Network anomaly event prevention method and device, electronic equipment and storage medium

Abstract

The application discloses a network abnormal event prevention method and device, electronic equipment and storage medium, and relates to the technical field of computers, and the method comprises the following steps: setting corresponding binding terminals and corresponding auxiliary account numbers for preset account data, so that when a user logs in an application program or a website by using the account data through a terminal, the comparison between the account data and the preset account data can be used as the first layer guarantee for authentication, and when a network abnormal event is detected subsequently, the authentication of the auxiliary account number is further provided, so that the security of the terminal logging in the application program or the website is guaranteed, and the security of other operations on the network is also guaranteed, and the network abnormal event prevention is greatly improved.

Description

Technical Field

[0001] This invention relates to the field of network technology, and in particular to a method, device, electronic device, and storage medium for preventing network anomalies. Background Technology

[0002] With the development of network technology, in order to protect users' interests, more and more applications or websites require corresponding accounts and passwords to log in to the application or website under the user's name and perform related operations on the functions provided therein.

[0003] However, some malicious individuals can use illegally obtained accounts and passwords to log into applications under the relevant usernames on other devices, and then carry out illegal operations on the applications and websites, causing losses to users. Summary of the Invention

[0004] To address the problems of existing technologies, embodiments of the present invention provide a method, apparatus, electronic device, and storage medium for preventing network anomalies. The technical solution is as follows:

[0005] Firstly, a method for preventing network anomalies is provided, the method including:

[0006] Retrieve the currently entered account and password data; the account and password data includes account information and password information.

[0007] If the account password data and the pre-stored account password data match, and the pre-stored account password data has a corresponding auxiliary account, and an abnormal network event is detected, an abnormal event authentication instruction is sent to the auxiliary terminal corresponding to the auxiliary account; the abnormal event authentication instruction contains abnormal event authentication information; wherein, the abnormal event authentication instruction is used to instruct the auxiliary terminal to complete the authentication based on the abnormal event authentication information.

[0008] Receive abnormal event authentication feedback sent by the auxiliary terminal.

[0009] Secondly, a device for preventing network anomalies is provided, the device comprising:

[0010] The account password data acquisition module is used to acquire the currently input account password data; the account password data includes account data and password data.

[0011] The sending module is used to send an abnormal event authentication command to the auxiliary terminal corresponding to the auxiliary account if an abnormal network event is detected, when the account password data and the pre-stored account password data match and the pre-stored account password data has a corresponding auxiliary account; the abnormal event authentication command contains abnormal event authentication information; wherein, the abnormal event authentication command is used to instruct the auxiliary terminal to complete the authentication according to the abnormal event authentication information.

[0012] The receiving module is used to receive authentication feedback for abnormal events sent by the auxiliary terminal.

[0013] Thirdly, a method for preventing network anomalies is provided, which includes:

[0014] Receive abnormal event authentication command; the abnormal event authentication command contains abnormal event authentication information; the abnormal event authentication command is sent by the terminal under the condition that preset conditions are met; wherein, the preset conditions include the detection of a network abnormal event when the account and password data of the current input terminal match the pre-stored account and password data, and the pre-stored account and password data has a corresponding auxiliary account; the account and password data includes account data and password data;

[0015] Displays authentication information for abnormal events;

[0016] In response to the authentication trigger operation, authentication is completed based on the authentication information of the abnormal event.

[0017] Send abnormal event authentication feedback.

[0018] Fourthly, a device for preventing network anomalies is provided, the device comprising:

[0019] The instruction receiving module is used to receive abnormal event authentication instructions. The abnormal event authentication instructions contain abnormal event authentication information. The abnormal event authentication instructions are sent by the terminal when preset conditions are met. The preset conditions include detecting a network abnormal event when the account and password data of the current input terminal match the pre-stored account and password data and the pre-stored account and password data has a corresponding auxiliary account. The account and password data includes account data and password data.

[0020] The display module is used to display authentication information for abnormal events;

[0021] The authentication module is used to respond to authentication trigger operations and complete authentication based on the authentication information of abnormal events;

[0022] The feedback sending module is used to send authentication feedback for abnormal events.

[0023] Fifthly, an electronic device is provided, including a processor and a memory, wherein the memory stores at least one instruction or at least one program, the at least one instruction or at least one program being loaded and executed by the processor to implement the network anomaly prevention method as described in the first or third aspects above.

[0024] In a sixth aspect, a computer-readable storage medium is provided, wherein at least one instruction or at least one program is stored therein, and the at least one instruction or at least one program is loaded and executed by a processor to implement the network anomaly prevention method as described in the first or third aspect above.

[0025] In a seventh aspect, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the network anomaly prevention method provided in the first or third aspect.

[0026] This invention provides a first layer of authentication by setting a corresponding bound terminal and an auxiliary account for preset account and password data. When a user logs into an application or website using the preset account and password data on the terminal, the comparison between the current account and password data and the preset account and password data serves as the first layer of authentication. In the event of a subsequent network anomaly, authentication of the auxiliary account is also provided. This not only ensures the security of the terminal logging into the application or website, but also provides security for other operations on the network, greatly improving the prevention of network anomalies. Attached Figure Description

[0027] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0028] Figure 1 This is a schematic diagram of an implementation environment provided by an embodiment of the present invention;

[0029] Figure 2 This is a schematic diagram of an implementation environment provided by an embodiment of the present invention;

[0030] Figure 3 This is a flowchart illustrating a method for preventing network anomalies provided in an embodiment of the present invention;

[0031] Figure 4 This is a schematic diagram of a login page provided in an embodiment of the present invention;

[0032] Figure 5 This is a schematic diagram of a terminal binding and adding page provided in an embodiment of the present invention;

[0033] Figure 6 This is a schematic diagram of an auxiliary account addition page provided in an embodiment of the present invention;

[0034] Figure 7 This is a flowchart illustrating a method for preventing login anomalies provided in an embodiment of the present invention;

[0035] Figure 8 This is a flowchart illustrating a method for preventing login anomalies provided in an embodiment of the present invention;

[0036] Figure 9 This is a flowchart illustrating a method for preventing login anomalies provided in an embodiment of the present invention;

[0037] Figure 10 This is a flowchart illustrating a method for preventing login anomalies provided in an embodiment of the present invention;

[0038] Figure 11 This is a flowchart illustrating a method for preventing login anomalies provided in an embodiment of the present invention;

[0039] Figure 12 This is a flowchart illustrating a method for preventing login anomalies provided in an embodiment of the present invention;

[0040] Figure 13 This is a schematic diagram of a process for determining authentication information for abnormal events provided by an embodiment of the present invention;

[0041] Figure 14 This is a flowchart illustrating a method for preventing network anomalies provided in an embodiment of the present invention;

[0042] Figure 15 This is a schematic diagram of an auxiliary authentication prompt message provided in an embodiment of the present invention;

[0043] Figure 16 This is a structural block diagram of a network anomaly prevention device provided in an embodiment of the present invention;

[0044] Figure 17 This is a structural block diagram of a network anomaly prevention device provided in an embodiment of the present invention;

[0045] Figure 18 This is a hardware structure block diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0046] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0047] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or server that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0048] In related technologies, users enter their username and password into a mobile application or PC website. If the username and password match the preset username and password, they can immediately log in to the application or website. However, in this approach, usernames and passwords are easily obtained illegally by malicious individuals. Therefore, to ensure account security, an alternative implementation can provide further protection by binding a phone number. Specifically, users bind their phone number to their account via their mobile phone and send the phone number to the server providing the application or website for storage. When the entered username and password match the preset username and password, the server can send a verification code to the terminal associated with that phone number. After obtaining the verification code, the user enters it on a verification code input page. If the verification code matches the phone number bound to the account, the user can log in to the application or website; otherwise, the login fails.

[0049] Another alternative implementation can be further secured through user liveness verification. Liveness verification is a method of verifying whether a user is the actual person. Common liveness verification methods include actions such as opening the mouth, nodding, blinking, or turning the head, or fingerprint verification, iris verification, etc. Specifically, the user binds their facial information obtained through facial recognition to their account via their mobile phone, and stores it on the user's device. When the entered account and password match the preset account and password, the user's device can display a facial recognition box on the page and prompt the user to complete the current facial recognition as required. If the facial information obtained by the current facial recognition matches the previously stored facial information, the user can log in to the application or website; otherwise, the login fails.

[0050] While the aforementioned technical solutions offer some protection for account security, technological advancements mean that, regarding the first technical solution, malicious individuals may attempt to illegally intercept verification information and obtain verification codes using certain devices, or obtain them through fraudulent means. Regarding the second technical solution, with the gradual maturation of AI technology, liveness verification may also present security vulnerabilities. All of these methods can lead to malicious individuals stealing accounts, causing financial losses for users, and compromising user privacy.

[0051] In view of this, embodiments of the present invention provide a method for preventing network anomalies. This method sets up a corresponding auxiliary account for preset account and password data, so that when a user logs into an application or website using the account and password data on a terminal, the comparison between the account and password data and the preset account and password data can serve as the first layer of authentication. When a network anomaly is detected, authentication of the auxiliary account is also provided, which not only ensures the security of the terminal logging into the application or website, but also provides security for other operations on the network.

[0052] Please see Figure 1 The diagram shown is a schematic diagram of an implementation environment provided by an embodiment of the present invention. The implementation environment may include a terminal 101 and an auxiliary terminal 102.

[0053] Terminal 101 is a device that, after confirming that the input password data matches the preset password data, can send an abnormal event authentication command to the auxiliary terminal when an abnormal network event is detected. The auxiliary terminal 102 is a device that provides abnormal event authentication when terminal 101 detects a network abnormal event after passing the initial verification.

[0054] Optionally, the aforementioned terminal 101 and auxiliary terminal 102 may be, but are not limited to, electronic devices such as smartphones, desktop computers, tablets, laptops, smart speakers, digital assistants, augmented reality (AR) / virtual reality (VR) devices, and smart wearable devices. They may also be software running on the aforementioned electronic devices, such as applications or mini-programs. Optionally, the operating system running on the electronic device may include, but is not limited to, Android, iOS, Linux, Windows, and Unix systems.

[0055] In one alternative implementation, since the application and website are provided by a company, that company must have a server providing the service; please refer to [link to relevant documentation]. Figure 2 The diagram shown is an implementation environment provided by an embodiment of the present invention. The implementation environment may include a terminal 201, a server 202, and an auxiliary terminal 203.

[0056] Terminal 201 is a device that, after confirming that the input password data matches the preset password data, can send an abnormal event authentication command to the auxiliary terminal when an abnormal network event is detected. The auxiliary terminal 203 is a device used to provide abnormal event authentication when terminal 201 detects a network abnormal event after passing the initial verification.

[0057] Optionally, the aforementioned terminal 201 and auxiliary terminal 203 may be, but are not limited to, electronic devices such as smartphones, desktop computers, tablets, laptops, smart speakers, digital assistants, augmented reality (AR) / virtual reality (VR) devices, and smart wearable devices. They may also be software running on the aforementioned electronic devices, such as applications or mini-programs. Optionally, the operating system running on the electronic device may include, but is not limited to, Android, iOS, Linux, Windows, and Unix systems.

[0058] In practical applications, information exchange can be ensured between terminal 201 and server 202, and between server 202 and auxiliary terminal 203, through wireless links. Optionally, server 202 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. This invention does not impose any limitations on these aspects.

[0059] Cloud computing is a computing model that distributes computing tasks across a large pool of computers, enabling various application systems to access computing power, storage space, and information services as needed. The network providing these resources is called the "cloud." From the user's perspective, resources in the "cloud" appear infinitely scalable, readily available, on-demand, and expandable, with payment based on usage. As a provider of fundamental cloud computing capabilities, a cloud resource pool (referred to as a cloud platform, generally called an IaaS (Infrastructure as a Service) platform) is established. Various types of virtual resources are deployed within this pool for external customers to choose from. The cloud resource pool mainly includes: computing devices (virtualized machines containing operating systems), storage devices, and network devices. Logically, a PaaS (Platform as a Service) layer can be deployed on top of the IaaS layer, and a SaaS (Software as a Service) layer can be deployed on top of the PaaS layer. Alternatively, SaaS can be directly deployed on top of IaaS. PaaS is a platform for running software, such as databases and web containers. SaaS refers to various types of business software, such as web portals and bulk SMS senders. Generally, SaaS and PaaS are upper layers compared to IaaS.

[0060] Please see Figure 3 The diagram shown is a flowchart illustrating a method for preventing network anomalies according to an embodiment of the present invention. This method can be applied to... Figure 1 or Figure 2 The system shown is illustrated. It should be noted that this specification provides the operational steps of the methods described in the embodiments or flowcharts, but based on conventional or non-inventive labor, more or fewer operational steps may be included. The order of steps listed in the embodiments is merely one possible execution order among many and does not represent the only execution order. In actual system or product execution, the methods shown in the embodiments or drawings can be executed sequentially or in parallel (e.g., in a parallel processor or multi-threaded processing environment). Specifically, as shown... Figure 3 As shown, the method is applicable to terminals or servers and includes:

[0061] S301: Obtain the currently entered account and password data; where the account and password data includes account data and password data.

[0062] In an optional embodiment, the currently entered account and password data is the account and password data used by the user to log in to the application or website via a terminal. Optionally, the aforementioned application can be a variety of applications, such as instant messaging applications, lifestyle shopping applications, entertainment game applications, and travel applications, etc. Similarly, the website can also be an instant messaging website, a lifestyle shopping website, an entertainment game website, and a travel website, etc.

[0063] In an optional implementation, step S301 is not the account initialization step. Before the terminal obtains the currently entered account password data, the account initialization step may also be included.

[0064] Specifically, when a user initially logs into an application or website through a terminal, the terminal may display the following: Figure 4 The login page 401 shown includes the account input area 402, password input area 403, and first confirmation trigger area 404 located on the login page 401.

[0065] After the user enters their account in the account input area 402 and their password in the password input area 403, they can click the first confirmation trigger area to activate the terminal and save the account and password as pre-stored account and password data. Once the terminal has saved the pre-stored account and password data, it can display the following: Figure 5 The binding terminal addition page 500 is shown, as well as the binding terminal addition area 501 and the second determination trigger area 502 located on the binding terminal addition page 500.

[0066] In an optional embodiment, the binding terminal adding area 501 includes, as follows: Figure 5 The diagram shows the current terminal addition area 5011 and other terminal addition areas 5012. The device identifier in the current terminal addition area 5011 can be obtained by the terminal itself and displayed in the current terminal addition area 5011. The device identifier in the other terminal addition area 5012 can be entered by the user. When the second confirmation trigger area 502 is clicked by the user, the entered device identifier can be saved and bound to the pre-stored account password data. The terminal corresponding to the device identifier is then used as the bound terminal for the pre-stored account password data.

[0067] In another optional embodiment, the device identifier in the binding terminal addition area 501 can be entered by the user. When the second determination trigger area 502 is clicked by the user, the entered device identifier can be saved, and the device identifier can be bound to the pre-stored account password data. The terminal corresponding to the device identifier can be used as the binding terminal of the pre-stored account password data.

[0068] Optionally, the number of device identifiers that can be entered is limited; for example, only five slots can be provided. Alternatively, it can be unlimited, with more input fields displayed based on the user's binding instructions.

[0069] Once the terminal has saved the device identifier of the bound terminal, it can display as follows: Figure 6 The auxiliary account addition page 600 shown includes the auxiliary account addition area 601 and the third confirmation trigger area 602.

[0070] In one optional embodiment, the auxiliary account addition area 601 may include one auxiliary account. In another optional embodiment, for the sake of security and comprehensiveness in the verification process, the auxiliary account addition area 601 may include multiple auxiliary account input boxes.

[0071] In an optional embodiment, the owners of one or more auxiliary accounts can be the user's own friends. In instant messaging, the auxiliary accounts and the user's own accounts are likely to be friends. Furthermore, the auxiliary accounts can be specific accounts selected by the server from the user's friends. After the terminal saves the auxiliary accounts, it can send the pre-stored account password data and the association between the auxiliary accounts to the server for storage. Optionally, during initial account setup, the user can add at least a preset number of auxiliary accounts according to the instructions.

[0072] Optionally, to further ensure the thoroughness of the verification process, certain requirements may be imposed on auxiliary accounts (reputation requirements, user loyalty requirements, etc.). For example, only accounts that have been registered for a certain period of time, have activated certain preset functions (such as payment functions), and / or have not been banned in the recent period of time are eligible to become auxiliary accounts for other users.

[0073] In an optional embodiment, the account password data, the device identifier of the bound terminal, and the auxiliary account during the initial account setup process can be saved step by step by clicking the first trigger area 404, the second trigger area 502, and the third trigger area 602. This avoids the need to start the input process again each time due to unforeseen circumstances (such as the terminal unexpectedly shutting down or freezing).

[0074] In another alternative embodiment, clicking the first trigger area 404 and the second trigger area 502 is only used to switch pages, and only when the third trigger area 602 is clicked can a unified saving be performed.

[0075] Therefore, by completing all the steps of the initial account setup described above, the pre-stored account and password data are set up, and the device lock achieved through binding the terminal and auxiliary account ensures account security. The device identifier of the bound terminal and the auxiliary account can be saved locally in a bitmap format using a lossless compression algorithm.

[0076] S303: If the account password data and the pre-stored account password data match, and the pre-stored account password data has a corresponding auxiliary account, and an abnormal network event is detected, an abnormal event authentication instruction is sent to the auxiliary terminal corresponding to the auxiliary account; the abnormal event authentication instruction contains abnormal event authentication information; wherein, the abnormal event authentication instruction is used to instruct the auxiliary terminal to complete the authentication based on the abnormal event authentication information.

[0077] In this embodiment of the disclosure, to ensure user security, abnormal events may include at least one of the following: abnormal transfer events, abnormal login events, and abnormal friend deletion events. The abnormal events described above will be elaborated upon below.

[0078] The following example illustrates a login anomaly, which mainly involves login device anomalies, including logging into a network account without a bound device. Figure 7 A flowchart illustrating a method for preventing login anomalies provided in an embodiment of the present invention includes:

[0079] S701: Determine whether the account password data matches the pre-stored account password data, and whether the pre-stored account password data has a corresponding auxiliary account. If both are true, proceed to step S703; if the account password data does not match the pre-stored account password data, proceed to step S713; if the account password data matches the pre-stored account password data, but there is no corresponding auxiliary account, proceed to step S715.

[0080] In an optional embodiment, when the content of step S301 is not the currently entered account and password data obtained during the initial account setup, but rather the account and password data entered by the user when logging in later, the terminal needs to determine whether the currently entered account and password data matches the pre-stored account and password data. If they do not match, a login failure message can be displayed as shown in step S713 below. Further, the terminal can display an error message to indicate that the entered account data and / or password data is incorrect and to request re-entry.

[0081] In another optional embodiment, if the account password data matches the pre-stored account password data, but the pre-stored account password data does not have a corresponding auxiliary account, this situation can be considered as the user not adding an auxiliary account when initially setting up the account. Alternatively, previous versions of the application or website did not have the auxiliary account addition function, and the auxiliary account addition function was only added in the latest iteration. In this case, the terminal can, as shown in step S715, respond to the user's auxiliary account addition operation, jump to the auxiliary account addition page, and prompt the user to add and save the auxiliary account on this auxiliary account addition page.

[0082] S703: Determine the terminal identifier of the terminal that uses account and password data to log in to an application or website.

[0083] S705: Determine if the pre-stored account password data exists in the corresponding bound terminal. If so, proceed to step S707.

[0084] S707: Obtain the device identifier of the above-mentioned bound terminal.

[0085] In an optional embodiment, the terminal can skip step S705 and directly obtain the device identifier of the bound device. If it can obtain it, it continues with step S709 to determine whether the device identifier and the terminal identifier match.

[0086] In another optional embodiment, the terminal device can first determine whether the pre-stored account password data has a corresponding bound terminal. Specifically, the terminal can determine whether the pre-stored account password data has a corresponding bound terminal by detecting whether the device identifier storage area stores a field. If the device identifier storage area does not store a field, that is, the device identifier storage area is empty, then there is no corresponding bound device. Otherwise, the device identifier of the bound device can be obtained.

[0087] S709: Determine whether the device identifier and the terminal identifier match. If not, proceed to step S711; if yes, proceed to step S717.

[0088] In an optional embodiment, if the device identifier of the terminal matches the terminal identifier, or if the terminal identifier exists among the device identifiers of multiple terminals, then the terminal determines that it is the already bound device, and therefore does not need to log in to the application or the website through other means, as shown in step S717.

[0089] S711: Sends an abnormal event authentication command to the auxiliary terminal corresponding to the auxiliary account.

[0090] S713: Displays a login failure message.

[0091] S715: Redirect to the auxiliary account addition page, prompting you to add an auxiliary account and save it on this auxiliary account addition page, then proceed to step S703.

[0092] S717: Log in to an application or website.

[0093] Optionally, steps S701-S717 above are a feasible method for preventing network anomalies, and the order of some implementation steps can be adjusted. For example, in step S701, after the terminal determines that the currently input account password data matches the pre-stored account password data, that is, after determining that the input account password data is the pre-stored account password data, it can attempt to obtain the bound terminal corresponding to the pre-stored account password data, that is, the device identifier of the bound terminal. If it cannot obtain it, this situation can be considered as the user not binding any devices when initially setting up the account. Alternatively, the application or website did not have the device binding function in previous versions, and the device binding function was only added in the latest iteration. In this case, in response to the user's first trigger operation (clicking the "Add Bind Terminal" button on the screen), the terminal can jump to the terminal binding page to indicate to the user to perform the terminal binding operation in the terminal binding area. For specific device binding operations, please refer to the description above, which will not be repeated here.

[0094] Figure 7 The corresponding implementation allows users to determine the compliance of a terminal to be verified by comparing the user's password data with the preset password data and comparing the identifier of the terminal to be verified with the identifier of the bound terminal when logging into an application or website using the user's password data. At the same time, it also provides auxiliary account authentication for terminals that fail the comparison, which not only ensures the security of the terminal to be verified when logging into the application or website, but also provides a more flexible and varied login method.

[0095] The following example illustrates a login anomaly, primarily involving abnormal login addresses, including logging into a network account from a different location. Figure 8 A flowchart illustrating a method for preventing login anomalies provided in an embodiment of the present invention includes:

[0096] S801: Determine whether the account password data matches the pre-stored account password data, and whether the pre-stored account password data has a corresponding auxiliary account. If both are true, proceed to step S803; if the account password data does not match the pre-stored account password data, proceed to step S811; if the account password data matches the pre-stored account password data, but there is no corresponding auxiliary account, proceed to step S813.

[0097] In an optional embodiment, when the content of step S301 is not the currently entered account and password data obtained during the initial account setup, but rather the account and password data entered by the user when they want to log in later, the terminal needs to determine whether the currently entered account and password data matches the pre-stored account and password data. If they do not match, a login failure message can be displayed as shown in step S811 below. Further, the terminal can display an error message to indicate that the entered account data and / or password data is incorrect and to request re-entry.

[0098] In another optional embodiment, if the account password data matches the pre-stored account password data, but the pre-stored account password data does not have a corresponding auxiliary account, this situation can be considered as the user not adding an auxiliary account when initially setting up the account. Alternatively, previous versions of the application or website did not have the auxiliary account addition function, and the auxiliary account addition function was only added in the latest iteration. In this case, the terminal can, as shown in step S813, respond to the user's auxiliary account addition operation, jump to the auxiliary account addition page, and prompt the user to add and save the auxiliary account on this auxiliary account addition page.

[0099] S803: Determine the current login address used to log in to the application or website using the account and password data.

[0100] In an optional embodiment, the terminal may use a positioning device to determine the address where the terminal is located and use that address as the current login address.

[0101] S805: Retrieve the historical login address corresponding to the preset account password data.

[0102] In this embodiment of the disclosure, the aforementioned historical login address can be preset by the user, or it can be a historical login address obtained by the terminal based on previous successful login history. Optionally, the aforementioned current login address and historical login address can be a city.

[0103] S807: Determine whether the current login address and the historical login address match. If not, proceed to step S809; if yes, proceed to step S815.

[0104] In an optional embodiment, if the previous login address and the historical login address match successfully, or in other words, the terminal determines that the current login address is the same as the historical login address, and it can be determined that the terminal has not logged in from a different location, then the terminal can log in to the application or the website as shown in step S815.

[0105] S809: Send an abnormal event authentication command to the auxiliary terminal corresponding to the auxiliary account.

[0106] S811: Displays a login failure message.

[0107] S813: Redirect to the auxiliary account addition page, prompting you to add an auxiliary account and save it on this auxiliary account addition page, then proceed to step S803.

[0108] S815: Log in to the application or website.

[0109] Figure 8 The corresponding implementation allows users to log in to applications or websites using their username and password data via a terminal. This provides a first layer of security by comparing the username and password data with preset username and password data, and provides auxiliary account authentication to identify terminals logging in from different locations, preventing malicious individuals from logging into accounts from other locations.

[0110] The following explanation uses one type of abnormal transfer event as an example, mainly involving abnormal large-amount transfer events, abnormal account events, and abnormal short-term frequent transfer events. Figure 9 A flowchart illustrating a method for preventing abnormal transfer events provided in an embodiment of the present invention includes:

[0111] S901: Determine whether the account password data matches the pre-stored account password data, and whether the pre-stored account password data has a corresponding auxiliary account. If both are true, proceed to step S903; if the account password data does not match the pre-stored account password data, proceed to step S907; if the account password data matches the pre-stored account password data, but there is no corresponding auxiliary account, proceed to step S909.

[0112] In an optional embodiment, when the content of step S301 is not the currently entered account and password data obtained during the initial account setup, but rather the account and password data entered by the user when they want to log in later, the terminal needs to determine whether the currently entered account and password data matches the pre-stored account and password data. If they do not match, a login failure message can be displayed as shown in step S907 below. Further, the terminal can display an error message to indicate that the entered account data and / or password data is incorrect and to request re-entry.

[0113] In another optional embodiment, if the account password data matches the pre-stored account password data, but the pre-stored account password data does not have a corresponding auxiliary account, this situation can be considered as the user not adding an auxiliary account when initially setting up the account. Alternatively, previous versions of the application or website did not have the auxiliary account addition function, and the auxiliary account addition function was only added in the latest iteration. In this case, the terminal can, as shown in step S909, respond to the user's auxiliary account addition operation, jump to the auxiliary account addition page, and prompt the user to add and save the auxiliary account on this auxiliary account addition page.

[0114] S903: Determine whether an abnormal transfer event has been detected. If so, proceed to step S905.

[0115] Figure 10 A flowchart illustrating a method for preventing abnormal transfer events provided in an embodiment of the present invention includes:

[0116] S1001: Log in to the application or website.

[0117] In an optional embodiment, the terminal can directly log in to the application or website as long as it determines that the input account password data matches the pre-stored account password data.

[0118] In another alternative embodiment, the transfer anomaly event can be combined with a login anomaly event. This includes:

[0119] In the first scenario, the terminal must not only verify that the entered password data matches the pre-stored password data, but also verify that the terminal identifier of the terminal logging into the application or website matches the device identifier of the bound terminal (this can include matching the terminal identifier of the terminal before and after abnormal event authentication with the device identifier of the bound terminal). Only in this way can the terminal log into the application or website.

[0120] The second scenario: The terminal must determine whether the entered username and password match the pre-stored username and password, and also whether the current login is a non-remote login or a remote login after successful authentication. Only then can the terminal log in to the application or website.

[0121] The third scenario: The terminal must determine whether the entered password data matches the pre-stored password data, whether the current login is a non-remote login or a remote login after successful authentication, and whether the terminal identifier of the terminal logging into the application or website matches the device identifier of the bound terminal (this can include matching the terminal identifier of the terminal before and after abnormal event authentication with the device identifier of the bound terminal). Only in this way can the terminal log into the application or website.

[0122] S1003: Get transfer instructions.

[0123] In this embodiment of the disclosure, on the interactive interface, the user can open the transfer page, enter the receiving account and the transfer amount, and click the transfer control (such as the transfer button), so that the terminal can obtain the transfer instruction.

[0124] S1005: Determine whether the transfer information carried in the transfer instruction meets the requirements for abnormal transfer information. If so, proceed to step S905.

[0125] In this embodiment of the disclosure, the transfer information may include one or more of the following: transfer amount, transfer recipient account, number of transfers after logging into the application or website, and the time since the first transfer.

[0126] In an optional embodiment, the transfer information may include the transfer amount. Transfer anomalies can be indicated by the transfer amount in the transfer instruction exceeding a preset amount. For example, the preset amount is 2000 yuan, and the transfer amount is 5000 yuan.

[0127] In another optional embodiment, the transfer information may include the transfer recipient account. Transfer anomaly information can be indicated by the transfer recipient account being either an abnormal account or a newly added account, as carried in the transfer instruction. The abnormal account could be an account that has been complained about by other users, an account with low credit rating, etc.

[0128] In another optional embodiment, the transfer information may include the number of transfers made after logging into the application or website and the time elapsed since the first transfer. Both the number of transfers and the time elapsed since the first transfer are based on the premise of the same receiving account. For example, if three transfers are made to account A after logging into the application, and the time elapsed between the first and third transfers to account A is 30 seconds. The terminal counts the number of transfers made after logging into the application or website by determining the number of transfer instructions received from the same receiving account. Transfer information meeting the criteria for transfer anomalies can be indicated by the number of transfers made by the account (the account logged into by the terminal) within a preset time period exceeding a preset number. For example, if three transfers are made to account A within 30 seconds, while the preset number is one, the terminal can determine that the transfer information meets the criteria for transfer anomalies.

[0129] The above content provides three exemplary embodiments, and other embodiments based on the content contained in the transfer information are also included in this disclosure.

[0130] S905: Sends an abnormal event authentication command to the auxiliary terminal corresponding to the auxiliary account.

[0131] Figure 11 A flowchart illustrating a method for preventing abnormal transfer events provided in an embodiment of the present invention includes:

[0132] S1101: If the transfer information carried in the transfer instruction meets the requirements for abnormal transfer information, the level of the abnormal event shall be determined based on the transfer information.

[0133] Optionally, assuming the transfer information is the transfer amount, the anomaly level can be determined based on the amount. For example, if the preset amount is 1000 yuan, and the transfer amount is between 1000 and 2000 yuan, the anomaly level is Level 1; if the transfer amount is between 2000 and 5000 yuan, the anomaly level is Level 2; if the transfer amount is between 5000 and 10000 yuan, the anomaly level is Level 3, and so on. The higher the numerical value within the level, the more abnormal the event.

[0134] Optionally, assuming the transfer information pertains to the receiving account, if the receiving account is deemed abnormal, the degree of abnormality of the receiving account is determined. A higher degree of abnormality corresponds to a higher level of the abnormal event. The degree of abnormality of the receiving account can be determined based on the number of complaints and / or its creditworthiness.

[0135] Optionally, assuming the transfer information includes the number of transfers made after logging into the application or website and the time since the first transfer, if the number of transfers made by the account within the preset time exceeds the preset number, the shorter the time and the more frequent the transfers, the higher the level of the abnormal event.

[0136] The three methods for determining the level of an abnormal event mentioned above are all based on one type of transfer information. Of course, the level of an abnormal event can also be determined by combining multiple types of transfer information, but examples will not be given here.

[0137] In an optional embodiment, before determining the level of the abnormal event, the terminal may also obtain the user attribute information of the user of the transfer account, that is, the user attribute information of the login account, and determine the level of the abnormal event based on the user attribute information and the transfer information.

[0138] Optionally, user attribute information may include the user's age range. This allows the terminal to determine the level of the abnormal event based on the user's age range and the transfer information. For example, if the transfer information is only the transfer amount (e.g., 2000 yuan), the abnormal event level determined based on the transfer amount would be Level 1. However, considering that minors or the elderly are more susceptible to scams, assuming the transfer amount is 2000 yuan and the user's age range is between 70 and 80 years old, the abnormal event level determined based on the transfer amount and the user's age range would be Level 2, which is higher than Level 1. Optionally, the user's age range may be obtained by the terminal device with the user's consent or provided actively by the user.

[0139] Optionally, user attribute information may also include records of whether the user has been scammed. In this way, the terminal can determine the level of the abnormal event based on records of whether the user has been scammed and transaction information.

[0140] S1103: Determine the account intimacy level based on the level of abnormal events.

[0141] In this embodiment of the disclosure, the terminal may pre-store a mapping table between abnormal event levels and account intimacy levels. For example, the first level corresponds to a low intimacy level, the second level corresponds to a medium intimacy level, the third level corresponds to a high intimacy level, and so on.

[0142] The aforementioned account intimacy level refers to the intimacy level between the auxiliary account and the user account (the account in the preset account password data).

[0143] S1105: Identify target auxiliary accounts from the auxiliary accounts that match the account's affinity level.

[0144] In an optional embodiment, each auxiliary account has its corresponding account intimacy level, which is stored in a preset area.

[0145] In this embodiment of the disclosure, taking the real-time communication program as an example: the terminal can determine the account intimacy level with the auxiliary account in one or more of the following ways: the more times the chat is conducted, the higher the account intimacy level; the longer the auxiliary account and the user account have established a friend relationship, the higher the account intimacy level; the more the nickname of the auxiliary account is obtained, the more the nickname matches the preset nickname (the preset nickname may include mom, dad, aunt, dear, etc.), the higher the account intimacy level.

[0146] After determining the account intimacy level based on the abnormal event level on the terminal, the account intimacy level can be matched with the account intimacy level of each auxiliary account to identify the target auxiliary account.

[0147] S1107: Send an abnormal event authentication command to the auxiliary terminal corresponding to the target auxiliary account.

[0148] S907: Displays a login failure message.

[0149] S909: Redirect to the auxiliary account addition page, prompting you to add an auxiliary account and save it on this auxiliary account addition page, then proceed to step S903.

[0150] Figure 9 The corresponding implementation allows users to log in to applications or websites using their account and password data via a terminal, providing a first layer of security by comparing the account and password data with preset account and password data. After determining that there is an abnormal transfer event, it also provides authentication of an auxiliary account. By setting the event abnormality level, account intimacy level, and target auxiliary account, it provides a strict authentication checkpoint for abnormal transfer events, further preventing malicious individuals from using accounts to conduct illegal transfers and other behaviors.

[0151] The following example illustrates an unusual event involving the deletion of friends. Figure 12A flowchart illustrating a method for preventing login anomalies provided in an embodiment of the present invention includes:

[0152] S1201: Determine whether the account password data matches the pre-stored account password data, and whether the pre-stored account password data has a corresponding auxiliary account. If both are true, proceed to step S1203; if the account password data does not match the pre-stored account password data, proceed to step S1207; if the account password data matches the pre-stored account password data, but there is no corresponding auxiliary account, proceed to step S1209.

[0153] In an optional embodiment, when the content of step S301 is not the currently entered account and password data obtained during the initial account setup, but rather the account and password data entered by the user when they want to log in later, the terminal needs to determine whether the currently entered account and password data matches the pre-stored account and password data. If they do not match, a login failure message can be displayed as shown in step S1207 below. Further, the terminal can display an error message to indicate that the entered account and / or password data is incorrect and to request re-entry.

[0154] In another optional embodiment, if the account password data matches the pre-stored account password data, but the pre-stored account password data does not have a corresponding auxiliary account, this situation can be considered as the user not adding an auxiliary account when initially setting up the account. Alternatively, previous versions of the application or website did not have the auxiliary account addition function, and the auxiliary account addition function was only added in the latest iteration. In this case, the terminal can, as shown in step S1209, respond to the user's auxiliary account addition operation, jump to the auxiliary account addition page, and prompt the user to add and save the auxiliary account on this auxiliary account addition page.

[0155] S1203: Determine whether an abnormal friend deletion event has been detected. If so, proceed to step S1205.

[0156] Optionally, the terminal detects a friend deletion anomaly by counting the number of deletion commands received. Specifically, if the number of friend deletion commands received within a preset time exceeds a preset number, a friend deletion anomaly is determined to have occurred.

[0157] S1205: Send an abnormal event authentication command to the auxiliary terminal corresponding to the auxiliary account.

[0158] In an optional embodiment, the terminal may also refer to the above description to determine the target auxiliary account from the auxiliary accounts based on the number of received friend deletion commands, and send an abnormal event authentication command to the auxiliary terminal corresponding to the target auxiliary account. Details regarding the determination of the target auxiliary account will not be elaborated further.

[0159] S1207: Displays a login failure message.

[0160] S1209: Redirect to the auxiliary account addition page, prompting you to add an auxiliary account and save it on this auxiliary account addition page, then proceed to step S1203.

[0161] Figure 12 The corresponding implementation allows users to log in to applications or websites using their account and password data via a terminal, providing a first layer of security by comparing the account and password data with preset account and password data. It also provides auxiliary account authentication for terminals that have abnormally deleted friends, preventing malicious individuals from deleting a large number of friends in the account in order to carry out illegal activities later.

[0162] In this embodiment of the disclosure, before sending the abnormal event authentication command to the auxiliary terminal corresponding to the auxiliary account in steps S303, S711, S809, S905, and S1205, a step of determining abnormal event authentication information is included. Figure 13 A flowchart illustrating the process of determining authentication information for an abnormal event, provided in an embodiment of the present invention, includes:

[0163] S1301: Obtain event description information for network anomaly events.

[0164] In an optional embodiment, the terminal can first determine the type of network anomaly event, such as a login anomaly event (login device anomaly event, login address anomaly event), a transfer anomaly event, or a friend deletion anomaly event. Then, it obtains the description information of the network anomaly event. For example, the event description information for a login device anomaly event could be "login without bound device," the event description information for a login address anomaly event could be "login from a different location," the event description information for a transfer anomaly event could be "large-amount transfer," "transfer to an abnormal account," or "frequent transfers in a short period," and the event description information for a friend deletion anomaly event could be "deleting a large number of friends in a short period," etc.

[0165] S1303: Generate a QR code based on preset account password data.

[0166] Optionally, the terminal device can generate a QR code based on preset account password data, or it can generate a QR code based on preset account data in preset account data.

[0167] S1305: Generate abnormal event authentication information based on the QR code and event description information.

[0168] The terminal can wrap the abnormal event authentication information in an abnormal event authentication command and send the abnormal event authentication command to the auxiliary terminal corresponding to the auxiliary account (or the target auxiliary account).

[0169] In another optional embodiment, the terminal obtains the event description information of the network abnormal event, and can generate abnormal event authentication information based on the event description information, preset information and preset number.

[0170] In one optional embodiment, the terminal can directly send the abnormal event authentication command to the auxiliary terminal corresponding to the auxiliary account (or the target auxiliary account). In another optional embodiment, the terminal can send the abnormal event authentication command and the auxiliary terminal identifier to the server. After obtaining them, the server can send the abnormal event authentication command to the auxiliary terminal corresponding to the auxiliary terminal identifier.

[0171] S305: Receive abnormal event authentication feedback sent by the auxiliary terminal.

[0172] In the login anomaly events involved in the two embodiments described above, if the authentication feedback of the anomaly event contains authentication success information after step S711 or step S809, then the application or website can be logged in.

[0173] Furthermore, for login anomalies of unbound terminals, after logging into the application or website, the terminal can add itself to the bound terminals of the preset account and password data and save the terminal identifier.

[0174] Please see Figure 14 The diagram shown is a flowchart illustrating a method for preventing network anomalies according to an embodiment of the present invention. This method can be applied to... Figure 1 or Figure 2 The system shown is illustrated. It should be noted that this specification provides the operational steps of the methods described in the embodiments or flowcharts, but based on conventional or non-inventive labor, more or fewer operational steps may be included. The order of steps listed in the embodiments is merely one possible execution order among many and does not represent the only execution order. In actual system or product execution, the methods shown in the embodiments or drawings can be executed sequentially or in parallel (e.g., in a parallel processor or multi-threaded processing environment). Specifically, as shown... Figure 14 As shown, the method is applicable to auxiliary terminals and includes:

[0175] S1401: Receive an abnormal event authentication instruction; the abnormal event authentication instruction contains abnormal event authentication information; the abnormal event authentication instruction is sent by the terminal under preset conditions; wherein, the preset conditions include detecting a network abnormal event when the account and password data of the currently input terminal match the pre-stored account and password data, and the pre-stored account and password data has a corresponding auxiliary account; the account and password data includes account data and password data.

[0176] In an optional embodiment, the aforementioned abnormal event authentication information is generated based on event description information and a QR code. The event description information is obtained by the terminal based on network abnormal events, and the QR code is generated by the terminal based on preset password data or preset account data.

[0177] In another optional embodiment, the above-mentioned abnormal event authentication information is generated based on the event description information, the preset number, and the preset information.

[0178] S1403: Displays abnormal event authentication information.

[0179] The optional auxiliary terminal can display abnormal event authentication information (including QR code) on the application interface, and can also display abnormal event authentication information (including preset number and preset information) on the SMS interface.

[0180] S1405: In response to the authentication trigger operation, complete authentication based on the authentication information of the exception event.

[0181] Specifically, the auxiliary terminal can respond to the user's QR code scanning command and scan the QR code to complete authentication. Alternatively, the auxiliary terminal can respond to an information sending command and send preset information to the device corresponding to the preset number to complete authentication.

[0182] In one optional embodiment, the auxiliary terminal does not directly display the abnormal event authentication information, but instead displays an auxiliary authentication prompt message. Figure 15 This is a schematic diagram of an auxiliary authentication prompt message provided in an embodiment of the present invention. It includes the auxiliary authentication prompt message "Your friend xxx is using a new device to log in to xx and needs your auxiliary authentication" and a "Enter Assistance" button. The abnormal event authentication information will only be displayed when the auxiliary terminal senses that the user clicks the "Enter Assistance" button.

[0183] In one optional embodiment, in response to the authentication sending trigger operation, the terminal can first determine which terminal to send the abnormal event authentication command to. Optionally, as in the above-described technical solution, the abnormal event authentication command can be sent to the auxiliary terminal. Alternatively, the abnormal event authentication information can be displayed directly on the terminal's own screen. This is typically used when the owner of the auxiliary account is near the user who needs to be verified. In this way, even if the owner of the auxiliary account is not logged into the application or website, they can immediately log in to the application or website, such as logging into a mobile application and directly using the scanning function in the application to scan the QR code on their own screen. This allows the auxiliary authentication method to have more flexible options depending on the application scenario.

[0184] S1407: Send abnormal event authentication feedback.

[0185] In an optional embodiment, after the auxiliary terminal device scans the QR code, it can send an abnormal event authentication feedback to the terminal, wherein the abnormal event authentication feedback includes authentication success information.

[0186] In another optional embodiment, if the auxiliary device successfully sends preset information to the device corresponding to the preset number, it can send an abnormal event authentication feedback to the terminal, wherein the abnormal event authentication feedback includes authentication success information.

[0187] In an optional embodiment, the server will only send auxiliary authentication feedback to the terminal after all auxiliary terminals that have received the auxiliary instructions have completed authentication. Correspondingly, the terminal receives the auxiliary authentication feedback sent by the server and determines that the auxiliary authentication feedback contains assistance success information.

[0188] In an optional embodiment, the server will only send auxiliary authentication feedback to the terminal after a preset number (e.g., 3) of the auxiliary terminals that have been given auxiliary instructions have completed authentication. Correspondingly, the terminal receives the auxiliary authentication feedback sent by the server and determines that the auxiliary authentication feedback contains assistance success information.

[0189] In another optional embodiment, if the auxiliary authentication is not satisfied, the server may send auxiliary authentication feedback to the terminal after a preset time period. Correspondingly, the terminal receives the auxiliary authentication feedback sent by the server and determines that the auxiliary authentication feedback contains auxiliary failure information.

[0190] To ensure authentication security and prevent malicious actors from exploiting bots to gain access to cheating services, users can optionally initiate only one cheating invitation per calendar day. This means a terminal can only send one abnormal event authentication command per calendar day, which can be sent simultaneously to multiple cheating terminals associated with different accounts. If a cheating invitation fails to authenticate, no more devices can be added to the linked account that day, and a resent abnormal event authentication command will be sent to the friend's account the following day.

[0191] Furthermore, a user can only request one assistance authentication invitation per week, regardless of whether the assistance authentication is successful or not.

[0192] For the auxiliary terminal, the displayed authentication information for abnormal events can only be shown for a preset duration. If the preset duration is exceeded, the auxiliary authentication will fail by default. Optionally, other settings can be configured, such as an auxiliary terminal only being able to assist the same terminal in completing authentication once per day, and assisting a maximum of 3 terminals in completing authentication per week, and a maximum of 7 terminals in completing authentication per month.

[0193] In summary, the embodiments of this application, through similar cooperation between the terminal and auxiliary terminals (including even the server), not only ensure account login security, but also provide authentication services for possible network anomalies.

[0194] Corresponding to the network anomaly prevention methods provided in the above embodiments, this embodiment of the invention also provides a network anomaly prevention device. Since the network anomaly prevention device provided in this embodiment corresponds to the network anomaly prevention methods provided in the above embodiments, the implementation methods of the aforementioned network anomaly prevention methods are also applicable to the network anomaly prevention device provided in this embodiment, and will not be described in detail in this embodiment.

[0195] Please see Figure 16 The diagram shows a structural schematic of a network anomaly prevention device provided in an embodiment of the present invention. This device has the function of implementing the network anomaly prevention method described in the above-described method embodiments. The function can be implemented by hardware or by hardware executing corresponding software. Figure 16 As shown, the device may include:

[0196] The account password data acquisition module 1601 is used to acquire the currently input account password data; wherein, the account password data includes account data and password data;

[0197] The sending module 1602 is used to send an abnormal event authentication instruction to the auxiliary terminal corresponding to the auxiliary account if an abnormal network event is detected when the account password data and the pre-stored account password data match and the pre-stored account password data has a corresponding auxiliary account. The abnormal event authentication instruction contains abnormal event authentication information. The abnormal event authentication instruction is used to instruct the auxiliary terminal to complete the authentication based on the abnormal event authentication information.

[0198] The receiving module 1603 is used to receive abnormal event authentication feedback sent by the auxiliary terminal.

[0199] As one possible implementation, the device may also include a login module and a transfer instruction acquisition module;

[0200] This login module is used to log in to applications or websites;

[0201] This transfer instruction acquisition module is used to acquire transfer instructions;

[0202] The sending module is used to send an abnormal event authentication command to the auxiliary terminal corresponding to the auxiliary account if the transfer information carried in the transfer instruction meets the requirements for abnormal transfer information.

[0203] As one possible implementation, the apparatus may further include:

[0204] The transfer information carried in the transfer instruction meets the requirements for abnormal transfer information, including at least one of the following:

[0205] The transfer amount in the transfer instruction is greater than the preset amount;

[0206] The transfer receiving account carried in the transfer instruction is at least one of the abnormal account and the newly added account;

[0207] The number of transfers made by the account specified in the transfer instruction within the preset time period exceeds the preset number.

[0208] As one possible implementation, the device may further include:

[0209] The abnormal event level determination module is used to determine the abnormal event level based on the transfer information if the transfer information carried in the transfer instruction meets the requirements for abnormal transfer information.

[0210] The intimacy level determination module is used to determine the intimacy level of an account based on the level of abnormal events.

[0211] The target auxiliary account identification module is used to identify target auxiliary accounts that match the account's affinity level from among the auxiliary accounts;

[0212] The aforementioned sending module is used to send an abnormal event authentication command to the auxiliary terminal corresponding to the target auxiliary account.

[0213] As one possible implementation, the device also includes an attribute information acquisition module;

[0214] This attribute information acquisition module is used to obtain the user attribute information of the user to whom the transfer account belongs;

[0215] The abnormal event level determination module is used to determine the abnormal event level based on user attribute information and transfer information.

[0216] As one possible implementation, the device may further include an identification determination module:

[0217] The identifier determination module is used to determine the terminal identifier of the terminal that logs in to the application or website using the account and password data; and to obtain the device identifier of the bound terminal corresponding to the pre-stored account and password data.

[0218] The sending module is used to send an abnormal event authentication command to the auxiliary terminal corresponding to the auxiliary account if the device identifier and the terminal identifier do not match.

[0219] As one possible implementation method,

[0220] The login confirmation module is used to log in to the application or website if the authentication feedback of the abnormal event contains authentication success information.

[0221] The save module is used to add a terminal to the bound terminal and save the terminal identifier.

[0222] As one possible implementation, the apparatus may further include:

[0223] The description information acquisition module is used to acquire event description information of network anomaly events;

[0224] The QR code generation module is used to generate QR codes based on preset account password data;

[0225] The authentication information generation module is used to generate authentication information for abnormal events based on the QR code and event description information.

[0226] The aforementioned sending module is used to send abnormal event authentication commands to the auxiliary terminal corresponding to the auxiliary account.

[0227] It should be noted that the apparatus provided in the above embodiments is only illustrated by the division of the above functional modules when implementing its functions. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the apparatus and method embodiments provided in the above embodiments belong to the same concept, and the specific implementation process can be found in the method embodiments, which will not be repeated here.

[0228] Please see Figure 17 The diagram shows a structural schematic of a network anomaly prevention device provided in an embodiment of the present invention. This device has the function of implementing the network anomaly prevention method described in the above-described method embodiments. The function can be implemented by hardware or by hardware executing corresponding software. Figure 17 As shown, the device may include:

[0229] The instruction receiving module 1701 is used to receive an abnormal event authentication instruction; the abnormal event authentication instruction contains abnormal event authentication information; the abnormal event authentication instruction is sent by the terminal under the condition that preset conditions are met; wherein, the preset conditions include the detection of a network abnormal event when the account and password data of the current input terminal match the pre-stored account and password data and the pre-stored account and password data has a corresponding auxiliary account; the account and password data includes account data and password data.

[0230] Display module 1702 is used to display abnormal event authentication information;

[0231] Authentication module 1703 is used to complete authentication based on abnormal event authentication information in response to authentication triggering operations;

[0232] Feedback sending module 1704 is used to send authentication feedback for abnormal events.

[0233] It should be noted that the apparatus provided in the above embodiments is only illustrated by the division of the above functional modules when implementing its functions. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the apparatus and method embodiments provided in the above embodiments belong to the same concept, and the specific implementation process can be found in the method embodiments, which will not be repeated here.

[0234] This invention provides an electronic device including a processor and a memory. The memory stores at least one instruction or at least one program segment, which is loaded and executed by the processor to implement the network anomaly prevention method provided in the above method embodiments.

[0235] The memory can be used to store software programs and modules. The processor executes these software programs and modules stored in the memory to perform various functional applications and prevent network anomalies. The memory can primarily include a program storage area and a data storage area. The program storage area can store the operating system, application programs required for the functions, etc.; the data storage area can store data created based on the use of the device, etc. Furthermore, the memory can include high-speed random access memory, and can also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. Accordingly, the memory can also include a memory controller to provide the processor with access to the memory.

[0236] The methods and embodiments provided in this invention can be executed on a computer terminal, server, or similar computing device. Figure 18 This is a hardware structure block diagram of an electronic device that implements a method for preventing network anomalies, as provided in an embodiment of the present invention. Figure 18 As shown, the internal structure of this electronic device may include, but is not limited to, a processor, a network interface, and a memory. The processor, network interface, and memory within the electronic device can be connected via a bus or other means, as illustrated in the embodiments of this specification. Figure 18 Taking the example of a connection between China and Israel via a bus.

[0237] The processor (or CPU, Central Processing Unit) is the computing and control core of the electronic device. The network interface may optionally include a standard wired interface or a wireless interface (such as Wi-Fi, mobile communication interface, etc.). The memory is the storage device in the electronic device used to store programs and data. It is understood that the memory here can be a high-speed RAM storage device, or a non-volatile memory device, such as at least one disk storage device; optionally, it can also be at least one storage device located remotely from the aforementioned processor. The memory provides storage space, which stores the operating system of the electronic device, including but not limited to: Windows (an operating system), Linux (an operating system), Android (a mobile operating system), iOS (a mobile operating system), etc., which are not limited in this invention; and the storage space also stores one or more instructions suitable for being loaded and executed by the processor, which can be one or more computer programs (including program code). In the embodiments of this specification, the processor loads and executes one or more instructions stored in the memory to implement the network anomaly prevention method provided in the above method embodiments.

[0238] Embodiments of the present invention also provide a computer-readable storage medium that can be disposed in an electronic device to store at least one instruction or at least one program related to implementing a method for preventing network anomalies, wherein the at least one instruction or the at least one program is loaded and executed by the processor to implement the method for preventing network anomalies provided in the above-described method embodiments.

[0239] Embodiments of the present invention also provide a computer program product or computer program comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the network anomaly prevention methods provided in the various optional implementations described above.

[0240] Optionally, in this embodiment, the storage medium may include, but is not limited to, various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0241] It should be noted that the order of the above embodiments of the present invention is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. Furthermore, specific embodiments have been described above. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps described in the claims can be performed in a different order than that shown in the embodiments and still achieve the desired result. Additionally, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0242] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the apparatus embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0243] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware or by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.

[0244] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for preventing network anomalies, characterized in that, The method includes: Obtain the currently input account and password data; wherein, the account and password data includes account data and password data; If the account password data matches the pre-stored account password data, and the pre-stored account password data has a corresponding auxiliary account, and an abnormal network event is detected, an abnormal event authentication instruction is sent to the auxiliary terminal corresponding to the auxiliary account; the abnormal event authentication instruction contains abnormal event authentication information; wherein, the abnormal event authentication instruction is used to instruct the auxiliary terminal to complete authentication according to the abnormal event authentication information; the pre-stored account password data is pre-configured with a corresponding auxiliary account that has been confirmed by the user before the abnormal network event is detected, and each auxiliary account pre-stores a corresponding account intimacy level; Receive abnormal event authentication feedback sent by the auxiliary terminal; If a network anomaly is detected, an anomaly event authentication command is sent to the auxiliary terminal corresponding to the auxiliary account, including: Log in to the application or website; Receive transfer instructions; If the transfer information carried in the transfer instruction meets the requirements for abnormal transfer information, the level of the abnormal event is determined based on the transfer information; The account intimacy level is determined based on the abnormal event level; the account intimacy level refers to the intimacy level between the auxiliary account and the account in the pre-stored account password data. Identify target auxiliary accounts that match the intimacy level of the auxiliary accounts; Send the abnormal event authentication command to the auxiliary terminal corresponding to the target auxiliary account.

2. The method for preventing network anomalies according to claim 1, characterized in that, The transfer information carried in the transfer instruction satisfies transfer anomaly information including at least one of the following: The transfer amount carried in the transfer instruction is greater than the preset amount; The transfer receiving account carried in the transfer instruction is at least one of the abnormal account and the newly added account; The number of times the transfer account carried in the transfer instruction performs transfers within a preset time period is greater than a preset number.

3. The method for preventing network anomalies according to claim 1, characterized in that, Determining the level of an abnormal event based on the transfer information includes: Obtain the user attribute information of the user to whom the transfer account belongs; The level of the abnormal event is determined based on the user attribute information and the transfer information.

4. The method for preventing network anomalies according to claim 1, characterized in that, If a network anomaly is detected, an anomaly event authentication command is sent to the auxiliary terminal corresponding to the auxiliary account, including: Determine the terminal identifier of the terminal that uses the account password data to log in to the application or website; obtain the device identifier of the bound terminal corresponding to the pre-stored account password data; If the device identifier does not match the terminal identifier, an abnormal event authentication command is sent to the auxiliary terminal corresponding to the auxiliary account.

5. The method for preventing network anomalies according to any one of claims 1-4, characterized in that, Sending the abnormal event authentication command to the auxiliary terminal corresponding to the auxiliary account includes: Obtain the event description information of the network anomaly event; A QR code is generated based on the preset account password data; The abnormal event authentication information is generated based on the QR code and the event description information; Send the abnormal event authentication command to the auxiliary terminal corresponding to the auxiliary account.

6. A method for preventing network anomalies, characterized in that, The method includes: The system receives an abnormal event authentication command; the abnormal event authentication command contains abnormal event authentication information; the abnormal event authentication command is sent by the terminal under preset conditions; wherein, the preset conditions include detecting a network abnormal event when the currently input account password data and pre-stored account password data match, and the pre-stored account password data has a corresponding auxiliary account; the account password data includes account data and password data; the network abnormal event includes the transfer information carried in the acquired transfer command satisfying the transfer abnormality information; the pre-stored account password data is pre-configured with a corresponding auxiliary account that has been confirmed by the user before detecting the network abnormal event, and each auxiliary account pre-stores a corresponding account intimacy level; Display the authentication information of the abnormal event; In response to the authentication trigger operation, authentication is completed based on the abnormal event authentication information; Send abnormal event authentication feedback.

7. A device for preventing network anomalies, characterized in that, The device includes: The account password data acquisition module is used to acquire the currently input account password data; wherein, the account password data includes account data and password data; The sending module is configured to, when the account password data and the pre-stored account password data match, and the pre-stored account password data has a corresponding auxiliary account, if an abnormal network event is detected, send an abnormal event authentication instruction to the auxiliary terminal corresponding to the auxiliary account; the abnormal event authentication instruction contains abnormal event authentication information; wherein, the abnormal event authentication instruction is used to instruct the auxiliary terminal to complete authentication according to the abnormal event authentication information; the pre-stored account password data is pre-configured with a corresponding auxiliary account that has been confirmed by the user before the abnormal network event is detected, and each auxiliary account pre-stores a corresponding account intimacy level; The receiving module is used to receive the abnormal event authentication feedback sent by the auxiliary terminal; The login module is used to log in to applications or websites. The transfer instruction acquisition module is used to acquire transfer instructions; An abnormal event level determination module is used to determine the abnormal event level based on the transfer information if the transfer information carried in the transfer instruction meets the requirements for abnormal transfer information. The intimacy level determination module is used to determine the account intimacy level based on the abnormal event level; the account intimacy level refers to the intimacy level between the auxiliary account and the account in the pre-stored account password data. The target auxiliary account determination module is used to determine the target auxiliary account that matches the intimacy level of the account from the auxiliary accounts; The sending module is used to send the abnormal event authentication command to the auxiliary terminal corresponding to the target auxiliary account.

8. A device for preventing network anomalies, characterized in that, The device includes: An instruction receiving module is used to receive an abnormal event authentication instruction; the abnormal event authentication instruction contains abnormal event authentication information; the abnormal event authentication instruction is sent by the terminal under preset conditions; wherein, the preset conditions include detecting a network abnormal event when the currently input account password data and pre-stored account password data match, and the pre-stored account password data has a corresponding auxiliary account; the account password data includes account data and password data; the network abnormal event includes the transfer information carried in the acquired transfer instruction satisfying transfer abnormality information; the pre-stored account password data is pre-configured with a corresponding auxiliary account that has been confirmed by the user before detecting the network abnormal event, and each auxiliary account pre-stores a corresponding account intimacy level; The display module is used to display the authentication information of the abnormal event; The authentication module is used to complete authentication based on the abnormal event authentication information in response to the authentication trigger operation. The feedback sending module is used to send authentication feedback for abnormal events.

9. An electronic device, characterized in that, The device includes a processor and a memory, wherein the memory stores at least one instruction or at least one program, the at least one instruction or the at least one program being loaded and executed by the processor to implement the method for preventing network anomalies as described in any one of claims 1 to 5 or claim 6.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one instruction or at least one program, which is loaded and executed by a processor to implement the method for preventing network anomalies as described in any one of claims 1 to 5 or claim 6.

Images