A method, system and electronic device for determining abnormal risk based on operation information

Abstract

The application provides a method and system for judging abnormal risk based on operation information and electronic equipment, and relates to the technical field of computers, which comprises embedding a buried point code for collecting abnormal information in a target application associated with the target application; obtaining an authentication ticket of the target application; obtaining login authentication information based on the authentication ticket, and returning the login authentication information to the target application; when it is identified that the target application is in a login state, obtaining operation information of the target application based on the buried point code; and combining the operation information of multiple target applications and current operation information of a current target application to analyze whether there is an abnormal risk in real time. The application unifies authentication of target applications by associating the target applications; collects operation information by embedding a buried point code after user authorization, so as to facilitate risk analysis across multiple target applications and timely investigation and treatment of abnormal risks.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a method and system for judging abnormal risk based on operation information and electronic equipment. BACKGROUND

[0002] A company may use multiple different systems for different business types, such as office management system, process management system, personnel management system, project management system, research and development management system, etc. Each system is independent of each other and performs its own function. This makes the same user may have multiple accounts in multiple systems, which cannot guarantee the uniqueness of the user identifier, and needs to log in separately when logging into different systems. When performing abnormal risk analysis, it is necessary to adjust and embed point code in multiple systems to obtain user operation information. In order to meet the analysis needs, it is also necessary to modify the log output code of each system, which increases the code coupling and development cost. Since the point code is embedded in different systems, different developers may maintain different systems, which may lead to different embedded point codes, and thus the format of the operation information obtained from each system is not uniform, which causes great inconvenience to abnormal risk analysis, increases the time cost, and makes the analysis of abnormal risk based on operation information lagging behind.

[0003] Therefore, it is necessary to provide a method and system for judging abnormal risk based on operation information and electronic equipment. SUMMARY

[0004] The present application provides a method and system for judging abnormal risk based on operation information and electronic equipment, which adopts a unified user association authentication method, so that each system embeds point code when associated, so as to collect operation information after user authorization. Based on the collected log files with uniform format, it can analyze whether there is abnormal risk in real time, and solve the problem of being unable to analyze abnormal risk conveniently and timely due to the independence of each system.

[0005] The present application provides a method for judging abnormal risk based on operation information, which adopts the following technical scheme, comprising:

[0006] Association with target application, embedding point code for collecting abnormal information in the target application;

[0007] Obtaining authentication ticket of the target application;

[0008] Based on the authentication ticket, obtaining login authentication information, and returning the login authentication information to the target application;

[0009] When it is identified that the target application is in a login state, obtaining operation information of the target application based on the point code;

[0010] Real-time analysis of whether there is an abnormal risk in combination with the operation information of the plurality of target applications and the current operation information of the current target application.

[0011] Optionally, before the association with the target application, further comprising:

[0012] Determine whether the user performs initial association authentication through the target application;

[0013] If it is determined through the target application that the user does not perform initial association authentication, obtain the identification information of the user, generate the authentication ticket based on the identification information, send the authentication ticket to the target application, and complete the initial association authentication;

[0014] If it is determined through the target application that the user has performed initial association authentication, associate the authentication ticket with the target application.

[0015] Optionally, the sending of the authentication ticket to the target application to complete the initial association authentication comprises:

[0016] Jump to the callback address of authentication success carrying the authentication ticket;

[0017] Send the authentication ticket to the target application through the callback address of authentication success to complete the initial association authentication.

[0018] Optionally, the embedding of the buried point code for collecting abnormal information in the target application comprises:

[0019] Based on the identification information, the pre-configured buried point code is embedded in the target application.

[0020] Optionally, the real-time analysis of whether there is an abnormal risk in combination with the operation information of the plurality of target applications and the current operation information of the current target application comprises:

[0021] Collect the current operation information of the current target application;

[0022] In combination with the operation information of the plurality of target applications, the current operation information of the current target application is analyzed in real time to determine whether the current operation behavior corresponding to the current operation information has an abnormal risk;

[0023] If it is found through real-time analysis of the current operation information that the current operation behavior has an abnormal risk, a pre-warning reminder and / or a pre-warning email is sent.

[0024] Optionally, the real-time analysis of the current operation information of the current target application judges whether the operation behavior corresponding to the current operation information has an abnormal risk, comprising:

[0025] Based on the obtained asynchronous request information, it is judged whether there is an abnormal refreshing behavior;

[0026] and / or,

[0027] Based on the information of the clicked coordinate point obtained, it is judged whether there is an abnormal clicking behavior;

[0028] and / or,

[0029] Based on the encryption information of the obtained identification information, it is judged whether there is an abnormal encryption and / or decryption behavior.

[0030] The system for judging abnormal risk based on operation information provided by the application adopts the following technical scheme, comprising:

[0031] The association authentication module is used for association with the target application, and the target application is embedded with the buried point code for collecting abnormal information;

[0032] The ticket acquisition module is used for acquiring the authentication ticket of the target application;

[0033] The authentication information exchange module is used for exchanging login authentication information based on the authentication ticket, and returning the login authentication information to the target application;

[0034] The information acquisition module is used for acquiring the operation information of the target application based on the buried point code when it is identified that the target application is in a login state;

[0035] The risk analysis module is used for real-time analysis of whether there is an abnormal risk in combination with the operation information of a plurality of target applications and the current operation information of the current target application.

[0036] Optionally, it further comprises an association judgment module;

[0037] The association judgment module comprises:

[0038] The association judgment submodule is used for judging whether the user has performed the initial association authentication through the target application;

[0039] The first association submodule is used for acquiring the identification information of the user if it is judged through the target application that the user has not performed the initial association authentication, generating the authentication ticket based on the identification information, sending the authentication ticket to the target application, and completing the initial association authentication;

[0040] The second association submodule is configured to associate the authentication ticket with the target application based on the authentication ticket if the user has passed the initial association authentication according to the target application.

[0041] Optionally, the first association submodule comprises:

[0042] The callback unit is configured to jump to a callback address of authentication success by carrying the authentication ticket.

[0043] The association unit is configured to send the authentication ticket to the target application through the callback address of authentication success, and complete the initial association authentication.

[0044] Optionally, the association authentication module comprises:

[0045] The embedding submodule is configured to embed the preconfigured burying point code in the target application based on the identification information.

[0046] Optionally, the risk analysis module comprises:

[0047] The collection submodule is configured to collect the current operation information of the current target application.

[0048] The analysis submodule is configured to combine the operation information of a plurality of target applications, analyze the current operation information of the current target application in real time, and determine whether the current operation behavior corresponding to the current operation information has an abnormal risk.

[0049] The early warning submodule is configured to send an early warning reminder and / or an early warning email if the current operation behavior has an abnormal risk according to the real-time analysis of the current operation information.

[0050] Optionally, the analysis submodule comprises:

[0051] The first analysis unit is configured to determine whether there is an abnormal refresh behavior based on the obtained asynchronous request information.

[0052] and / or,

[0053] The second analysis unit is configured to determine whether there is an abnormal click behavior based on the information of the obtained click coordinate point.

[0054] and / or,

[0055] The third analysis unit is configured to determine whether there is an abnormal encryption and / or decryption behavior based on the obtained encryption information of the identification information.

[0056] The present specification also provides an electronic device, wherein the electronic device comprises:

[0057] a processor; and

[0058] a memory storing computer-executable instructions that, when executed, cause the processor to perform any of the above methods.

[0059] The specification also provides a computer-readable storage medium storing one or more programs, which when executed by a processor, implement any of the above methods.

[0060] In the present application, associated with a target application, by embedding a buried point code in multiple target applications, after user authorization, the operation information of the user is obtained, which facilitates risk analysis across multiple target applications. Since unified burying is performed on multiple target applications, development costs are saved; by configuring in one place and using in multiple target applications, it is convenient to manage the buried point code, effectively improving the convenience and speed of burying, and ensuring the integrity of the collected operation information and the uniformity of the log file format corresponding to the obtained operation information; in combination with the operation information of multiple target applications and the current operation information of the current target application, it can be analyzed in real time whether there is an abnormal risk, so as to timely investigate and handle security vulnerabilities and other problems. BRIEF DESCRIPTION OF DRAWINGS

[0061] Figure 1 A principle diagram of an embodiment of a method for judging abnormal risks based on operation information provided by the specification;

[0062] Figure 2 A principle diagram of another embodiment of a method for judging abnormal risks based on operation information provided by the specification;

[0063] Figure 3 A principle diagram of an authentication process of a method for judging abnormal risks based on operation information provided by the embodiment of the specification;

[0064] Figure 4 A principle diagram of a behavior analysis of a method for judging abnormal risks based on operation information provided by the embodiment of the specification;

[0065] Figure 5 A structure diagram of a system for judging abnormal risks based on operation information provided by the embodiment of the specification;

[0066] Figure 6 A structure diagram of an electronic device provided by the embodiment of the specification;

[0067] Figure 7 A structure diagram of a computer readable medium provided by the embodiment of the specification. DETAILED DESCRIPTION

[0068] The following description is provided so as to enable any person skilled in the art to practice the application. The preferred embodiments described herein are only examples of the application and the application is not limited to these embodiments. Various modifications to these embodiments can be made by those skilled in the art without departing from the spirit and scope of the application. Those skilled in the art will further appreciate that the application can be used with any assay or apparatus of this type.

[0069] Exemplary embodiments of the present application will now be described more fully with reference to the accompanying drawings. The exemplary embodiments, however, can be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these exemplary embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the application to those skilled in the art, with the full scope of the application being set out in the claims. Like reference numerals refer to like elements throughout the specification.

[0070] Features, structures, characteristics or other details described in relation to a certain embodiment are not excluded from being combinable with one or more other embodiments in a suitable manner.

[0071] In the description of the specific embodiments, features, structures, characteristics or other details described in relation to the application are to enable a person skilled in the art to fully understand the embodiments. However, it is not excluded that a person skilled in the art can practice the technical solution of the application without one or more of the specific features, structures, characteristics or other details.

[0072] The flowcharts shown in the drawings are only exemplary illustrations and do not necessarily include all contents and operations / steps, nor are they necessarily executed in the order described. For example, some operations / steps can be further decomposed, and some operations / steps can be combined or partially combined, so the actual execution order can be changed according to the actual situation.

[0073] The block diagrams shown in the drawings are only functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in the form of software, or in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0074] The term "and / or" or "and / or" includes all combinations of one or more of the associated listed items.

[0075] Figure 1 A schematic diagram of the principle of a method for judging an abnormal risk based on operation information according to an embodiment of the present disclosure is provided. The method includes:

[0076] S120 is associated with a target application, and a tracking code for collecting abnormal information is embedded in the target application;

[0077] S130 obtains the authentication ticket of the target application;

[0078] S140 exchanges the authentication ticket for login authentication information, and returns the login authentication information to the target application;

[0079] S150: When it is recognized that the target application is in a logged-in state, obtaining operation information of the target application based on the embedded code;

[0080] S160 combines the operation information of the plurality of target applications and the current operation information of the current target application to analyze in real time whether there is an abnormal risk.

[0081] in,

[0082] In one embodiment of the present specification, since the association with the target application relies on the authentication ticket, and the authentication ticket is obtained from the initial association authentication, Figure 2 As shown, before being associated with this application, it also includes:

[0083] S110 determines whether the user performs initial association authentication through the target application;

[0084] A company may use different target applications, each with its own account system. Since the information between each target application is independent of each other, in order to deal with the problem of multiple accounts for the same user and to facilitate unified management and control, in one embodiment of this specification, user association authentication is adopted, and the user's unique identification is used to log in to bind the associated user's accounts in multiple target applications, avoiding the mapping problem of multiple accounts for one user and providing greater convenience for the subsequent analysis of log files. The target application can be a third-party application.

[0085] When the user is identified as entering the target application, the target application receives the user's access request and determines whether the user is performing initial association authentication. In one embodiment of the present specification, the target application determines whether the user is performing initial association authentication by determining whether the authentication ticket corresponding to the user exists. The user entering the target application means that the user clicks the target application icon to launch the target application.

[0086] If the authentication ticket corresponding to the user is not confirmed by the target application, that is, it is determined that the user has not performed the initial association authentication, the initial association authentication needs to be performed first, and then the target application is accessed. When performing the initial association authentication, the user is logged in by the user unique identifier, and then the identification information of the user in the target application is obtained. Based on the identification information, the authentication ticket is generated and sent to the target application, the initial association authentication is completed, and the user unique identifier is successfully bound to the target application. In an embodiment of the present application, after the initial association authentication, the login authentication information of the user in the target application is obtained and saved based on the identification information. The access to the target application refers to the operation of the user on the target application after the initial association authentication.

[0087] The identification information includes a unique identifier and an identification key, and the unique identifier corresponds to the identification key one-to-one. In an embodiment of the present application, the unique identifier is an original account number for logging in to the target application, and the identification key is an original account password for logging in to the target application. The original account number corresponds to the original account password one-to-one.

[0088] In an embodiment of the present application, the user logs in by using a domain account, and of course can also log in by using a mobile phone account to bind the account of the user in each target application of the company. The domain account / mobile phone account is the user unique identifier of the user in the company. After the user association authentication, the user can log in by using the user unique identifier to manage the accounts of multiple target applications, and it is also convenient for the operation and management of the company. In an embodiment of the present application, when associating multiple target applications of the user, multiple authentication tickets are generated based on the identification information of multiple target applications.

[0089] In order to facilitate the user to know the authentication result in time, in an embodiment of the present application, after the authentication ticket is generated based on the identification information, the authentication ticket is carried to jump to the callback address of the successful authentication, and the user is notified that the initial association authentication has been successful.

[0090] The authentication ticket is sent to the target application through the callback address of the successful authentication, and the initial association authentication is completed. In an embodiment of the present application, on the callback address of the successful authentication, after a preset display time, the target application is automatically jumped to, and the carried authentication ticket is sent to the target application, and the initial association authentication is completed. In another embodiment of the present application, after the user is notified that the initial association authentication has been successful, the target application is jumped to based on the user clicking the link on the authentication success page.

[0091] S120 associates with the target application, and embeds a point code for collecting abnormal information in the target application;

[0092] If the authentication ticket corresponding to the user is confirmed through the target application, that is, it is determined that the user has performed initial association authentication, the authentication ticket is associated with the target application, and a point code for collecting abnormal information is embedded in the target application, so that in the future, the user's operation information is collected and risk analysis is performed under the condition of obtaining user authorization.

[0093] S121 associates with the target application based on the authentication ticket;

[0094] When it is determined through the target application that the user has performed initial association authentication, it means that the target application has the authentication ticket corresponding to the user, so that the user does not need to perform initial association authentication when entering the target application in the future, and can be associated with the target application and access the target application.

[0095] S122 embeds a point code for collecting abnormal information in the target application;

[0096] Based on the identification information, the preconfigured point code is embedded in the target application, which is used to collect the user's operation information after obtaining user authorization, so as to facilitate risk analysis across multiple target applications. After accessing the target application once, there is no need to change according to different target applications respectively, and there is no need to notify the target application to modify the log output code, which reduces the code coupling and development cost.

[0097] In an embodiment of the present application, an interface address for obtaining the point code is provided. Since multiple target applications are uniformly instrumented, it is convenient to collect operation information of a unified position of multiple target applications after obtaining user authorization. Since the instrumented method is convenient and fast, the development cost is effectively saved. Moreover, by configuring in one place, the point code can be used in multiple places of multiple target applications, which effectively improves the convenience of instrumenting. Moreover, the integrity of collecting operation information is ensured, so that when performing risk analysis in the future, based on the operation information of the unified position of other target applications, it is analyzed whether the current operation information of the current target application has abnormal risk. Based on the interface, the user's operation information is collected after obtaining user authorization, which ensures the real-time collection of operation information.

[0098] Since the same user can only register one original account in one target application, the unique identifier of the target application is the original account used to log in the target application, therefore, the target application is distinguished and configured through the unique identifier of the target application. After being authorized by the user, the operation information of the target application corresponding to the unique identifier is collected by the embedded code based on the unique identifier on demand, and the configuration is effective after being completed, which greatly improves the use convenience. In an embodiment of the present specification, the embedded code can be used for interface watermark display.

[0099] S130 obtains the authentication ticket of the target application;

[0100] After identifying that the user enters the target application, the access request of the user is received based on the target application, and the authentication ticket sent to the target application is obtained. In an embodiment of the present specification, the authentication ticket sent by the target application for exchanging the login authentication information is obtained. In an embodiment of the present specification, the authentication ticket includes identification information and a ticket for exchanging login authentication information.

[0101] S140 exchanges the login authentication information based on the authentication ticket, and returns the login authentication information to the target application;

[0102] After obtaining the authentication ticket, the login authentication information is returned to the target application for display, so as to facilitate the user to perform subsequent operations in the target application. In an embodiment of the present specification, before returning the login authentication information to the target application, the authenticity of the authentication ticket is judged, and the login authentication information is sent only after determining the authenticity of the authentication ticket, thereby improving the security of accessing the target application. In an embodiment of the present specification, when performing initial association authentication, the generated authentication ticket includes an identification mark, and when subsequently obtaining the authentication ticket sent by the target application, the authenticity of the authentication ticket is identified by verifying whether the authentication ticket includes the identification mark. If it is identified that the authentication ticket includes the identification mark, it is determined that the authenticity of the authentication ticket is correct, and the login authentication information is sent to the target application; if it is identified that the authentication ticket does not include the identification mark, it is determined that the authenticity of the authentication ticket is doubtful, and the login authentication information is refused to be sent to the target application. If the authenticity of the authentication ticket is doubtful, the initial association authentication of the target application needs to be performed again.

[0103] In an embodiment of the present specification, the login authentication information includes user information and authentication user login state id. The user information includes the cache data of the user in the target application, and the login state is used to refresh the login state of the user in the target application. When identifying the logout request of the target application, the target application is logged out according to the authentication user login state id, and the login is exited.

[0104] S150 When it is identified that the target application is in a login state, operation information of the target application is acquired based on the burying point code;

[0105] When it is identified that the user is in a login state of the target application, operation information of the target application is acquired and recorded in real time based on the pre-configured burying point code after user authorization. In an embodiment of the present specification, the operation information includes a log file, and the log file is used to record the operation behavior of the user. Since the burying point code embedded in each target application is the same, the format of the collected log file is unified, which ensures the standardization of the log file format, facilitates quick analysis of the log files collected from different target applications in the later stage, and timely risk checking.

[0106] S160 Real-time analysis is performed on whether there is an abnormal risk by combining the operation information of a plurality of target applications and the current operation information of the current target application.

[0107] Based on the operation information of the user in all target applications and the current operation information of the user in the current target application, it is determined in real time whether the operation behavior of the user corresponding to the current operation information is abnormal, and whether the current target application has an abnormal risk is further determined.

[0108] S161 The current operation information of the current target application is collected;

[0109] After user authorization, the current operation information is recorded and collected in real time based on the burying point code.

[0110] S162 The current operation information of the current target application is analyzed in real time by combining the operation information of a plurality of target applications, and it is determined whether the current operation behavior corresponding to the current operation information is abnormal;

[0111] The current operation information recorded in real time and authorized by the user is acquired for real-time analysis and determination of whether there is an abnormal risk, which ensures the real-time nature of the data, facilitates timely discovery of abnormalities and processing, avoids information leakage due to abnormal risks as much as possible, and improves data security. Of course, in the case where the user has authorized, the burying point can also be configured to collect operation information data as needed, and then more targeted data collection and analysis can be performed.

[0112] In an embodiment of the present specification, based on the acquired asynchronous request information, it is determined whether there is an abnormal refreshing behavior; specifically, based on asynchronous request interception technology, all asynchronous request information is acquired, and if it is identified that the refreshing frequency of the target application has exceeded a preset refreshing threshold, it is determined that there is an abnormal risk;

[0113] In another embodiment of the present specification, based on the obtained information of the click coordinate point, it is judged whether there is an abnormal click behavior; specifically, based on the pixel ratio of the web interface window of the target application, the information of the electrode coordinate point is obtained, and compared with the operation information of the plurality of target applications, if it is identified that the user clicks at an abnormal position of the target application, it is determined that there is an abnormal click behavior. The abnormal position includes a coordinate point that the user has no access right.

[0114] In yet another embodiment of the present specification, based on the obtained encryption information of the identification information, it is judged whether there is an abnormal encryption and / or decryption behavior; specifically, the encryption information is data encryption through the combination of asymmetric encryption and unique identification, such as data encryption through the combination of RSA and unique identification; the encryption information can also be data encryption through the combination of symmetric encryption and unique identification, such as data encryption through the combination of AES and unique identification. If it is identified that the user uses other encryption methods for data transmission in the target application, it is determined that there is an abnormal encryption / decryption behavior. Through the encryption of the authentication encryption technology of the target application, different target applications are accurately distinguished based on the unique identification, and then it is judged whether the target application has an abnormal risk, so as to ensure the safety of data transmission.

[0115] S163 If it is found through real-time analysis of the current operation information that the current operation behavior has an abnormal risk, a pre-warning reminder and / or a pre-warning email is sent.

[0116] If it is identified through real-time analysis of the current operation information that the current operation behavior of the user corresponding to the current operation information has an abnormal risk, real-time pre-warning reminders are sent to relevant personnel, pre-warning emails are sent and / or pre-warning contents are displayed, so as to facilitate the relevant personnel to timely investigate and confirm whether there is a security loophole, and then timely handle the security hidden danger. The pre-warning reminder includes a sound reminder. The relevant personnel includes a user, a pre-warning processing person in charge, a burying point person in charge, etc. In an embodiment of the present specification, the pre-warning content includes a user name and a user behavior analysis result. If the relevant personnel thinks that part of the burying point code needs to be modified, the burying point code of the target application can be configured according to the pre-warning content, and based on the obtained configured burying point code of the target application, it is embedded into the corresponding position of the target application.

[0117] The following briefly describes the user association authentication process, such as Figure 3As shown, after identifying that the user enters the target application, it is judged whether the user has performed initial association authentication through the target application. If an authentication ticket corresponding to the user is identified, it is determined that the user has performed initial association authentication, and the target application is directly accessed. If no authentication ticket is identified, it is determined that the user has not performed initial association authentication. After performing initial association authentication, it is judged whether the initial association authentication is successful. If it is determined that the initial association authentication fails, the initial association authentication needs to be performed again. If it is determined that the initial association authentication is successful, the authentication ticket is carried to jump to the callback address of successful authentication, and then jump to the target application. When the authentication ticket carried by the target application is identified, login authentication information is returned to the target application based on the authentication ticket.

[0118] The behavior analysis process is briefly described as follows, for example, Figure 4 As shown, after identifying that the user accesses the target application, the operation information of the user in the target application is obtained and sent based on the buried point code under the condition that the user has authorized. Based on the received operation information of the user, and in combination with the operation information of the user in other target applications, it is analyzed in real time whether the current operation behavior corresponding to the current operation information is abnormal. If it is found that the current operation behavior of the user has abnormal risk, relevant personnel are immediately warned and reminded, and a warning email is sent and / or warning content is displayed. In the later period, the buried point code configured for the target application can be embedded into the corresponding position of the target application.

[0119] Figure 5 A structure schematic diagram of a system for judging abnormal risk based on operation information provided by an embodiment of the present specification is provided. The system comprises:

[0120] The association authentication module 510 is configured to be associated with the target application, and the buried point code for collecting abnormal information is embedded in the target application.

[0121] The ticket obtaining module 520 is configured to obtain the authentication ticket of the target application.

[0122] The authentication information exchange module 530 is configured to exchange login authentication information based on the authentication ticket, and return the login authentication information to the target application.

[0123] The information obtaining module 540 is configured to obtain the operation information of the target application based on the buried point code when it is identified that the target application is in a login state.

[0124] The risk analysis module 550 is configured to analyze in real time whether there is an abnormal risk in combination with the operation information of a plurality of target applications and the current operation information of the current target application.

[0125] In an embodiment of the present specification, the association judgment module is further included.

[0126] Wherein, the association judgment module includes:

[0127] An association determination submodule, configured to determine whether the user has performed initial association authentication through the target application;

[0128] A first association submodule is configured to, if the target application determines that the user has not performed initial association authentication, obtain identification information of the user, generate the authentication ticket based on the identification information, and send the authentication ticket to the target application to complete initial association authentication;

[0129] The second association submodule is configured to associate the target application with the authentication ticket based on the authentication ticket if the target application determines that the user has performed initial association authentication.

[0130] In one embodiment of this specification, the first association submodule includes:

[0131] A callback unit, configured to carry the authentication ticket and jump to a callback address if authentication is successful;

[0132] The association unit is used to send the authentication ticket to the target application through the callback address of the successful authentication to complete the initial association authentication.

[0133] In one embodiment of this specification, the association authentication module 510 includes:

[0134] The embedding submodule embeds the pre-configured embedding code in the target application based on the identification information, wherein the identification information includes: a unique identifier and an identification key, and the unique identifier corresponds to the identification key in a one-to-one manner.

[0135] In one embodiment of the present specification, the risk analysis module 550 includes:

[0136] A collection submodule, after authorization by the user, is used to collect the current operation information of the current target application;

[0137] an analysis submodule, configured to combine the operation information of the plurality of target applications, analyze the current operation information of the current target application in real time, and determine whether the current operation behavior corresponding to the current operation information has an abnormal risk;

[0138] The early warning submodule is used to send an early warning reminder and / or an early warning email if it is found that the current operation behavior has an abnormal risk through real-time analysis of the current operation information.

[0139] In one embodiment of this specification, the analysis submodule includes:

[0140] The first analysis unit is configured to determine whether there is abnormal refreshing behavior based on the obtained asynchronous request information.

[0141] and / or,

[0142] The second analysis unit is configured to determine whether there is abnormal clicking behavior based on the obtained information of the clicking coordinate point.

[0143] and / or,

[0144] The third analysis unit is configured to determine whether there is abnormal encryption and / or decryption behavior based on the obtained encryption information of the identification information.

[0145] The functions of the device of the embodiments of the present application have been described in the above-mentioned method embodiments, and thus the descriptions of the present embodiments are not described in detail, and the relevant descriptions in the foregoing embodiments can be referred to, which will not be described herein.

[0146] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can adopt a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can adopt a computer program product in the form of being implemented on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program codes.

[0147] The present application is described with reference to flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of the flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to produce a machine, so that the instructions executed by the computer or other programmable data processing devices produce a device implemented in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 an apparatus that implements the functions specified in the flow(s) or block(s).

[0148] These computer program instructions can also be stored in a computer readable storage medium that can direct the computer or other programmable data processing devices to work in a specific manner, so that the instructions stored in the computer readable storage medium produce a manufactured product including instruction apparatus, which implements the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 an apparatus that implements the functions specified in the flow(s) or block(s).

[0149] These computer program instructions can also be loaded into a computer or other programmable data processing devices, so that a series of operational steps are performed on the computer or other programmable devices to generate computer-implemented processes, thus the instructions executed on the computer or other programmable devices provide processes for implementing the functions specified in the flowchart Figure 1 one or more flows and / or blocks Figure 1 one or more blocks or steps of the functions specified in the flowchart

[0150] Obviously, those skilled in the art can make various modifications and variations to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application belong to the scope of the claims of the present application and their equivalent technologies, the present application also intends to include these modifications and variations.

Claims

1. A method for judging abnormal risk based on operation information, characterized in that: include: Associated with target applications, unified tracking of multiple target applications, and embedded tracking code for collecting abnormal information; After obtaining user authorization, collect the operation information of multiple target applications in a unified location; Obtaining an authentication ticket for the target application; exchanging the authentication ticket for login authentication information, and returning the login authentication information to the target application; When it is recognized that the target application is in a logged-in state, obtaining operation information of the target application based on the embedded code; Combine the operation information of multiple target applications and the current operation information of the current target application to analyze in real time whether there is an abnormal risk, wherein the current operation information of the current target application is collected; combine the operation information of multiple target applications, analyze the current operation information of the current target application in real time, and judge whether there is an abnormal risk in the current operation behavior corresponding to the current operation information; specifically, based on the obtained asynchronous request information, judge whether there is abnormal refresh behavior; and / or, based on the obtained information of the click coordinate point, judge whether there is abnormal click behavior; and / or, based on the obtained encryption information of the identification information, judge whether there is abnormal encryption and / or decryption behavior.

2. The method according to claim 1, wherein Before associating with the target application, the following steps are also included: Determining whether the user performs association authentication through the target application; If the target application determines that the user has not undergone association authentication, obtaining identification information of the user, generating the authentication ticket based on the identification information, and sending the authentication ticket to the target application to complete the initial association authentication; If it is determined by the target application that the user has been associated and authenticated, association is performed with the target application based on the authentication ticket.

3. The method according to claim 2, wherein The sending of the authentication ticket to the target application to complete the initial association authentication includes: Carry the authentication ticket and jump to the callback address of successful authentication; The authentication ticket is sent to the target application through the callback address of the successful authentication to complete the initial association authentication.

4. The method according to claim 2, wherein The unified tracking of the plurality of target applications and embedding of tracking code for collecting abnormal information include: Based on the identification information, the pre-configured embedding code is embedded in the target application.

5. The method according to claim 1, wherein The real-time analysis of whether there is an abnormal risk by combining the operation information of the plurality of target applications and the current operation information of the current target application includes: If the current operation behavior is found to have abnormal risks through real-time analysis of the current operation information, an early warning reminder and / or an early warning email will be sent.

6. A system for determining abnormal risk based on operation information, characterized in that: include: An associated authentication module is used to associate with a target application, perform unified tracking on multiple target applications, and embed tracking code that collects abnormal information; After obtaining user authorization, collect the operation information of multiple target applications in a unified location; A ticket acquisition module, used to obtain the authentication ticket of the target application; An authentication information exchange module, configured to exchange the authentication ticket for login authentication information and return the login authentication information to the target application; An information acquisition module, configured to acquire operation information of the target application based on the embedded code when identifying that the target application is in a logged-in state; A risk analysis module is used to analyze in real time whether there is an abnormal risk by combining the operation information of multiple target applications and the current operation information of the current target application. The risk analysis module includes: a collection submodule and an analysis submodule; the collection submodule is used to collect the current operation information of the current target application; the analysis submodule is used to combine the operation information of multiple target applications, analyze the current operation information of the current target application in real time, and determine whether the current operation behavior corresponding to the current operation information has an abnormal risk; The analysis submodule includes: A first analyzing unit is configured to determine whether there is abnormal refresh behavior based on the acquired asynchronous request information; and / or A second analysis unit is configured to determine whether there is abnormal click behavior based on the acquired click coordinate information; and / or The third analyzing unit is configured to determine whether there is abnormal encryption and / or decryption behavior based on the encrypted information of the acquired identification information.

7. The system according to claim 6, wherein: Also includes: Association judgment module; The association judgment module includes: An association determination submodule, configured to determine whether the user has performed association authentication through the target application; A first association submodule is configured to, if the target application determines that the user has not performed association authentication, obtain identification information of the user, generate the authentication ticket based on the identification information, and send the authentication ticket to the target application to complete the initial association authentication; The second association submodule is configured to associate the target application with the authentication ticket based on the authentication ticket if it is determined by the target application that the user has been authenticated.

8. The system according to claim 7, wherein: The first association submodule includes: A callback unit, configured to carry the authentication ticket and jump to a callback address if authentication is successful; The association unit is used to send the authentication ticket to the target application through the callback address of the successful authentication to complete the initial association authentication.

9. The system according to claim 7, wherein: The association authentication module includes: The embedding submodule embeds the pre-configured embedding code in the target application based on the identification information.

10. The system according to claim 6, wherein: The risk analysis module includes: The early warning submodule is used to send an early warning reminder and / or an early warning email if it is found that the current operation behavior has an abnormal risk through real-time analysis of the current operation information.

11. An electronic device, wherein: The electronic device includes: processor; and, A memory storing computer executable instructions which, when executed, cause the processor to perform the method according to any one of claims 1 to 5.

12. A computer-readable storage medium, wherein: The computer-readable storage medium stores one or more programs, and when the one or more programs are executed by a processor, the method of any one of claims 1 to 5 is implemented.

Images