Unauthorized behavior detection method and device

Abstract

The invention discloses an unauthorized behavior detection method and device, and the method comprises the steps: receiving an access request of a user, and obtaining the current related information provided by the user; searching matched IP address information in a first database record table according to the current related information; after the matched IP address information is found in the first database record table, authorization information in the first database record table is determined according to the IP address information; and when the current related information provided by the user does not exist in the authorization information in the first database record table, determining that the user has an unauthorized behavior, and refusing the access request of the user. According to the invention, the judgment accuracy and efficiency of the unauthorized behavior can be improved.

Description

Technical Field

[0001] The present invention relates to the field of financial technology, and in particular to a method and device for detecting unauthorized behavior. Background Art

[0002] This section is intended to provide a background or context to the embodiments of the invention recited in the claims. No admission is made that the description herein is prior art by inclusion in this section.

[0003] After the user logs in to the financial system client, he will obtain relevant information about the customer, including sensitive information such as customer number, ID number, bank card number, mobile phone number, etc. In order to allow users to access only their own relevant information and prevent the acquisition of other people's sensitive information, the existing technology usually generates a corresponding identifier after the user logs in. When the login is successful, the authentication identifier will be returned to verify the user's identity through the identifier. Only after the verification is successful can the relevant functions be accessed. However, the existing technology relies too much on the login step, and has the defects of low accuracy and low efficiency in determining unauthorized behavior. Therefore, there is an urgent need for an unauthorized behavior detection method to solve the above problems. Summary of the invention

[0004] The embodiment of the present invention provides a method for detecting unauthorized behavior, which is used to improve the accuracy and efficiency of determining unauthorized behavior. The method includes:

[0005] Receive the user's access request and obtain the current relevant information provided by the user; the relevant information includes one or any combination of IP address information, multiple card number information, certificate number information and mobile phone number information;

[0006] According to the current relevant information, searching for matching IP address information in the first database record table; the first database record table is constructed based on the historical relevant information; the first database record table is stored in the blockchain;

[0007] After finding the matching IP address information in the first database record table, determining the authorization information in the first database record table according to the IP address information; the authorization information in the first database record table includes the user's authorized IP address information, multiple card number information, certificate number information and mobile phone number information;

[0008] When the current relevant information provided by the user does not exist in the authorization information in the record table of the first database, it is determined that the user has exceeded his authority and the user's access request is rejected.

[0009] The embodiment of the present invention further provides an unauthorized behavior detection device for improving the accuracy and efficiency of determining unauthorized behavior, the device comprising:

[0010] The relevant information acquisition module is used to receive the user's access request and obtain the current relevant information provided by the user; the relevant information includes one or any combination of IP address information, multiple card number information, certificate number information and mobile phone number information;

[0011] An IP address information matching module, used to search for matching IP address information in a first database record table according to current relevant information; the first database record table is constructed according to historical relevant information; the first database record table is stored in the blockchain;

[0012] An authorization information determination module is used to determine the authorization information in the first database record table according to the IP address information after finding the matching IP address information in the first database record table; the authorization information in the first database record table includes the user's authorized IP address information, multiple card number information, certificate number information and mobile phone number information;

[0013] The unauthorized behavior determination module is used to determine that the user has unauthorized behavior and reject the user's access request when the current relevant information provided by the user does not exist in the authorization information in the first database record table.

[0014] An embodiment of the present invention further provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned unauthorized behavior detection method when executing the computer program.

[0015] An embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the above-mentioned unauthorized behavior detection method is implemented.

[0016] An embodiment of the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the above-mentioned unauthorized behavior detection method is implemented.

[0017] In the embodiment of the present invention, by receiving the user's access request, the current relevant information provided by the user is obtained; the relevant information includes one or any combination of IP address information, multiple card number information, certificate number information and mobile phone number information; according to the current relevant information, the matching IP address information is searched in the first database record table; the first database record table is constructed according to the historical relevant information; the first database record table is stored in the blockchain; after finding the matching IP address information in the first database record table, the authorization information in the first database record table is determined according to the IP address information; the authorization information in the first database record table includes the user's authorized IP address information, multiple card number information, certificate number information and mobile phone number information; when the current relevant information provided by the user does not exist in the authorization information in the first database record table, it is determined that the user has exceeded the authority and the user's access request is rejected. In the above process, the embodiment of the present invention is based on the authorization information under the IP address information found in the first database record table, confirms whether the user's relevant information exists in the authorization information through the IP address information, judges the unauthorized behavior to realize the unauthorized behavior detection, thereby improving the accuracy and efficiency of the determination of the unauthorized behavior. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0019] Figure 1 Flow chart of the unauthorized behavior detection method according to an embodiment of the present invention;

[0020] Figure 2 A flowchart of obtaining an updated first database record table in an embodiment of the present invention;

[0021] Figure 3 A flowchart of obtaining a replaced first database record table in an embodiment of the present invention;

[0022] Figure 4 Schematic diagram of an unauthorized behavior detection device in an embodiment of the present invention;

[0023] Figure 5 It is a specific schematic diagram of the unauthorized behavior detection device in an embodiment of the present invention. DETAILED DESCRIPTION

[0024] To make the purpose, technical solution and advantages of the embodiments of the present invention more clear, the embodiments of the present invention are further described in detail below in conjunction with the accompanying drawings. Here, the exemplary embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0025] The acquisition, transmission, storage, use, and processing of data in the technical solution of this application comply with the relevant provisions of national laws and regulations.

[0026] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0027] Figure 1 Flow chart of the unauthorized behavior detection method in an embodiment of the present invention, the method comprising:

[0028] Step 101, receiving a user's access request and obtaining current relevant information provided by the user; the relevant information includes one or any combination of IP address information, multiple card number information, certificate number information and mobile phone number information;

[0029] Step 102: searching for matching IP address information in a first database record table according to current relevant information; the first database record table is constructed according to historical relevant information; the first database record table is stored in the blockchain;

[0030] Step 103, after finding the matching IP address information in the first database record table, determine the authorization information in the first database record table according to the IP address information; the authorization information in the first database record table includes the user's authorized IP address information, multiple card number information, certificate number information and mobile phone number information;

[0031] Step 104: When the current relevant information provided by the user does not exist in the authorization information in the first database record table, it is determined that the user has exceeded his authority and the user's access request is rejected.

[0032] Each step is described in detail below.

[0033] In step 101, a user's access request is received, and the current relevant information provided by the user is obtained; the relevant information includes one or any combination of IP address information, multiple card number information, ID number information and mobile phone number information; in step 102, according to the current relevant information, the matching IP address information is searched in the first database record table; the first database record table is constructed based on historical relevant information; the first database record table is stored in the blockchain.

[0034] In one embodiment, it further includes:

[0035] After obtaining authorization from the user's relevant contacts, a second database record table is constructed based on the IP address information, multiple card number information, certificate number information, and mobile phone number information of the user's relevant contacts, and the second database record table is stored in the blockchain;

[0036] Receive the user's access request and obtain the current relevant information of the relevant contacts provided by the user;

[0037] According to the current relevant information of the relevant contact, searching the first database record table for the IP address information of the matching relevant contact;

[0038] After finding the matching IP address information of the relevant contact in the second database record table, determining the authorization information in the second database record table according to the IP address information of the relevant contact; the authorization information in the second database record table includes the authorized IP address information, multiple card number information, certificate number information and mobile phone number information of the relevant contact;

[0039] When the current relevant information of the relevant contact exists in the authorization information in the second database record table, it is determined that the user has not exceeded his authority, and the user's access request is executed.

[0040] In a specific embodiment, the user submits an authorization application for the relevant contact from his own account, and when the other party confirms, the authorization authentication operation is completed. After authorization by the person related to the user (the relevant contact), the user can share the account with his relevant contact, thereby realizing the detection of unauthorized behavior of different users based on the same device.

[0041] In a specific embodiment, IP address information refers to one of the characteristics of the client, including but not limited to the following information. For example, when a user uses an APP, the IP address information may be a device number; when a user uses a mini program, the IP address information may be a unionid; when a user uses a browser, the IP address information may be device information obtained by the browser.

[0042] In a specific embodiment, taking online banking as an example, the construction process of the first database record table is as follows: the user accesses the online banking, enters the account number and password, logs in to the online banking, generates a token after logging in, and verifies whether the token is correct. If it is correct, the login authentication is successful and it is considered to be authorized. At this time, the user's IP address will be transmitted to the application layer field through the network layer. The application layer records the obtained user IP address information in the database, and uses the advantage of blockchain that it can be traced and cannot be tampered with to store the first database record table in the blockchain. After the login function is verified, the customer's mobile phone number, card number, ID number and other information will be obtained and synchronously recorded in the first database record table corresponding to the user's IP address information. As shown in Table 1.

[0043] Table 1

[0044]

[0045] In step 103, after finding the matching IP address information in the first database record table, the authorization information in the first database record table is determined based on the IP address information; the authorization information in the first database record table includes the user's authorized IP address information, multiple card number information, ID number information and mobile phone number information.

[0046] Figure 2 FIG. 1 is a flowchart of obtaining an updated first database record table in an embodiment of the present invention. Figure 2 As shown, in one embodiment, constructing a first database record table according to historical related information also includes:

[0047] Step 201, after the user applies for a new card, receiving an add instruction issued by the user; the add instruction carries the new card number information;

[0048] Step 202, verifying whether the adding instruction is an operation of the target user;

[0049] Step 203, after the verification is passed, the new card number information is added to the authorization information of the first database record table to obtain an updated first database record table, and the updated first database record table is stored in the blockchain.

[0050] In a specific embodiment, the card number information provided by the user when requesting access is not in the first database record table, and the card number information to be queried is bound to the corresponding authorization information. For example, the corresponding card number information can be bound to the online bank, and the binding operation will send the user a text message verification code to verify the card in the form of a text message. After the verification is successful, the card number information of the card is considered to be authorized.

[0051] Figure 3 FIG. 1 is a flowchart of obtaining a first database record table after replacement in an embodiment of the present invention. Figure 3 As shown, in one embodiment, constructing a first database record table according to historical related information also includes:

[0052] Step 301, receiving a replacement instruction issued by a user, wherein the replacement instruction carries information of the old card number and information of the new card number to be replaced;

[0053] Step 302, verifying whether the replacement instruction is operated by the target user;

[0054] Step 303, after the verification is passed, the old card number information in the authorization information of the first database record table is replaced with the new card number information to be replaced, and the replaced first database record table is obtained, and the replaced first database record table is stored in the blockchain.

[0055] In step 104, when the current relevant information provided by the user does not exist in the authorization information in the first database record table, it is determined that the user has exceeded his authority and the user's access request is rejected.

[0056] In one embodiment, it further includes:

[0057] When the card number information provided by the user does not exist in the authorization information, it is determined that the user has exceeded his / her authority and an alarm message is issued.

[0058] In one embodiment, when the card number information provided by the user does not exist in the authorization information, determining that the user has exceeded his / her authority includes:

[0059] When the card number information provided by the user does not exist in the authorization information, obtain the function ID and function ID field corresponding to the user's access request;

[0060] The last two digits of the function ID field are matched with the preset exception field, and the user's unauthorized behavior is detected based on the matching result.

[0061] In a specific embodiment, in a financial service, when the function ID corresponding to the user's access request is: transfer to another person, at this time, the transferor's card number is the user's own, but the recipient's account number has not been authorized. For example, when user A's bank card is transferred to user B's bank card, at this time, user B's bank card information needs to be confirmed whether it has been authorized under user A's IP address information, but user B's bank card information is an exception. For this transfer function, a preset exception field needs to be configured to exempt the authorization requirement. As shown in Table 2.

[0062] Table 2

[0063] Function ID Preset exception fields Remark date A Card NumberAA Payment card numbers are an exception Update time C B Mobile phone number BB The receiving mobile phone number is an exception Update time B

[0064] First determine whether the function ID has an exception field according to Table 2, and then determine whether the user has exceeded his authority.

[0065] The present invention also provides an unauthorized behavior detection device, as described in the following embodiments. Since the principle of solving the problem by the device is similar to that of the unauthorized behavior detection method, the implementation of the device can refer to the implementation of the unauthorized behavior detection method, and the repeated parts will not be repeated.

[0066] Figure 4 Schematic diagram of an unauthorized behavior detection device according to an embodiment of the present invention, the device comprises:

[0067] Related information acquisition module 401, used to receive the user's access request and obtain the current related information provided by the user; the related information includes one or any combination of IP address information, multiple card number information, certificate number information and mobile phone number information;

[0068] An IP address information matching module 402 is used to search for matching IP address information in a first database record table according to current relevant information; the first database record table is constructed according to historical relevant information; the first database record table is stored in a blockchain;

[0069] The authorization information determination module 403 is used to determine the authorization information in the first database record table according to the IP address information after finding the matching IP address information in the first database record table; the authorization information in the first database record table includes the user's authorized IP address information, multiple card number information, certificate number information and mobile phone number information;

[0070] The unauthorized behavior determination module 404 is used to determine that the user has unauthorized behavior and reject the user's access request when the current relevant information provided by the user does not exist in the authorization information in the first database record table.

[0071] In one embodiment, a related contact unauthorized behavior detection module is further included, which is specifically used to:

[0072] After obtaining authorization from the user's relevant contacts, a second database record table is constructed based on the IP address information, multiple card number information, certificate number information, and mobile phone number information of the user's relevant contacts, and the second database record table is stored in the blockchain;

[0073] Receive the user's access request and obtain the current relevant information of the relevant contacts provided by the user;

[0074] According to the current relevant information of the relevant contact, searching the first database record table for the IP address information of the matching relevant contact;

[0075] After finding the matching IP address information of the relevant contact in the second database record table, determining the authorization information in the second database record table according to the IP address information of the relevant contact; the authorization information in the second database record table includes the authorized IP address information, multiple card number information, certificate number information and mobile phone number information of the relevant contact;

[0076] When the current relevant information of the relevant contact exists in the authorization information in the second database record table, it is determined that the user has not exceeded his authority, and the user's access request is executed.

[0077] In one embodiment, a first database record table construction module is further included, which is specifically used to:

[0078] After the user applies for a new card, receiving an add instruction issued by the user; the add instruction carries the new card number information;

[0079] Verify whether the adding instruction is operated by the target user;

[0080] After the verification is passed, the new card number information is added to the authorization information of the first database record table to obtain an updated first database record table, and the updated first database record table is stored in the blockchain.

[0081] In one embodiment, a first database record table construction module is further included, which is specifically used to:

[0082] Receiving a replacement instruction issued by a user, wherein the replacement instruction carries information of an old card number and information of a new card number to be replaced;

[0083] Verifying whether the replacement instruction is operated by the target user;

[0084] After the verification is passed, the old card number information in the authorization information of the first database record table is replaced with the new card number information to be replaced, and the replaced first database record table is obtained, and the replaced first database record table is stored in the blockchain.

[0085] In one embodiment, the unauthorized behavior determination module 404 is further configured to:

[0086] When the card number information provided by the user does not exist in the authorization information, obtain the function ID and function ID field corresponding to the user's access request;

[0087] The last two digits of the function ID field are matched with the preset exception field, and the user's unauthorized behavior is detected based on the matching result.

[0088] Figure 5 Schematic diagram of an unauthorized behavior detection device in an embodiment of the present invention. In one embodiment, it also includes an alarm module 501, which is specifically used to:

[0089] When the card number information provided by the user does not exist in the authorization information, it is determined that the user has exceeded his / her authority and an alarm message is issued.

[0090] An embodiment of the present invention further provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned unauthorized behavior detection method when executing the computer program.

[0091] An embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the above-mentioned unauthorized behavior detection method is implemented.

[0092] An embodiment of the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the above-mentioned unauthorized behavior detection method is implemented.

[0093] In the embodiment of the present invention, by receiving the user's access request, the current relevant information provided by the user is obtained; the relevant information includes one or any combination of IP address information, multiple card number information, certificate number information and mobile phone number information; according to the current relevant information, the matching IP address information is searched in the first database record table; the first database record table is constructed according to the historical relevant information; the first database record table is stored in the blockchain; after finding the matching IP address information in the first database record table, the authorization information in the first database record table is determined according to the IP address information; the authorization information in the first database record table includes the user's authorized IP address information, multiple card number information, certificate number information and mobile phone number information; when the current relevant information provided by the user does not exist in the authorization information in the first database record table, it is determined that the user has exceeded the authority and the user's access request is rejected. In the above process, the embodiment of the present invention is based on the authorization information under the IP address information found in the first database record table, confirms whether the user's relevant information exists in the authorization information through the IP address information, judges the unauthorized behavior to realize the unauthorized behavior detection, thereby improving the accuracy and efficiency of the determination of the unauthorized behavior.

[0094] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0095] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0096] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0097] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0098] The specific embodiments described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for detecting unauthorized behavior, characterized in that: include: Receive user access requests and obtain current relevant information provided by the user; The relevant information includes one or any combination of IP address information, multiple card number information, ID number information and mobile phone number information; According to the current relevant information, searching for matching IP address information in the first database record table; the first database record table is constructed based on the historical relevant information; the first database record table is stored in the blockchain; After finding the matching IP address information in the first database record table, determining the authorization information in the first database record table according to the IP address information; the authorization information in the first database record table includes the user's authorized IP address information, multiple card number information, certificate number information and mobile phone number information; When the current relevant information provided by the user does not exist in the authorization information in the record table of the first database, it is determined that the user has exceeded his authority and the user's access request is rejected.

2. The method according to claim 1, characterized in that Also includes: After obtaining authorization from the user's relevant contacts, a second database record table is constructed based on the IP address information, multiple card number information, certificate number information, and mobile phone number information of the user's relevant contacts, and the second database record table is stored in the blockchain; Receive the user's access request and obtain the current relevant information of the relevant contacts provided by the user; According to the current relevant information of the relevant contact, searching the first database record table for the IP address information of the matching relevant contact; After finding the matching IP address information of the relevant contact in the second database record table, determining the authorization information in the second database record table according to the IP address information of the relevant contact; The authorization information in the second database record table includes the IP address information, multiple card number information, certificate number information and mobile phone number information authorized by the relevant contact; When the current relevant information of the relevant contact exists in the authorization information in the second database record table, it is determined that the user has not exceeded his authority, and the user's access request is executed.

3. The method according to claim 1, characterized in that Constructing a first database record table according to the historical related information also includes: After the user applies for a new card, receiving an add instruction issued by the user; the add instruction carries the new card number information; Verify whether the adding instruction is operated by the target user; After the verification is passed, the new card number information is added to the authorization information of the first database record table to obtain an updated first database record table, and the updated first database record table is stored in the blockchain.

4. The method according to claim 1, characterized in that Constructing a first database record table according to the historical related information also includes: Receiving a replacement instruction issued by a user, wherein the replacement instruction carries information of an old card number and information of a new card number to be replaced; Verifying whether the replacement instruction is operated by the target user; After the verification is passed, the old card number information in the authorization information of the first database record table is replaced with the new card number information to be replaced, and the replaced first database record table is obtained, and the replaced first database record table is stored in the blockchain.

5. The method according to claim 1, characterized in that Also includes: When the card number information provided by the user does not exist in the authorization information, it is determined that the user has exceeded his / her authority and an alarm message is issued.

6. The method according to claim 5, characterized in that When the card number information provided by the user does not exist in the authorization information, it is determined that the user has exceeded his / her authority, including: When the card number information provided by the user does not exist in the authorization information, obtain the function ID and function ID field corresponding to the user's access request; The last two digits of the function ID field are matched with the preset exception field, and the user's unauthorized behavior is detected based on the matching result.

7. An unauthorized behavior detection device, characterized in that: include: The relevant information acquisition module is used to receive the user's access request and obtain the current relevant information provided by the user; the relevant information includes one or any combination of IP address information, multiple card number information, certificate number information and mobile phone number information; An IP address information matching module, used to search for matching IP address information in a first database record table according to current relevant information; the first database record table is constructed according to historical relevant information; the first database record table is stored in the blockchain; An authorization information determination module is used to determine the authorization information in the first database record table according to the IP address information after finding the matching IP address information in the first database record table; The authorization information in the first database record table includes the user's authorized IP address information, multiple card number information, certificate number information and mobile phone number information; The unauthorized behavior determination module is used to determine that the user has unauthorized behavior and reject the user's access request when the current relevant information provided by the user does not exist in the authorization information in the first database record table.

8. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images