SMS verification code attack protection method and device

Abstract

The present application provides a method and device for SMS verification code attack protection, which can be used in the financial field or other fields. The method includes: receiving a target user's request for obtaining a SMS verification code, the request for obtaining a SMS verification code includes: the target user's login operation information and login address information; obtaining the number of SMS verification codes sent to the target user within a preset time period according to the login operation information and login address information; judging whether the number of SMS verification codes sent exceeds the threshold of the number of SMS verification codes, and if so, rejecting the request for obtaining a SMS verification code, and completing the SMS verification code attack protection corresponding to the request for obtaining a SMS verification code. The present application can avoid the SMS bomb problem, improve the accuracy of SMS verification code attack protection, and thus improve the user experience.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a method and device for protecting against SMS verification code attacks. Background Art

[0002] This section is intended to provide a background or context to the embodiments of the invention recited in the claims. No admission is made that the description herein is prior art by inclusion in this section.

[0003] With the development and promotion of online banking around the world, online banking serves more and more customers. There are many scenarios in which online banking needs to send SMS verification codes or SMS notifications to customers to improve security. Online banking services have the ability to send large-scale group SMS messages. If this ability cannot be effectively protected, it may be used maliciously. For example, attackers use online banking to maliciously send a large number of spam SMS messages to designated mobile phone numbers to carry out SMS bomb attacks.

[0004] At present, graphic verification codes are usually used to prevent SMS verification code attacks; online banks require users to submit graphic verification codes before sending SMS verification codes to prevent robots from calling the SMS sending interface in large quantities.

[0005] However, there are still some problems with using graphic verification codes to protect against SMS verification code attacks: it only protects against the scene in which the SMS is triggered, and there is no control over the recipient's SMS bomb; it only prevents robot attacks, and cannot prevent manual attacks by a large number of customers at the same time, resulting in low reliability. Summary of the invention

[0006] In response to the problems in the prior art, the present application proposes a method and device for protecting against SMS verification code attacks, which can avoid the SMS bomb problem, improve the accuracy of SMS verification code attack protection, and thus enhance the user experience.

[0007] In order to solve the above technical problems, this application provides the following technical solutions:

[0008] In a first aspect, the present application provides a method for protecting against SMS verification code attacks, comprising:

[0009] Receive a target user's SMS verification code acquisition request, where the SMS verification code acquisition request includes: the target user's login operation information and login address information;

[0010] According to the login operation information and the login address information, obtaining the number of SMS verification codes sent to the target user within a preset time period;

[0011] Determine whether the number of SMS verification codes sent exceeds the SMS verification code number threshold. If so, reject the request to obtain the SMS verification code, and complete the SMS verification code attack protection corresponding to the request to obtain the SMS verification code.

[0012] Further, obtaining the number of SMS verification codes sent to the target user within a preset time period according to the login operation information and the login address information includes:

[0013] Determine whether the login operation information contains the target user's logged-in status identifier and the user unique identifier. If so, obtain the number of SMS verification codes sent to the target user within a preset time period based on the user unique identifier.

[0014] Further, obtaining the number of SMS verification codes sent to the target user within a preset time period according to the login operation information and the login address information includes:

[0015] Determine whether the login operation information contains a non-logged-in status identifier and user behavior information of the target user, and if so, determine whether the target user is a real user based on the user behavior information;

[0016] If the target user is a real user, the number of SMS verification codes sent to the target user within a preset time period is obtained according to the login address information.

[0017] Furthermore, judging whether the target user is a real user according to the user behavior information includes:

[0018] Determining whether the target user is a real user based on the user behavior information and a preset user classification model;

[0019] The preset user classification model is obtained by training a classification algorithm based on batch historical user behavior information and their corresponding labels, and the labels include: real user labels and non-real user labels.

[0020] Furthermore, before receiving the target user's SMS verification code acquisition request, the method further includes:

[0021] Receive a slider verification request from the target user;

[0022] According to the slider verification request, it is determined that the slider verification of the target user is passed.

[0023] Furthermore, the SMS verification code attack protection method further includes:

[0024] If the number of sent SMS verification codes does not exceed the SMS verification code number threshold, a SMS verification code is sent to the mobile communication device of the target user.

[0025] In a second aspect, the present application provides a SMS verification code attack protection device, comprising:

[0026] A receiving module, configured to receive a target user's SMS verification code acquisition request, the SMS verification code acquisition request including: the target user's login operation information and login address information;

[0027] An acquisition module, used to obtain the number of SMS verification codes sent to the target user within a preset time period according to the login operation information and the login address information;

[0028] The judgment module is used to judge whether the number of SMS verification codes sent exceeds the SMS verification code number threshold. If so, the request to obtain the SMS verification code is rejected, and the SMS verification code attack protection corresponding to the request to obtain the SMS verification code is completed.

[0029] Furthermore, the obtaining module includes:

[0030] The first obtaining unit is used to determine whether the login operation information contains the target user's logged-in status identifier and user unique identifier. If so, the number of SMS verification codes sent to the target user within a preset time period is obtained based on the user unique identifier.

[0031] Furthermore, the obtaining module includes:

[0032] A judging unit, configured to judge whether the login operation information includes a non-logged-in status identifier and user behavior information of the target user, and if so, judge whether the target user is a real user according to the user behavior information;

[0033] The second obtaining unit is used to obtain the number of SMS verification codes sent to the target user within a preset time period according to the login address information if the target user is a real user.

[0034] Furthermore, the judging unit includes:

[0035] A classification subunit, used to determine whether the target user is a real user based on the user behavior information and a preset user classification model;

[0036] The preset user classification model is obtained by training a classification algorithm based on batch historical user behavior information and their corresponding labels, and the labels include: real user labels and non-real user labels.

[0037] In a third aspect, the present application provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the SMS verification code attack protection method when executing the computer program.

[0038] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the SMS verification code attack protection method is implemented.

[0039] In a fifth aspect, the present application provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the SMS verification code attack protection method is implemented.

[0040] It can be seen from the above technical solution that the present application provides a method and device for protecting against SMS verification code attacks. The method includes: receiving a target user's request for obtaining a SMS verification code, the request for obtaining a SMS verification code includes: the target user's login operation information and login address information; obtaining the number of SMS verification codes sent to the target user within a preset time period according to the login operation information and login address information; judging whether the number of SMS verification codes sent exceeds the threshold of the number of SMS verification codes, and if so, rejecting the request for obtaining a SMS verification code, completing the SMS verification code attack protection corresponding to the request for obtaining a SMS verification code, avoiding the SMS bomb problem, improving the accuracy of SMS verification code attack protection, and thus improving the user experience; specifically, preventing SMS bombs while ensuring the normal ability to send SMS, ensuring the SMS sending function in different scenarios, providing customers with safe and available SMS services, and improving customer experience; using the server to record the number of SMS sent, providing a more rigorous ability to prevent SMS bombs. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0042] Figure 1 This is a first flow chart of the SMS verification code attack protection method in an embodiment of the present application;

[0043] Figure 2 It is a second flow chart of the SMS verification code attack protection method in an embodiment of the present application;

[0044] Figure 33 is a schematic diagram of a third process of the SMS verification code attack protection method in an embodiment of the present application;

[0045] Figure 4 4 is a schematic diagram of a fourth process of the SMS verification code attack protection method in an embodiment of the present application;

[0046] Figure 5 It is a structural diagram of the SMS verification code attack protection device in an embodiment of the present application. DETAILED DESCRIPTION

[0047] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0048] In order to facilitate the understanding of this solution, the technical contents related to this solution are explained below.

[0049] SMS bomb: Use Internet services to send repeated spam text messages to a mobile phone number to achieve harassment and prank effects.

[0050] Internet banking: Internet banking, also known as network banking, online banking or electronic banking, is a virtual counter set up by banks on the Internet. Banks use network technology to provide customers with inquiry, reconciliation, transfer, payment, credit, financial management and other services through the Internet, allowing customers to enjoy banking services anytime and anywhere as long as network conditions are met.

[0051] It should be noted that the SMS verification code attack protection method and device disclosed in this application can be used in the field of financial technology, and can also be used in any field other than the financial technology field. The application field of the SMS verification code attack protection method and device disclosed in this application is not limited. The acquisition, storage, use, and processing of data in the technical solution of this application are in compliance with the relevant provisions of national laws and regulations.

[0052] The details are described through the following embodiments.

[0053] In order to avoid the SMS bomb problem, improve the accuracy of SMS verification code attack protection, and thus improve the user experience, this embodiment provides a method for SMS verification code attack protection, in which the execution subject is a SMS verification code attack protection device, and the SMS verification code attack protection device includes but is not limited to a server, such as Figure 1 As shown, the method specifically includes the following contents:

[0054] Step 101: Receive a request from a target user for obtaining a text message verification code, where the request includes: login operation information and login address information of the target user.

[0055] Specifically, a request for obtaining a text message verification code sent by the target user at the front end can be received; when the target user is in a logged-in state, the login operation information can include: a logged-in state identifier and a user unique identifier; when the target user is in an offline state, the login operation information can include: a non-logged-in state identifier and user behavior information; "0" can be used to represent the logged-in state identifier, and "1" can be used to represent the non-logged-in state identifier; the user unique identifier is used to distinguish different users, and can be a string of numbers and letters, such as an account number or a mobile phone number; the login address information can be an IP address.

[0056] Step 102: According to the login operation information and the login address information, the number of SMS verification codes sent to the target user within a preset time period is obtained.

[0057] Specifically, the preset time period can be set according to actual needs, and this application does not impose any restrictions on this, such as 30 seconds or 1 minute.

[0058] Step 103: determine whether the number of SMS verification codes sent exceeds the SMS verification code number threshold. If so, reject the request to obtain the SMS verification code, and complete the SMS verification code attack protection corresponding to the request to obtain the SMS verification code.

[0059] Specifically, if the number of SMS verification codes sent exceeds the SMS verification code number threshold, the current operation is terminated and the SMS verification code attack protection corresponding to the SMS verification code acquisition request is completed; the alarm information corresponding to the SMS verification code acquisition request can also be output.

[0060] In order to achieve SMS verification code attack protection in the logged-in state and improve the accuracy of SMS verification code attack protection, see Figure 2 In one embodiment of the present application, step 102 includes:

[0061] Step 201: Determine whether the login operation information contains the target user's logged-in status identifier and user unique identifier. If so, obtain the number of SMS verification codes sent to the target user within a preset time period based on the user unique identifier.

[0062] Specifically, the server, i.e., the above-mentioned SMS verification code attack protection device, can be used to cache the target user's unique user identifier and the number of SMS verification codes sent within a preset time period corresponding to the unique user identifier; the number of SMS verification codes sent within a preset time period corresponding to the unique user identifier is obtained from the SMS verification code attack protection device cache, and determined as the number of SMS verification codes sent to the target user within the preset time period. Furthermore, if the number of SMS verification codes sent does not exceed the SMS verification code number threshold, the SMS verification code is sent to the target user's mobile communication device. After the SMS verification code is successfully sent, it can be determined whether the current system time has just completed a preset time period. If so, the number of SMS verification codes sent corresponding to the unique user identifier in the cache within the preset time period can be reset to 1. Otherwise, the number of SMS verification codes sent corresponding to the unique user identifier in the cache within the preset time period can be increased by 1.

[0063] That is to say, in the scenario where a text message verification code is sent after the target user logs into the online banking, the server cache can be used to record the number of times text messages are sent to the target user and control it.

[0064] In order to achieve SMS verification code attack protection when not logged in, and improve the accuracy of SMS verification code attack protection, see Figure 3 In one embodiment of the present application, step 102 includes:

[0065] Step 301: Determine whether the login operation information contains the target user's non-logged-in status identifier and user behavior information. If so, determine whether the target user is a real user based on the user behavior information.

[0066] Specifically, the user behavior information may include: mouse movement track, mouse movement speed, screen resolution, screen color depth, etc.

[0067] Step 302: If the target user is a real user, the number of SMS verification codes sent to the target user within a preset time period is obtained according to the login address information.

[0068] Specifically, since the target user is not logged in at this time, the server has not cached the user's unique identifier and the number of SMS verification codes sent within the preset time period corresponding to the login address information. The login address information can be used as a key element to record the number of SMS verification codes sent corresponding to the login address information within the preset time period through the database; the number of SMS verification codes sent corresponding to the login address information within the preset time period can be obtained from the database and determined as the number of SMS verification codes sent to the target user within the preset time period. Further, if the number of SMS verification codes sent does not exceed the threshold of the number of SMS verification codes, the SMS verification code is sent to the mobile communication device of the target user. After the SMS verification code is successfully sent, it can be determined whether the current system time has just completed a preset time period. If so, the number of SMS verification codes sent corresponding to the login address information in the database within the preset time period can be reset to 1. Otherwise, the number of SMS verification codes sent corresponding to the login address information in the database within the preset time period can be increased by 1.

[0069] That is to say, in the scenario where a text message verification code is sent when the customer is not logged in to the online banking, the server has no cache information control and can use the target user's IP information as a key factor to record the number of text messages sent when the target user is not logged in through the database and control it; it does not need to pay attention to which customers trigger the action of sending text messages, but only pays attention to the number of times text messages are sent to the recipient and controls it.

[0070] In order to further improve the accuracy and intelligence of SMS verification code attack protection, in one embodiment of the present application, judging whether the target user is a real user according to the user behavior information in step 301 includes:

[0071] Step 401: Determine whether the target user is a real user based on the user behavior information and a preset user classification model; wherein the preset user classification model is obtained by training a classification algorithm based on batch historical user behavior information and their respective corresponding labels, and the labels include: real user labels and non-real user labels.

[0072] Specifically, the classification algorithm may be a decision tree algorithm, a KNN algorithm, etc.; the user behavior information may be input into a preset user classification model, and whether the target user is a real user may be determined based on the output result of the preset user classification model.

[0073] To further improve the accuracy of SMS verification code attack protection, see Figure 4 In one embodiment of the present application, before step 101, the following steps are further included:

[0074] Step 501: Receive a slider verification request from a target user.

[0075] Step 502: Determine, according to the slider verification request, whether the slider verification of the target user is passed.

[0076] Specifically, in this embodiment, the SMS verification code can be sent to the target user's mobile communication device only after the target user manually completes the slider verification; that is, in the scenario of sending the SMS verification code to the target user's designated mobile phone number, the user is required to submit the slider verification before sending the SMS verification code, so as to prevent the robot from calling the SMS sending interface in large quantities.

[0077] In order to further illustrate this solution, this application provides an application example of a method for protecting against SMS verification code attacks, which specifically includes:

[0078] Step 1: Get the customer's designated mobile phone number.

[0079] Step 2: Provide slider verification to ensure that customers must manually complete the slider verification before sending SMS to the mobile phone number.

[0080] Step 3: When the customer is logged in, control the frequency of SMS messages sent by the customer.

[0081] Specifically, a login status cache mechanism can be established, and a counter can be set in the server cache to control the frequency of clients sending text messages; a recipient control mechanism can be established, and the server sets a counter according to the recipient to control the frequency of the recipient receiving text messages.

[0082] Step 4: When the customer is logged in, the number of times the SMS is sent to the customer is recorded through the server cache, and the frequency of sending SMS to the customer is controlled.

[0083] Step 5: Use the database to control the frequency of sending SMS to customers when they are not logged in; that is, by identifying the key factors of the customer when they are not logged in, and recording the number of SMS sent in the database, the frequency of sending SMS to customers is controlled.

[0084] Specifically, a database recording mechanism without login status can be established, key factors such as customer IP can be used to identify the actual service scenario, and database records can be used to control the frequency of sending text messages to customers.

[0085] Step 6: Control the frequency of the recipient receiving SMS messages on the server side; that is, record the number of times the recipient receives SMS messages and control the frequency of receiving SMS messages.

[0086] Step 7: Send a text message verification code to the customer's designated mobile phone number based on the frequency of the customer sending text messages.

[0087] From the above description, it can be seen that the SMS verification code attack protection method provided by this application example can control the frequency in the sending trigger, sending in the logged-in state, sending in the non-logged-in state, and recipient control links, solve the problem of SMS bombs, improve the ability to prevent SMS bombs, and achieve more complex scenario requirements; while meeting the normal use of customers, it protects the recipients to a greater extent.

[0088] In order to avoid the SMS bomb problem, improve the accuracy of SMS verification code attack protection, and thus improve user experience, the present application provides an embodiment of a SMS verification code attack protection device for implementing all or part of the contents of the SMS verification code attack protection method, see Figure 5 The SMS verification code attack protection device specifically includes the following contents:

[0089] The receiving module 10 is used to receive a request from a target user to obtain a text message verification code, where the request includes: login operation information and login address information of the target user;

[0090] The obtaining module 20 is used to obtain the number of SMS verification codes sent to the target user within a preset time period according to the login operation information and the login address information;

[0091] The judgment module 30 is used to judge whether the number of SMS verification codes sent exceeds the SMS verification code number threshold. If so, the request to obtain the SMS verification code is rejected, and the SMS verification code attack protection corresponding to the request to obtain the SMS verification code is completed.

[0092] In one embodiment of the present application, the obtaining module includes:

[0093] The first obtaining unit is used to determine whether the login operation information contains the target user's logged-in status identifier and user unique identifier. If so, the number of SMS verification codes sent to the target user within a preset time period is obtained based on the user unique identifier.

[0094] In one embodiment of the present application, the obtaining module includes:

[0095] A judging unit, configured to judge whether the login operation information includes a non-logged-in status identifier and user behavior information of the target user, and if so, judge whether the target user is a real user according to the user behavior information;

[0096] The second obtaining unit is used to obtain the number of SMS verification codes sent to the target user within a preset time period according to the login address information if the target user is a real user.

[0097] In one embodiment of the present application, the judging unit includes:

[0098] The classification subunit is used to determine whether the target user is a real user based on the user behavior information and a preset user classification model; wherein the preset user classification model is obtained by training a classification algorithm based on batch historical user behavior information and their respective corresponding labels, and the labels include: real user labels and non-real user labels.

[0099] The embodiment of the SMS verification code attack protection device provided in this specification can be specifically used to execute the processing flow of the embodiment of the above-mentioned SMS verification code attack protection method. Its functions are not repeated here, and reference can be made to the detailed description of the embodiment of the above-mentioned SMS verification code attack protection method.

[0100] An embodiment of the present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned SMS verification code attack protection method when executing the computer program.

[0101] An embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the above-mentioned SMS verification code attack protection method is implemented.

[0102] An embodiment of the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the above-mentioned SMS verification code attack protection method is implemented.

[0103] From the above description, it can be seen that the SMS verification code attack protection method and device provided by the present application can avoid the SMS bomb problem, can improve the accuracy of SMS verification code attack protection, and thus can improve the user experience; specifically, it can prevent SMS bombs while ensuring the normal ability to send SMS, can ensure the SMS sending function in different scenarios, and provide customers with safe and available SMS services.

[0104] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0105] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0106] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0107] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0108] The specific embodiments described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for protecting against SMS verification code attacks, characterized in that: include: Receive a target user's SMS verification code acquisition request, where the SMS verification code acquisition request includes: the target user's login operation information and login address information; According to the login operation information and the login address information, obtaining the number of SMS verification codes sent to the target user within a preset time period; Determine whether the number of SMS verification codes sent exceeds the SMS verification code number threshold, and if so, reject the request to obtain the SMS verification code, and complete the SMS verification code attack protection corresponding to the request to obtain the SMS verification code; The obtaining, according to the login operation information and the login address information, the number of SMS verification codes sent to the target user within a preset time period includes: Determine whether the login operation information contains a non-logged-in status identifier and user behavior information of the target user. If so, determine whether the target user is a real user based on the user behavior information, wherein the user behavior information includes: mouse movement trajectory, mouse movement speed, screen resolution, and screen color depth; If the target user is a real user, then obtaining the number of SMS verification codes sent to the target user within a preset time period according to the login address information; The determining, based on the user behavior information, whether the target user is a real user includes: Determining whether the target user is a real user based on the user behavior information and a preset user classification model; The preset user classification model is obtained by training the classification algorithm based on batch historical user behavior information and their corresponding labels, and the labels include: real user labels and non-real user labels; The SMS verification code attack protection method further includes: If the number of SMS verification codes sent does not exceed the SMS verification code number threshold, then send the SMS verification code to the target user's mobile communication device. After the SMS verification code is sent successfully, determine whether the current system time has completed a preset time period. If so, reset the number of SMS verification codes sent corresponding to the login address information in the database within the preset time period to 1; otherwise, add 1 to the number of SMS verification codes sent corresponding to the login address information in the database within the preset time period. The obtaining, according to the login address information, the number of SMS verification codes sent to the target user within a preset time period includes: The number of SMS verification codes sent within a preset time period corresponding to the login address information is obtained from a database, and determined as the number of SMS verification codes sent to the target user within the preset time period.

2. The SMS verification code attack protection method according to claim 1, characterized in that: The obtaining, according to the login operation information and the login address information, the number of SMS verification codes sent to the target user within a preset time period includes: Determine whether the login operation information contains the target user's logged-in status identifier and the user unique identifier. If so, obtain the number of SMS verification codes sent to the target user within a preset time period based on the user unique identifier.

3. The SMS verification code attack protection method according to claim 1, characterized in that: Before receiving the target user's request for obtaining the SMS verification code, the method further includes: Receive a slider verification request from the target user; According to the slider verification request, it is determined that the slider verification of the target user is passed.

4. The SMS verification code attack protection method according to claim 1, characterized in that: Also includes: If the number of sent SMS verification codes does not exceed the SMS verification code number threshold, a SMS verification code is sent to the mobile communication device of the target user.

5. A SMS verification code attack protection device, characterized in that: include: A receiving module, configured to receive a target user's SMS verification code acquisition request, the SMS verification code acquisition request including: the target user's login operation information and login address information; An acquisition module, used to obtain the number of SMS verification codes sent to the target user within a preset time period according to the login operation information and the login address information; A judgment module, used to judge whether the number of SMS verification codes sent exceeds the SMS verification code number threshold, and if so, reject the request to obtain the SMS verification code, and complete the SMS verification code attack protection corresponding to the request to obtain the SMS verification code; The acquisition module comprises: A judging unit, configured to judge whether the login operation information includes a non-logged-in status identifier and user behavior information of the target user, and if so, to judge whether the target user is a real user according to the user behavior information, wherein the user behavior information includes: mouse movement track, mouse movement speed, screen resolution, and screen color depth; A second obtaining unit is used to obtain the number of SMS verification codes sent to the target user within a preset time period according to the login address information if the target user is a real user; The judging unit comprises: A classification subunit, used to determine whether the target user is a real user based on the user behavior information and a preset user classification model; The preset user classification model is obtained by training the classification algorithm based on batch historical user behavior information and their corresponding labels, and the labels include: real user labels and non-real user labels; The SMS verification code attack protection device is also used for: If the number of SMS verification codes sent does not exceed the SMS verification code number threshold, then send the SMS verification code to the target user's mobile communication device. After the SMS verification code is sent successfully, determine whether the current system time has completed a preset time period. If so, reset the number of SMS verification codes sent corresponding to the login address information in the database within the preset time period to 1; otherwise, add 1 to the number of SMS verification codes sent corresponding to the login address information in the database within the preset time period. The obtaining, according to the login address information, the number of SMS verification codes sent to the target user within a preset time period includes: The number of SMS verification codes sent within a preset time period corresponding to the login address information is obtained from a database, and determined as the number of SMS verification codes sent to the target user within the preset time period.

6. The SMS verification code attack protection device according to claim 5, characterized in that: The acquisition module comprises: The first obtaining unit is used to determine whether the login operation information contains the target user's logged-in status identifier and user unique identifier. If so, the number of SMS verification codes sent to the target user within a preset time period is obtained based on the user unique identifier.

7. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the SMS verification code attack protection method described in any one of claims 1 to 4 is implemented.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the SMS verification code attack protection method according to any one of claims 1 to 4 is implemented.

9. A computer program product, characterized in that The computer program product includes a computer program, and when the computer program is executed by a processor, the SMS verification code attack protection method according to any one of claims 1 to 4 is implemented.

Images