A method and device for automatically analyzing abnormal account logins

Abstract

The embodiment of the present invention provides a method and device for automatically analyzing abnormal account logins. By correlating and analyzing the log information of multiple login verification systems, abnormal login behaviors that cannot be discovered by traditional account and password login authentication can be discovered, thereby reducing the risk of illegal users using the correct account and password to perform malicious logins.

Description

Technical Field

[0001] The present invention relates to the field of computer application technology, and in particular to a method and device for automatically analyzing abnormal account logins. Background Art

[0002] The existing technical solution for channel machine server account login is to determine the legitimacy of the user login by the correct correspondence between the user name and the password, and to enter the correct user name, password, and dynamic password as the basis for determining whether the account can log in normally. The existing server login authentication process is that the user logs in to the channel machine server (i.e. JumpServer) through SSH, the channel authentication machine service authenticates through the user name and password, and returns a QR code to the login terminal for confirmation. The server login uses the mobile office authentication system on the mobile phone to scan the QR code to confirm the login. If the scan authentication is successful, the terminal operation prompt for logging in to the server is returned. The existing technical solution does not have more re-confirmation mechanisms, and does not consider that even if the correct user name and password are used, there is still a risk of illegally obtaining user name account information and illegally entering the system under a false name.

[0003] In the process of implementing the present invention, the applicant discovered that there are at least the following problems in the prior art:

[0004] The user login verification process of the prior art still has the risk of illegal login to the system under a false name. Summary of the invention

[0005] The embodiment of the present invention provides a method and device for automatically analyzing abnormal account logins, which improves the existing user login verification process and reduces the risk of illegal users logging into the system under false names.

[0006] To achieve the above-mentioned purpose, on the one hand, an embodiment of the present invention provides a method for automatically analyzing abnormal account logins, comprising:

[0007] Collecting login verification logs of multiple login verification systems related to the login operation of the specified account; wherein the login verification systems communicate with each other and collaborate to complete the login operation;

[0008] Obtain at least one pre-specified sensitive indicator information of each login verification log record;

[0009] Performing a security threat assessment on the at least one sensitive indicator information to obtain at least one assessment score;

[0010] All evaluation points are weighted and accumulated to obtain the total evaluation points;

[0011] If the total evaluation score and the specified score threshold satisfy a specified size relationship, the login operation of the specified account is determined to be an abnormal login.

[0012] On the other hand, an embodiment of the present invention provides an automatic analysis device for abnormal account logins, comprising:

[0013] A log collection unit, used to collect login verification logs of multiple login verification systems related to the login operation of a specified account; wherein the login verification systems communicate with each other to collaboratively complete the login operation;

[0014] A sensitive indicator acquisition unit, used to acquire at least one pre-specified sensitive indicator information of each login verification log record;

[0015] An evaluation score acquisition unit, used to perform security threat evaluation on the at least one sensitive indicator information to obtain at least one evaluation score;

[0016] A total score acquisition unit is used to perform weighted accumulation of each evaluation score to obtain a total evaluation score;

[0017] The abnormality determination unit is used to determine the login operation of the specified account as an abnormal login if the total evaluation score and the specified score threshold satisfy a specified size relationship.

[0018] The above technical solution has the following beneficial effects: the embodiment of the present invention can discover abnormal login behaviors that cannot be discovered by traditional account and password login authentication by associating and analyzing the log information of multiple login verification systems, thereby reducing the risk of illegal users using the correct account and password to log in maliciously. Furthermore, the technical solution of the present invention can obtain more device information, threat intelligence information, and geographic location information while using the user password to confirm whether the user's identity is normal, and can associate other dimensions of log data to obtain more device information, threat intelligence information, and geographic location information. The fingerprint information of user operations such as relevant data and historical data in the user's historical login process can confirm the legitimacy of the user's login in more dimensions in addition to the password information. Ensure the security of user account assets. Specifically, the technical solution of the present invention associates the client IP of the user connecting to the channel machine system, the corresponding geographic location information, the mobile device IP address location information when the mobile device logs in for the second confirmation, the user's mobile device ID history information, the user's login password collision behavior information, the IP threat intelligence library information, and the face recognition information. The correlation analysis results in abnormal logins of impersonated accounts, abnormal logins with dangerous database collisions, abnormal logins with dangerous IP addresses, abnormal logins with unfamiliar devices, and abnormal logins in different cities, and evaluation and scoring are performed. If the score data is greater than the pre-set threshold, the face recognition mechanism is activated to perform unique identity identification. Through the abnormal characteristics of various related data when the user logs in abnormally, the problem when the account login is abnormal is analyzed. And based on the abnormal results, it is decided whether to reconfirm the face information recognition process. Through the above mechanism, the security of user account login is guaranteed. Once a potential account abnormal login occurs, the identity is confirmed, and the user and security operation personnel are notified immediately. Through relevant personnel, a rapid response and security emergency response are carried out, which also has the significance of deepening and strengthening the protection of key accounts. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 This is a flow chart of a method for automatically analyzing abnormal account logins according to one embodiment of the present invention;

[0021] Figure 2 This is an architecture diagram of an automatic analysis device for abnormal account logins according to one embodiment of the present invention;

[0022] Figure 3 Another workflow diagram of the method for automatically analyzing abnormal account logins according to one embodiment of the present invention;

[0023] Figure 4 The present invention is a system structure diagram of an automatic analysis device for abnormal login of an application account according to one embodiment of the present invention. DETAILED DESCRIPTION

[0024] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0025] The inventor analyzed the prior art and found that the prior art usually performs dynamic password authentication and scanning QR code login authentication when the user logs in; but when only dynamic code authentication is performed, no matter what method is used, as long as the illegal user obtains the normal user's mobile phone, the mobile device can be used to complete the dynamic authentication; when only QR code authentication is performed, similarly, after the mobile phone authentication device and static password are obtained by the illegal user, the login authentication push can be received and the authentication can be performed; the inventor found that if the login user's geographical location is abnormal, the login IP is abnormal, and the login device is abnormal, and the associated threat intelligence information is analyzed, the risk of device IDs of the same organization but different owners accessing the same account, sharing an account, and logging in under a false name is analyzed, the login operation of illegal users can be effectively discovered, and the probability of illegal users logging into the system can be significantly reduced or the attempt time for illegal users to successfully log in can be significantly extended. Further, when it is determined to be an abnormal login, the login authentication linked to face recognition is performed, and the authentication process of reconfirmation is performed, which can further avoid illegal login to user accounts.

[0026] There is a lack of facial recognition authentication. Facial recognition information is an authentication credential that is more difficult to steal. There is no related authentication analysis or login authentication protection measures to confirm again.

[0027] There is a lack of records of device management information and historical login information of logged-in users. There is no abnormal analysis and determination process for all devices of the same organization and the same person, and no inspection mechanism for logins by other user IDs and false identities.

[0028] On the one hand, if Figure 1 As shown, an embodiment of the present invention provides a method for automatically analyzing abnormal account logins, including:

[0029] Step S100, collecting login verification logs of multiple login verification systems related to the login operation of the specified account; wherein the login verification systems communicate with each other and collaborate to complete the login operation;

[0030] Step S101, obtaining at least one pre-specified sensitive indicator information of each login verification log record;

[0031] Step S102, performing a security threat assessment on the at least one sensitive indicator information to obtain at least one assessment score;

[0032] Step S103, weighted accumulation of all evaluation scores to obtain a total evaluation score;

[0033] Step S104: If the total evaluation score and the specified score threshold satisfy a specified size relationship, the login operation of the specified account is determined to be an abnormal login.

[0034] In some embodiments, when a designated account performs a login operation, the login operation is completed through mutual communication and collaboration of each login verification system, and log information related to the login operation is generated in the login verification logs of multiple login verification systems; for example, the login verification system includes but is not limited to the channel machine system, the user login authentication system, and the mobile office authentication system. The user first logs in to the channel machine system through SSH. After the user logs in, the channel machine system will send an authentication request to the user login authentication system. The user login authentication system can perform user authentication in two ways. The first is that the user login authentication system requires the user to enter the account number, password, and dynamic verification code of the designated account on the client in the channel machine system used by the user through the channel machine system. The second is that the user login authentication system will return a verification QR code to the channel machine system, and the channel machine system will display the verification QR code on the client of the channel machine system used by the user. The user needs to log in to the mobile client in the mobile office authentication system by entering the account number and password of the designated account, and use the mobile client to scan the verification QR code. After scanning, the mobile office authentication system will send the designated account number and password to the user login authentication system for verification. The designated account can only be successfully logged in after each system confirms success. In this process, the login operation of the user's login designated account generates relevant login verification log information in the respective logs of the channel system, user login authentication system, and mobile office authentication system. The login verification log record represents the log related to the login operation in the log of each system. Relevant information can be collected through a variety of common log information collection components, and at least one pre-specified sensitive indicator information can be extracted from the corresponding login verification log of each login verification system, and the relevant sensitive indicator information can be stored using a variety of common databases; for example, Graylog is an open source log aggregation, analysis, audit, display and early warning tool; Rsyslog is a log management tool; each login verification system can use the Graylog log center to create a UDP protocol network monitoring service, and forward the logs generated by each login verification system to the log center through the Rsyslog service program. After the log center receives the log data, it formats the log data and saves the formatted log data to a database such as the ElasticSearch centralized database. The determination of sensitive indicator information can be determined by statistically analyzing the historical operation of the login verification system to determine the relevant indicators that are sensitive to abnormal login judgments. The extracted sensitive indicator information can be formatted information and can be saved in a database. When conducting security threat assessment on sensitive indicator information, a suitable specific security threat assessment method can be selected according to the characteristics of the sensitive indicator information, and after the security threat assessment, a corresponding evaluation score can be obtained. The specific value of the evaluation score can be set according to the closeness between the relevant sensitive indicator information and the abnormal login through preliminary analysis of historical data.Preferably, security threat evaluation is performed on the at least one sensitive indicator information, and corresponding threat information can also be obtained, and the threat information corresponds to the evaluation score one by one. The threat information is used to clearly indicate the detailed information of the threat quantified by the evaluation score, and the threat information is also used to be sent to the designated alarm receiving terminal, such as the administrator's mailbox, etc.; the administrator can analyze the specific circumstances of the abnormal login according to the threat information and make further processing. The weighted cumulative sum of all the evaluation scores obtained is calculated according to the pre-specified weights for each evaluation score to obtain the total evaluation score, and the total evaluation score is compared with the specified score threshold to see whether they meet the specified size relationship. If the total evaluation score and the specified score threshold meet the specified size relationship, the login operation of the specified account is determined to be an abnormal login. The weight of each evaluation score can be pre-specified or calculated by methods including but not limited to the coefficient of variation method. The designated score threshold can be statistically analyzed based on historical data to obtain a reasonable value for a specific project; the designated size relationship can be determined based on the specific definition of the evaluation score in the specific project. For example, in some embodiments, the higher the evaluation score, the greater the threat. In this case, the designated size relationship can be defined as the total evaluation score being greater than or equal to the designated score threshold; in other embodiments, the lower the evaluation score, the greater the threat. In this case, the designated size relationship can be defined as the total evaluation score being less than or equal to the designated score threshold. Taking the channel machine system, the user login authentication system and the mobile office authentication system as examples, the channel machine system log information, the user authentication login system log information and the mobile office authentication system log information are aggregated by the above method, and the key fields (i.e., sensitive indicator information) in the log data are compared and correlated with other related data to identify the data features of the log, thereby judging whether the user's login behavior is malicious, whether the account is stolen, blasted, and other situations. Further, if a related threat phenomenon occurs, the face recognition confirmation mechanism of the mobile office system can be awakened, and the security operation and maintenance personnel can be notified. The illegal login behavior of the designated account can be warned of the threat and handled in a timely manner. The above examples are not intended to limit the technical solution of the present invention. The specific systems and relationships included in the login verification system need to be determined based on specific needs or actual projects.

[0035] The embodiment of the present invention has the following technical effects: when a user performs a login operation to log in to a specified account, corresponding log information will be generated on each of the one or more login verification systems. Sensitive indicator information is extracted from the log information of each system and the obtained sensitive indicator information is analyzed. The individual security threat evaluation of any login verification system and any sensitive indicator is combined with the joint security threat evaluation of multiple login verification systems and multiple sensitive indicator information. The obtained evaluation points are further accumulated and summed up through weighted calculation to obtain the total evaluation points. Whether the login operation is abnormal is determined based on the total evaluation points, thereby realizing correlation analysis of the log information of the login operation process, and significantly reducing the probability of successful login by illegal users.

[0036] Furthermore, the performing of security threat assessment on the at least one sensitive indicator information to obtain at least one assessment score includes:

[0037] An independent security threat evaluation is performed on each sensitive indicator information to obtain an evaluation score corresponding to the sensitive indicator information.

[0038] In some embodiments, the sensitive indicator information recorded in the login verification log from each login verification system is independently evaluated for security threats, that is, the relationship between each sensitive indicator information is not considered. For example, sensitive indicator information includes but is not limited to client IP address, login time, login location, client device ID such as MAC address, etc., and the sensitive indicator information is judged whether there is an abnormality based on the normal value range or abnormal value range corresponding to each sensitive indicator information. For example, the client IP address can be matched with a pre-created IP threat intelligence library. If the client IP address is in the IP threat intelligence library, it is considered that the login operation using the client IP is abnormal; for another example, if some accounts have a habitual login time interval, if the login time is found not in the habitual login time interval, the login operation corresponding to the login time is considered abnormal. A specific security threat evaluation method can be formulated based on the role of specific sensitive indicator information in the login operation and possible abnormal performance.

[0039] Furthermore, the performing of security threat assessment on the at least one sensitive indicator information to obtain at least one assessment score includes:

[0040] Perform security threat evaluation on the associated sensitive indicator combination to obtain the evaluation score corresponding to the associated sensitive indicator combination;

[0041] The associated sensitive indicator combination includes: part or all of the pre-selected sensitive indicator information in the at least one sensitive indicator information.

[0042] In some embodiments, security threat assessment is performed based on the relationship between relevant sensitive indicator information from a login verification system or the relationship between relevant sensitive indicator information from different login verification systems to obtain corresponding assessment points.

[0043] The embodiments of the present invention have the following technical effects: it realizes the joint correlation analysis of multiple sensitive indicator information, and the multiple sensitive indicators can partially or completely come from the same login verification system or from different types of login verification systems, so as to achieve a more comprehensive analysis of abnormal login situations, reduce the omission of abnormal logins and the misjudgment of normal logins, and better prevent illegal users from logging into accounts.

[0044] Furthermore, after determining the login operation of the designated account as an abnormal login, the method further includes:

[0045] Perform secondary verification through a specified verification method; if the result of the secondary verification is normal, login is allowed; if the result of the secondary verification is abnormal, login is not allowed.

[0046] In some embodiments, after determining that a login operation for a designated account is an abnormal login, in order to further avoid the situation where a normal user is unable to log in to the designated account due to misjudgment, the user may be required to perform an additional more stringent secondary verification, such as face verification. If the secondary verification passes, the user is allowed to log in to the designated account normally, otherwise, the user is not allowed to log in to the designated account. Furthermore, after determining that a login operation for a designated account is an abnormal login, or after the secondary verification result is abnormal, threat information and evaluation points corresponding to each threat information may be sent to a designated alarm receiving terminal for management personnel to further analyze and process the abnormal login.

[0047] The embodiment of the present invention has the following technical effects: after automatically determining that a login operation is an abnormal login, secondary verification is allowed to avoid normal users being unable to log into their accounts due to misjudgment, thereby maintaining a good user experience while ensuring login security.

[0048] Further, the login verification system includes: a channel machine system; the at least one sensitive indicator information includes: an IP address of a channel machine client used in the login operation;

[0049] The independent security threat evaluation is performed on each sensitive indicator information to obtain the evaluation score corresponding to the sensitive indicator information, including:

[0050] Compare the IP address of the channel machine client used in the login operation recorded in the login verification log of the channel machine system with each IP address in the IP threat intelligence library;

[0051] If the IP address of the channel machine client used in the login operation matches an IP address in the IP threat intelligence library, setting the value of the first evaluation score corresponding to the IP address of the channel machine client used in the login operation to the specified first score value;

[0052] Wherein, the IP threat intelligence library includes: at least one threat IP address collected in advance.

[0053] In some embodiments, when a user uses an SSH (Secure Shell) client program to log in to the SSH service port of a channel machine server in a channel machine system, user login information will be generated in the log. This information includes but is not limited to the network IP of the client host (i.e., the channel machine client IP address), user name, timestamp, and other information when the user logs in to the channel machine server; through Graylog and Rsyslog service programs, the log data generated by the user logging in to the channel machine SSH service is forwarded to the log data receiving monitoring service created by the log center. After receiving the log data, the log center service program shapes the log data, formats the log data in a unified manner, and then saves it to the ElasticSearch cluster database; for example, when a user logs in to the channel machine system, the relevant information of the channel machine client IP address used by the user for the login operation of the specified account is removed from the login verification log and formatted to include the following fields: user IP, user name, success or failure flag, and timestamp, wherein the user IP here is the channel machine client IP address; when writing to the ElasticSearch database, the following fields are included: index name , user IP, user name, success / failure flag and timestamp; wherein the index name refers to the table index name of ElasticSearch, which is equivalent to the table name in MYSQL; based on the record information of the channel machine client IP address used for the login operation generated by the user logging into the channel machine server through SSH, that is, the IP of the user device login in the channel machine system log, that is, the user IP obtained in the log of the aforementioned channel machine system, that is, the channel machine client IP address and the IP address field in the IP threat intelligence library are queried and compared in a dictionary manner. If it is found that the channel machine client IP address clearly has a record of the relevant threat name, and / or threat type and / or threat level in the IP threat intelligence library, the obtained threat information and the channel machine client IP address related information are saved in the following field format: user IP, user name, threat name and / or threat type and / or threat level and security score value, wherein the security score value here is the value of the first evaluation score, and is set to the specified first score. The size of the first score can be set by pre-analyzing historical data according to the closeness of relevant sensitive indicator information and abnormal login. Here, the threat information includes the threat name, and / or threat type, and / or threat level, which can be used as job email content data to notify security operation and maintenance personnel.

[0054] The embodiments of the present invention have the following technical effects: the IP threat intelligence library is a collection of threat IPs provided by an open source third party; comparing the IP address of the channel machine client with the threat IP in the IP threat intelligence library can quickly verify whether there is any abnormality in the login operation.

[0055] Further, the login verification system includes: a mobile office authentication system; the at least one sensitive indicator information includes: a mobile client device ID used for the login operation;

[0056] The independent security threat evaluation is performed on each sensitive indicator information to obtain the evaluation score corresponding to the sensitive indicator information, including:

[0057] Obtaining the mobile client device ID used for the login operation recorded in the login verification log of the mobile office authentication system;

[0058] Obtaining all historical mobile client device IDs that have been used by the designated account and recorded in the login verification log of the mobile office authentication system;

[0059] If the mobile client device ID used for the login operation does not exist in all historical mobile client device IDs used by the designated account, the value of the second evaluation score corresponding to the mobile client device ID used for the login operation is set to the designated second score value.

[0060] In some embodiments, the mobile office authentication system user information is the log data generated when the user logs into the mobile office system on the mobile phone in association with the user authentication system. The log center creates a log data receiving monitoring service, and the log output software module in the mobile office system service program on the mobile phone is responsible for sending Syslog log data to the log center, which receives the data and formats and organizes it uniformly, and then saves the organized log data to the database. When the user uses the channel machine server as a springboard to log in to the real intranet server, he needs to perform a second confirmation authentication login or QR code scanning on the mobile office system to complete the login process of the channel machine server. In the process of interacting with the mobile office system, the user will generate log data. The mobile office authentication system will send the log information of the user login confirmation to the log receiving monitoring service of the log center in the Syslog log format. The log format includes the following fields: mobile device ID, user name, mobile device IP, login confirmation success or failure flag and timestamp, where the mobile device ID is the mobile client device ID; the formatted log information is written into the ElasticSearch database index table for storage, forming the following information log including fields: index name, mobile device ID, user name, mobile device IP, login confirmation success or failure flag and timestamp, etc., where the index name refers to the table index name of ElasticSearch, which is equivalent to the table name in MYSQL. Based on the username of the current user, that is, the designated account, the mobile office authentication system log information is searched to determine whether the mobile client device ID corresponding to the current login operation of the designated account exists in all historical mobile client device IDs corresponding to the designated account. If the mobile client device ID used in the current login operation does not exist in all historical mobile client device IDs, it means that the current login operation uses a new device. In this case, threat information of login from an unfamiliar device is generated, and the value of the second evaluation score is set to the designated second score value.

[0061] The embodiments of the present invention have the following technical effects: when a user logs into an account, he usually uses the same mobile device. When it is found that the user logs in using an unfamiliar device, there may be an abnormal login. The abnormal situation is quantified by setting a second evaluation score, so that the situation of logging in with an unfamiliar device can be combined with other situations through the total evaluation score to evaluate whether the login operation is abnormal, thereby achieving a more comprehensive and accurate analysis effect.

[0062] Further, the login verification system includes: a mobile office authentication system; the at least one sensitive indicator information includes: a mobile client device ID used for the login operation;

[0063] The independent security threat evaluation is performed on each sensitive indicator information to obtain the evaluation score corresponding to the sensitive indicator information, including:

[0064] Obtaining the mobile client device ID used for the login operation recorded in the login verification log of the mobile office authentication system;

[0065] Obtain all historical mobile client device IDs used by all accounts recorded in the login verification log of the mobile office authentication system;

[0066] Searching for the mobile client device ID used for the login operation among all historical mobile client device IDs used by all accounts;

[0067] If a mobile client device ID identical to the mobile client device ID used in the login operation is found, and the account corresponding to the identical mobile client device ID is not the designated account, setting the value of the third evaluation score corresponding to the mobile client device ID used in the login operation to the designated third score value;

[0068] In some embodiments, the mobile office authentication system user information is the log data generated when the user logs into the mobile office system on the mobile phone in association with the user authentication system. The log center creates a log data receiving monitoring service, and the log output software module in the mobile office system service program on the mobile phone is responsible for sending Syslog log data to the log center, which receives the data and formats and organizes it uniformly, and then saves the organized log data to the database. When the user logs in to the real intranet server through the channel machine server as a springboard, he needs to perform a second confirmation authentication login or QR code scanning on the mobile office system to complete the login process of the channel machine server. In the process of interacting with the mobile office system, the user will generate log data. The mobile office authentication system will send the log information of the user login confirmation to the log receiving monitoring service of the log center through the Syslog log format. The log format includes the following fields: mobile device ID, user name, mobile device IP, login confirmation success and failure flag and timestamp, where the mobile device ID is the mobile client device ID; the formatted log information is written into the ElasticSearch database index table for storage, forming the following information log, including the following fields: index name, mobile device ID, user name, mobile device IP, login confirmation success and failure flag and timestamp, where the index name refers to the table index name of ElasticSearch, which is equivalent to the table name in MYSQL. Based on the current user name, the mobile device ID of the specified account is compared with the mobile device ID of all accounts to find out whether there is a situation where the device of other accounts logs in to the specified account, that is, to determine whether someone uses their own device to log in to the account of other employees. When this situation is discovered, a record containing the following fields is generated: mobile device IP, user name, impersonated account login, and security score value, where the user name is the designated account, the impersonated account login is the threat information corresponding to the third evaluation score, and the security score value here is the third evaluation score, which is set to the designated third score value.

[0069] The embodiments of the present invention have the following technical effects: the embodiments of the present invention can determine whether other devices are used to impersonate and log in to a specified account, and establish a third evaluation score to determine whether it is an abnormal login in combination with other sensitive indicators, thereby ensuring the comprehensiveness and accuracy of the determination.

[0070] Furthermore, the login verification system includes: a user login authentication system; the at least one sensitive indicator information includes: the number of login authentication failures and the login authentication password;

[0071] The security threat evaluation of the associated sensitive indicator combination is performed to obtain the evaluation score corresponding to the associated sensitive indicator combination, including:

[0072] Obtaining a login authentication record corresponding to the client IP address used in the login operation recorded in the login verification log of the user login authentication system within the first specified time range;

[0073] Obtaining all login authentication passwords and the number of login authentication failures recorded in the login authentication record when the login authentication fails;

[0074] If the number of login authentication failures is greater than or equal to the specified login number threshold, each login authentication password is compared with the passwords in the specified weak password library;

[0075] If the ratio of login authentication passwords that successfully match the passwords in the specified weak password library to all login authentication passwords is greater than or equal to the specified weak password ratio, the value of the fourth evaluation score corresponding to the associated sensitive indicator combination consisting of the number of failed login authentication times and the login authentication password is set to the specified fourth score value.

[0076] In some embodiments, user authentication login information is collected in the form of RSyslog logs. The relevant IP information, user name information, login timestamp, and other log information of the user logging into the user authentication system through the channel machine server are collected. A Syslog log monitoring service is created on the log center to receive the Syslog log data of the user login sent by the channel machine. The log is formatted uniformly through the data format arrangement program of the log center and saved in the database. Graylog log center creates a UDP protocol network monitoring service. The authentication system forwards the Syslog login log information generated when the user logs in to the user authentication system through the channel machine to the log receiving monitoring service created by the log center. After receiving the log data, the log center service program shapes the log data, formats the log data uniformly, and then saves it to the ElasticSearch cluster database. The formatted log includes the following fields: client IP, user name, password, success and failure flags, and timestamp. Among them, the client IP is the IP address of the client used by the user to perform the login operation in the log record of the user login authentication system when the user performs the login operation. For example, when the user enters the designated account, corresponding password and dynamic verification code of the user login authentication system through the channel machine system, the client IP is the channel machine client IP address used by the designated account login operation in the channel machine system; when the mobile client in the mobile office authentication system scans the code or enters the designated account and password, the client IP is the IP address of the mobile client currently used for the login operation of the designated account in the mobile office system. The formatted log data is written into the index table of the ElasticSearch database and saved to form the following information log, which contains the following fields: index name, client IP, user name, login authentication password, success and failure flag, and timestamp, where the user name is the specified account, the login authentication password is the password entered when logging in to the specified account, and the index name refers to the table index name of ElasticSearch, which is equivalent to the table name in MYSQL.Query the records in the database according to the first specified time range. Specifically, the length of the first specified time range can be set as needed. For example, the user login authentication system information can be queried according to a period of 1 minute. The number of record entries generated in the user login authentication system log by the client IP used for the current login operation. If the success or failure flag indicates that the number of login failures, that is, the number of login authentication failures, is greater than the specified login number threshold, then the login password used by the current client IP, that is, the login authentication password, is compared with the weak password password library in a many-to-many manner. If it is found that the account corresponding to the current client IP is trying to log in with a weak password, that is, if the ratio of the login authentication passwords that successfully match the passwords in the specified weak password password library to all the login authentication passwords is greater than or equal to the specified weak password ratio, then data including the following fields is generated: client IP, user name, weak password blasting and security score value, wherein the weak password blasting is the threat information generated for this security threat evaluation, the security score value is the value of the fourth evaluation score, which is set to the specified fourth score value, and the specified weak password ratio can be specified based on historical experience.

[0077] The embodiment of the present invention has the following technical effects: by analyzing the dynamic process of the user inputting the password and the dynamic changes of the specific composition of the password used for the failed login, the purpose of comprehensively and accurately determining whether there is an abnormality in the login operation is achieved.

[0078] Furthermore, the login verification system includes: a channel machine system and a mobile office authentication system; the at least one sensitive indicator information includes: a channel machine client IP address and a mobile client IP address used in the login operation;

[0079] The security threat evaluation of the associated sensitive indicator combination is performed to obtain the evaluation score corresponding to the associated sensitive indicator combination, including:

[0080] Obtain the IP address of the channel machine client used for the login operation recorded in the login verification log of the channel machine system;

[0081] Obtaining the mobile client IP address used in the login operation recorded in the login verification log of the mobile office authentication system;

[0082] Querying the IP geographical location information database to obtain the geographical location corresponding to the IP address of the channel machine client used for the login operation as the current channel machine client location of the login operation;

[0083] Querying an IP geographical location information database to obtain a geographical location corresponding to the mobile client IP address used in the login operation as the current mobile client location of the login operation;

[0084] Obtaining all historical channel machine client IP addresses recorded in the login verification log of the channel machine system that have been used by the designated account within a second designated time range before the login operation occurs;

[0085] Obtaining all historical mobile client IP addresses recorded in the login verification log of the mobile office authentication system that have been used by the designated account within a second designated time range before the login operation occurs;

[0086] Query the IP geographic location information database to obtain the geographic locations corresponding to the IP addresses of all historical channel machine clients to form a historical channel machine client location set;

[0087] Query the IP geographic location information database to obtain the geographic locations corresponding to all historical mobile client IP addresses as a historical mobile client location set;

[0088] If the current channel machine client location does not belong to the historical channel machine client location set, and the current mobile client location does not belong to the historical mobile client location set, the value of the fifth evaluation integral corresponding to the associated sensitive indicator combination consisting of the channel machine client IP address and the mobile client IP address used in the login operation is set to the specified fifth integral value.

[0089] In some embodiments, based on the channel machine client IP address recorded in the login verification log information of the channel machine system for the current login operation of the specified account and the mobile client IP address recorded in the login verification log information of the mobile office authentication system for the login operation, the country and city where the IP is located are determined according to the IP geographic location information database, that is, the corresponding geographic location information of the channel machine client IP address and the mobile client IP address are determined respectively; then the geographic location information corresponding to all historical channel machine client IP addresses and mobile client IP addresses that have been used by the specified account within a second specified time range, for example, within a specified N months, where N is a positive integer greater than or equal to 1, is queried, that is, the historical channel machine client location set and the historical mobile client location set; if If the current channel machine client location does not belong to the historical channel machine client location set, and the current mobile client location does not belong to the historical mobile client location set, then data containing the following fields is generated for the associated sensitive indicator group consisting of the channel machine client IP address and the mobile client IP address used for the login operation: user IP, user name, remote login, country, city and security score value; here the user IP includes the channel machine client IP address and / or the mobile client IP address, and the user IP here preferably records the channel machine client IP address, the user name is the designated account, the remote login, country and city are the threat information generated for this security threat assessment, and the security score value here is the value of the fifth evaluation score, which is set to the specified fifth score value.

[0090] The embodiment of the present invention has the following technical effects: comprehensively analyzing the mutual relationship between the sensitive indicator information of two associated login verification systems involved in the login operation, thereby obtaining the effect of comprehensively and accurately determining whether the login is abnormal.

[0091] On the other hand, Figure 2 As shown, an embodiment of the present invention provides an automatic analysis device for abnormal account login, comprising:

[0092] The log collection unit 200 is used to collect the login verification logs of multiple login verification systems related to the login operation of the specified account; wherein the login verification systems communicate with each other to collaboratively complete the login operation;

[0093] The sensitive indicator acquisition unit 201 is used to acquire at least one pre-specified sensitive indicator information of each login verification log record;

[0094] An evaluation score acquisition unit 202, configured to perform a security threat evaluation on the at least one sensitive indicator information to obtain at least one evaluation score;

[0095] A total score acquisition unit 203 is used to perform weighted accumulation of each evaluation score to obtain a total evaluation score;

[0096] The abnormality determination unit 204 is configured to determine the login operation of the specified account as an abnormal login if the total evaluation score and the specified score threshold satisfy a specified size relationship.

[0097] Furthermore, the evaluation score acquisition unit 202 includes:

[0098] The independent evaluation module is used to perform independent security threat evaluation on each sensitive indicator information and obtain the evaluation score corresponding to the sensitive indicator information.

[0099] Furthermore, the evaluation score acquisition unit 202 includes:

[0100] A joint evaluation module is used to evaluate the security threat of the associated sensitive indicator combination and obtain the evaluation score corresponding to the associated sensitive indicator combination;

[0101] The associated sensitive indicator combination includes: part or all of the pre-selected sensitive indicator information in the at least one sensitive indicator information.

[0102] Furthermore, the device further comprises:

[0103] The secondary verification unit is used to perform secondary verification through a specified verification method; if the result of the secondary verification is normal, login is allowed; if the result of the secondary verification is abnormal, login is not allowed.

[0104] Further, the login verification system includes: a channel machine system; the at least one sensitive indicator information includes: an IP address of a channel machine client used in the login operation;

[0105] The independent evaluation module comprises:

[0106] A channel machine client IP comparison module is used to compare the channel machine client IP address used in the login operation recorded in the login verification log of the channel machine system with each IP address in the IP threat intelligence library;

[0107] A first evaluation score acquisition module is used to set the value of the first evaluation score corresponding to the channel machine client IP address used in the login operation to a specified first score value if the channel machine client IP address used in the login operation matches an IP address in the IP threat intelligence library;

[0108] Wherein, the IP threat intelligence library includes: at least one threat IP address collected in advance.

[0109] Further, the login verification system includes: a mobile office authentication system; the at least one sensitive indicator information includes: a mobile client device ID used for the login operation;

[0110] The independent evaluation module comprises:

[0111] A first current mobile ID acquisition module, used to acquire the mobile client device ID used in the login operation recorded in the login verification log of the mobile office authentication system;

[0112] A historical mobile ID acquisition module, used to acquire all historical mobile client device IDs used by the designated account recorded in the login verification log of the mobile office authentication system;

[0113] The second evaluation score acquisition module is used to set the value of the second evaluation score corresponding to the mobile client device ID used in the login operation to the specified second score value if the mobile client device ID used in the login operation does not exist in all historical mobile client device IDs used by the specified account.

[0114] Further, the login verification system includes: a mobile office authentication system; the at least one sensitive indicator information includes: a mobile client device ID used for the login operation;

[0115] The independent evaluation module comprises:

[0116] A second current mobile ID acquisition module, used for obtaining the mobile client device ID used in the login operation recorded in the login verification log of the mobile office authentication system;

[0117] A module for acquiring all mobile IDs, used to acquire all historical mobile client device IDs used by all accounts recorded in the login verification log of the mobile office authentication system;

[0118] A mobile ID search module, used to search for the mobile client device ID used for the login operation among all historical mobile client device IDs used by all accounts;

[0119] A third score acquisition module is used to set the value of the third evaluation score corresponding to the mobile client device ID used in the login operation to the specified third score value if a mobile client device ID identical to the mobile client device ID used in the login operation is found and the account corresponding to the identical mobile client device ID is not the specified account;

[0120] Furthermore, the login verification system includes: a user login authentication system; the at least one sensitive indicator information includes: the number of login authentication failures and the login authentication password;

[0121] The joint evaluation module comprises:

[0122] A login authentication record acquisition module, used to acquire the login authentication record corresponding to the client IP address used in the login operation recorded in the login verification log of the user login authentication system within a first specified time range;

[0123] A login failure information acquisition module, used to acquire all login authentication passwords and login authentication failure times recorded in the login authentication record when the login authentication fails;

[0124] A password comparison module, for comparing each login authentication password with a password in a specified weak password library if the number of login authentication failures is greater than or equal to a specified login number threshold;

[0125] The fourth score acquisition module is used to set the value of the fourth evaluation score corresponding to the associated sensitive indicator combination consisting of the number of failed login authentication times and the login authentication password to the specified fourth score value if the ratio of the login authentication passwords that successfully match the passwords in the specified weak password library to all the login authentication passwords is greater than or equal to the specified weak password ratio.

[0126] Furthermore, the login verification system includes: a channel machine system and a mobile office authentication system; the at least one sensitive indicator information includes: a channel machine client IP address and a mobile client IP address used in the login operation;

[0127] The joint evaluation module comprises:

[0128] The current channel machine client IP acquisition module is used to obtain the channel machine client IP address used for the login operation recorded in the login verification log of the channel machine system;

[0129] A current mobile IP acquisition module, used to acquire the mobile client IP address used in the login operation recorded in the login verification log of the mobile office authentication system;

[0130] A current channel machine location acquisition module is used to query the IP geographical location information database to obtain the geographical location corresponding to the channel machine client IP address used in the login operation as the current channel machine client location of the login operation;

[0131] A current mobile location acquisition module, used to query an IP geographical location information database to acquire a geographical location corresponding to the mobile client IP address used in the login operation as the current mobile client location of the login operation;

[0132] A historical channel machine client IP acquisition module, used to acquire all historical channel machine client IP addresses recorded in the login verification log of the channel machine system that were used by the designated account within a second designated time range before the login operation occurred;

[0133] A historical mobile IP acquisition module, used to acquire all historical mobile client IP addresses used by the designated account within a second designated time range before the login operation occurs, which are recorded in the login verification log of the mobile office authentication system;

[0134] The historical channel machine client location acquisition module is used to query the IP geographic location information database to obtain the geographic locations corresponding to the IP addresses of all historical channel machine clients to form a historical channel machine client location set;

[0135] A historical mobile client location acquisition module is used to query the IP geographic location information database to obtain the geographic locations corresponding to all historical mobile client IP addresses as a historical mobile client location set;

[0136] The fifth points acquisition module is used to set the value of the fifth evaluation points corresponding to the associated sensitive indicator combination consisting of the channel machine client IP address and the mobile client IP address used in the login operation to a specified fifth points value if the current channel machine client position does not belong to the historical channel machine client position set and the current mobile client position does not belong to the historical mobile client position set.

[0137] The embodiment of the present invention provides the above-mentioned automatic analysis device for abnormal account logins, which corresponds one to one with the embodiment of the above-mentioned automatic analysis method for abnormal account logins. The embodiment of the above-mentioned automatic analysis device for abnormal account logins can be understood based on the embodiment of the above-mentioned automatic analysis method for abnormal account logins, and will not be repeated here.

[0138] The above technical solution of the embodiment of the present invention is described in detail below in conjunction with specific application examples. For technical details not introduced during the implementation process, please refer to the relevant description in the previous text.

[0139] like Figure 3 As shown, the embodiment of the present invention mainly includes four parts: channel machine system log information aggregation, user login authentication information aggregation, mobile office authentication system information aggregation, and account abnormal login correlation analysis. Login verification logs are collected through channel machine system log information aggregation, user login authentication information aggregation, and mobile office authentication system information aggregation. Interested sensitive indicator information is obtained through log formatting and extraction, and each sensitive indicator information is stored in a database. Abnormal login threat correlation analysis is automatic analysis of account abnormal login. During the analysis process, different sensitive indicator information is respectively associated with IP threat intelligence library information (i.e. Figure 3 Threat intelligence information in the IP geolocation information database (i.e. Figure 3 The IP geographic location information in the login is analyzed, and when it is determined to be an abnormal login, face recognition is triggered for secondary confirmation.

[0140] Figure 4 This is a system structure diagram of a device using an embodiment of the present invention. The working principle process can refer to the above Figure 3 Explanation understanding.

[0141] Channel machine system information log aggregation:

[0142] When a user uses the SSH client program to log in to the SSH service port of the channel machine server of the channel machine system, the corresponding user login information will be generated. This information includes the channel machine client IP address, user name (that is, specified account), timestamp (used to record the time when the login operation occurred) and other information when the user logs in to the channel machine server. This information generates corresponding Syslog logs on the channel machine server. We aggregate this type of log into the log data, which is the receiving service monitor. After receiving the data, it is saved in the database.

[0143] Channel machine system information acquisition:

[0144] Graylog Log Center creates a UDP protocol network monitoring service. The channel machine server forwards the log data generated when the user logs into the channel machine SSH service to the log data receiving monitoring service created by the log center through the Rsyslog service program. After receiving the log data, the log center service program organizes the log data, formats the log data uniformly, and then saves it to the ElasticSearch cluster database. The log format contains the following fields:

[0145] User IP, user name, success / failure flag, and timestamp; the user IP here refers to the IP address of the channel machine client, the user name refers to the specified account, the success / failure flag is used to record the login success or failure, and the timestamp is used to record the time when the login operation occurred.

[0146] Data storage:

[0147] The information obtained by the channel machine system is written into the ElasticSearch database index table for storage, forming the following information log. The split fields are as follows.

[0148] Index name, user IP, user name, success / failure flag, timestamp; the index name refers to the table index name of ElasticSearch, which is equivalent to the table name in MYSQL.

[0149] User authentication login information aggregation:

[0150] User authentication login information is collected in the form of RSyslog logs. The relevant IP information, user name information, login timestamp, and other log information of the user logging in to the user login authentication system through the channel machine server are collected. A Syslog log monitoring service is created on the log center to receive the Syslog log data of the user login sent by the channel machine. The log center's data formatting program is used to uniformly adjust the log format and save it in the database.

[0151] User login authentication information acquisition:

[0152] Graylog log center creates a UDP protocol network monitoring service. The authentication system forwards the Syslog login log information generated when the user logs in to the user authentication system through the channel machine to the log data receiving monitoring service created by the log center. After receiving the log data, the log center service program shapes the log data, formats the log data uniformly, and then saves it to the ElasticSearch cluster database. The log format is as follows:

[0153] User IP, user name, password, success / failure flag and timestamp; the user IP here refers to the IP address of the channel machine client; the user name refers to the specified account; the password here refers to the login authentication password when logging in to the specified account;

[0154] Data storage:

[0155] The information obtained from the user login authentication information is written into the ElasticSearch database index table for storage, forming the following information log. The split fields are as follows.

[0156] Index name, user IP, user name, password, success / failure flag and timestamp. Index name refers to the table index name of ElasticSearch, which is equivalent to the table name in MYSQL. User IP here refers to the IP address of the channel machine client. User name refers to the specified account. Password here refers to the login authentication password when logging in to the specified account.

[0157] Mobile office authentication system information aggregation:

[0158] The user information of the mobile office authentication system is the log data generated when the user logs into the mobile office system on the mobile phone and is associated with the user authentication system. The log center creates a log data receiving and monitoring service. The log output software module in the mobile office system service program on the mobile phone is responsible for sending Syslog log data to the log center. The log center receives the data and formats and organizes it uniformly. The organized log data is then saved in the database.

[0159] Mobile office authentication system information aggregation:

[0160] When users use the channel machine server as a springboard to log in to the real intranet server, they need to perform a second confirmation authentication login or QR code scanning on the mobile office system to complete the login process of the channel machine server. In the process of interaction between users and the mobile office system, log data will be generated. The mobile office authentication system will send the user login confirmation log information to the log receiving monitoring service of the log center in the Syslog log format. The log format is as follows: mobile device ID, user name, IP, login confirmation success or failure flag, timestamp;

[0161] Data storage:

[0162] The information aggregated from the mobile office authentication system is written into the index table of the ElasticSearch database for storage, forming the following information log. The split fields are as follows.

[0163] Index name, mobile device ID, user name, IP, login confirmation success or failure flag, timestamp; the index name refers to the table index name of ElasticSearch, which is equivalent to the table name in MYSQL.

[0164] User account abnormal login threat correlation analysis:

[0165] Aggregate the channel machine system log information, user authentication login system log information, and mobile office authentication system log information, compare and associate the key fields in the log data with other related data, and judge whether the user's login behavior contains malicious login attempts and non-user normal logins, whether the account is stolen or blasted, etc. through the data characteristics of the log. If relevant threats occur, wake up the face recognition confirmation mechanism of the mobile office system, notify the security operation and maintenance personnel, and store the illegal login behavior of the account, issue an alarm for the threat, and deal with it in a timely manner.

[0166] Based on the above principles, the channel machine system log information, user login authentication log information, mobile office authentication system log information, IP geographic location information, IP threat intelligence information, and weak password information are correlated and analyzed, involving the following correlation field information:

[0167] Channel machine system log information:

[0168] User IP, user name, success / failure flags and timestamp;

[0169] User login authentication log information:

[0170] User IP, username, password, success / failure flags and timestamp;

[0171] Mobile office authentication system log information:

[0172] Mobile device ID, user name, IP, login confirmation success or failure flag and timestamp;

[0173] IP geolocation information

[0174] IP, City and Country

[0175] IP Threat Intelligence Information

[0176] IP, threat name, and threat type;

[0177] Weak password library

[0178] Weak password 1, ..., weak password N;

[0179] The abnormal login threat correlation analysis system checks the user's abnormal login through the data query interface service REST provided by the log center Graylog, obtains each related log data, and then performs a correlation analysis of the login threat based on the key related fields in each related log data:

[0180] Step 1: Based on the user's login to the channel machine server through SSH at the time of login, the user IP of the user device in the channel machine system log, that is, the channel machine client IP address, is compared with the IP field in the IP threat intelligence library. If it is found that the IP of the client host that logs into the channel machine has a clear record of the threat name, threat type, and threat level in the threat intelligence library, these two pieces of information are temporarily saved in a temporary variable space for the final notification to the security operation and maintenance personnel as the content data of the email; and a new security score value variable is newly generated with an initial value of 0 points, and one point is accumulated in this variable, and the data containing the following fields is obtained:

[0181] User IP, user name, threat name, threat type, threat level and security score value;

[0182] Step 2: Use 1 minute as the period, i.e. the first specified time range, to query the user login authentication system information, the number of record entries generated by the current user IP, i.e. the client IP, in the user login authentication system log. If the value of the success failure flag generated by a failed login is greater than or equal to the specified number of logins, the login password used by the current user IP (after SSH login, log in to the user login authentication system by entering the user name, password, dynamic verification code, or log in to the mobile client through the mobile office mobile client by entering the user name and password. In both cases, the password will be sent to the user login authentication system) is compared with the weak password library in a many-to-many password comparison. If it is found that the specified account of the current user IP is trying to log in with a weak password, add a weak password cracking field to the record in the new temporary variable, and then add one point to the security score to generate a new temporary variable. The following are the fields included in the new temporary variable record: user IP, user name, weak password cracking, and security score;

[0183] Step 3: Based on the user IP of the user name logged in at the current time in the channel machine system log information and the user IP in the mobile office authentication system log information, query and locate them according to the country and city in the IP geographic location information database, and compare the user IP of the current user name with the geographic location corresponding to the user IP used to log in N months ago. It is a one-to-many relationship. Check the user IP corresponding to the client port host of the current user's SSH login and compare it with the geographic location of the current user's historical login. Compare the user IP corresponding to the user's mobile device with the geographic location of the current user's historical login. If it is found that the login location is from an unfamiliar country or a different city that has never been logged in, the login location information is recorded through a new temporary variable, and the security score value is accumulated. The following are the fields contained in the new temporary variable record: user IP, user name, remote login, country, city and security score value;

[0184] Step 4: Based on the username of the current user, search the mobile office authentication system log information to see if the mobile user device ID corresponding to the current username, i.e., the mobile client device ID, has appeared in all the historical mobile user device IDs corresponding to the username. If the mobile user device ID currently used for login is a new device, mark and record it through a new temporary variable, and accumulate the security points. The following are the fields included in the new temporary variable record: user IP, username, login with unfamiliar device, and security points.

[0185] Compare the mobile user device ID of the current user name with the mobile user device ID of all accounts to find and confirm whether there is a user with a different user name using their own device to log in to the account of the current user name, that is, to find out whether someone has used their own device to log in to other employees' accounts. If so, the security points are accumulated. The following are the fields included in the new temporary variable record: user IP, user name, login with an impersonated account, and security points;

[0186] Step 5: Based on the previous correlation judgment and correlation analysis, the abnormal message record set that will appear during abnormal login is obtained, as follows:

[0187] User IP, user name, threat name, threat type, threat level, security score value;

[0188] User IP, user name, weak password cracking, and security score value;

[0189] User IP, user name, remote login, country, city, security points value;

[0190] User IP, user name, login from unfamiliar device, security points value;

[0191] User IP, user name, fake account login, security points value;

[0192] According to the occurrence of the above abnormal login records, the sum of each security score is calculated. When the score of the security score is higher than the danger threshold N, it interacts with the mobile user authentication system to drive the mobile authentication system to wake up the mobile phone face recognition mechanism. After the face recognition confirms that the information is correct, the alarm is eliminated and the user is authenticated. The abnormal event message of the upper login channel machine system is now sent to the security operation personnel. If the abnormal login wakes up the face recognition mechanism and confirms that the login identity fails, the security operation personnel are informed to confirm and respond in time to investigate the cause of the abnormal login. Especially for key accounts, the response speed and processing priority should be improved. With this threat discovery mechanism, the security of key account authentication and login can be better guaranteed.

[0193] The embodiments of the present invention have the following technical effects:

[0194] Compared with the traditional channel machine login authentication, the abnormal login analysis mechanism of the embodiment of the present invention associates and analyzes the user IP information, device information, login history information and threat intelligence, and can detect abnormal login behaviors that cannot be detected by traditional account login authentication. The traditional technical solution is based on the determination of a single dimension of password. Even if the correct username and password are used to log in to the system, there is still a risk of malicious login. The embodiment of the present invention uses the user password to confirm whether the user's identity is normal. At the same time, it associates log data of other dimensions to obtain more device information, threat intelligence information, geographic location information, and fingerprint information of user operations such as relevant data and historical data during the user's historical login process. In addition to password information, the legitimacy of the user login is confirmed with more dimensions. Ensure the security of user account assets.

[0195] The embodiment of the present invention uses a targeted big data log storage solution to centrally collect and manage user login information through a log system, fully automatically collect various log information of logged-in users, and perform automatic data validity management. Through centralized time configuration management settings, the cycle time length of related log data storage is flexibly managed. The scattered logs in various systems are centrally managed, and a unified API query interface is provided to facilitate the query and use of various third-party applications and perform correlation analysis of log data.

[0196] The embodiment of the present invention uses a simple logical processing method to correlate and analyze the channel machine system log information, user authentication system information, mobile office authentication system log information, IP threat intelligence information, IP geographic location information, weak password library information, and face recognition information.

[0197] The client IP of the user connecting to the channel machine system, the corresponding geographic location information, the mobile device IP address location information during the second confirmation of the mobile device login, the user's mobile device ID history information, the user's login password collision behavior information, the IP threat intelligence library information, and the face recognition information are associated.

[0198] The correlation analysis results in abnormal logins under false names, abnormal logins with dangerous database collisions, abnormal logins with dangerous IP addresses, abnormal logins with unfamiliar devices, and abnormal logins in different cities, and they are evaluated and scored. If the score is greater than the pre-set threshold, the face recognition mechanism is activated to perform unique identity verification. The abnormal features of various related data when the user logs in abnormally are used to correlate and analyze the problems caused by the abnormal account login.

[0199] The embodiment of the present invention adds more relevant data association analysis based on the traditional channel machine server login system, authentication account name, password, and dynamic code, and adds a scoring mechanism for the degree of threatening behavior. Combined with the score, it is decided whether to perform the reconfirmation process of facial information recognition.

[0200] The above mechanism is used to ensure the security of user account login. Once a potential account login occurs abnormally, the identity is confirmed and the user and security operations personnel are notified immediately. Through relevant personnel, rapid response and security emergency response are carried out, which also deepens and strengthens the protection of key accounts.

[0201] It should be understood that the specific order or hierarchy of steps in the disclosed process is an example of an exemplary method. Based on design preferences, it should be understood that the specific order or hierarchy of steps in the process can be rearranged without departing from the scope of protection of the present disclosure. The attached method claims present the elements of the various steps in an exemplary order and are not intended to be limited to the specific order or hierarchy described.

[0202] In the above detailed description, various features are grouped together in a single embodiment to simplify the disclosure. This method of disclosure should not be interpreted as reflecting an intention that the embodiments of the claimed subject matter require more features than are clearly stated in each claim. On the contrary, as reflected in the appended claims, the invention is in a state of having less than all the features of the disclosed individual embodiments. Therefore, the appended claims are hereby expressly incorporated into the detailed description, with each claim standing on its own as a separate preferred embodiment of the invention.

[0203] The disclosed embodiments are described above to enable any person skilled in the art to implement or use the present invention. Various modifications of these embodiments are obvious to those skilled in the art, and the general principles defined herein may also be applied to other embodiments without departing from the spirit and scope of the present disclosure. Therefore, the present disclosure is not limited to the embodiments given herein, but is consistent with the broadest scope of the principles and novel features disclosed in this application.

[0204] The above description includes examples of one or more embodiments. Of course, it is impossible to describe all possible combinations of components or methods for the purpose of describing the above embodiments, but it should be recognized by those skilled in the art that the various embodiments may be further combined and arranged. Therefore, the embodiments described herein are intended to cover all such changes, modifications and variations that fall within the scope of protection of the appended claims. In addition, with respect to the term "comprising" used in the specification or claims, the word is covered in a manner similar to the term "including", as explained by "including:" used as a transitional word in the claims. In addition, any term "or" used in the specification of the claims is intended to mean "non-exclusive or".

[0205] Those skilled in the art may also understand that the various illustrative logical blocks, units, and steps listed in the embodiments of the present invention may be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly demonstrate the interchangeability of hardware and software, the various illustrative components, units, and steps described above have generally described their functions. Whether such functions are implemented by hardware or software depends on the specific application and the design requirements of the entire system. Those skilled in the art may use various methods to implement the described functions for each specific application, but such implementation should not be understood as exceeding the scope of protection of the embodiments of the present invention.

[0206] The various illustrative logic blocks or units described in the embodiments of the present invention can be implemented or operated by a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a field programmable gate array or other programmable logic device, a discrete gate or transistor logic, a discrete hardware component, or any combination of the above. The general-purpose processor can be a microprocessor, and optionally, the general-purpose processor can also be any conventional processor, controller, microcontroller or state machine. The processor can also be implemented by a combination of computing devices, such as a digital signal processor and a microprocessor, a plurality of microprocessors, one or more microprocessors combined with a digital signal processor core, or any other similar configuration.

[0207] The steps of the method or algorithm described in the embodiments of the present invention can be directly embedded in hardware, a software module executed by a processor, or a combination of the two. The software module can be stored in a RAM memory, a flash memory, a ROM memory, an EPROM memory, an EEPROM memory, a register, a hard disk, a removable disk, a CD-ROM, or other storage media of any form in the art. Exemplarily, the storage medium can be connected to the processor so that the processor can read information from the storage medium and can write information to the storage medium. Optionally, the storage medium can also be integrated into the processor. The processor and the storage medium can be arranged in an ASIC, and the ASIC can be arranged in a user terminal. Optionally, the processor and the storage medium can also be arranged in different components in the user terminal.

[0208] In one or more exemplary designs, the above functions described in the embodiments of the present invention can be implemented in hardware, software, firmware or any combination of the three. If implemented in software, these functions can be stored on a computer-readable medium, or transmitted in the form of one or more instructions or codes on a computer-readable medium. Computer-readable media include computer storage media and communication media that facilitate the transfer of computer programs from one place to another. The storage medium can be any available medium that can be accessed by any general or special computer. For example, such computer-readable media can include but are not limited to RAM, ROM, EEPROM, CD-ROM or other optical disk storage, disk storage or other magnetic storage devices, or any other medium that can be used to carry or store program codes in the form of instructions or data structures and other forms that can be read by general or special computers, or general or special processors. In addition, any connection can be appropriately defined as a computer-readable medium, for example, if the software is transmitted from a website site, server or other remote resource through a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL) or wirelessly, such as infrared, wireless and microwave, it is also included in the defined computer-readable medium. The disk and disc include compact disk, laser disk, optical disk, DVD, floppy disk and blue-ray disk. Disks usually copy data magnetically, while discs usually copy data optically with lasers. The above combination can also be included in computer readable media.

[0209] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for automatically analyzing abnormal account logins, characterized in that: include: Collecting login verification logs of multiple login verification systems related to the login operation of the specified account; wherein the login verification systems communicate with each other and collaborate to complete the login operation; Obtain at least one pre-specified sensitive indicator information of each login verification log record; Performing a security threat assessment on the at least one sensitive indicator information to obtain at least one assessment score; All evaluation points are weighted and accumulated to obtain the total evaluation points; If the total evaluation score and the specified score threshold satisfy a specified size relationship, the login operation of the specified account is determined to be an abnormal login; The multiple login verification systems include: a channel machine system, a mobile office authentication system, and a user login authentication system; The login verification systems communicate with each other and collaborate to complete the login operation, including: The user logs in to the channel machine system through SSH. After the user logs in, the channel machine system sends an authentication request to the user login authentication system; The user login authentication system returns a verification QR code to the channel machine system, and the channel machine system displays the verification QR code on the client of the channel machine system used by the user. The user logs in to the mobile client in the mobile office authentication system by entering the account number and password of the specified account, and uses the mobile client to scan the verification QR code. After scanning, the mobile office authentication system sends the specified account number and password to the user login authentication system for verification; After the channel machine system, mobile office authentication system, and user login authentication system have all confirmed success, the designated account is successfully logged in; The performing security threat assessment on the at least one sensitive indicator information to obtain at least one assessment score includes: Perform an independent security threat assessment on each sensitive indicator information to obtain the assessment score corresponding to the sensitive indicator information; or, Perform security threat evaluation on the associated sensitive indicator combination to obtain the evaluation score corresponding to the associated sensitive indicator combination; The associated sensitive indicator combination includes: part or all of the pre-selected sensitive indicator information among the at least one sensitive indicator information; In the case where the login verification system includes a user login authentication system, the at least one sensitive indicator information includes: the number of login authentication failures and the login authentication password; The security threat evaluation of the associated sensitive indicator combination is performed to obtain the evaluation score corresponding to the associated sensitive indicator combination, including: Obtaining a login authentication record corresponding to the client IP address used in the login operation recorded in the login verification log of the user login authentication system within the first specified time range; Obtaining all login authentication passwords and the number of login authentication failures recorded in the login authentication record when the login authentication fails; If the number of login authentication failures is greater than or equal to the specified login number threshold, each login authentication password is compared with the passwords in the specified weak password library; If the ratio of the login authentication passwords that successfully match the passwords in the specified weak password library to all the login authentication passwords is greater than or equal to the specified weak password ratio, the value of the fourth evaluation score corresponding to the associated sensitive indicator combination consisting of the number of login authentication failures and the login authentication password is set to the specified fourth score value; When the login verification system includes a channel machine system and a mobile office authentication system, the at least one sensitive indicator information includes: a channel machine client IP address and a mobile client IP address used for the login operation; The security threat evaluation of the associated sensitive indicator combination is performed to obtain the evaluation score corresponding to the associated sensitive indicator combination, including: Obtain the IP address of the channel machine client used for the login operation recorded in the login verification log of the channel machine system; Obtaining the mobile client IP address used in the login operation recorded in the login verification log of the mobile office authentication system; Querying the IP geographical location information database to obtain the geographical location corresponding to the IP address of the channel machine client used for the login operation as the current channel machine client location of the login operation; Querying an IP geographical location information database to obtain a geographical location corresponding to the mobile client IP address used in the login operation as the current mobile client location of the login operation; Obtaining all historical channel machine client IP addresses recorded in the login verification log of the channel machine system that have been used by the designated account within a second designated time range before the login operation occurs; Obtaining all historical mobile client IP addresses recorded in the login verification log of the mobile office authentication system that have been used by the designated account within a second designated time range before the login operation occurs; Query the IP geographic location information database to obtain the geographic locations corresponding to the IP addresses of all historical channel machine clients to form a historical channel machine client location set; Query the IP geographic location information database to obtain the geographic locations corresponding to all historical mobile client IP addresses as a historical mobile client location set; If the current channel machine client location does not belong to the historical channel machine client location set, and the current mobile client location does not belong to the historical mobile client location set, the value of the fifth evaluation integral corresponding to the associated sensitive indicator combination consisting of the channel machine client IP address and the mobile client IP address used in the login operation is set to the specified fifth integral value.

2. The method for automatically analyzing abnormal account logins according to claim 1, characterized in that: After determining the login operation of the designated account as an abnormal login, the method further includes: Perform secondary verification through a specified verification method; if the result of the secondary verification is normal, login is allowed; if the result of the secondary verification is abnormal, login is not allowed.

3. The method for automatically analyzing abnormal account logins according to claim 1, characterized in that: In the case where the login verification system includes a channel machine system, the at least one sensitive indicator information includes: an IP address of a channel machine client used for the login operation; The independent security threat evaluation is performed on each sensitive indicator information to obtain the evaluation score corresponding to the sensitive indicator information, including: Compare the IP address of the channel machine client used in the login operation recorded in the login verification log of the channel machine system with each IP address in the IP threat intelligence library; If the IP address of the channel machine client used in the login operation matches an IP address in the IP threat intelligence library, setting the value of the first evaluation score corresponding to the IP address of the channel machine client used in the login operation to the specified first score value; Wherein, the IP threat intelligence library includes: at least one threat IP address collected in advance.

4. The method for automatically analyzing abnormal account logins according to claim 1, characterized in that: In the case where the login verification system includes a mobile office authentication system, the at least one sensitive indicator information includes: a mobile client device ID used for the login operation; The independent security threat evaluation is performed on each sensitive indicator information to obtain the evaluation score corresponding to the sensitive indicator information, including: Obtaining the mobile client device ID used for the login operation recorded in the login verification log of the mobile office authentication system; Obtaining all historical mobile client device IDs that have been used by the designated account and recorded in the login verification log of the mobile office authentication system; If the mobile client device ID used for the login operation does not exist in all historical mobile client device IDs, the value of the second evaluation score corresponding to the mobile client device ID used for the login operation is set to the specified second score value.

5. The method for automatically analyzing abnormal account logins according to claim 1, characterized in that: In the case where the login verification system includes a mobile office authentication system, the at least one sensitive indicator information includes: a mobile client device ID used for the login operation; The independent security threat evaluation is performed on each sensitive indicator information to obtain the evaluation score corresponding to the sensitive indicator information, including: Obtaining the mobile client device ID used for the login operation recorded in the login verification log of the mobile office authentication system; Obtain all historical mobile client device IDs used by all accounts recorded in the login verification log of the mobile office authentication system; Searching for the mobile client device ID used for the login operation among all historical mobile client device IDs used by all accounts; If a mobile client device ID identical to the mobile client device ID used for the login operation is found, and the account corresponding to the identical mobile client device ID is not the designated account, the value of the third evaluation points corresponding to the mobile client device ID used for the login operation is set to the designated third points value.

6. An automatic analysis device for abnormal account login, characterized in that: include: A log collection unit, used to collect login verification logs of multiple login verification systems related to the login operation of a specified account; wherein the login verification systems communicate with each other to collaboratively complete the login operation; A sensitive indicator acquisition unit, used to acquire at least one pre-specified sensitive indicator information of each login verification log record; An evaluation score acquisition unit, used to perform security threat evaluation on the at least one sensitive indicator information to obtain at least one evaluation score; A total score acquisition unit is used to perform weighted accumulation of each evaluation score to obtain a total evaluation score; an abnormality determination unit, configured to determine the login operation of the specified account as an abnormal login if the total evaluation score and a specified score threshold satisfy a specified size relationship; The multiple login verification systems include: a channel machine system, a mobile office authentication system, and a user login authentication system; The login verification systems communicate with each other and collaborate to complete the login operation, including: The user logs in to the channel machine system through SSH. After the user logs in, the channel machine system sends an authentication request to the user login authentication system; The user login authentication system returns a verification QR code to the channel machine system, and the channel machine system displays the verification QR code on the client of the channel machine system used by the user. The user logs in to the mobile client in the mobile office authentication system by entering the account number and password of the specified account, and uses the mobile client to scan the verification QR code. After scanning, the mobile office authentication system sends the specified account number and password to the user login authentication system for verification; After the channel machine system, mobile office authentication system, and user login authentication system have all confirmed success, the designated account is successfully logged in; An independent evaluation module is used to perform independent security threat evaluation on each sensitive indicator information and obtain the evaluation score corresponding to the sensitive indicator information; A joint evaluation module is used to evaluate the security threat of the associated sensitive indicator combination and obtain the evaluation score corresponding to the associated sensitive indicator combination; The associated sensitive indicator combination includes: part or all of the pre-selected sensitive indicator information among the at least one sensitive indicator information; In the case where the login verification system includes a user login authentication system, the at least one sensitive indicator information includes: the number of login authentication failures and the login authentication password; The joint evaluation module comprises: A login authentication record acquisition module, used to acquire the login authentication record corresponding to the client IP address used in the login operation recorded in the login verification log of the user login authentication system within a first specified time range; A login failure information acquisition module, used to acquire all login authentication passwords and login authentication failure times recorded in the login authentication record when the login authentication fails; A password comparison module, for comparing each login authentication password with a password in a specified weak password library if the number of login authentication failures is greater than or equal to a specified login number threshold; A fourth score acquisition module, configured to set the value of a fourth evaluation score corresponding to the associated sensitive indicator combination consisting of the number of failed login authentications and the login authentication password to a specified fourth score value if the ratio of the login authentication passwords that successfully match the passwords in the specified weak password library to all the login authentication passwords is greater than or equal to the specified weak password ratio; When the login verification system includes a channel machine system and a mobile office authentication system, the at least one sensitive indicator information includes: a channel machine client IP address and a mobile client IP address used for the login operation; The joint evaluation module comprises: The current channel machine client IP acquisition module is used to obtain the channel machine client IP address used for the login operation recorded in the login verification log of the channel machine system; A current mobile IP acquisition module, used to acquire the mobile client IP address used in the login operation recorded in the login verification log of the mobile office authentication system; A current channel machine location acquisition module is used to query the IP geographical location information database to obtain the geographical location corresponding to the channel machine client IP address used in the login operation as the current channel machine client location of the login operation; A current mobile location acquisition module, used to query an IP geographical location information database to acquire a geographical location corresponding to the mobile client IP address used in the login operation as the current mobile client location of the login operation; A historical channel machine client IP acquisition module, used to acquire all historical channel machine client IP addresses recorded in the login verification log of the channel machine system that were used by the designated account within a second designated time range before the login operation occurred; A historical mobile IP acquisition module, used to acquire all historical mobile client IP addresses used by the designated account within a second designated time range before the login operation occurs, which are recorded in the login verification log of the mobile office authentication system; The historical channel machine client location acquisition module is used to query the IP geographic location information database to obtain the geographic locations corresponding to the IP addresses of all historical channel machine clients to form a historical channel machine client location set; A historical mobile client location acquisition module is used to query the IP geographic location information database to obtain the geographic locations corresponding to all historical mobile client IP addresses as a historical mobile client location set; The fifth points acquisition module is used to set the value of the fifth evaluation points corresponding to the associated sensitive indicator combination consisting of the channel machine client IP address and the mobile client IP address used in the login operation to a specified fifth points value if the current channel machine client position does not belong to the historical channel machine client position set and the current mobile client position does not belong to the historical mobile client position set.

Images