Account abnormal login detection method and device
By establishing a time series model and frequency model, combining environmental and behavioral factors, detecting abnormal login for account, the problem of difficult to identify abnormal login for account in the existing technology is solved, and information security protection capabilities are improved.
Patent Information
- Application Number
- CN202411048007.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-08-01
- Publication Date
- 2024-12-17
AI Technical Summary
It is difficult for the prior art to effectively detect and identify abnormal login behaviors for account accounts, especially in a large number of user accounts, which may cause theft incident to be undetected for a long time, causing greater harm.
By establishing a time series-based activity model and frequency model, combining environmental factors and behavioral factors, we can judge the abnormal login behavior of the account, including obtaining login data, establishing feature models, detecting suspicious login and abnormal login.
It realizes efficient and accurate detection of abnormal login behavior of account accounts, improves information security protection capabilities, and ensures system account security.
Smart Images
Figure CN119155059A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of secure login, and in particular, relates to a method for detecting abnormal login of an account and a device for detecting abnormal login of an account using the method. Background Art
[0002] At present, data and information are growing explosively, including various social media data, system data, CRM data, and a large amount of network data. However, in most cases, these data only present the common behavior patterns of users, and abnormal changes in data may be the "crux" of system failure or user loss. How to identify the "reefs" in the ocean of data is the problem to be explored in the analysis of abnormal user behavior.
[0003] In reality, there are tens of thousands of user accounts in the same system, and each user has many types of accounts. Due to the large number of accounts, if some accounts are stolen and cause obvious losses, it is easy to be discovered and remedial measures can be taken; however, if no obvious losses are caused immediately, the theft may not be discovered for a long time. Once it is used by attackers for a long time, it will cause greater and more far-reaching harm. In addition, due to the difference in permissions between different accounts, it is difficult to simply determine the extent of activities that are considered to be violations. At the same time, due to the complexity of the business, it is also difficult to accurately determine whether an account is in an abnormal login state. Therefore, effectively detecting abnormal login behavior of accounts is an important measure to prevent data theft. Summary of the invention
[0004] In view of the above background, the present invention aims to propose a method for detecting abnormal account login and a device using the method, which uses statistical laws to establish a data model to efficiently and accurately detect abnormal account login behavior. The specific technical solution includes the following contents.
[0005] In one aspect, the present invention provides a method for detecting abnormal account logins, comprising: obtaining behavioral factors and environmental factors for each login, wherein: A login includes the process from initiating login to logging out or going offline; the behavioral factors include: account name, login result, login time, logout time, access traffic; the environmental factors include: login device IP, browser or client, protocol; Count the historical login data of the account, establish the activity model and frequency model of the account based on time series; and establish the environmental characteristics of the account based on the environmental factors; Acquire real-time login data of the account, and if the environmental factor of the login does not meet the environmental characteristics, and / or the behavioral factor of the login does not meet the first threshold interval specified by the activity model, determine that the login is a suspicious login; The login data within a specific period after the suspicious login is obtained, and if the login frequency within the period does not meet the second threshold interval specified by the frequency model, the suspicious login is determined to be an abnormal login.
[0006] Preferably, the above-mentioned determination of whether the behavioral factors meet the first threshold interval specified by the activity model includes obtaining the login time period and online duration based on the login result, login time and logout time, and determining whether the time period and online duration meet the activity model.
[0007] If the login result is a failure, when the number of failures reaches the preset threshold, the corresponding account will be marked as a suspicious account, and all failed logins will be marked as suspicious logins.
[0008] Preferably, the above-mentioned time series-based model includes the activity trend and frequency trend obtained by analyzing the login data statistically collected in a specific period; the specific period includes a time period, day, week, or month; Preferably, the above-mentioned login frequency includes the number of logins in each cycle, and the activity includes the online time period and online duration in each cycle.
[0009] Also, if the login target is of a sensitive type, a content audit is performed on the data accessed after login; and if any account is detected as suspicious, anomaly detection is performed on the login data of all accounts of the target in the same period.
[0010] If an account is judged to have an abnormal login, the login data of all other accounts logged in with the same IP address within the same period will be checked for abnormalities.
[0011] On the other hand, the present invention provides an account abnormal login detection device, the device comprising: The data acquisition module is used to obtain the behavioral factors and environmental factors of each login, wherein: the login includes the process from initiating login to logging out or going offline; the behavioral factors include: account name, login result, login time, logout time, access traffic; the environmental factors include: login device IP, browser or client, protocol; A data analysis module is used to collect statistics on the historical login data of the account, establish an activity model and a frequency model of the account based on a time series; and establish the environmental characteristics of the account based on the environmental factors; The detection module obtains the real-time login data of the account. If the environmental factors of the login do not meet the environmental characteristics, and / or the behavioral factors of the login do not meet the first threshold interval specified by the activity model, the login is judged to be a suspicious login; the login data within a specific period after the suspicious login is obtained. If the login frequency within the period does not meet the second threshold interval specified by the frequency model, the suspicious login is judged to be an abnormal login.
[0012] Preferably, the above-mentioned data analysis module analyzes the activity trend and frequency trend based on the login data counted within a specific period; the specific period includes time period, day, week, and month; the login frequency includes the number of logins in each period, and the activity includes the online time period and online duration in each period.
[0013] Preferably, the above-mentioned detection module determines whether the behavioral factors meet the first threshold interval specified by the activity model, including obtaining the login time period and online duration based on the login result, login time and logout time, and determining whether the time period and online duration meet the activity model.
[0014] Also, if the login result is a failure, when the number of failures reaches the preset threshold, the corresponding account will be marked as a suspicious account, and all failed logins will be marked as suspicious logins; if the login target is a sensitive type, a content audit will be performed on the data accessed after the login; and if any account is detected as suspicious, anomaly detection will be performed on the login data of all accounts of the target within the same period; if an account is judged to be an abnormal login, anomaly detection will be performed on the login data of all other accounts logged in with the same IP within the same period.
[0015] The present invention adopting the above technical solution has at least the following beneficial effects: based on time series, historical login data is counted and analyzed to establish a multi-dimensional model of normal account login behavior. First, each real-time login data is tested for environmental factors and activity models. If suspicious, the periodic data of the login data is tested for login frequency models, and login failures and sensitive content access data are further tested. It can detect abnormal login behavior of accounts from multiple dimensions in turn, provide protection for system account security, and help improve information security protection capabilities. BRIEF DESCRIPTION OF THE DRAWINGS
[0016] Figure 1 This is a schematic diagram of the overall process of an embodiment of the method for detecting abnormal account logins of the present invention; Figure 2 for Figure 1 Detection method embodiment in, example diagram of frequency model based on time series; Figure 3 This is a schematic diagram of the module composition of an embodiment of the account abnormal login detection device of the present invention. DETAILED DESCRIPTION
[0017] The present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the relevant contents of the present application, rather than to limit the application. It is also necessary to explain that, for ease of description, only the parts related to the application are shown in the accompanying drawings.
[0018] A time series model refers to a set of data points arranged in chronological order. These data reflect the changes of a variable over time. It is a statistical model used to analyze and predict data series that change over time. This type of model is widely used in many fields such as economics, finance, meteorology, biology, physics, and engineering. It is especially important when it is necessary to predict future trends. In addition, the selection and application of time series models is an iterative process, and the model structure and parameters may need to be adjusted multiple times to achieve the best prediction effect.
[0019] Based on a time series model and statistical techniques, the embodiments of the present invention respectively provide a method and a device for detecting anomalies in an account.
[0020] like Figure 1 As shown, an embodiment of a method for detecting abnormal account logins includes: obtaining behavioral factors and environmental factors for each login, wherein: A login includes the process from initiating login to logging out or going offline; the behavioral factors include: account name, login result, login time, logout time, access traffic; the environmental factors include: login device IP, browser or client, protocol; Count the historical login data of the account, establish the activity model and frequency model of the account based on time series; and establish the environmental characteristics of the account based on the environmental factors; Acquire real-time login data of the account, and if the environmental factor of the login does not meet the environmental characteristics, and / or the behavioral factor of the login does not meet the first threshold interval specified by the activity model, determine that the login is a suspicious login; The login data within a specific period after the suspicious login is obtained, and if the login frequency within the period does not meet the second threshold interval specified by the frequency model, the suspicious login is determined to be an abnormal login.
[0021] Preferably, the above-mentioned determination of whether the behavioral factors meet the first threshold interval specified by the activity model includes obtaining the login time period and online duration based on the login result, login time and logout time, and determining whether the time period and online duration meet the activity model.
[0022] If the login result is a failure, when the number of failures reaches the preset threshold, the corresponding account will be marked as a suspicious account, and all failed logins will be marked as suspicious logins.
[0023] Preferably, a time series-based model includes analyzing the activity trend and frequency trend obtained based on the login data collected within a specific period; the specific period includes a time period, day, week, or month; Preferably, the login frequency includes the number of logins in each cycle, and the activity includes the online time period and online duration in each cycle.
[0024] Also, if the login target is of a sensitive type, a content audit is performed on the data accessed after login; and if any account is detected as suspicious, anomaly detection is performed on the login data of all accounts of the target in the same period.
[0025] If an account is judged to have an abnormal login, the login data of all other accounts logged in with the same IP address within the same period will be checked for abnormalities.
[0026] like Figure 2 As shown, as a preferred implementation of Example 1, a login frequency model with a weekly period is created, and login data within a specific period after the suspicious login is obtained. If the login frequency within the period does not meet the second threshold interval specified by the frequency model, for example, the second threshold interval may refer to a certain interval above and below the average login frequency value specified by the model, such as between 2.5-3.5, then the suspicious login is judged to be an abnormal login.
[0027] The technical solution of the embodiment of the abnormal login detection device for accounts as described above analyzes and learns historical login data based on time series to establish a model of normal login behavior of accounts. First, environmental factors and activity models are tested for each real-time login data. If suspicious, the login frequency model is tested for the periodic data where the login data is located, and login failures and sensitive content access data are further tested. The abnormal login behavior of accounts can be deeply detected from multiple dimensions in turn, providing protection for the security of system accounts and improving information security protection capabilities.
[0028] like Figure 3 As shown, an embodiment of an abnormal account login detection device includes a data acquisition module, an analysis module and a detection module. Specifically, see: The data acquisition module is used to obtain the behavioral factors and environmental factors of each login, wherein: the login includes the process from initiating login to logging out or going offline; the behavioral factors include: account name, login result, login time, logout time, access traffic; the environmental factors include: login device IP, browser or client, protocol; A data analysis module is used to collect statistics on the historical login data of the account, establish an activity model and a frequency model of the account based on a time series; and establish the environmental characteristics of the account based on the environmental factors; The detection module obtains the real-time login data of the account. If the environmental factors of the login do not meet the environmental characteristics, and / or the behavioral factors of the login do not meet the first threshold interval specified by the activity model, the login is judged to be a suspicious login; the login data within a specific period after the suspicious login is obtained. If the login frequency within the period does not meet the second threshold interval specified by the frequency model, the suspicious login is judged to be an abnormal login.
[0029] As a preferred implementation, the data analysis module analyzes the activity trend and frequency trend based on the login data counted within a specific period; the specific period includes time period, day, week, and month; the login frequency includes the number of logins in each period, and the activity includes the online time period and online duration in each period.
[0030] As a preferred implementation, the detection module determines whether the behavioral factors meet the first threshold interval specified by the activity model, including obtaining the login time period and online duration based on the login result, login time and logout time, and determining whether the time period and online duration meet the activity model.
[0031] Also, if the login result is a failure, when the number of failures reaches the preset threshold, the corresponding account will be marked as a suspicious account, and all failed logins will be marked as suspicious logins; if the login target is a sensitive type, a content audit will be performed on the data accessed after the login; and if any account is detected as suspicious, anomaly detection will be performed on the login data of all accounts of the target within the same period; if an account is judged to be an abnormal login, anomaly detection will be performed on the login data of all other accounts logged in with the same IP within the same period.
[0032] The technical solution of the embodiment of the abnormal login detection device for accounts as described above analyzes and learns historical login data based on time series to establish a model of normal login behavior of accounts. First, environmental factors and activity models are tested for each real-time login data. If suspicious, the login frequency model is tested for the periodic data where the login data is located, and login failures and sensitive content access data are further tested. The abnormal login behavior of accounts can be deeply detected from multiple dimensions in turn, providing protection for the security of system accounts and improving information security protection capabilities.
[0033] A person skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc.
[0034] The above description of the above disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but will conform to the broadest scope consistent with the principles disclosed herein.
Claims
1. A method for detecting abnormal account login, It is characterized in that include: Obtain behavioral and environmental factors for each login, including: The login includes the process from initiating login to logging out or going offline; the behavioral factors include: account name, login result, login time, logout time, access traffic; the environmental factors include: login device IP, browser or client, protocol; Count the historical login data of the account, establish the activity model and frequency model of the account based on time series; and establish the environmental characteristics of the account based on the environmental factors; Acquire real-time login data of the account, and if the environmental factor of the login does not meet the environmental characteristics, and / or the behavioral factor of the login does not meet the first threshold interval specified by the activity model, determine that the login is a suspicious login; The login data within a specific period after the suspicious login is obtained, and if the login frequency within the period does not meet the second threshold interval specified by the frequency model, the suspicious login is determined to be an abnormal login.
2. The detection method according to claim 1, It is characterized in that The determining whether the behavior factor meets the first threshold interval specified by the activity model includes obtaining a login time period and an online duration according to a login result, a login time, and a logout time, and determining whether the time period and the online duration meet the activity model.
3. The detection method according to claim 1, It is characterized in that If the login result is a failure, when the number of failures reaches the preset threshold, the corresponding account will be marked as a suspicious account, and all failed logins will be marked as suspicious logins.
4. The detection method according to claim 1, It is characterized in that The time series-based model includes the activity trend and frequency trend obtained by analyzing the login data collected during a specific period; the specific period includes a time period, day, week, or month; The login frequency includes the number of logins in each cycle, and the activity includes the online time period and online duration in each cycle.
5. The detection method according to any one of claims 1 to 4, It is characterized in that If the login target is of a sensitive type, a content audit will be performed on the data accessed after login; and if any account is detected to be suspicious, anomaly detection will be performed on the login data of all accounts of the target in the same period.
6. The detection method according to any one of claims 1 to 4, It is characterized in that If an account is judged to have an abnormal login, the login data of all other accounts logged in with the same IP address within the same period will be checked for abnormalities.
7. An account abnormal login detection device, It is characterized in that The device comprises: The data acquisition module is used to obtain the behavioral factors and environmental factors of each login, wherein: the login includes the process from initiating login to logging out or going offline; the behavioral factors include: account name, login result, login time, logout time, access traffic; the environmental factors include: login device IP, browser or client, protocol; A data analysis module is used to collect statistics on the historical login data of the account, establish an activity model and a frequency model of the account based on a time series; and establish the environmental characteristics of the account based on the environmental factors; The detection module obtains the real-time login data of the account. If the environmental factors of the login do not meet the environmental characteristics, and / or the behavioral factors of the login do not meet the first threshold interval specified by the activity model, the login is judged to be a suspicious login; the login data within a specific period after the suspicious login is obtained. If the login frequency within the period does not meet the second threshold interval specified by the frequency model, the suspicious login is judged to be an abnormal login.
8. The detection device according to claim 8, It is characterized in that The data analysis module, The activity trend and frequency trend are analyzed based on the login data collected during a specific period; the specific period includes time period, day, week, and month; the login frequency includes the number of logins in each period, and the activity includes the online time period and online duration in each period.
9. The detection device according to claim 8, It is characterized in that The detection module, Determining whether the behavior factor meets the first threshold interval specified by the activity model includes obtaining the login time period and the online duration according to the login result, the login time and the logout time, and determining whether the time period and the online duration meet the activity model.
10. The detection device according to claim 9, It is characterized in that The detection module, If the login result is a failure, when the number of failures reaches the preset threshold, the corresponding account will be marked as a suspicious account, and all failed logins will be marked as suspicious logins; If the login target is of a sensitive type, the data accessed after login will be audited; and if any account is detected as suspicious, the login data of all accounts of the target in the same period will be checked for anomalies; If an account is judged to have an abnormal login, the login data of all other accounts logged in with the same IP address within the same period will be checked for abnormalities.