Password detection behavior monitoring method, device, electronic device and storage medium

Abstract

The present invention provides a password detection behavior monitoring method, device, electronic device and storage medium, the method comprising: obtaining data records of password detection authentication failures of salespersons within a preset time period; using a BK tree algorithm to extract detection behavior data from all data records to determine detection behavior data sets of different salespersons; clustering analysis of the data in the detection behavior data sets to determine detection behavior detection rules of different salespersons. The password detection behavior monitoring method, device, electronic device and storage medium provided by the present invention can systematically analyze the detection behavior of salespersons by extracting the salesperson's illegal password detection behavior data using a BK-Tree algorithm and obtaining the detection behavior rules using a clustering algorithm, can effectively discover password detection behavior, improve network reliability, save manpower and improve efficiency.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a password detection behavior monitoring method, device, electronic equipment and storage medium. Background Art

[0002] At present, in the telecommunications industry, some sales staff, in order to improve performance, illegally detect user passwords and unauthorizedly obtain user information, change or order packages without the knowledge of the users.

[0003] In response to the salesperson's illegal operations, the current business management mainly sets different permissions for different salespersons, and sets corresponding thresholds when monitoring illegal behaviors, and identifies illegal behaviors through manual screening.

[0004] However, when managers audit the salesperson's manipulation behavior, they have to face a large amount of data records. They are unable to accurately analyze which operations are illegal, and they have no way to deal with a large amount of data records. Therefore, it is time-consuming and labor-intensive, with low accuracy and prone to omissions. Summary of the invention

[0005] The present invention provides a password detection behavior monitoring method, device, electronic device and storage medium, which are used to solve the defects of the prior art that the monitoring of the operation behavior of the salesperson is time-consuming and labor-intensive, has low accuracy and is prone to omissions, thereby improving the security and reliability of the network.

[0006] The present invention provides a password detection behavior monitoring method, comprising:

[0007] Obtain data records of password detection and authentication failures of salespersons within a preset time period;

[0008] The BK tree algorithm is used to extract the detection behavior data from all data records to determine the detection behavior data sets of different salesmen;

[0009] Cluster analysis is performed on the data in the detection behavior data set to determine the detection rules of the detection behaviors of different salesmen.

[0010] According to a password detection behavior monitoring method provided by the present invention, each data record includes a salesperson identification, a detected mobile phone number, a detection failure password and a detection time.

[0011] According to a password detection behavior monitoring method provided by the present invention, a BK tree algorithm is used to extract detection behavior data from all data records to determine detection behavior data sets of different salespersons, including:

[0012] For the target salesperson, construct a BK tree with the detected mobile phone number as the root node;

[0013] Calculate the Levenshtein distance between the probe password and the root node;

[0014] Filter data records whose Levenshtein distance to the root node is within the threshold n;

[0015] The data records whose Levenshtein distance to the root node is within the threshold n are used to construct the detection behavior dataset of the target salesperson.

[0016] According to a password detection behavior monitoring method provided by the present invention, cluster analysis is performed on the data in the detection behavior data set, including:

[0017] The binary K-means algorithm is used to perform cluster analysis on the data in the detection behavior dataset.

[0018] According to a password detection behavior monitoring method provided by the present invention, the detection behavior detection rule is the detection frequency of the salesperson's password detection behavior.

[0019] According to a password detection behavior monitoring method provided by the present invention, after determining the detection behavior detection rules of different salespersons, the method further includes:

[0020] The risk levels of different salespersons are determined based on the detection behavior detection rules.

[0021] According to a password detection behavior monitoring method provided by the present invention, after different risk levels of salespersons are detected according to the detection behavior rules, the method further includes:

[0022] Set account permissions for sales staff at different risk levels.

[0023] The present invention also provides a password detection behavior monitoring device, comprising:

[0024] An acquisition module is used to acquire data records of password detection and authentication failures of salespersons within a preset time period;

[0025] The first determination module is used to extract the data of the detection behavior from all data records using the BK tree algorithm to determine the detection behavior data sets of different salesmen;

[0026] The second determination module is used to perform cluster analysis on the data in the detection behavior data set to determine the detection rules of the detection behaviors of different salesmen.

[0027] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of any of the above-mentioned password detection behavior monitoring methods are implemented.

[0028] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the above-described password detection behavior monitoring methods.

[0029] The password detection behavior monitoring method, device, electronic device and storage medium provided by the present invention can systematically analyze the detection behavior of salespersons by extracting the salesperson's illegal password detection behavior data using the BK-Tree algorithm and obtaining the law of the detection behavior using the clustering algorithm, and can effectively discover the password detection behavior, thereby improving the reliability of the network, saving manpower and improving efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0031] Figure 1 It is a flow chart of the password detection behavior monitoring method provided by the present invention;

[0032] Figure 2 It is a logic flow chart of password detection behavior monitoring provided by the present invention;

[0033] Figure 3 It is a schematic diagram of a password detection behavior analysis system based on a BK-Tree algorithm provided by the present invention;

[0034] Figure 4 This is a schematic diagram of the construction principle of BK-Tree;

[0035] Figure 5 It is a schematic diagram of the construction process of the detection behavior data set of different salesmen provided by the present invention;

[0036] Figure 6 It is a schematic diagram of the construction process of the BK-Tree provided by the present invention;

[0037] Figure 7 It is a structural schematic diagram of the password detection behavior monitoring device provided by the present invention;

[0038] Figure 8 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0039] At present, the main mode of the business support system of telecom operators is the user self-service mode to handle operations such as payment, inquiry, and business change, and the above business is handled by business personnel logging into the system, especially through WEB-level pages for user information query, data selection and entry, page cascading, business processing, information landing and other interactive processes are becoming more and more complicated. At the same time, with the core system opening up capabilities through the PAAS layer, decoupling central service capabilities, and decoupling data to business personnel, user self-service end-to-end authority authentication access poses new security challenges. Especially in the telecommunications industry, when users are unaware, some sales staff, in order to improve performance, illegally detect user passwords, and unauthorizedly obtain user information, change or order packages.

[0040] In response to the salesperson's illegal operations, the current business management mainly sets different permissions for different salespersons, and sets corresponding thresholds when monitoring illegal behaviors, and identifies illegal behaviors through manual screening.

[0041] Currently, the password detection behavior of salespersons is mainly detected through manual screening or setting simple thresholds. There is a lack of effective analysis methods for salespersons' illegal operations, especially when detecting salespersons' detection of user passwords and privately opening packages for users. The main manifestations are as follows:

[0042] (1) When managers audit the manipulation behavior of sales staff, they have to face a large amount of data records. They are unable to accurately analyze which operations are illegal, and they have no way to deal with a large amount of data records. Therefore, it is time-consuming and labor-intensive, with low accuracy and prone to omissions.

[0043] (2) The audit effect is difficult to guarantee. The time span of the salesperson's operating behavior data is relatively large, and there are many data records. It is impossible to systematically analyze the detection rules of the salesperson's detection behavior manually, so it is impossible to accurately prevent and control the salesperson's illegal behavior.

[0044] In view of this, it is necessary to propose an analysis method and system for password detection behavior, so as to effectively analyze the illegal operations of sales staff and carry out precise prevention and control management.

[0045] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0046] The password detection behavior monitoring method, device, electronic device and storage medium of the present invention are described below in conjunction with some drawings.

[0047] Figure 1 : is a flow chart of the password detection behavior monitoring method provided by the present invention, such as Figure 1 As shown, the embodiment of the present application provides a password detection behavior monitoring method. The method includes:

[0048] Step 101: Obtain data records of password detection and authentication failures of salespersons within a preset time period.

[0049] Optionally, each data record includes the salesperson ID, the detected mobile phone number, the detection failure password and the detection time.

[0050] Step 102: Use the BK-Tree algorithm to extract detection behavior data from all data records to determine detection behavior data sets for different salespersons.

[0051] Optionally, a BK-Tree algorithm is used to extract data of detection behaviors from all data records to determine detection behavior data sets of different salespersons, including:

[0052] For the target salesperson, construct a BK-Tree with the detected mobile phone number as the root node;

[0053] Calculate the Levenshtein distance between the probe password and the root node;

[0054] Filter data records whose Levenshtein distance to the root node is within the threshold n;

[0055] The data records whose Levenshtein distance to the root node is within the threshold n are used to construct the detection behavior dataset of the target salesperson.

[0056] Step 103: Perform cluster analysis on the data in the detection behavior data set to determine the detection rules of the detection behaviors of different salespeople.

[0057] Optionally, performing cluster analysis on the data in the detection behavior data set includes:

[0058] The binary K-means algorithm is used to perform cluster analysis on the data in the detection behavior dataset.

[0059] Optionally, the detection behavior detection rule is the type or detection frequency of the salesperson's password detection behavior.

[0060] Optionally, after determining the detection rules of the detection behaviors of different salespersons, the method further includes:

[0061] The risk levels of different salespersons are determined based on the detection behavior detection rules.

[0062] Optionally, after determining the risk level of different salespersons according to the detection behavior detection rules, the method further includes:

[0063] Set account permissions for sales staff at different risk levels.

[0064] Specifically, Figure 2 is a logic flow chart of password detection behavior monitoring provided by the present invention, such as Figure 2 As shown, the logical flow of password detection behavior monitoring provided by the present invention is as follows:

[0065] S1: Data acquisition and preprocessing, obtain the salesperson's operation data within a certain period of time t, filter out the records of authentication failures, and extract the operation records of specific numbers. Each piece of data includes the salesperson number, the detected phone number, the authentication result, the authentication failure password, and the operation time.

[0066] S2: BK-Tree algorithm modeling is used to process the salesperson's operation data. The BK-Tree algorithm is used to extract the detection behavior data of the operation data to obtain the detection behavior data set S of different salespersons.

[0067] S3: Obtain detection rules. Use the binary K-means algorithm to perform cluster analysis on the detection data set to obtain the detection rules of detection behaviors of different sales personnel, such as the detection frequency of password detection behaviors of different sales personnel.

[0068] S4: Determine the risk level, based on the analysis results of step S3, determine the risk level of different salespersons;

[0069] S5: Risk prevention and control. According to the risk level determined in step S4, account permissions are set for sales staff of different risk levels to reduce the risk of illegal operations.

[0070] Figure 3 is a schematic diagram of the analysis system of password detection behavior based on the BK-Tree algorithm provided by the present invention, such as Figure 3 As shown, the system includes: a data acquisition and preprocessing unit, a BK-Tree algorithm modeling unit, a detection rule acquisition unit, a risk level determination unit and a risk prevention and control unit.

[0071] Among them, the data acquisition and preprocessing unit is used to obtain the salesperson's operation data within a certain time period t, filter out the records of authentication failures, and extract the operation records of specific numbers. Each piece of data includes the salesperson number, the detected phone number, the authentication result, the authentication failure password, and the operation time.

[0072] The BK-Tree algorithm modeling unit is used to process the operation data of the salesperson, and uses the BK-Tree algorithm to extract the data of the detection behavior of the operation data, and obtain the detection behavior data set S of different salespeople.

[0073] The detection rule acquisition unit uses a binary K-means algorithm to perform cluster analysis on the detection data set to obtain the detection rules of detection behaviors and detection frequencies of different sales personnel.

[0074] The risk level determination unit determines the risk level of different salespersons based on the analysis results of the detection rule acquisition unit.

[0075] The risk prevention and control unit sets account permissions for sales staff at different risk levels according to the risk levels determined by the risk level determination unit to reduce the risk of illegal operations.

[0076] BK-Tree or Burkhard Keller Tree is a data structure used to perform spell checking based on the Levenshtein distance concept. BK-Tree is also used for approximate string matching. Based on this data structure, various automatic correction features in many software can be implemented. Figure 4 This is a schematic diagram of the construction principle of BK-Tree, such as Figure 4 As shown, the construction process of BK-Tree is as follows:

[0077] 1) Determine the root node (such as game);

[0078] 2) When inserting the next word, first calculate the Levenshtein distance between the word and the root;

[0079] 3) If this distance value appears for the first time at this node, create a new child node; otherwise, recurse along the corresponding edge.

[0080] For example, when we insert the word fame, its distance from game is 1, so we create a new child node and connect it with an edge numbered 1. The next time we insert gain, we calculate its distance from game to be 2, so we put it under the edge numbered 2. The next time we insert gate, its distance from game is 1, so we recursively go down along the edge numbered 1 and recursively insert it into the subtree where fame is located. The distance between gate and fame is 2, so we put gate under the fame node and the edge numbered 2.

[0081] Each node has any number of child nodes, and each edge has a value representing the edit distance. All edges from child nodes to parent nodes are marked with n, indicating that the edit distance is exactly n.

[0082] Levenshtein distance, also known as Levenshtein distance, is a type of edit distance, which refers to the minimum number of edit operations required to convert two strings from one to another. The allowed edit operations include:

[0083] 1. Replace one character with another.

[0084] 2. Insert a character.

[0085] 3. Delete a character.

[0086] After each operation, the edit distance increases by +1. Of course, different weights can be set according to actual needs. For example, from cute to cat, u needs to be replaced by a and e needs to be deleted, so its shortest edit distance is 2.

[0087] Optionally, the present invention obtains the operation data of the salesperson and analyzes the operation data of the salesperson. The specific analysis process is as follows:

[0088] S1: Acquisition of data records and data extraction.

[0089] The operation data of the salesperson within a certain period of time t is obtained, and the records of authentication failure are screened out. The data is shown in Table 1. The operation records of a specific number are extracted. Each piece of data includes the salesperson number, the detected phone number, the authentication result, the authentication failure password, and the operation time. In this embodiment, t is set to 3 months.

[0090] Table 1 Data records of authentication failures screened out

[0091] Operator telephone number Cause Wrong password Operation time 0001 15536896724 Authentication Error 896724 2020-6-17 9:50:00 0001 15536896724 Authentication Error 689672 2020-6-17 9:50:10 0001 15536896724 Authentication Error 155368 2020-6-17 9:51:20 0001 15536896724 Authentication Error 536896 2020-6-17 9:51:21 0001 15536896724 Authentication Error 255368 2020-6-17 9:51:50 0001 15536896724 Authentication Error 536897 2020-6-17 9:52:05 0001 15536896724 Authentication Error 796725 2020-6-17 9:52:15 0001 15536896724 Authentication Error 789673 2020-6-17 9:52:22 0001 15536896724 Authentication Error 255367 2020-6-17 9:52:25 0001 15536896724 Authentication Error 111111 2020-6-17 9:52:40 0001 15536896724 Authentication Error 654321 2020-6-17 9:52:42 0001 15536896725 Authentication Error 896725 2020-6-17 9:52:45 0001 15536896725 Authentication Error 368967 2020-6-17 9:53:00 0001 15536896725 Authentication Error 553689 2020-6-17 9:53:08 0001 15536896725 Authentication Error 368961 2020-6-17 9:53:16 0001 15536896725 Authentication Error 896726 2020-6-17 9:53:24 0001 15536896725 Authentication Error 553687 2020-6-17 9:53:32 0001 15536896725 Authentication Error 155368 2020-6-17 9:53:40 0001 15536896725 Authentication Error 536896 2020-6-17 9:53:48 0001 15536896725 Authentication Error 689672 2020-6-17 9:53:56 0001 15536896725 Authentication Error 689671 2020-6-17 9:54:05 0001 15536896725 Authentication Error 368966 2020-6-17 9:54:11 0001 15536896725 Authentication Error 368967 2020-6-17 9:54:17 0001 15536896725 Authentication Error 000000 2020-6-17 9:54:23 0001 15536896725 Authentication Error 111111 2020-6-17 9:54:29 0001 15536896725 Authentication Error 888888 2020-6-17 9:54:35 0001 15536896725 Authentication Error 123456 2020-6-17 9:54:41 0001 15536896725 Authentication Error 654321 2020-6-17 9:54:47

[0092] S2: BK-Tree algorithm modeling is used to process the salesperson’s operation data.

[0093] The BK-Tree algorithm is used to extract the detection behavior data of its operation data to obtain the detection behavior data set S of different salesmen.

[0094] Figure 5 FIG. 1 is a schematic diagram of the construction process of the detection behavior data set of different salespersons provided by the present invention, such as Figure 5 As shown, according to one aspect of the present invention, the detection behavior data set S of different salespersons is obtained by using the BK-Tree algorithm to extract the detection behavior of the operation data. The specific process is as follows:

[0095] S2.1: Simple and regular password record extraction.

[0096] After acquiring the data, extract the password records with simple rules and put them into set S. Simple rules include passwords with simple sequences (such as 123456), simple overlapping passwords (such as 000000), etc. The data includes the business employee number, the detected mobile phone number, the detection failure password, and the detection time. In this embodiment, for the phone number 15536896724, (0001, 15536896724, authentication error, 111111, 2020-6-17 9:52:40) and (0001, 15536896724, authentication error, 654321, 2020-6-17 9:52:42) are put into set S.

[0097] S2.2: Determination of the BK-Tree root node.

[0098] Figure 6 It is a schematic diagram of the construction process of the BK-Tree provided by the present invention, such as Figure 6 As shown, after putting the passwords with simple rules into the set S, the construction of BK-Tree begins, and the detected phone number is used as the root node.

[0099] In this embodiment, the telephone number 15536896724 is used as the root node.

[0100] S2.3: Calculate the Levenshtein distance and determine the child nodes. Calculate the Levenshtein distance between the detection password and the root node: if this distance value appears for the first time at the node, create a new child node; otherwise, recurse along the corresponding edge. In this embodiment, the Levenshtein distances of the authentication failed passwords 896724, 689672, 155368, 536896, 255368, 536897, 796725, 789673, 255367 and the telephone number 15536896724 are 5, 5, 5, 5, 6, 6, 7, 7, 7 respectively.

[0101] The BK-Tree constructed with respect to the operation behavior data of salesperson 0001 for number 15536896724 is as follows Figure 6 shown.

[0102] S2.4: Filter similar records. Filter records whose Levenshtein distance to the root node is within the threshold n, that is, find the subtree within the range of d≤n, and put the node-related data records into the set S, which is the detection behavior data set established for each salesperson.

[0103] In this embodiment, n=5 is set. For the number 15536896724, the relevant data records that meet the conditions are shown in Table 2.

[0104] Table 2 Related data records that meet the conditions

[0105] 0001 15536896724 Authentication Error 896724 2020-6-17 9:50:00 0001 15536896724 Authentication Error 689672 2020-6-17 9:50:10 0001 15536896724 Authentication Error 155368 2020-6-17 9:51:20 0001 15536896724 Authentication Error 536896 2020-6-17 9:51:21

[0106] Put these 4 records into the operation set S of the corresponding salesperson.

[0107] S2.5: Process the salesperson's detection behavior data on other numbers as in steps S2.1-S2.4.

[0108] S2.6: The operation data of all the salesmen who need to be monitored are processed as in steps S2.1-S2.5 to obtain the detection behavior data sets S of different salesmen.

[0109] S3: Obtain detection rules.

[0110] The binary K-means algorithm is used to perform cluster analysis on the detection data set to obtain the detection rules of detection behaviors of different sales personnel, such as the detection frequency of password detection behaviors of different sales personnel.

[0111] S4: Risk level determination.

[0112] According to the analysis result of step S3, the risk levels of different salesmen are determined; the risk levels include: high, medium-high, medium, medium-low, and low.

[0113] For example, the risk level may be determined based on the detection frequency. The higher the detection frequency, the higher the risk level, and the lower the detection frequency, the lower the risk level.

[0114] S5: Risk prevention and control.

[0115] According to the risk level in step S4, account permissions are set for sales staff of different risk levels. Different permissions are set for sales staff of different risk levels. Accounts are locked when necessary to reduce the risk of illegal operations.

[0116] The present invention uses the BK-Tree algorithm to extract the salesperson's illegal password detection behavior data, and uses the binary K-means algorithm to obtain the law of detection behavior. It can systematically analyze the salesperson's detection behavior, effectively discover password detection behavior, save manpower, and improve efficiency.

[0117] The present invention determines the risk level of the salesperson and determines the authority of the salesperson according to different risk levels. Therefore, the present invention can accurately prevent and control the illegal password detection behavior of the salesperson.

[0118] Figure 7 : is a schematic diagram of the structure of the password detection behavior monitoring device provided by the present invention, such as Figure 7As shown, the embodiment of the present application provides a password detection behavior monitoring device, which specifically includes an acquisition module 701, a first determination module 702 and a second determination module 703, wherein:

[0119] The acquisition module 701 is used to obtain data records of password detection authentication failures of salespersons within a preset time period; the first determination module 702 is used to use the BK-Tree algorithm to extract data on detection behavior from all data records and determine the detection behavior data sets of different salespersons; the second determination module 703 is used to perform cluster analysis on the data in the detection behavior data set and determine the detection rules of detection behavior of different salespersons.

[0120] The password detection behavior monitoring device provided in the embodiment of the present application can be used to execute the methods described in the above-mentioned corresponding embodiments. The specific steps of executing the methods described in the above-mentioned corresponding embodiments through the device provided by this embodiment are the same as those in the above-mentioned corresponding embodiments, and can achieve the same technical effects. The parts and beneficial effects of this embodiment that are the same as those in the method embodiment will not be described in detail here.

[0121] Figure 8 is a schematic diagram of the structure of the electronic device provided by the present invention, such as Figure 8 As shown, the electronic device may include: a processor 810, a communication interface 820, a memory 830 and a communication bus 840, wherein the processor 810, the communication interface 820 and the memory 830 communicate with each other via the communication bus 840. The processor 810 may call the logic instructions in the memory 830 to execute the password detection behavior monitoring method, which includes: obtaining data records of password detection authentication failures of the salesperson within a preset time period;

[0122] The BK-Tree algorithm is used to extract the detection behavior data from all data records and determine the detection behavior data sets of different salesmen;

[0123] Cluster analysis is performed on the data in the detection behavior data set to determine the detection rules of the detection behaviors of different salesmen.

[0124] In addition, the logic instructions in the above-mentioned memory 830 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0125] On the other hand, the present invention further provides a computer program product, the computer program product comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions, when the program instructions are executed by a computer, the computer can execute the password detection behavior monitoring method provided by the above methods, the method comprising: obtaining data records of password detection authentication failures of salespersons within a preset time period;

[0126] The BK-Tree algorithm is used to extract the detection behavior data from all data records and determine the detection behavior data sets of different salesmen;

[0127] Cluster analysis is performed on the data in the detection behavior data set to determine the detection rules of the detection behaviors of different salesmen.

[0128] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented when the computer program is executed by a processor to perform the password detection behavior monitoring method provided above, the method comprising: obtaining data records of password detection authentication failures of salespersons within a preset time period;

[0129] The BK-Tree algorithm is used to extract the detection behavior data from all data records and determine the detection behavior data sets of different salesmen;

[0130] Cluster analysis is performed on the data in the detection behavior data set to determine the detection rules of the detection behaviors of different salesmen.

[0131] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0132] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0133] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A password detection behavior monitoring method, characterized in that: include: Obtain data records of password detection and authentication failures of salespersons within a preset time period; The BK tree algorithm is used to extract the detection behavior data from all data records to determine the detection behavior data sets of different salesmen; Performing cluster analysis on the data in the detection behavior data set to determine the detection rules of detection behaviors of different salespeople; The BK tree algorithm is used to extract the detection behavior data from all data records to determine the detection behavior data sets of different salesmen, including: For the target salesperson, construct a BK tree with the detected mobile phone number as the root node; Calculate the Levenshtein distance between the probe password and the root node; Filter data records whose Levenshtein distance to the root node is within the threshold n; The data records whose Levenshtein distance to the root node is within the threshold n are used to construct the detection behavior dataset of the target salesperson.

2. The password detection behavior monitoring method according to claim 1, characterized in that: Each data record includes the salesperson ID, the detected mobile phone number, the detection failure password and the detection time.

3. The password detection behavior monitoring method according to claim 1, characterized in that: Performing cluster analysis on the data in the detection behavior data set includes: The binary K-means algorithm is used to perform cluster analysis on the data in the detection behavior dataset.

4. The password detection behavior monitoring method according to claim 1, characterized in that: The detection behavior detection rule is the detection frequency of the salesperson's password detection behavior.

5. The password detection behavior monitoring method according to claim 1, characterized in that: After determining the detection rules of different salespersons' detection behaviors, it also includes: The risk levels of different salespersons are determined based on the detection behavior detection rules.

6. The password detection behavior monitoring method according to claim 5, characterized in that: After detecting the risk level of different salespersons according to the detection behavior rules, it also includes: Set account permissions for sales staff at different risk levels.

7. A password detection behavior monitoring device, characterized in that: include: An acquisition module is used to acquire data records of password detection and authentication failures of salespersons within a preset time period; The first determination module is used to extract the data of the detection behavior from all data records using the BK tree algorithm to determine the detection behavior data sets of different salesmen; A second determination module is used to perform cluster analysis on the data in the detection behavior data set to determine the detection rules of the detection behaviors of different salesmen; The BK tree algorithm is used to extract the detection behavior data from all data records to determine the detection behavior data sets of different salesmen, including: For the target salesperson, construct a BK tree with the detected mobile phone number as the root node; Calculate the Levenshtein distance between the probe password and the root node; Filter data records whose Levenshtein distance to the root node is within the threshold n; The data records whose Levenshtein distance to the root node is within the threshold n are used to construct the detection behavior dataset of the target salesperson.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the password detection behavior monitoring method as described in any one of claims 1 to 6 are implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the password detection behavior monitoring method as described in any one of claims 1 to 6 are implemented.

Images