Abnormality detection method and device, equipment, medium and program product

Abstract

The invention provides an anomaly detection method which can be applied to the technical fields of information security, information technology and account detection. The anomaly detection method comprises the following steps: acquiring login time for logging in a target website by using a target account and a network address of terminal equipment for logging in; obtaining an internal network identifier of an institution to which the terminal equipment belongs according to the network address, wherein the internal network identifier is associated with a geographic position of the institution to which the terminal equipment belongs; when it is detected that the two internal network identifiers of the target account are not matched, determining a time interval of two login times corresponding to the two internal network identifiers; under the condition that the time interval meets a preset time interval threshold value, it is determined that an abnormal login event exists in the target account; wherein the preset time interval threshold value is determined according to the distance between the two geographic positions associated with the two internal network identifiers. The invention further provides an anomaly detection device, equipment, a storage medium and a program product.

Description

Technical Field

[0001] The present disclosure relates to technical fields such as information security, information technology, and account detection, and specifically to an anomaly detection method, device, equipment, medium, and program product. Background Art

[0002] As the degree of enterprise informatization continues to improve, enterprise application accounts have become an important bridge connecting enterprises with employees, customers, and partners. However, this also makes enterprise application accounts face threats from external attackers, and abnormal login behavior has become an important security risk point. Abnormal account login may not only lead to the leakage of enterprise data, but also have a serious impact on enterprise operations.

[0003] The geographical location of network devices can be determined through network address (IP address) positioning technology on the Internet. Therefore, the use of IP address positioning technology can determine whether there is an off-site login event for an account, and further determine whether the account has been borrowed or stolen. However, for a large enterprise that has established an intranet, the IP address is usually private and only valid within the scope of the intranet. It is not directly exposed to the public Internet, and it is impossible to directly determine the geographical location of network devices in the intranet through IP address positioning technology. Therefore, it is impossible to effectively monitor the borrowing or theft of accounts within the enterprise. Summary of the invention

[0004] In view of the above problems, the present disclosure provides an anomaly detection method, apparatus, device, medium and program product.

[0005] According to a first aspect of the present disclosure, there is provided an anomaly detection method, comprising: obtaining a login time of a target website logged in using a target account and a network address of a terminal device used for the login; obtaining an internal network identifier of an organization to which the terminal device belongs according to the network address, the internal network identifier being associated with a geographical location of the organization to which the terminal device belongs; in the case where it is detected that two internal network identifiers of the target account do not match, determining a time interval between two login times corresponding to the two internal network identifiers; and in the case where the time interval satisfies a preset time interval threshold, determining that an abnormal login event exists in the target account; wherein the preset time interval threshold is determined based on the distance between two geographical locations associated with the two internal network identifiers.

[0006] According to an embodiment of the present disclosure, the internal network identifier includes: a first location identifier associated with the first-level institution to which the terminal device belongs; the above method also includes: when it is detected that the first location identifiers of the two internal network identifiers of the target account do not match, determining that there is a login event for the target account across the first-level institutions; and determining a preset time interval threshold based on the respective geographical locations of the two first-level institutions.

[0007] According to an embodiment of the present disclosure, the internal network identifier also includes: a second location identifier associated with the secondary organization to which the terminal device belongs; the method also includes: when it is detected that the first location identifiers of the two internal network identifiers of the target account match, determining the matching results of the two second location identifiers; when the two second location identifiers of the target account do not match, determining that there is a login event for the target account across secondary organizations; and determining a preset time interval based on the respective geographical locations of the two secondary organizations.

[0008] According to an embodiment of the present disclosure, the internal network identifier also includes: a third location identifier associated with the secondary organization to which the terminal device belongs; the above method also includes: when it is detected that the two first location identifiers of the target account match and the two second location identifiers match, determining the matching results of the two third location identifiers; when the two third location identifiers of the target account do not match, determining that the target account has a login event across three-level organizations; and determining a preset time interval based on the respective geographical locations of the two third-level organizations.

[0009] According to an embodiment of the present disclosure, the above method also includes: determining a target type network device from a plurality of different types of network devices, wherein the target type network device is deployed in each institution, and an internal network identifier of the target type network device corresponds one-to-one to a geographical location of the institution to which the target type network device belongs; determining an internal network identifier corresponding to each institution based on the internal network identifier of the target network device; and associating the internal network identifier corresponding to each institution and the geographical location corresponding to each institution to obtain an association relationship table.

[0010] According to an embodiment of the present disclosure, determining the time interval between two login times corresponding to two internal network identifiers includes querying an association table based on the two internal network identifiers to obtain the geographic locations of two affiliated institutions corresponding to the two internal network identifiers.

[0011] According to an embodiment of the present disclosure, obtaining the login time of using a target account to log in to a target website and the network address of a terminal device used for login includes: obtaining a login log of the target account from a user authentication information system; and obtaining the network address of the terminal device used by the user to log in each time and the login time of each login based on the login log of the target account.

[0012] A second aspect of the present disclosure provides an anomaly detection device, including: a first acquisition module, used to obtain the login time of logging into a target website using a target account and the network address of a terminal device used for logging in; a second acquisition module, used to obtain an internal network identifier of an organization to which the terminal device belongs based on the network address, the internal network identifier being associated with a geographical location of the organization to which the terminal device belongs; a first determination module, which, when detecting that two internal network identifiers of the target account do not match, determines the time interval between two login times corresponding to the two internal network identifiers; and a second determination module, which, when the time interval satisfies a preset time interval threshold, determines that the target account is in the presence of an abnormal login event; wherein the preset time interval threshold is determined based on the distance between two geographical locations associated with the two internal network identifiers.

[0013] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0014] The fourth aspect of the present disclosure further provides a computer-readable storage medium having a computer program or instructions stored thereon, which implements the steps of the above method when the above computer program or instructions are executed by a processor.

[0015] The fifth aspect of the present disclosure further provides a computer program product, including a computer program or instructions, which implement the steps of the above method when the above computer program or instructions are executed by a processor.

[0016] According to the detection method provided by the present disclosure, by obtaining the login time and network address of the target account to log in to the target website, since the network address assigned to each terminal device of the same organization contains a fixed internal network identification part, the internal network identification can correspond one-to-one with the organization to which the terminal device belongs. By associating the internal network identification with the geographical location of the organization to which it belongs, and then obtaining the internal network identification when logging in at different times, when it is detected that the obtained internal network identification is different, it means that the target account has cross-institutional login behavior. The time interval between logins can further determine whether the cross-institutional login behavior is an abnormal login behavior. If the time interval is too short and the geographical locations are far apart, then this login behavior is likely to be abnormal. In this way, it is possible to detect abnormal logins of user accounts without IP address location information. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The above contents and other purposes, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0018] Figure 1 The application scenario diagram of the anomaly detection method, apparatus, device, medium and program product according to the embodiments of the present disclosure is schematically shown;

[0019] Figure 2 A flowchart of an abnormality detection method according to an embodiment of the present disclosure is schematically shown;

[0020] Figure 3 A flowchart of an abnormality detection method according to another embodiment of the present disclosure is schematically shown;

[0021] Figure 4 A structural block diagram of an abnormality detection device according to an embodiment of the present disclosure is schematically shown; and

[0022] Figure 5 A block diagram of an electronic device suitable for implementing an abnormality detection method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0023] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0024] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0025] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly rigid manner.

[0026] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0027] In the technical solution of the present disclosure, the user information (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0028] In the scenario of using personal information for automated decision-making, the methods, devices, and systems provided by the embodiments of the present disclosure provide users with corresponding operation portals for users to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered. The expression "automated decision-making" here refers to the activity of automatically analyzing and evaluating a person's behavioral habits, interests and hobbies, or economic, health, credit status, etc. through computer programs, and making decisions. The expression "expert decision-making" here refers to the activity of making decisions by people who specialize in a certain field, have specialized experience, knowledge and skills, and have reached a certain level of professionalism.

[0029] The inventors found that there may be a risk of users’ personal accounts borrowing from each other or being stolen by others within the enterprise, which has an adverse impact on the security and compliance of enterprise management. However, for a large enterprise that has established an internal private network, there is no IP address location information within the enterprise, so the enterprise cannot use Internet technology to determine whether a user has been borrowed or stolen. The inventors also found that for institutions of different levels of an enterprise and multiple institutions of the same level, their IP addresses are usually allocated according to certain rules to facilitate the management of IP addresses. The IP address consists of a network part and a host part. The network part of an institution’s IP address is usually unchanged. Therefore, the location information of the logged-in IP address can be obtained by associating the network part of the IP address with the geographical location of the institution.

[0030] Based on the above-mentioned inventive concept, the present disclosure provides an anomaly detection method, including: obtaining the login time of logging into the target website using the target account and the network address of the terminal device used for login. According to the network address, the internal network identifier of the organization to which the terminal device belongs is obtained, and the internal network identifier is associated with the geographical location of the organization to which the terminal device belongs. In the case where it is detected that the two internal network identifiers of the target account do not match, the time interval between the two login times corresponding to the two internal network identifiers is determined. And in the case where the time interval meets the preset time interval threshold, it is determined that an abnormal login event exists in the target account. Among them, the preset time interval threshold is determined according to the distance between the two geographical locations associated with the two internal network identifiers.

[0031] According to the detection method provided by the present disclosure, the internal network identifier and the geographical location of the organization are associated, the login IP address and login time are obtained from the user's login information, and the internal network identifier of the organization where the user is located when logging in is obtained from the login IP address, thereby determining the login location. When it is detected that the obtained internal network identifiers are different, it means that the target account has cross-institutional login behavior. Furthermore, through the login time interval, it is possible to further determine whether the cross-institutional login behavior is an abnormal login behavior. If the time interval is too short and the geographical locations are far apart, then this login behavior is likely to be abnormal. In this way, it is possible to detect abnormal logins to user accounts without Internet network address status information.

[0032] Figure 1 The application scenario diagram of the anomaly detection method and device according to an embodiment of the present disclosure is schematically shown.

[0033] like Figure 1 As shown, the application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 is used to provide a medium for a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0034] The user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0035] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0036] The server 105 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0037] It should be noted that the anomaly detection method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the anomaly detection device provided in the embodiment of the present disclosure can generally be set in the server 105. The anomaly detection method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Accordingly, the anomaly detection device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0038] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0039] Figure 2 The flowchart of the abnormality detection method according to the embodiment of the present disclosure is schematically shown.

[0040] like Figure 2 As shown, the abnormality detection method of this embodiment includes operations S210 to S230.

[0041] In operation S210, a login time of logging into a target website using a target account and a network address of a terminal device used for logging in are obtained.

[0042] In operation S220, an internal network identifier of the organization to which the terminal device belongs is obtained according to the network address, and the internal network identifier is associated with the geographical location of the organization to which the terminal device belongs.

[0043] In operation S230, when it is detected that the two internal network identifiers of the target account do not match, a time interval between two login times corresponding to the two internal network identifiers is determined.

[0044] In operation S240, when the time interval meets a preset time interval threshold, it is determined that an abnormal login event exists in the target account.

[0045] According to an embodiment of the present disclosure, the preset time interval threshold is determined according to the distance between two geographical locations associated with two internal network identifiers.

[0046] In an embodiment of the present disclosure, before obtaining the user's information, the user's consent or authorization may be obtained. For example, before operation S210, a request to obtain the user's information may be issued to the user. When the user agrees or authorizes that the user's information may be obtained, operation S210 is performed.

[0047] According to an embodiment of the present disclosure, the target account represents a personal account of an internal user of an enterprise that is authenticated and registered in a relevant application or website of the enterprise based on personal identity information. The terminal device may be a computer, a tablet computer, or other device.

[0048] According to an embodiment of the present disclosure, in the intranet of an organization, the internal network identifier represents the fixed network part of the IP address of an organization. Each IP address includes two identifiers, namely the internal network identifier and the host identifier. The internal network identifier is fixed in the intranet of the same organization of the enterprise, that is, the same internal network identifier can be obtained from different terminal devices of the same organization. Therefore, the internal network identifier can be associated with the organization to which the terminal device belongs, and by obtaining the geographical location of the organization to which the terminal device belongs, the association between the internal network identifier and the geographical location is achieved. Therefore, by obtaining the IP address of the terminal device when the user logs in to the target website or application, the geographical location of the user when using the target account to log in to the target application can be indirectly determined.

[0049] According to the embodiments of the present disclosure, the target account's login information within a period of time may be obtained first, and the login information may include the login time of the target account's multiple logins to the target website or application and the IP address of the terminal device used for each login to the target website or application. The internal network identifier obtained at each login may be detected in the order of the login time, and when it is detected that two consecutive internal network identifiers do not match each other, it indicates that the target account has a cross-institutional login event.

[0050] According to the embodiments of the present disclosure, when a cross-institution login event is detected for a target account, it is possible to further determine whether the cross-institution login of the target account is an abnormal login event based on the time interval between the two logins. Specifically, firstly, the specific locations of the two institutions are obtained based on the internal network identifiers of the two logins of the target account, and based on the distance between the two institutions, the traffic time required under normal traffic conditions is considered as a preset time interval threshold. When the time interval between the two logins is lower than the preset time interval, it can be determined that the target account has an abnormal login event.

[0051] According to the detection method provided by the present disclosure, by associating the internal network identifier with the geographical location of the organization, the login IP address and login time are obtained from the user's login information, and the internal network identifier of the organization where the user is located when logging in is obtained from the login IP address, thereby determining the login location. When it is detected that the obtained internal network identifiers are different, it means that the target account has cross-institutional login behavior. Furthermore, through the login time interval, it is possible to further determine whether the cross-institutional login behavior is an abnormal login behavior. If the time interval is too short and the geographical locations are far apart, then this login behavior is likely to be abnormal. In this way, it is possible to detect abnormal logins to user accounts without Internet network address status information.

[0052] According to an embodiment of the present disclosure, obtaining the login time of logging into the target website using the target account and the network address of the terminal device used for logging in includes obtaining the login log of the target account from the user authentication information system. According to the login log of the target account, obtaining the network address of the terminal device used by the user to log in each time and the login time of each login.

[0053] According to the embodiments of the present disclosure, each website or application authenticates and logs in the target account through the user authentication information system. The login log of the user authentication information system records a lot of information such as successful login information and failed login information of the user using the target account to log in. Only the successful login information of the user can be extracted, which greatly reduces the amount of data analysis.

[0054] After extracting the user's successful login information, the terminal device IP address information, login user, login application name, login application IP, login time and other information can be intercepted from the login log based on the preset rules. And the network address of the terminal device used by the target account to log in each time and the login time of each login can be further obtained from this information.

[0055] According to the embodiments of the present disclosure, in some login information, some login IP addresses are some special transit IP addresses, such as VPN information or other intermediate key IP address information. These IP addresses have nothing to do with the login user. If the location analysis of this information is performed, it will interfere with the result. Therefore, these exception IPs can be removed in advance to eliminate interference.

[0056] According to an embodiment of the present disclosure, by acquiring and analyzing login logs, the login activities of the target account can be monitored in real time, including login time, location and device, which can provide instant feedback for account security.

[0057] According to an embodiment of the present disclosure, before operation S210, it also includes determining a target type network device from a plurality of different types of network devices, wherein the target type network device is deployed in each institution, and the internal network identifier of the target type network device corresponds to the geographical location of the institution to which the target type network device belongs. According to the internal network identifier of the target type network device, the internal network identifier corresponding to each institution is determined. And the internal network identifier corresponding to each institution and the geographical location corresponding to each institution are associated to obtain an association relationship table.

[0058] According to the embodiments of the present disclosure, information of various types of network devices can be obtained from the configuration management system of the enterprise. In the configuration management system of the enterprise, the corresponding IP address information and corresponding management agencies of various types of network devices of the enterprise are entered. For example, servers, terminal devices, security devices, storage devices, etc. are all entered with IP address information and corresponding management agencies, so the relationship between IP addresses and agencies can be obtained through the above data.

[0059] According to the embodiments of the present disclosure, in large enterprises, there may be the following exceptions: a certain device is deployed by another first-level organization in the organization and is assigned the IP address of the organization, but the management organization registered with the device is not the organization. This type of information will cause incorrect attribution information of the internal network identifier. To prevent this from happening, it is necessary to remove such internal network identifiers in advance to avoid such internal network identifiers from interfering with the attribution results.

[0060] According to the embodiments of the present disclosure, when allocating IP addresses to network devices, in order to save IP address information, some small organizations (third-level organizations or second-level organizations) will share an internal network identifier. This will have an impact on the subsequent result judgment: when judging this type of internal network identifier as logging in to two organizations at the same time, it is judged that the account has been stolen or borrowed. To avoid such an impact, if multiple organizations share the same internal network identifier, one organization is randomly selected as the representative organization of this internal network identifier, and the geographic locations of other organizations that share this internal network identifier will not appear in the association table.

[0061] According to the embodiments of the present disclosure, the IP addresses of some devices may involve two organizations, for example, the wide area network address of a network device router may involve two organizations, and some devices may not exist in a specific organization, for example, some security devices may not exist in a third-level organization. Therefore, the target type network device needs to exist in each organization, and the IP address on the device is only valid locally, so that each organization can obtain an internal network identifier from the network device, and the obtained internal network identifier corresponds to the geographical location of the organization to which the target type network device belongs. For example, the target network device can be a network switch, but the present disclosure is not limited to this.

[0062] According to the embodiment of the present disclosure, after the internal network identification of the target type network device is obtained, since the target network device and the terminal device have the same internal network identification in the intranet of an organization, the internal network identification of the target network device obtained is the internal network identification of the terminal device. The internal network identification is associated with the geographical location of the organization to obtain an association relationship table.

[0063] According to the embodiments of the present disclosure, by screening network devices and eliminating interference items, the internal network identifier can accurately represent the geographical location of the organization to which it actually belongs, thereby establishing an accurate association relationship table.

[0064] According to an embodiment of the present disclosure, determining the time interval between two login times corresponding to two internal network identifiers includes querying an association table based on the two internal network identifiers to obtain the geographic locations of two affiliated institutions corresponding to the two internal network identifiers.

[0065] According to an embodiment of the present disclosure, when it is detected that there are two internal network identifiers that do not match, a field value that matches the field values ​​of the two internal network identifiers is queried in the association table, and the geographic locations of the two affiliated institutions associated with the two internal network identifiers are extracted from the association table, and then the queried geographic location information is returned as a query result.

[0066] According to an embodiment of the present disclosure, by constructing an association table between internal identification and organizational geographic location, after determining the internal network identification, the login location of the target account can be quickly located by querying the association table.

[0067] According to an embodiment of the present disclosure, the internal network identifier includes: a first location identifier associated with a primary institution to which a terminal device belongs, a second location identifier associated with a secondary institution to which the terminal device belongs, and a third location identifier associated with a secondary institution to which the terminal device belongs.

[0068] According to an embodiment of the present disclosure, the first position identifier of the internal network identifier represents the first network segment of the internal network identifier, the second position identifier of the internal network identifier represents the second network segment of the internal network identifier, and the third position identifier of the internal network identifier represents the third network segment of the internal network identifier.

[0069] For example, if the internal network identifier is 87.10.15, 87 is the first location identifier, 10 is the second location identifier, and 15 is the third location identifier.

[0070] According to the embodiments of the present disclosure, different first-level institutions have different first location identifiers; subordinate institutions belonging to the same first-level institution have the same first location identifier. Different third-level institutions belonging to the same second-level institution have the same first location identifier, second location identifier, and different third location identifiers.

[0071] For example, for a banking enterprise, the first location identifiers of the internal network identifiers of its first-level branches in various locations are usually different. Therefore, different first-level institutions can be distinguished by the first location identifiers.

[0072] A first-level branch also has second-level branches in different cities in a province. The first location identifier of the internal network identifier of the same first-level branch is the same, but the second-level branches under the first-level branch are usually designed to belong to the same large subnet or network, that is, the second-level branches under the same first-level branch have the same first location identifier and different second location identifiers. Therefore, different second-level branches can be distinguished by the second location identifier.

[0073] A second-level branch also has multiple different sub-branches based on administrative regions or business districts. The internal network identifiers of the sub-branches under the same second-level branch have the same first location identifier and second location identifier, as well as different third location identifiers. Therefore, different sub-branches can be distinguished by the third location identifier.

[0074] According to an embodiment of the present disclosure, when it is detected that the first location identifiers of the two internal network identifiers of the target account do not match, it is determined that there is a login event across the first-level institutions for the target account; and a preset time interval threshold is determined based on the respective geographical locations of the two first-level institutions.

[0075] According to an embodiment of the present disclosure, when detecting two internal network identifiers obtained from two login times of a target account, the first location identifier may be detected first. If the first location identifier does not match, it means that the target account has logged in at different first-level institutions, and there is a login event for the target account across first-level institutions.

[0076] According to the embodiment of the present disclosure, when a target account is detected to have a login event across first-level institutions, the geographical locations of the two first-level institutions are determined through the internal network identifier. Based on the distance between the geographical locations, the time required for transportation between the two first-level institutions under normal traffic time conditions is fully considered as the preset time interval threshold. When the time between two logins is lower than the preset time interval threshold, it means that the target account has an abnormal login event.

[0077] According to an embodiment of the present disclosure, when it is detected that the first location identifiers of the two internal network identifiers of the target account match, the matching results of the two second location identifiers are determined. When the two second location identifiers of the target account do not match, it is determined that there is a login event across the secondary institutions for the target account. And according to the respective geographical locations of the two secondary institutions, a preset time interval is determined.

[0078] According to an embodiment of the present disclosure, when detecting two internal network identifiers obtained when the target account logs in twice, the first location identifier can be detected first, and if the first location identifier matches, the second location identifier is detected. When it is detected that the second location identifier does not match, it is determined that the target account has logged in at two secondary institutions.

[0079] According to an embodiment of the present disclosure, when it is detected that the target account logs in at two secondary institutions, the geographical locations of the two secondary institutions are determined through internal network identification. Based on the geographical location between the two secondary institutions, the time required for transportation between the two secondary institutions under normal traffic time conditions is fully considered as the preset time interval threshold. When the time between two logins is lower than the preset time interval threshold, it means that there is an abnormal login event in the target account.

[0080] According to an embodiment of the present disclosure, when it is detected that the two first location identifiers of the target account match and the two second location identifiers match, the matching results of the two third location identifiers are determined. When the two third location identifiers of the target account do not match, it is determined that the target account has a login event across three-level institutions. And according to the respective geographical locations of the two third-level institutions, a preset time interval is determined.

[0081] According to an embodiment of the present disclosure, two internal network identifiers obtained when the target account logs in twice are detected. When it is detected that the first location identifier and the second location identifier are the same, the third location identifier is detected. When the two third location identifiers do not match, it is determined that the target account has logged in at two third-level institutions.

[0082] According to the embodiment of the present disclosure, when it is detected that the target account logs in at two third-level institutions, the geographical locations of the two third-level institutions are determined through the internal network identifier. Based on the geographical location between the two third-level institutions, the time required for transportation between the two third-level institutions under normal traffic time conditions is fully considered as the preset time interval threshold. When the time between two logins is lower than the preset time interval threshold, it means that there is an abnormal login event in the target account.

[0083] In an illustrative embodiment, for a large national enterprise, its first-level institutions are usually set up in different provinces, second-level institutions are usually set up in various cities in the province, and third-level institutions are usually set up in different administrative regions of the city. Therefore, the distance between first-level institutions is usually relatively far, the distance between second-level institutions is second, and the distance between third-level institutions is relatively close. For example, for a bank enterprise, its first-level branches are usually set up across provinces, and its second-level branches are usually set up in the same province, and each branch is set up in different administrative regions of the city.

[0084] In order to simplify the complexity and diversity of setting the preset time interval, a fixed time interval can be set for each of the first-level institutions, the second-level institutions, and the third-level institutions as the preset time interval threshold. For example, the preset time interval threshold between the first-level institutions can be set based on the minimum or average duration required for traffic between multiple first-level institutions; the preset time interval threshold between the second-level institutions can be set based on the minimum or average duration required for traffic between multiple second-level institutions; the preset time interval threshold between the third-level institutions can be set based on the minimum or average duration required for traffic between multiple third-level institutions.

[0085] For example, the preset time interval threshold between first-level institutions is 8 hours, the preset time interval threshold for second-level institutions is 4 hours, and the preset time interval between third-level institutions is 1 hour. When it is detected that the first position identifier of the internal network identifier obtained when the target account logs into the target website twice is inconsistent, calculate whether the time interval between the two logins is less than 8 hours. If it is less than 8 hours, it means that the target account may have an abnormal login event. If the first position identifier is the same, detect the second position identifier of each of the two internal network identifiers. If the second position identifiers are different, calculate whether the time interval between the two logins is less than 4 hours. If it is less than 4 hours, it means that the target account may have an abnormal login event. If the first position identifier and the second position identifier are the same, detect the third position identifier of each of the two internal network identifiers. If the third position identifiers are different, detect whether the time interval between the two logins is less than 1 hour. If it is less than 1 hour, it means that the target account may have an abnormal login event.

[0086] In addition, when a fixed time interval is set as the preset time interval threshold for each of the first-level, second-level, and third-level institutions, there may be some first-level institutions that are actually very close to each other. If a fixed time interval is used for judgment, it may lead to false alarms. For example, some first-level branches and headquarters may be very close, and if the regular time interval is used, it may lead to false judgments. Therefore, the internal network identifiers of these exceptional first-level institutions need to be registered separately. When the two detected internal network identifiers match the two registered internal network identifiers, the preset time interval threshold needs to be determined according to the actual geographical location.

[0087] By setting a fixed time interval for the distance between the geographical locations of the first-level institutions, the second-level institutions and the third-level institutions respectively, it is possible to quickly determine whether a cross-institution login event is an abnormal login event, thereby improving the efficiency of the judgment.

[0088] According to the embodiments of the present disclosure, by associating the first location identifier with the primary structure, the second location identifier with the secondary organization, and the third location identifier with the tertiary organization, judgment is made in sequence according to the location order. When the first location identifier of the internal network identifier is different, the subsequent detection of the second location identifier and the third location identifier can be stopped, or when it is detected that the second location identifier is different, the detection of the three location identifiers can be stopped, thereby improving the detection efficiency and speeding up the identification of whether the target account has logged in across organizations.

[0089] Figure 3 A flowchart of an abnormality detection method according to another embodiment of the present disclosure is schematically shown.

[0090] like Figure 3 As shown, the abnormality detection method of this embodiment includes operations S301 to S311.

[0091] In operation S301, the login time of each login of the target account and the IP address of the terminal device at each login are obtained.

[0092] In operation S302, the internal network identifier of each login is obtained according to the IP address of the terminal device at each login.

[0093] In operation S303, the internal network identifiers of two consecutive logins are detected in order of login time.

[0094] In operation S304, it is detected whether the first location identifiers of the two internal network identifiers match each other.

[0095] If the two first location identifiers match, operation S305 is performed; if the two first location identifiers do not match, operation S307 is performed.

[0096] In operation S305, when the two first location identifiers match, it is detected whether the second location identifiers of the two internal network identifiers match.

[0097] If the two second location identifiers match, operation S306 is performed; if the two second location identifiers do not match, operation S307 is performed.

[0098] In operation S306, when the two first location identifiers and the second location identifiers do not match, it is detected whether the third location identifiers of the two internal network identifiers match.

[0099] If the two third location identifiers match, it is determined in operation S312 that the target account is logged in normally; if the two third location identifiers do not match, operation S307 is executed.

[0100] In operation S307, when it is detected that the first location identifiers, the second location identifiers, or the third location identifiers of the two internal network identifiers do not match, the time interval between the two login times is calculated.

[0101] In operation S308, the geographical location of the organization to which the two internal network identifiers belong is queried according to the association relationship table.

[0102] In operation S309, a preset time interval is determined according to the geographical locations of the organizations to which the two internal network identifiers belong.

[0103] In operation S310, it is determined whether the time interval between two login times is less than a preset time.

[0104] If it is determined that the time interval between the two login times is not less than the preset time interval, it is determined in operation S312 that the target account has logged in normally; if it is determined that the time interval between the two login times is less than the preset time interval, it is determined in operation S311 that an abnormal login event has occurred in the target account.

[0105] According to the anomaly detection method disclosed in the present invention, by detecting the internal network identification of the terminal device each time the target account logs in, the abnormal login information of the user's account can be discovered in time, hidden dangers can be discovered in time, and then the user of the user's account can be notified to change the password in time to avoid the user's account being stolen, while also improving the security of the business. Furthermore, for the asset management of large enterprises, the system prohibits the illegal operation of users' accounts borrowing from each other. This method can detect and analyze the internal network identification of the terminal device each time the target account logs in, and can discover the illegal operation of users' accounts borrowing from each other, thereby improving the compliance of enterprise management.

[0106] Based on the above abnormality detection method, the present disclosure also provides an abnormality detection device. Figure 3 The device is described in detail.

[0107] Figure 4 The structural block diagram of the abnormality detection device according to an embodiment of the present disclosure is schematically shown.

[0108] like Figure 4 As shown, the abnormality detection device 400 of this embodiment includes a first acquisition module 410 , a second acquisition module 420 , a first determination module 430 and a second determination module 440 .

[0109] The first acquisition module 410 is used to acquire the login time of the target website using the target account and the network address of the terminal device used for login. In one embodiment, the first acquisition module 410 can be used to perform the operation S210 described above, which will not be repeated here.

[0110] The second acquisition module 420 is used to acquire the internal network identifier of the organization to which the terminal device belongs according to the network address, and the internal network identifier is associated with the geographical location of the organization to which the terminal device belongs. In one embodiment, the second acquisition module 420 can be used to perform the operation S220 described above, which will not be repeated here.

[0111] The first determination module 430 determines the time interval between two login times corresponding to the two internal network identifiers when detecting that the two internal network identifiers of the target account do not match. In one embodiment, the first determination module 430 can be used to perform the operation S230 described above, which will not be described in detail here.

[0112] The second determination module 440 is used to determine that there is an abnormal login event in the target account when the time interval meets a preset time interval threshold; wherein the preset time interval threshold is determined according to the distance between two geographical locations associated with the two internal network identifiers. In one embodiment, the second determination module 440 can be used to perform the operation S240 described above, which will not be repeated here.

[0113] According to an embodiment of the present disclosure, the first acquisition module 410 includes a first acquisition unit and a second acquisition unit.

[0114] The first acquisition unit is used to acquire the login log of the target account from the user authentication information system.

[0115] The second acquisition unit acquires the network address of the terminal device used by the user to log in each time and the login time of each login according to the login log of the target account.

[0116] According to an embodiment of the present disclosure, the first determination module includes a first mechanism determination unit and a first time determination unit.

[0117] The first organization determination unit is used to determine that there is a cross-first-level organization login event for the target account when it is detected that the first location identifiers of the two internal network identifiers of the target account do not match.

[0118] The first time determination unit is used to determine a preset time interval threshold according to the respective geographical locations of the two first-level institutions.

[0119] According to an embodiment of the present disclosure, the first determination module further includes a second position confirmation unit, a second mechanism determination unit and a second time determination unit.

[0120] The second location confirmation unit is used to determine the matching result of two second location identifiers when it is detected that the first location identifiers of the two internal network identifiers of the target account match each other.

[0121] The second institution determination unit is used to determine that there is a login event across secondary institutions for the target account when the two second location identifiers of the target account do not match.

[0122] The second time determination unit is used to determine a preset time interval according to the respective geographical locations of the two secondary institutions.

[0123] According to an embodiment of the present disclosure, the first determination module further includes a third position confirmation unit, a third mechanism determination unit and a third time determination unit.

[0124] The third location confirmation unit is used to determine the matching result of the two third location identifiers when it is detected that the two first location identifiers of the target account match and the two second location identifiers match.

[0125] The third institution determination unit is used to determine that there is a login event across three-level institutions for the target account when the two third location identifiers of the target account do not match.

[0126] The third time determination unit is used to determine a preset time interval according to the respective geographical locations of the two third-level institutions.

[0127] According to an embodiment of the present disclosure, the anomaly detection device further includes: a device determination module, an identification determination module and an association module.

[0128] The device determination module is used to determine a target type network device from multiple different types of network devices, wherein the target type network device is deployed in various institutions, and the internal network identifier of the target type network device corresponds one-to-one to the geographical location of the institution to which the target type network device belongs.

[0129] The identification determination module determines the internal network identification corresponding to each organization according to the internal network identification of the target network device.

[0130] The association module is used to associate the internal network identifiers corresponding to each organization and the geographical locations corresponding to each organization to obtain an association relationship table.

[0131] According to an embodiment of the present disclosure, the first determination module further includes a query unit.

[0132] The query unit is used to query the association relationship table according to the two internal network identifiers to obtain the geographical locations of the two affiliated institutions corresponding to the two internal network identifiers.

[0133] According to an embodiment of the present disclosure, any multiple modules of the first acquisition module 410, the second acquisition module 420, the first determination module 430, and the second determination module 440 can be combined in one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the first acquisition module 410, the second acquisition module 420, the first determination module 430, and the second determination module 440 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware, and firmware, or in any appropriate combination of any of them. Alternatively, at least one of the first acquisition module 410 , the second acquisition module 420 , the first determination module 430 , and the second determination module 440 may be at least partially implemented as a computer program module, and when the computer program module is executed, a corresponding function may be executed.

[0134] Figure 5 A block diagram of an electronic device suitable for implementing an abnormality detection method according to an embodiment of the present disclosure is schematically shown.

[0135] like Figure 4 As shown, the electronic device 500 according to an embodiment of the present disclosure includes a processor 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage part 508 into a random access memory (RAM) 503. The processor 501 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 501 may also include an onboard memory for caching purposes. The processor 501 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0136] In RAM 503, various programs and data required for the operation of electronic device 500 are stored. Processor 501, ROM 502 and RAM 503 are connected to each other via bus 504. Processor 501 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 502 and / or RAM 503. It should be noted that the program can also be stored in one or more memories other than ROM 502 and RAM 503. Processor 501 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in one or more memories.

[0137] According to an embodiment of the present disclosure, the electronic device 500 may further include an input / output (I / O) interface 505, which is also connected to the bus 504. The electronic device 500 may further include one or more of the following components connected to the I / O interface 505: an input portion 506 including a keyboard, a mouse, etc.; an output portion 507 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 508 including a hard disk, etc.; and a communication portion 509 including a network interface card such as a LAN card, a modem, etc. The communication portion 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the I / O interface 505 as needed. A removable medium 511, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 510 as needed, so that a computer program read therefrom is installed into the storage portion 508 as needed.

[0138] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0139] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 502 and / or RAM 503 described above and / or one or more memories other than ROM 502 and RAM 503.

[0140] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the anomaly detection method provided by the embodiment of the present disclosure.

[0141] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 501. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0142] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 509, and / or installed from the removable medium 511. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0143] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 509, and / or installed from the removable medium 511. When the computer program is executed by the processor 501, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0144] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0145] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0146] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0147] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. An anomaly detection method, characterized in that: The method comprises: Obtain the login time of the target website using the target account and the network address of the terminal device used for login; Acquire an internal network identifier of the organization to which the terminal device belongs according to the network address, wherein the internal network identifier is associated with a geographical location of the organization to which the terminal device belongs; In the case where it is detected that the two internal network identifiers of the target account do not match, determining the time interval between two login times corresponding to the two internal network identifiers; and When the time interval meets a preset time interval threshold, determining that an abnormal login event occurs in the target account; The preset time interval threshold is determined according to the distance between two geographical locations associated with the two internal network identifiers.

2. The method according to claim 1, characterized in that The internal network identifier includes: a first location identifier associated with a primary institution to which the terminal device belongs; The method further comprises: In the case where it is detected that the first location identifiers of the two internal network identifiers of the target account do not match each other, determining that there is a login event of the target account across the first-level institution; and The preset time interval threshold is determined according to the respective geographical locations of the two first-level institutions.

3. The method according to claim 2, characterized in that The internal network identifier also includes: a second location identifier associated with a secondary organization to which the terminal device belongs; The method further comprises: In the case where it is detected that the first location identifiers of the two internal network identifiers of the target account match each other, determining a matching result of the two second location identifiers; If the two second location identifiers of the target account do not match, determining that there is a login event for the target account across secondary institutions; and The preset time interval is determined according to the respective geographical locations of the two secondary institutions.

4. The method according to claim 3, characterized in that: The internal network identifier also includes: a third location identifier for associating with the secondary organization to which the terminal device belongs; The method further comprises: In the case where it is detected that the two first location identifiers of the target account match and the two second location identifiers match, determining a matching result of the two third location identifiers; In the case where the two third location identifiers of the target account do not match, determining that there is a login event for the target account across three-level institutions; and The preset time interval is determined according to the respective geographical locations of the two third-level institutions.

5. The method according to claim 1, characterized in that: The method further comprises: Determine a target type network device from a plurality of different types of network devices, wherein the target type network device is deployed in each institution, and an internal network identifier of the target type network device corresponds one-to-one to a geographical location of the institution to which the target type network device belongs; Determining the internal network identifier corresponding to each organization according to the internal network identifier of the target network device; and The internal network identifiers corresponding to each organization and the geographical locations corresponding to each organization are associated to obtain an association relationship table.

6. The method according to claim 5, characterized in that The determining of the time interval between two login times corresponding to the two internal network identifiers comprises: According to the two internal network identifiers, a query is performed in the association relationship table to obtain the geographical locations of the two affiliated institutions corresponding to the two internal network identifiers.

7. The method according to claim 1, characterized in that The obtaining of the login time of logging into the target website using the target account and the network address of the terminal device used for logging in includes: Obtaining a login log of the target account from a user authentication information system; and According to the login log of the target account, the network address of the terminal device used by the user to log in each time and the login time of each login are obtained.

8. An abnormality detection device, characterized in that: The device comprises: A first acquisition module is used to obtain the login time of logging into the target website using the target account and the network address of the terminal device used for logging in; A second acquisition module, configured to acquire an internal network identifier of an organization to which the terminal device belongs according to the network address, wherein the internal network identifier is associated with a geographical location of the organization to which the terminal device belongs; A first determination module, when detecting that the two internal network identifiers of the target account do not match, determines the time interval between two login times corresponding to the two internal network identifiers; and A second determination module is used to determine that there is an abnormal login event in the target account when the time interval meets a preset time interval threshold; The preset time interval threshold is determined according to the distance between two geographical locations associated with the two internal network identifiers.

9. An electronic device, comprising: one or more processors; a memory for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program or instruction stored thereon, characterized in that: When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

11. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images