding window module, used to acquire, based on the user behavior data, the number of times the multiple users respectively use each Internet Protocol address to perform the predetermined network access behaviors at the predetermined behavior time; a relationship acquisition module, used to determine, from the multiple users, a first user and a second user who use the same Internet Protocol address to perform the predetermined network access behaviors at the predetermined behavior time; and a relationship credibility determination module, used to acquire a relationship credibility index based on the number of times the first user and the second user respectively use the same Internet Protocol address to perform the predetermined network access behaviors at the predetermined behavior time, so as to acquire the relationship between the multiple users.

[0015] According to one embodiment of the present disclosure, the predetermined behavior time includes a first predetermined behavior time and a second predetermined behavior time; the relationship acquisition module is also used to determine, from the multiple users, a first user and a second user who use the same Internet Protocol address to perform the predetermined network access behavior at the first predetermined behavior time.

[0016] According to an embodiment of the present disclosure, the relationship credibility determination module includes: an address list module, used to obtain the same Internet Protocol address used by the first user and the second user to perform the predetermined network access behavior at the first predetermined behavior time; a behavior frequency statistics module, used to obtain the first behavior frequency of the first user and the second user using the same Internet Protocol address to perform the predetermined network access behavior at the first predetermined behavior time; obtain the second behavior frequency of the first user and the second user using the same Internet Protocol address to perform the predetermined network access behavior at the second predetermined behavior time; a credibility index calculation module, used to obtain a first weight coefficient for the first predetermined behavior time and a second weight coefficient for the second predetermined behavior time; and obtain the relationship credibility index based on the first behavior frequency, the second behavior frequency, the first weight coefficient and the second weight coefficient.

[0017] According to one embodiment of the present disclosure, the user behavior data also includes the ports used by multiple users when performing predetermined network access behaviors; the relationship acquisition module is also used to determine, from the multiple users, the first user and the second user who used the same Internet Protocol address and the same port to perform the predetermined network access behavior at the predetermined behavior time.

[0018] According to an embodiment of the present disclosure, the data sliding window module is also used to obtain, based on the user behavior data, the number of times that the multiple users use each Internet Protocol address and each port to perform the predetermined network access behavior at the predetermined behavior time; the relationship credibility determination module is also used to obtain a relationship credibility index based on the number of times that the first user and the second user use the same Internet Protocol address and the same port to perform the predetermined network access behavior at the predetermined behavior time.

[0019] According to an embodiment of the present disclosure, the device further includes: a data extraction module for extracting data through a data warehouse system based on a tracking program in the network business system to obtain behavioral data of terminal users in the network business system.

[0020] According to an embodiment of the present disclosure, the device further includes: a data cleaning module for clearing the behavior data of the terminal user using a proxy Internet Protocol address and an invalid Internet Protocol address in the behavior data of the network business system to obtain the user behavior data.

[0021] According to another aspect of the present disclosure, a device is provided, comprising: a memory, a processor, and executable instructions stored in the memory and executable in the processor, wherein the processor implements any of the above methods when executing the executable instructions.

[0022] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which computer-executable instructions are stored, and when the executable instructions are executed by a processor, any of the above methods is implemented.

[0023] The access security control method provided by the embodiments of the present disclosure determines, from multiple users, a first user and a second user who use the same Internet Protocol address to perform a predetermined network access behavior at a predetermined behavior time, and obtains a relationship credibility index based on the number of times the first user and the second user respectively use the same Internet Protocol address to perform the predetermined network access behavior at the predetermined behavior time, so as to obtain the relationship between the multiple users, thereby achieving risk defense and accurate identification.

[0024] It is to be understood that the foregoing general description and the following detailed description are exemplary only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The above and other objects, features and advantages of the present disclosure will become more apparent by describing in detail example embodiments thereof with reference to the attached drawings.

[0026] Figure 1 A schematic diagram showing a system structure in an embodiment of the present disclosure.

[0027] Figure 2A A flow chart of an access security control method in an embodiment of the present disclosure is shown.

[0028] Figure 2B The diagram is a user relationship network diagram according to an exemplary embodiment.

[0029] Figure 3 The figure is a flow chart of a method for obtaining user behavior data according to an exemplary embodiment.

[0030] Figure 4 A flow chart showing another access security control method in an embodiment of the present disclosure.

[0031] Figure 5 A flowchart of another access security control method in an embodiment of the present disclosure is shown.

[0032] Figure 6 A schematic diagram of a process for establishing a user relationship network according to an exemplary embodiment is shown.

[0033] Figure 7 A block diagram of an access security control device in an embodiment of the present disclosure is shown.

[0034] Figure 8 A block diagram of another access security control device in an embodiment of the present disclosure is shown.

[0035] Fig. 9 A schematic structural diagram of an electronic device in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0036] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the disclosure will be more comprehensive and complete and will fully convey the concepts of the example embodiments to those skilled in the art. The accompanying drawings are only schematic illustrations of the disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and thus their repeated description will be omitted.

[0037] In addition, the described features, structures or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced while omitting one or more of the specific details, or other methods, devices, steps, etc. may be adopted. In other cases, well-known structures, methods, devices, implementations or operations are not shown or described in detail to avoid obscuring various aspects of the present disclosure.

[0038] In addition, the terms "first", "second", etc. are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the present disclosure, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined. The symbol " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0039] In this disclosure, unless otherwise clearly specified and limited, terms such as "connection" should be understood in a broad sense, for example, it can be an electrical connection or can communicate with each other; it can be directly connected or indirectly connected through an intermediate medium. For ordinary technicians in this field, the specific meanings of the above terms in this disclosure can be understood according to specific circumstances.

[0040] As mentioned above, the relationship networks constructed in the relevant technologies are based on devices, mobile phone numbers, ID cards, bank cards and other information to establish side relationships, connect various information nodes to form a super-large relationship network, and provide the ability to analyze and mine from the perspective of "relationships". However, due to information leakage and other reasons, the risk network constructed by information nodes such as devices, mobile phone numbers, and ID cards cannot locate real criminal individuals or gangs, so it is impossible to provide comprehensive research clues and accurate identification effects for combating cybercrime.

[0041] In addition, before collecting personal information, the personal information subject should be clearly informed of the types of personal information collected for different business functions of the products or services provided, as well as the rules for collecting and using personal information (such as the purpose of collecting and using personal information, collection method and frequency, storage location, storage period, its own data security capabilities, and relevant circumstances of external sharing, transfer, and public disclosure, etc.), and the authorization and consent of the personal information subject should be obtained.

[0042] Therefore, the present disclosure provides an access security control method, which determines a first user and a second user from multiple users who use the same Internet Protocol address to perform a predetermined network access behavior at a predetermined behavior time, and obtains a relationship credibility index according to the number of times the first user and the second user respectively use the same Internet Protocol address to perform the predetermined network access behavior at the predetermined behavior time, so as to obtain the relationship between multiple users, thereby achieving risk defense and accurate identification.

[0043] Figure 1 An exemplary system architecture 10 to which the access security control method or access security control device of the present disclosure can be applied is shown.

[0044] like Figure 1 As shown, the system architecture 10 may include a terminal device 102, a network 104, and a server 106. The terminal device 102 may be any electronic device having a display screen and supporting input and output, including but not limited to a smart phone, a tablet computer, a laptop computer, a desktop computer, a wearable device, a virtual reality device, a smart home, and the like. For example, a buyer user may log in to an e-commerce website through the terminal device 102. For another example, a supplier user may log in to a supplier website through the terminal device 102. The network 104 is a medium for providing a communication link between the terminal device 102 and the server 106. The network 104 may include various connection types, such as wired, wireless communication links, or optical fiber cables, and the like. The server 106 may be a server or server cluster that provides various services, such as a processing server, a database server, and the like.

[0045] The terminal device 102 can interact with the server 106 through the network 104 to receive or send data, etc. For example, when a user registers, places an order, or registers on the terminal device 102, the tracking program set on the processing server 106 can obtain the user's behavior data through the network 104, and the processing server 106 analyzes the behavior data and sends the behavior data to the database server 106 for storage.

[0046] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to the implementation requirements.

[0047] Figure 2A FIG. 1 is a flow chart of an access security control method according to an exemplary embodiment. Figure 2A The method shown can be applied to the server side of the above system, for example, and can also be applied to the terminal device of the above system.

[0048] refer to Figure 2A , the method 20 provided in the embodiment of the present disclosure may include the following steps.

[0049] In step S202, user behavior data is obtained, and the user behavior data includes the Internet Protocol addresses used by multiple users when performing predetermined network access behaviors and the time when the predetermined network access behaviors occur. Users may include buyer users, merchant users, supplier users, etc. Buyer users mainly include C (Consumer, Client, consumers, individual users, etc.) end and B (Business, enterprises, etc.) end users, etc. Merchant users may include Platform Open Plan (Platform Open Plan, POP) merchants, logistics merchants and financial merchants, etc. Supplier users mainly include self-operated suppliers, procurement suppliers and factory direct suppliers, etc. User behavior data can be obtained in the form of a detailed table, and the detailed table header format may be, for example, as shown in the following table:

[0050]

[0051] When computers in a network communicate with each other, an identification number must be assigned to each computer. This identification number is used to specify the computer that receives or sends data. In the TCP (Transmission Control Protocol) / IP (Internet Protocol) protocol, the IP address is this identification number, and the IP address can uniquely identify a computer. You can connect to a specified computer through an IP address, but if you want to access an application in the target computer, you also need to specify a port number. In the computer, different applications are distinguished by port numbers. A user can use a computer located in the network to access another computer in the network through an IP address, and access an application in the target computer through a port number to log in to a website, place an order, ship goods, etc. The specific implementation method of the access security control method considering port factors can be referred to. Figure 5 .

[0052] In some embodiments, for example, the original data may be extracted and cleaned to obtain a detailed list of user behavior data. For specific implementations, please refer to Figure 3 .

[0053] In step S204, the predetermined behavior time is obtained. The predetermined behavior time is the frequency of occurrence of IPs that have the predetermined network access behavior within a certain period of time. The predetermined behavior time can be, for example, one hour, 24 hours, 3 days, 7 days, etc.

[0054] In step S206, the number of times that a plurality of users respectively use each Internet Protocol address to perform a predetermined network access behavior at a predetermined behavior time is obtained based on the user behavior data.

[0055] In some embodiments, for example, data sliding window statistics can be performed based on the above behavior details table. The sliding window statistics mechanism is to obtain the corresponding time window according to the current time and update the various statistical indicators in the event window. For example, the number of IPs that have a predetermined network access behavior on the same day can be counted based on the user behavior details table. The edge model header format that can be obtained is as follows:

[0056]

[0057] The data sliding window type is the scheduled behavior time, and H represents 1 hour, that is, within the current hour.

[0058] In step S208, the first user and the second user who use the same Internet Protocol address to perform the predetermined network access behavior at the predetermined behavior time are determined from multiple users. For the same IP address within the predetermined behavior time, the first user of the source computer that performs the predetermined network access behavior and the second user of the target computer can be regarded as two parties of a relationship, and the relationship can be "pulled" from multiple users to obtain user pairs of each IP address that performs the predetermined network access behavior within the predetermined time.

[0059] In step S210, a relationship credibility index is obtained based on the number of times the first user and the second user respectively use the same Internet Protocol address to perform a predetermined network access behavior at the predetermined behavior time, so as to obtain the relationship between the multiple users. The credibility of the relationship between the first user and the second user can be measured based on the number of times the predetermined network access behavior occurs using the same IP address at the predetermined behavior time, and the more times, the more credible it can be. The relationship credibility list of user pairs of each IP address can be displayed, for example, the model sample data can be as follows:

[0060]

[0061] Then, a relationship network is established for user pairs whose credibility is higher than a preset threshold. For example, the preset threshold can be 0.75, 0.81, 0.85, etc. A relationship network can be established based on the network IP through suppliers, merchants, and user edges to build connections, and finally generate 9 types of relationship network structures: supplier to merchant, supplier to user, merchant to user, merchant to supplier, user to merchant, user to supplier, supplier to supplier, merchant to merchant, and user to user. A relationship network is a graph-based data structure consisting of nodes and edges. Each node represents an individual, and each edge is a relationship between individuals. Figure 2B A user relationship network diagram is shown. Figure 2B As shown in the figure, users (buyers), merchants and suppliers are connected through IP addresses. This relationship network model can be applied to the internal investigation system-relationship graph module to provide relationship clues for internal compliance investigations of enterprises, and can also assist external judicial authorities in pushing clues involved in the case.

[0062] In some embodiments, the number of times a predetermined network access behavior occurs using the same IP address at multiple predetermined behavior times can be obtained respectively, and then a weight is assigned to each predetermined behavior time to calculate the relationship credibility index. For a specific implementation method, refer to Figure 4 .

[0063] According to the access security control method provided by the embodiment of the present disclosure, a first user and a second user who use the same Internet Protocol address to perform a predetermined network access behavior at a predetermined behavior time are determined from multiple users, and a relationship credibility index is obtained according to the number of times the first user and the second user respectively use the same Internet Protocol address to perform the predetermined network access behavior at the predetermined behavior time, so as to obtain the relationship between the multiple users, thereby achieving risk defense and accurate identification, and making up for the shortcomings of the existing relationship network.

[0064] Figure 3 FIG. 1 is a flow chart of a method for obtaining user behavior data according to an exemplary embodiment. Figure 3 The method shown can be applied to the server side of the above system, for example, and can also be applied to the terminal device of the above system.

[0065] refer to Figure 3 , the method 30 provided in the embodiment of the present disclosure may include the following steps.

[0066] In step S302, based on the tracking program in the network business system, data is extracted through the data warehouse system to obtain the behavioral data of the terminal user in the network business system. Tracking can be performed through the omni-channel system. The omni-channel may include applications (Application, APP), personal computers (Personal Computer, PC), mobile web pages (mobile, M), WeChat, mobile QQ, etc. The IP of the terminal user is recorded in the log, and the tracking program writes to the database after recording the data on the front end. The database where the tracking data is written is the production library. The JD BUFFALO system can be used to periodically extract the data of the production library to the data warehouse for use by data analysts. The process of data extraction is to directly connect to the production library, periodically read the production library data, and then write the data to the data warehouse. Network IP data tracking can be performed based on certain rules. The corresponding list of rules and users can be shown as follows:

[0067]

[0068] Among them, the supplier tracking data acquisition can be based on the tracking programs of various supplier systems (mainly including BIP (Buyer Integrated Platform), procurement and other systems), and the data can be extracted through the JD data warehouse system (BUFFALO) and landed in the supplier tracking log table; the merchant tracking data acquisition can be based on the merchant systems (merchant login client (main) end, ECLP (Electronic Commerce Logistics Platform) merchant platform, etc.) tracking programs, and the data can be extracted through the JD data warehouse buffalo system and landed in the merchant tracking log table; the user tracking data acquisition is based on the user's commonly used related systems (mall APP, PC, financial APP, etc.) tracking programs, and the data can be extracted through the JD data warehouse buffalo system and landed in the user tracking log table.

[0069] In step S304, the behavior data of the terminal user using the proxy Internet Protocol address and the invalid Internet Protocol address in the behavior data of the network business system are cleared to obtain the user behavior data. Data extraction can be performed first from the data obtained from the buried point. For example, the supplier behavior data extraction can establish a supplier behavior IP table, including account, IP, port, behavior creation time, behavior type (such as settlement, login, order, etc.); merchant behavior data extraction can establish a merchant behavior IP table, including account, IP, port, behavior creation time, behavior type (such as settlement, login, order, etc.); user behavior data extraction: establish a user behavior IP table, including account, IP, port, behavior creation time, behavior type (such as registration, login, order, etc.). Based on the above cleaned supplier behavior data, merchant behavior data, and user behavior data, through the IP proxy identification pool (mainly including ordinary anonymous, deceptive anonymous, and high anonymous proxy types) and invalid IP pool provided by security attack and defense, a behavior detail table is established, including account, IP, port, creation time, behavior type, and user type (supplier, merchant, user).

[0070] According to the user behavior data acquisition method provided by the embodiment of the present disclosure, the behavioral IP data of suppliers, merchants and buyers is obtained from the user behavior data obtained from all-channel embedding points, and the proxy IP and invalid IP are cleaned, so as to obtain valid user behavior IP data.

[0071] Figure 4 FIG. 1 is a flow chart of another access security control method according to an exemplary embodiment. Figure 4 The method shown can be applied to the above-mentioned server side, for example, and can also be applied to the terminal device of the above-mentioned system.

[0072] refer to Figure 4 , the method 40 provided in the embodiment of the present disclosure may include the following steps.

[0073] In step S402, user behavior data is obtained, and the user behavior data includes the Internet protocol addresses used by multiple users when performing predetermined network access behaviors and the occurrence time of the predetermined network access behaviors. The specific implementation method can refer to step S202, which will not be repeated here.

[0074] In step S404, the first predetermined behavior time and the second predetermined behavior time are obtained. Multiple predetermined behavior times can be set to count the behavior IP frequency, for example, one hour, 24 hours, 3 days, 7 days, etc.

[0075] In step S406, the number of times that multiple users use each Internet Protocol address to perform a predetermined network access behavior at the first predetermined behavior time and the second predetermined behavior time is obtained based on the user behavior data. Data sliding window statistics can be performed based on the above behavior details table, for example, the user behavior details table counts the number of times the behavior IP appears on the same day, the user behavior details table counts the number of times the behavior IP appears within 3 days, the user behavior details table counts the number of times the behavior IP appears within 7 days, and the user behavior details table counts the number of times the behavior IP appears within the same hour.

[0076] In step S408, a first user and a second user who use the same Internet protocol address to perform a predetermined network access behavior at the first predetermined behavior time are determined from multiple users. The specific implementation method can refer to step S208, which will not be repeated here.

[0077] In step S410, the same Internet Protocol address used by the first user and the second user to perform a predetermined network access behavior at a first predetermined behavior time is obtained.

[0078] In step S412, a first behavior number of the first user and the second user performing a predetermined network access behavior using the same Internet Protocol address at a first predetermined behavior time is obtained.

[0079] In step S414, a second behavior number of the first user and the second user performing a predetermined network access behavior using the same Internet Protocol address at a second predetermined behavior time is obtained.

[0080] In step S416, a first weight coefficient of the first scheduled behavior time and a second weight coefficient of the second scheduled behavior time are obtained.

[0081] In step S418, a relationship credibility index is obtained according to the first behavior number, the second behavior number, the first weight coefficient, and the second weight coefficient.

[0082] In some embodiments, for example, based on the edge model indicators, the relationship credibility is calculated, and the credibility is represented by Fr. The number of times the behavior IP is used on the same day is represented by OT1, the number of times the behavior IP is used within 3 days is represented by OT2, the number of times the behavior IP is used within 7 days is represented by OT3, and the number of times the behavior IP is used within the same hour is represented by OH. The calculation of Fr can be as follows:

[0083]

[0084] Where α, β, θ, and σ are the weight coefficients corresponding to the number of times the IP is used in the same hour, day, 3 days, and 7 days, respectively, and the value range is (0,10).

[0085] In step S420, the same Internet protocol addresses used by the first user and the second user for the predetermined network access behavior at the first predetermined time are arranged according to the relationship credibility index to establish a user relationship network. Then, a relationship network is established for user pairs whose credibility is higher than a preset threshold. The relationship network can be established based on the network IP through the supplier, merchant, and user edge. The specific implementation method can refer to step S210 and will not be repeated here.

[0086] According to the access security control method provided by the embodiment of the present disclosure, a first user and a second user who use the same Internet Protocol address to perform a predetermined network access behavior at a predetermined behavior time are determined from multiple users, and a relationship credibility index is obtained according to the number of times the first user and the second user use the same Internet Protocol address to perform the predetermined network access behavior at multiple predetermined behavior times, respectively, to obtain the relationship between the multiple users, thereby further improving the accuracy of the user relationship network.

[0087] Figure 5 FIG. 1 is a flow chart of another access security control method according to an exemplary embodiment. Figure 5 The method shown can be applied to the server side of the above system, for example, and can also be applied to the terminal device of the above system.

[0088] refer to Figure 5 , the method 50 provided in the embodiment of the present disclosure may include the following steps.

[0089] In step S502, user behavior data is obtained, and the user behavior data includes the ports of the Internet protocol addresses used by multiple users when performing predetermined network access behaviors, and the occurrence time of the predetermined network access behaviors. The specific implementation method can refer to step S202, which will not be repeated here.

[0090] In step S504, the scheduled behavior time is obtained. The specific implementation can refer to step S204 and step S404, which will not be described in detail here.

[0091] In step S506, the number of times that multiple users use each Internet Protocol address and each port to perform a predetermined network access behavior at a predetermined behavior time is obtained based on the user behavior data. Each user can access multiple applications corresponding to different port numbers through one IP address, and the behavior data of different applications can be listed separately, and the number of times the predetermined network access behavior occurs at the predetermined behavior time can be counted separately.

[0092] In step S508, a first user and a second user who use the same Internet Protocol address and the same port to perform a predetermined network access behavior at a predetermined behavior time are determined from multiple users. This can be refined to obtain a user pair that uses the same IP address to access the same application program when pulling relationships.

[0093] In step S510, the relationship credibility index is obtained according to the number of times the first user and the second user respectively use the same Internet Protocol address and the same port to perform the predetermined network access behavior at the predetermined behavior time, so as to obtain the relationship between the multiple users. After the relationship connection is refined to include the port, the model sample data can be as follows:

[0094]

[0095] According to the access security control method provided by the embodiment of the present disclosure, a first user and a second user who use the same Internet Protocol address and the same port to perform a predetermined network access behavior at a predetermined behavior time are determined from multiple users, and a relationship credibility index is obtained according to the number of times the first user and the second user use the same Internet Protocol address and the same port to perform the predetermined network access behavior at multiple predetermined behavior times, respectively, to obtain the relationship between the multiple users, thereby further improving the accuracy of the user relationship network.

[0096] Figure 6 FIG. 1 is a schematic diagram showing a process of establishing a user relationship network according to an exemplary embodiment. Figure 6 As shown, firstly, the tracking point is carried out through the omni-channel 6002 (APP, PC, M, WeChat, mobile QQ) and other systems (S602), and the IP record of the terminal user (S604) is recorded in the corresponding supplier, merchant, and user log table 6004; then the behavior data is extracted from each tracking point log table 6004 for cleaning (S606), firstly, the proxy IP is cleaned through the IP proxy identification pool provided by the security attack and defense (mainly including ordinary anonymous, deceptive anonymous, and highly anonymous proxy types) (S6062), and then the invalid IP is cleaned through the invalid IP pool provided by the security attack and defense (S6064), and a behavior detail table 6006 is established; then, based on the behavior detail table 6006, data sliding window statistics are performed (S6082), and an edge model 6008 is constructed (S608); finally, based on the edge model 6008, the relationship credibility is calculated (S6102), and a relationship network is established through the supplier, merchant, and user edges based on the network IP (S6104).

[0097] Figure 7 FIG. 1 is a block diagram of an access security control device according to an exemplary embodiment. Figure 7 The access security control device shown can be applied to the server side of the above system, for example, and can also be applied to the terminal device of the above system.

[0098] refer to Figure 7The device 70 provided in the embodiment of the present disclosure may include a behavior data acquisition module 702 , a sliding window type acquisition module 704 , a data sliding window module 706 , a relationship acquisition module 708 and a relationship credibility determination module 710 .

[0099] The behavior data acquisition module 702 may be used to acquire user behavior data, where the user behavior data includes Internet protocol addresses used by multiple users when performing predetermined network access behaviors and the occurrence time of the predetermined network access behaviors.

[0100] The sliding window type acquisition module 704 may be used to acquire a predetermined behavior time.

[0101] The data sliding window module 706 may be used to obtain, based on the user behavior data, the number of times that a plurality of users respectively use each Internet Protocol address to perform a predetermined network access behavior at a predetermined behavior time.

[0102] The relationship obtaining module 708 may be used to determine, from a plurality of users, a first user and a second user who perform a predetermined network access behavior using the same Internet Protocol address at a predetermined behavior time.

[0103] The relationship credibility determination module 710 may be used to obtain a relationship credibility index according to the number of times the first user and the second user respectively use the same Internet Protocol address to perform a predetermined network access behavior at a predetermined behavior time, so as to obtain the relationship between the multiple users.

[0104] Figure 8 FIG. 1 is a block diagram of another access security control device according to an exemplary embodiment. Figure 8 The access security control device shown can be applied to the server side of the above system, for example, and can also be applied to the terminal device of the above system.

[0105] refer to Figure 8 The device 80 provided in the embodiment of the present disclosure may include a data extraction module 8012, a data cleaning module 8014, a behavior data acquisition module 802, a sliding window type acquisition module 804, a data sliding window module 806, a relationship acquisition module 808 and a relationship credibility determination module 810, wherein the relationship credibility determination module includes: an address list module 8102, a behavior frequency statistics module 8104 and a credibility index calculation module 8106.

[0106] The data extraction module 8012 can be used to extract data based on the tracking program in the network business system through the data warehouse system to obtain the behavior data of the terminal users in the network business system.

[0107] The data cleaning module 8014 can be used to clear the behavior data of the terminal user in the network business system using the proxy Internet Protocol address and the invalid Internet Protocol address to obtain the user behavior data.

[0108] The behavior data acquisition module 802 can be used to acquire user behavior data, which includes Internet protocol addresses used when multiple users perform predetermined network access behaviors, ports used when multiple users perform predetermined network access behaviors, and the occurrence time of the predetermined network access behaviors.

[0109] The sliding window type acquisition module 804 may be used to acquire a predetermined behavior time, which includes a first predetermined behavior time and a second predetermined behavior time.

[0110] The data sliding window module 806 may be used to obtain, based on the user behavior data, the number of times that a plurality of users respectively use each Internet Protocol address to perform a predetermined network access behavior at a predetermined behavior time.

[0111] The data sliding window module 806 may also be used to obtain, based on the user behavior data, the number of times that a plurality of users respectively use each Internet Protocol address and each port to perform a predetermined network access behavior at a predetermined behavior time.

[0112] The relationship obtaining module 808 may be used to determine, from a plurality of users, a first user and a second user who perform a predetermined network access behavior using the same Internet Protocol address at a predetermined behavior time.

[0113] The relationship obtaining module 808 can also be used to determine, from a plurality of users, a first user and a second user who use the same Internet Protocol address to perform a predetermined network access behavior at a first predetermined behavior time.

[0114] The relationship acquisition module 808 can also be used to determine, from a plurality of users, a first user and a second user who perform a predetermined network access behavior using the same Internet Protocol address and the same port at a predetermined behavior time.

[0115] The relationship credibility determination module 810 may be used to obtain a relationship credibility index according to the number of times the first user and the second user respectively use the same Internet Protocol address to perform a predetermined network access behavior at a predetermined behavior time, so as to obtain the relationship between the multiple users.

[0116] The relationship credibility determination module 810 may also be used to obtain a relationship credibility index according to the number of times the first user and the second user respectively perform a predetermined network access behavior using the same Internet Protocol address and the same port at a predetermined behavior time.

[0117] The address list module 8102 can be used to obtain the same Internet Protocol address used by the first user and the second user to perform a predetermined network access behavior at the first predetermined behavior time.

[0118] The behavior frequency statistics module 8104 can be used to obtain the first behavior frequency of the first user and the second user using the same Internet Protocol address to perform a predetermined network access behavior at the first predetermined behavior time; and obtain the second behavior frequency of the first user and the second user using the same Internet Protocol address to perform a predetermined network access behavior at the second predetermined behavior time.

[0119] The credibility index calculation module 8106 can be used to obtain the first weight coefficient of the first scheduled behavior time and the second weight coefficient of the second scheduled behavior time; obtain the relationship credibility index according to the first behavior number, the second behavior number, the first weight coefficient and the second weight coefficient.

[0120] The specific implementation of each module in the device provided by the embodiment of the present disclosure can refer to the content of the above method, which will not be repeated here.

[0121] Fig. 9 FIG. 1 is a schematic diagram showing the structure of an electronic device in an embodiment of the present disclosure. It should be noted that: Fig. 9 The device shown is only an example of a computer system, which should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0122] like Fig. 9 As shown, the device 900 includes a central processing unit (CPU) 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage part 908 into a random access memory (RAM) 903. In the RAM 903, various programs and data required for the operation of the device 900 are also stored. The CPU 901, the ROM 902, and the RAM 903 are connected to each other via a bus 904. An input / output (I / O) interface 905 is also connected to the bus 904.

[0123] The following components are connected to the I / O interface 905: an input section 906 including a keyboard, a mouse, etc.; an output section 907 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 908 including a hard disk, etc.; and a communication section 909 including a network interface card such as a LAN card, a modem, etc. The communication section 909 performs communication processing via a network such as the Internet. A drive 99 is also connected to the I / O interface 905 as needed. A removable medium 911, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 99 as needed, so that a computer program read therefrom is installed into the storage section 908 as needed.

[0124] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication part 909, and / or installed from a removable medium 911. When the computer program is executed by a central processing unit (CPU) 901, the above-mentioned functions defined in the system of the present disclosure are executed.

[0125] It should be noted that the computer-readable medium shown in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0126] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0127] The modules involved in the embodiments described in the present disclosure may be implemented by software or hardware. The modules described may also be set in a processor, for example, it may be described as: a processor includes a behavior data acquisition module, a sliding window type acquisition module, a data sliding window module, a relationship acquisition module, and a relationship credibility determination module. The names of these modules do not constitute a limitation on the modules themselves in some cases. For example, the behavior data acquisition module may also be described as a "module for acquiring cleaned user behavior data."

[0128] As another aspect, the present disclosure also provides a computer-readable medium, which may be included in the device described in the above embodiment; or it may exist independently and not be assembled into the device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by a device, the device includes: obtaining user behavior data, the user behavior data includes the Internet Protocol addresses used by multiple users when performing predetermined network access behaviors and the occurrence time of the predetermined network access behaviors; obtaining the predetermined behavior time; obtaining the number of times multiple users use each Internet Protocol address to perform predetermined network access behaviors at the predetermined behavior time according to the user behavior data; determining the first user and the second user who use the same Internet Protocol address to perform predetermined network access behaviors at the predetermined behavior time from multiple users; obtaining the relationship credibility index according to the number of times the first user and the second user use the same Internet Protocol address to perform predetermined network access behaviors at the predetermined behavior time, so as to obtain the relationship between the multiple users.

[0129] The exemplary embodiments of the present disclosure are specifically shown and described above. It should be understood that the present disclosure is not limited to the detailed structures, configurations or implementations described herein; on the contrary, the present disclosure is intended to cover various modifications and equivalent configurations included in the spirit and scope of the appended claims.

Claims

1. An access security control method, characterized in that: include: Acquiring user behavior data, the user behavior data including Internet protocol addresses used by multiple users when performing predetermined network access behaviors and the time when the predetermined network access behaviors occurred; Get the scheduled behavior time; Obtaining, according to the user behavior data, the number of times the plurality of users respectively use each Internet Protocol address to perform the predetermined network access behavior at the predetermined behavior time; Determine, from among the plurality of users, a first user and a second user who uses the same Internet Protocol address to perform the predetermined network access behavior at the predetermined behavior time; A relationship credibility index is obtained according to the number of times the first user and the second user respectively perform the predetermined network access behavior using the same Internet Protocol address at the predetermined behavior time, so as to establish a relationship network using user pairs among the multiple users whose relationship credibility index is higher than a preset threshold, wherein the more times the predetermined network access behavior occurs, the higher the relationship credibility index of the first user and the second user is.

2. The method according to claim 1, characterized in that: The predetermined behavior time includes a first predetermined behavior time and a second predetermined behavior time; The step of determining, from the plurality of users, a first user and a second user who use the same Internet Protocol address to perform the predetermined network access behavior at the predetermined behavior time comprises: A first user and a second user who use the same Internet Protocol address to perform the predetermined network access behavior at the first predetermined behavior time are determined from the multiple users.

3. The method according to claim 2, characterized in that The obtaining of the relationship credibility index according to the number of times the first user and the second user respectively use the same Internet Protocol address to perform the predetermined network access behavior at the predetermined behavior time comprises: Acquire the same Internet Protocol address used by the first user and the second user to perform the predetermined network access behavior at the first predetermined behavior time; Obtaining a first behavior number of the first user and the second user performing the predetermined network access behavior using the same Internet Protocol address at the first predetermined behavior time; Obtaining a second number of times the first user and the second user perform the predetermined network access behavior using the same Internet Protocol address at the second predetermined behavior time; Obtaining a first weight coefficient of the first scheduled behavior time and a second weight coefficient of the second scheduled behavior time; The relationship credibility index is obtained according to the first behavior number, the second behavior number, the first weight coefficient, and the second weight coefficient.

4. The method according to claim 1, characterized in that: The user behavior data also includes ports used by multiple users when performing predetermined network access behaviors; The step of determining, from the plurality of users, a first user and a second user who use the same Internet Protocol address to perform the predetermined network access behavior at the predetermined behavior time comprises: A first user and a second user who use the same Internet Protocol address and the same port to perform the predetermined network access behavior at the predetermined behavior time are determined from the multiple users.

5. The method according to claim 4, characterized in that Obtaining, according to the user behavior data, the number of times that the plurality of users respectively use each Internet Protocol address to perform the predetermined network access behavior at the predetermined behavior time includes: Obtaining, based on the user behavior data, the number of times the plurality of users respectively use each Internet Protocol address and each port to perform the predetermined network access behavior at the predetermined behavior time; The obtaining of the relationship credibility index according to the number of times the first user and the second user respectively use the same Internet Protocol address to perform the predetermined network access behavior at the predetermined behavior time comprises: The relationship credibility index is obtained according to the number of times the first user and the second user respectively use the same Internet Protocol address and the same port to perform the predetermined network access behavior at the predetermined behavior time.

6. The method according to any one of claims 1 to 5, characterized in that Also includes: Based on the tracking program in the network business system, data is extracted through the data warehouse system to obtain the behavioral data of the terminal users in the network business system.

7. The method according to claim 6, characterized in that Also includes: The behavior data of the terminal user using a proxy Internet Protocol address and an invalid Internet Protocol address are cleared from the behavior data of the network business system to obtain the user behavior data.

8. An access security control device, characterized in that: include: A behavior data acquisition module, used to acquire user behavior data, wherein the user behavior data includes Internet protocol addresses used by multiple users when performing predetermined network access behaviors and the occurrence time of the predetermined network access behaviors; A sliding window type acquisition module is used to obtain the scheduled behavior time; A data sliding window module, used for obtaining, according to the user behavior data, the number of times that the plurality of users respectively use each Internet Protocol address to perform the predetermined network access behavior at the predetermined behavior time; A relationship obtaining module, used to determine, from the plurality of users, a first user and a second user who use the same Internet Protocol address to perform the predetermined network access behavior at the predetermined behavior time; A relationship credibility determination module is used to obtain a relationship credibility index based on the number of times the first user and the second user respectively perform the predetermined network access behavior using the same Internet Protocol address at the predetermined behavior time, so as to establish a relationship network using user pairs among the multiple users whose relationship credibility index is higher than a preset threshold, wherein the more times the predetermined network access behavior occurs, the higher the relationship credibility index of the first user and the second user.

9. A device comprising: A memory, a processor, and executable instructions stored in the memory and executable in the processor, wherein the processor implements the method according to any one of claims 1 to 7 when executing the executable instructions.

10. A computer-readable storage medium having computer-executable instructions stored thereon, characterized in that: When the executable instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images