Anomaly detection method, apparatus, device, medium, and program product

Abstract

The present disclosure provides an anomaly detection method, which can be applied to the technical fields of information security, information technology and account detection. The anomaly detection method comprises: obtaining a login time of a target account logging into a target website and a network address of a terminal device used for login; obtaining an internal network identifier of an organization to which the terminal device belongs according to the network address, the internal network identifier being associated with a geographic location of the organization to which the terminal device belongs; in a case where it is detected that two internal network identifiers of the target account do not match, determining a time interval of two login times corresponding to the two internal network identifiers; and in a case where the time interval satisfies a preset time interval threshold, determining that the target account has an abnormal login event; wherein the preset time interval threshold is determined according to a distance between two geographic locations associated with the two internal network identifiers. The present disclosure also provides an anomaly detection device, equipment, storage medium and program product.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of information security, information technology, and account detection, and in particular to an abnormality detection method, device, equipment, medium and program product. BACKGROUND

[0002] With the continuous improvement of enterprise informatization, enterprise application accounts have become an important bridge connecting enterprises with employees, customers, and partners. However, this also makes enterprise application accounts face threats from external attackers, and abnormal login behavior has become an important security risk point. Abnormal account login can not only lead to the leakage of enterprise data, but also have a serious impact on enterprise operation.

[0003] In the Internet, the network address (IP address) positioning technology can determine the geographical location of the network device. Therefore, using IP address positioning technology can determine whether the account has a remote login event, and further determine whether the account is borrowed or stolen. However, for a large enterprise that establishes an intranet, the IP address is usually private and only valid within the intranet, and is not directly exposed to the public Internet, so it is not possible to directly determine the geographical location of the network device in the intranet through IP address positioning technology, and therefore it is not possible to effectively monitor the account borrowing or stealing within the enterprise. SUMMARY

[0004] In view of the above problems, the present disclosure provides an abnormality detection method, device, equipment, medium and program product.

[0005] According to a first aspect of the present disclosure, an abnormality detection method is provided, comprising: obtaining a login time of a target account logging into a target website and a network address of a terminal device used for login; obtaining an internal network identifier of an organization to which the terminal device belongs according to the network address, the internal network identifier being associated with a geographical location of the organization to which the terminal device belongs; in a case where it is detected that two internal network identifiers of the target account do not match, determining a time interval of two login times corresponding to the two internal network identifiers; and in a case where the time interval satisfies a preset time interval threshold, determining that the target account has an abnormal login event; wherein the preset time interval threshold is determined according to a distance between two geographical locations associated with the two internal network identifiers.

[0006] According to an embodiment of the present disclosure, the internal network identifier comprises: a first location identifier associated with a first-level organization to which the terminal device belongs; the above method further comprises: in a case where it is detected that the first location identifiers of the two internal network identifiers of the target account do not match, determining that the target account has a login event across the first-level organizations; and determining the preset time interval threshold according to the geographical locations of the two first-level organizations.

[0007] According to an embodiment of the present disclosure, the internal network identifier further comprises a second location identifier associated with a secondary organization to which the terminal device belongs; the method further comprises: in a case where the two first location identifiers of the target account are detected to match, determining a matching result of the two second location identifiers; in a case where the two second location identifiers of the target account do not match, determining that the target account has a login event across the secondary organizations; and determining a preset time interval according to the geographical positions of the two secondary organizations.

[0008] According to an embodiment of the present disclosure, the internal network identifier further comprises a third location identifier associated with a tertiary organization to which the terminal device belongs; the method further comprises: in a case where the two first location identifiers of the target account are detected to match and the two second location identifiers are detected to match, determining a matching result of the two third location identifiers; in a case where the two third location identifiers of the target account do not match, determining that the target account has a login event across the tertiary organizations; and determining a preset time interval according to the geographical positions of the two tertiary organizations.

[0009] According to an embodiment of the present disclosure, the method further comprises: determining a target type of network device from a plurality of different types of network devices, wherein the target type of network device is deployed in each organization, and the internal network identifier of the target type of network device corresponds to the geographical position of the organization to which the target type of network device belongs; determining the internal network identifier corresponding to each organization according to the internal network identifier of the target network device; and associating the internal network identifier corresponding to each organization and the geographical position corresponding to each organization to obtain an association relationship table.

[0010] According to an embodiment of the present disclosure, determining the time interval of the two login times corresponding to the two internal network identifiers comprises: according to the two internal network identifiers, querying the association relationship table to obtain the geographical positions of the two organizations to which the two internal network identifiers belong.

[0011] According to an embodiment of the present disclosure, the login time of logging in to the target website by using the target account and the network address of the terminal device for logging in are obtained by: obtaining the login log of the target account from a user authentication information system; and obtaining the network address of the terminal device for each login and the login time of each login according to the login log of the target account.

[0012] The second aspect of the present disclosure provides an anomaly detection apparatus, comprising: a first obtaining module configured to obtain a login time of a target account logging into a target website and a network address of a terminal device used for the login; a second obtaining module configured to obtain an internal network identifier of an organization to which the terminal device belongs according to the network address, the internal network identifier being associated with a geographical location of the organization to which the terminal device belongs; a first determining module configured to determine a time interval between two login times corresponding to two internal network identifiers of the target account in a case where the two internal network identifiers are detected to be mismatched; and a second determining module configured to determine that the target account is in an abnormal login event in a case where the time interval satisfies a preset time interval threshold, wherein the preset time interval threshold is determined according to a distance between two geographical locations associated with the two internal network identifiers.

[0013] The third aspect of the present disclosure provides an electronic device, comprising: one or more processors; a memory configured to store one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method.

[0014] The fourth aspect of the present disclosure further provides a computer-readable storage medium having stored thereon a computer program or instructions, wherein the computer program or instructions, when executed by a processor, implement the steps of the method.

[0015] The fifth aspect of the present disclosure further provides a computer program product comprising a computer program or instructions, wherein the computer program or instructions, when executed by a processor, implement the steps of the method.

[0016] According to the detection method provided by the present disclosure, by obtaining the login time and the network address of the target account logging into the target website, since the network address of each terminal device of the same organization contains a fixed and unchanged internal network identifier part, the internal network identifier can be one-to-one corresponding to the organization to which the terminal device belongs. By associating the internal network identifier with the geographical location of the organization to which it belongs, and then obtaining the internal network identifier at different login times, when it is detected that the obtained internal network identifiers are different, it means that the target account has a cross-organization login behavior. The time interval of the login can further determine whether the cross-organization login behavior is an abnormal login behavior. If the time interval is too short and the geographical locations are far apart, then this login behavior is likely to be abnormal. In this way, without IP address positioning information, the detection of abnormal login of the user account can be realized. BRIEF DESCRIPTION OF DRAWINGS

[0017] The above and other objects, features and advantages of the present disclosure will become more apparent from the following description of embodiments of the present disclosure, taken in conjunction with the accompanying drawings, in which:

[0018] Figure 1 An application scenario diagram of the anomaly detection method, apparatus, device, medium, and program product according to an embodiment of the present disclosure is schematically shown;

[0019] Figure 2 A flowchart of the anomaly detection method according to an embodiment of the present disclosure is schematically shown;

[0020] Figure 3 A flowchart of the anomaly detection method according to another embodiment of the present disclosure is schematically shown;

[0021] Figure 4 A structural block diagram of the anomaly detection apparatus according to an embodiment of the present disclosure is schematically shown; and

[0022] Figure 5 A block diagram of an electronic device suitable for implementing the anomaly detection method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0023] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it is to be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present disclosure. In the following detailed description, numerous specific details are set forth in order to provide a thorough understanding of the embodiments of the present disclosure. However, it will be apparent to one skilled in the art that one or more embodiments can be practiced without these specific details. In addition, in the following description, descriptions of well-known structures and techniques have been omitted to avoid unnecessarily obscuring the concept of the present disclosure.

[0024] The terms used herein are merely used to describe specific embodiments and are not intended to limit the present disclosure. The terms "include", "comprise", and the like used herein indicate the presence of the features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0025] All terms used herein, including technical and scientific terms, have the same meanings as those generally understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having meanings consistent with the context of the present specification, and should not be interpreted in an idealized or excessively formal manner.

[0026] In the case of using expressions similar to "at least one of A, B, and C, etc.", it should be generally interpreted as having the same meaning as the expression "one or more of the items from the group consisting of A, B, and C" unless otherwise defined. For example, "a system having at least one of A, B, and C" should include but not be limited to a system having A alone, a system having B alone, a system having C alone, a system having both A and B, a system having both A and C, a system having both B and C, and / or a system having A, B, and C, etc.

[0027] In the technical solutions of the present disclosure, the user information (including but not limited to user personal information, user image information, user device information such as location information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of related data all comply with relevant laws, regulations and standards, take necessary security measures, do not violate public order and good customs, and provide corresponding operation portals for users to choose authorization or refusal.

[0028] In the scenario of making automatic decisions by using personal information, the method, device and system provided by the embodiments of the present disclosure all provide corresponding operation portals for users to choose to agree or refuse the automatic decision result; if the user chooses to refuse, the expert decision process is entered. The expression "automatic decision" here refers to the activity of automatically analyzing, evaluating the behavior habits, interests and hobbies or economic, health, credit status of individuals by computer programs and making decisions. The expression "expert decision" here refers to the activity of making decisions by personnel who are engaged in a certain field of work, have special experience, knowledge and skills and reach a certain professional level.

[0029] The inventors find that there is a risk that the personal accounts of users in an enterprise may be borrowed by each other or stolen by others, which has an adverse effect on the security and compliance of enterprise management. However, for a large enterprise that establishes an internal private network, there is no IP address location information in the enterprise, so the enterprise cannot use Internet technology to determine whether the user is borrowed or stolen. The inventors also find that for different levels of institutions of an enterprise and multiple institutions at the same level, the IP addresses are usually allocated according to certain rules to facilitate the management of IP addresses, and the IP address is composed of a network part and a host part, and the network part of the IP address of an institution is usually unchanged, so the location information of the logged-in IP address can be obtained by associating the network part of the IP address with the geographical location of the institution.

[0030] Based on the above inventive concept, the disclosure provides an abnormality detection method, comprising: obtaining a login time of a target account logging into a target website and a network address of a terminal device used for login. An internal network identifier of an organization to which the terminal device belongs is obtained according to the network address, and the internal network identifier is associated with a geographical location of the organization to which the terminal device belongs. In a case where it is detected that two internal network identifiers of the target account do not match, a time interval of two login times corresponding to the two internal network identifiers is determined. And in a case where the time interval satisfies a preset time interval threshold, it is determined that the target account has an abnormal login event. Wherein, the preset time interval threshold is determined according to a distance between two geographical locations associated with the two internal network identifiers.

[0031] According to the detection method provided by the disclosure, by associating the internal network identifier with the geographical location of the organization, the IP address of login and the time of login are obtained from the login information of the user, and the internal network identifier of the organization where the user is located when logging in is obtained from the IP address of login, so as to determine the place where the user logs in. When it is detected that the obtained internal network identifiers are different, it means that the target account has a cross-organization login behavior. Further, by the time interval of login, it can be further judged whether the cross-organization login behavior is an abnormal login behavior. If the time interval is too short and the geographical locations are far apart, such login behavior is likely to be abnormal. In this way, the detection of abnormal login of user account can be realized without the location information of the Internet network address.

[0032] Figure 1 The application scenario diagram of the abnormality detection method and device according to the embodiment of the disclosure is schematically shown.

[0033] As shown in Figure 1 The application scenario 100 according to the embodiment can include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104 and a server 105. The network 104 is a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103 and the server 105. The network 104 can include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0034] The user can use the first terminal device 101, the second terminal device 102, the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0035] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with a display screen and supporting web browsing, including but not limited to a smartphone, a tablet computer, a laptop computer, a desktop computer, and the like.

[0036] The server 105 can be a server providing various services, for example, a background management server supporting a website browsed by a user using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (only as an example). The background management server can perform analysis and the like on received user requests and the like, and feed back a processing result (for example, a webpage, information, or data obtained or generated according to a user request, and the like) to a terminal device.

[0037] It should be noted that the abnormality detection method provided by the embodiments of the present disclosure can generally be executed by the server 105. Correspondingly, the abnormality detection apparatus provided by the embodiments of the present disclosure can generally be arranged in the server 105. The abnormality detection method provided by the embodiments of the present disclosure can also be executed by a server or a server cluster different from the server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or the server 105. Correspondingly, the abnormality detection apparatus provided by the embodiments of the present disclosure can also be arranged in a server or a server cluster different from the server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or the server 105.

[0038] It should be understood that Figure 1 The number of terminal devices, networks, and servers in the system shown in FIG. 1 is only illustrative. According to the needs of implementation, there can be any number of terminal devices, networks, and servers.

[0039] Figure 2 An illustrative flowchart of an abnormality detection method according to an embodiment of the present disclosure is shown.

[0040] As shown in FIG. 2, the abnormality detection method of this embodiment includes operations S210-S230. Figure 2

[0041] In operation S210, a login time of logging into a target website using a target account and a network address of a terminal device used for login are acquired.

[0042] In operation S220, an internal network identifier of an organization to which the terminal device belongs is acquired according to the network address, the internal network identifier being associated with a geographical location of the organization to which the terminal device belongs.

[0043] ​In operation S230, in a case where it is detected that the two internal network identifiers of the target account do not match, a time interval of two login times corresponding to the two internal network identifiers is determined.

[0044] In operation S240, in a case where the time interval satisfies a preset time interval threshold, it is determined that the target account has an abnormal login event.

[0045] According to an embodiment of the present disclosure, the preset time interval threshold is determined according to a distance between two geographic locations associated with the two internal network identifiers.

[0046] In an embodiment of the present disclosure, before obtaining the information of the user, the consent or authorization of the user can be obtained. For example, before operation S210, a request for obtaining the information of the user can be sent to the user. In a case where the user consents or authorizes that the information of the user can be obtained, operation S210 is performed.

[0047] According to an embodiment of the present disclosure, the target account represents a personal account of a user of an enterprise, which is authenticated and registered by the user based on personal identity information in a related application or website of the enterprise. The terminal device can be a computer, a tablet computer or the like.

[0048] According to an embodiment of the present disclosure, in an intranet of an organization, the internal network identifier represents a fixed network part in an IP address of an organization. Each IP address includes two identifiers, i.e., an internal network identifier and a host identifier. The internal network identifier is fixed in the intranet of the same organization of the enterprise, i.e., the same internal network identifier can be obtained from different terminal devices of the same organization. Therefore, the internal network identifier can be associated with the organization to which the terminal device belongs, and the geographic location of the organization to which the terminal device belongs is obtained, i.e., the association between the internal network identifier and the geographic location is achieved. Thus, by obtaining the IP address of the terminal device when the user logs in to the target website or application, the geographic location of the user when logging in to the target application using the target account can be indirectly determined.

[0049] According to an embodiment of the present disclosure, the login information of the target account in a period of time can be obtained first, and the login information can include the login time of the target account when logging in to the target website or application multiple times and the IP address of the terminal device used when logging in to the target website or application each time. The internal network identifier obtained each time can be detected in the order of login time, and when it is detected that there are two continuous internal network identifiers that do not match each other, it is indicated that the target account has a cross-organization login event.

[0050] According to an embodiment of the present disclosure, when a cross-institution login event of a target account is detected, whether the cross-institution login of the target account is an abnormal login event can be further determined according to a time interval of two logins. Specifically, first, the specific locations of two institutions are obtained according to the internal network identifiers of two logins of the target account, and according to the distance between the two institutions, the traffic time required under normal traffic conditions is taken as a preset time interval threshold. When the time interval of two logins is less than the preset time interval, it is determined that the target account has an abnormal login event.

[0051] According to the detection method provided by the present disclosure, the internal network identifier and the geographical location of the institution are associated, the login IP address and the login time are obtained from the login information of the user, and the internal network identifier of the institution where the user logs in is obtained from the login IP address, so as to determine the login location. When it is detected that the obtained internal network identifiers are different, it is indicated that the target account has a cross-institution login behavior. Further, by the time interval of login, whether the cross-institution login behavior is an abnormal login behavior can be further determined. If the time interval is too short and the geographical locations are far apart, the login behavior is likely to be abnormal. In this way, the detection of abnormal login of the user account can be realized without the location information of the Internet network address.

[0052] According to an embodiment of the present disclosure, the login time of the target website logged in by the target account and the network address of the terminal device used for login are obtained, including obtaining the login log of the target account from the user authentication information system. According to the login log of the target account, the network address of the terminal device of each login of the user and the login time of each login are obtained.

[0053] According to an embodiment of the present disclosure, each website or application authenticates and logs in the target account through the user authentication information system. The login log of the user authentication information system records login success information, login failure information and other information of the user logging in using the target account. Only the login success information of the user can be extracted, which greatly reduces the amount of data analysis.

[0054] After the login success information of the user is extracted, the terminal device IP address information, the login user, the login application name, the login application IP, the login time and other information of the terminal device of each login of the target account and the login time of each login can be obtained from the login log based on a preset rule. And the network address of the terminal device of each login of the target account and the login time of each login can be further obtained from the information.

[0055] According to an embodiment of the present disclosure, in some login information, some IP addresses of some logins are some special transit IP addresses, such as VPN information or some other intermediate key IP address information. These IP addresses have nothing to do with the logins, and if the attribution analysis is performed on these information, it will interfere with the result, so these exceptional IP addresses can be excluded in advance to eliminate the interference.

[0056] According to an embodiment of the present disclosure, by acquiring and analyzing the login log, the login activities of the target account can be monitored in real time, including login time, location and device, which can provide instant feedback for account security.

[0057] According to an embodiment of the present disclosure, before operation S210, further comprising: determining a target type network device from a plurality of different types of network devices, wherein the target type network device is deployed in each institution, and the internal network identifier of the target type network device corresponds to the geographical location of the institution to which the target type network device belongs. According to the internal network identifier of the target type network device, the internal network identifier corresponding to each institution is determined. And the internal network identifier corresponding to each institution and the geographical location corresponding to each institution are associated to obtain an association relationship table.

[0058] According to an embodiment of the present disclosure, the information of each type of network device can be obtained according to the configuration management system of the enterprise. In the configuration management system of the enterprise, the IP address information and the corresponding management institution of each type of network device of the enterprise are inputted. For example, servers, terminal devices, security devices, storage devices, etc. have inputted IP address information and corresponding management institutions, so the relationship between IP address and institution can be obtained through the above data.

[0059] According to an embodiment of the present disclosure, in a large enterprise, the following exceptional cases may exist: a certain device is deployed in the institution by other first-level institutions and is assigned with the IP address of the institution, but the management institution registered by the device is not the institution. This kind of information will cause the attribution information of the internal network identifier to be wrong. In order to prevent such situations from occurring, it is necessary to exclude such internal network identifiers in advance to avoid interference with the attribution result.

[0060] According to an embodiment of the present disclosure, in order to save IP address information, some small institutions (third-level institutions or second-level institutions) share an internal network identifier when the network device is assigned an IP address. This will affect the subsequent result judgment: judging that the internal network identifier is logged in at the same time in two institutions, and thus judging that the account is stolen or borrowed. To avoid such an impact, if multiple institutions share the same internal network identifier, a random institution is selected as the representative institution of the internal network identifier, and the geographical positions of other institutions sharing the internal network identifier do not appear in the association relationship table.

[0061] According to an embodiment of the present disclosure, the IP address of part of the devices may involve two institutions, for example, the wide area network address of the network device router may involve two institutions, and part of the devices may not exist in a specific institution, for example, part of the security devices may not exist in the third-level institution. Therefore, the target type network device needs to meet that it exists in each institution, and the IP address on the device is only locally valid, so that the internal network identifier obtained from each institution from the network device is one-to-one corresponding to the geographical position of the institution to which the target type network device belongs. For example, the target network device can be a network switch, and the present disclosure is not limited thereto.

[0062] According to an embodiment of the present disclosure, after obtaining the internal network identifier of the target type network device, since the target network device and the terminal device have the same internal network identifier in the intranet of an institution, the internal network identifier obtained from the target network device is the internal network identifier of the terminal device. By associating the internal network identifier with the geographical position of the institution, the association relationship table can be obtained.

[0063] According to an embodiment of the present disclosure, by screening and removing interference items from the network device, the internal network identifier can accurately represent the geographical position of the institution to which it actually belongs, so as to establish a precise association relationship table.

[0064] According to an embodiment of the present disclosure, determining the time interval of the two login times corresponding to the two internal network identifiers includes querying the association relationship table according to the two internal network identifiers to obtain the geographical positions of the two institutions to which the two internal network identifiers belong.

[0065] According to an embodiment of the present disclosure, in the case where it is detected that there are two internal network identifiers that do not match, the field values matching the two internal network identifiers are queried in the association relationship table, and the geographical positions of the two institutions to which the two internal network identifiers belong are extracted from the association relationship table, and then the queried geographical position information is returned as a query result.

[0066] According to an embodiment of the present disclosure, by constructing a correlation table of internal identification and institutional geographic location, after determining the internal network identification, the correlation table can be queried, so that the login location of the target account can be quickly located.

[0067] According to an embodiment of the present disclosure, the internal network identification includes: a first location identification associated with a first-level institution to which the terminal device belongs, a second location identification associated with a second-level institution to which the terminal device belongs, and a third location identification associated with a third-level institution to which the terminal device belongs.

[0068] According to an embodiment of the present disclosure, the first location identification of the internal network identification represents a first network segment of the internal network identification, the second location identification of the internal network identification represents a second network segment of the internal network identification, and the third location identification of the internal network identification represents a third network segment of the internal network identification.

[0069] For example, if the internal network identification is 87.10.15, then 87 is the first location identification, 10 is the second location identification, and 15 is the third location identification.

[0070] According to an embodiment of the present disclosure, different first-level institutions have different first location identifications, and subordinate institutions belonging to the same first-level institution have the same first location identification. Different third-level institutions belonging to the same second-level institution have the same first location identification and second location identification, and different third location identifications.

[0071] For example, for a bank enterprise, the first location identification of the internal network identification of the first-level branch in each place is usually different, so that different first-level institutions can be distinguished by the first location identification.

[0072] A first-level branch also sets up second-level branches in different cities in a province. The first location identification of the internal network identification of the same first-level branch is the same, but each second-level branch under the first-level branch is usually designed to belong to the same large subnetwork or network, that is, each second-level branch under the same first-level branch has the same first location identification and different second location identification. Therefore, different second-level branches can be distinguished by the second location identification.

[0073] A second-level branch also sets up multiple different branches based on administrative regions or business circles, and the internal network identification of each branch under the same second-level branch has the same first location identification and second location identification, and different third location identification. Therefore, different branches can be distinguished by the third location identification.

[0074] According to an embodiment of the present disclosure, in a case where the two internal network identifiers of the target account are detected to have different first location identifiers, it is determined that the target account has a cross-level-1-organization login event; and a preset time interval threshold is determined according to the geographical positions of the two level-1 organizations.

[0075] According to an embodiment of the present disclosure, in the detection of the two internal network identifiers of the target account obtained from the two login times, the first location identifier can be detected first. If the first location identifier is not matched, it means that the target account has logged in different level-1 organizations, and the target account has a cross-level-1-organization login event.

[0076] According to an embodiment of the present disclosure, in a case where the target account has a cross-level-1-organization login event, the geographical positions of the two level-1 organizations are determined through the internal network identifiers. According to the distance between the geographical positions, the time required for transportation between the two level-1 organizations under normal traffic conditions is taken into full consideration as a preset time interval threshold. When the time of the two logins is lower than the preset time interval threshold, it means that the target account has an abnormal login event.

[0077] According to an embodiment of the present disclosure, in a case where the two internal network identifiers of the target account are detected to have different first location identifiers, it is determined that the target account has a cross-level-1-organization login event; and a preset time interval threshold is determined according to the geographical positions of the two level-1 organizations.

[0078] According to an embodiment of the present disclosure, in the detection of the two internal network identifiers of the target account obtained from the two login times, the first location identifier can be detected first. If the first location identifier is not matched, it means that the target account has logged in different level-1 organizations, and the target account has a cross-level-1-organization login event.

[0079] According to an embodiment of the present disclosure, in a case where the target account has a cross-level-1-organization login event, the geographical positions of the two level-1 organizations are determined through the internal network identifiers. According to the distance between the geographical positions, the time required for transportation between the two level-1 organizations under normal traffic conditions is taken into full consideration as a preset time interval threshold. When the time of the two logins is lower than the preset time interval threshold, it means that the target account has an abnormal login event.

[0080] According to an embodiment of the present disclosure, in the case that the two first location identifiers of the target account are detected to be matched and the two second location identifiers are matched, the matching results of the two third location identifiers are determined. In the case that the two third location identifiers of the target account are not matched, it is determined that the target account has a login event across the three-level institutions. And according to the geographical positions of the two three-level institutions respectively, a preset time interval is determined.

[0081] According to an embodiment of the present disclosure, in the case that the two internal network identifiers obtained when the target account logs in twice are detected, in the case that the first location identifier and the second location identifier are detected to be the same, the third location identifier is detected again, and in the case that the two third location identifiers are not matched, it is determined that the target account logs in at the two three-level institutions.

[0082] According to an embodiment of the present disclosure, in the case that the target account logs in at the two three-level institutions, the geographical positions of the two three-level institutions are determined through the internal network identifiers. According to the geographical positions between the two three-level institutions, the time required for transportation between the two three-level institutions under the condition of normal traffic time is taken into account as a preset time interval threshold. In the case that the time of the two logins is lower than the preset time interval threshold, it is indicated that the target account has an abnormal login event.

[0083] In an illustrative embodiment, for a nationwide large enterprise, the first-level institutions are set in different provinces, the second-level institutions are set in different cities of a province, and the third-level institutions are usually set in different administrative regions of a city. Therefore, the distance between the first-level institutions is usually relatively far, the distance between the second-level institutions is second, and the distance between the third-level institutions is relatively close. For example, for a bank enterprise, the first-level branches are usually set across provinces, the second-level branches are usually set in the same province, and the branch banks are set in different administrative regions of a city.

[0084] In order to simplify the complexity and diversity of the setting of the preset time interval, a fixed time interval can be set as the preset time interval threshold for the first-level institutions, the second-level institutions and the third-level institutions respectively. For example, the preset time interval threshold between the first-level institutions can be set based on the minimum or average time required for transportation between the first-level institutions; the preset time interval threshold between the second-level institutions can be set based on the minimum or average time required for transportation between the second-level institutions; and the preset time interval threshold between the third-level institutions can be set based on the minimum or average time required for transportation between the third-level institutions.

[0085] For example, the preset time interval threshold between the first-level institutions is 8 hours, the preset time interval threshold between the second-level institutions is 4 hours, and the preset time interval between the third-level institutions is 1 hour. When the first location identifiers of the internal network identifiers obtained when detecting two login target websites of the target account are inconsistent, it is determined whether the time interval between the two logins is less than 8 hours. If the time interval is less than 8 hours, it is determined that the target account may have an abnormal login event. If the first location identifiers are the same, the second location identifiers of the two internal network identifiers are detected. If the second location identifiers are different, it is determined whether the time interval between the two logins is less than 4 hours. If the time interval is less than 4 hours, it is determined that the target account may have an abnormal login event. If the first location identifier and the second location identifier are the same, the third location identifier of each of the two internal network identifiers is detected. If the third location identifiers are different, it is determined whether the time interval between the two logins is less than 1 hour. If the time interval is less than 1 hour, it is determined that the target account may have an abnormal login event.

[0086] In addition, when a fixed time interval is set as the preset time interval threshold for the first-level institutions, the second-level institutions, and the third-level institutions, respectively, there may be some first-level institutions that are very close in actual distance. If a fixed time interval is used for judgment, it may cause false positives. For example, some first-level branch institutions and headquarter institutions may be very close, and if the regular time interval is used, it may cause false positives. Therefore, the internal network identifiers of these exceptional first-level institutions need to be registered separately. When the two internal network identifiers detected meet the registered two internal network identifiers, the preset time interval threshold needs to be determined according to the actual geographical location.

[0087] By setting a fixed time interval for the distance between the geographical locations of the first-level institutions, the second-level institutions, and the third-level institutions, respectively, it can be quickly determined whether the cross-institution login event is an abnormal login event, thereby improving the efficiency of the judgment.

[0088] According to an embodiment of the present disclosure, by associating the first location identifier with the first-level structure, the second location identifier with the second-level institution, and the third location identifier with the third-level institution, the detection efficiency is improved, and the identification of whether the target account has performed cross-institution login is accelerated.

[0089] Figure 3 A flowchart of an abnormality detection method according to another embodiment of the present disclosure is schematically shown.

[0090] As shown in Figure 3 The abnormality detection method of this embodiment includes operations S301-S311.

[0091] In operation S301, the login time of each login of the target account and the IP address of the terminal device at each login are acquired.

[0092] In operation S302, the internal network identification of each login is acquired according to the IP address of the terminal device at each login.

[0093] In operation S303, the internal network identifications of two consecutive logins are detected in the order of login time.

[0094] In operation S304, it is detected whether the first location identifications of the two internal network identifications are matched.

[0095] If the two first location identifications are matched, operation S305 is performed; if the two first location identifications are not matched, operation S307 is performed.

[0096] In operation S305, it is detected whether the second location identifications of the two internal network identifications are matched in the case that the two first location identifications are matched.

[0097] If the two second location identifications are matched, operation S306 is performed; if the two second location identifications are not matched, operation S307 is performed.

[0098] In operation S306, it is detected whether the third location identifications of the two internal network identifications are matched in the case that the two first location identifications and the second location identifications are not matched.

[0099] If the two third location identifications are matched, it is determined in operation S312 that the target account is normally logged in; if the two third location identifications are not matched, operation S307 is performed.

[0100] In operation S307, the time interval of the two login times is calculated in the case that the first location identification, or the second location identification, or the third location identification of the two internal network identifications is not matched.

[0101] In operation S308, the geographical location of the organization to which the two internal network identifications belong is queried according to the association relationship table.

[0102] In operation S309, the preset time interval is determined according to the geographical location of the organization to which the two internal network identifications belong.

[0103] In operation S310, it is judged whether the time interval of the two login times is lower than the preset time.

[0104] If it is judged that the time interval of the two login times is not lower than the preset time interval, it is determined in operation S312 that the target account is normally logged in; if it is judged that the time interval of the two login times is lower than the preset time interval, it is determined in operation S311 that the target account has an abnormal login event.

[0105] According to the abnormality detection method, by detecting the internal network identifier of the terminal device each time the target account is logged in, abnormal login information of the account of the user can be found in time, hidden dangers can be found in time, and the user of the account can be notified to modify the password in time, so as to avoid the account of the user from being stolen and used, and the security of the business is improved. Further, for asset management of a large enterprise, it is prohibited in the system that the accounts of the users are borrowed by each other, and the method can find the situation of the accounts of the users being borrowed by each other, and the compliance of the enterprise management is improved.

[0106] Based on the above abnormality detection method, the disclosure further provides an abnormality detection device. The following will be described in detail Figure 3 The device is described in detail.

[0107] Figure 4 The structure block diagram of the abnormality detection device according to the embodiment of the disclosure is schematically shown.

[0108] As Figure 4 shown, the abnormality detection device 400 of the embodiment includes a first acquisition module 410, a second acquisition module 420, a first determination module 430 and a second determination module 440.

[0109] The first acquisition module 410 is configured to acquire a login time of logging into a target website by using a target account and a network address of a terminal device used for login. In an embodiment, the first acquisition module 410 can be configured to perform the operation S210 described above, and details are not repeated here.

[0110] The second acquisition module 420 is configured to acquire an internal network identifier of an organization to which the terminal device belongs according to the network address, and the internal network identifier is associated with a geographical position of the organization to which the terminal device belongs. In an embodiment, the second acquisition module 420 can be configured to perform the operation S220 described above, and details are not repeated here.

[0111] The first determination module 430 is configured to determine a time interval of two login times corresponding to two internal network identifiers of the target account in a case where the two internal network identifiers are detected to be not matched. In an embodiment, the first determination module 430 can be configured to perform the operation S230 described above, and details are not repeated here.

[0112] The second determining module 440 is configured to determine that the target account has an abnormal login event when the time interval satisfies a preset time interval threshold. The preset time interval threshold is determined according to the distance between the two geographic locations associated with the two internal network identifiers. In an embodiment, the second determining module 440 can be configured to perform operation S240 described above, and details are not repeated here.

[0113] According to an embodiment of the present disclosure, the first obtaining module 410 includes a first obtaining unit and a second obtaining unit.

[0114] The first obtaining unit is configured to obtain the login log of the target account from a user authentication information system.

[0115] The second obtaining unit is configured to obtain, according to the login log of the target account, the network address of the terminal device of each login of the user and the login time of each login.

[0116] According to an embodiment of the present disclosure, the first determining module includes a first institution determining unit and a first time determining unit.

[0117] The first institution determining unit is configured to determine that the target account has a login event across a primary institution when it is detected that the first location identifiers of the two internal network identifiers of the target account do not match.

[0118] The first time determining unit is configured to determine the preset time interval threshold according to the geographic locations of the two primary institutions.

[0119] According to an embodiment of the present disclosure, the first determining module further includes a second location confirming unit, a second institution determining unit, and a second time determining unit.

[0120] The second location confirming unit is configured to determine the matching result of the two second location identifiers when it is detected that the first location identifiers of the two internal network identifiers of the target account match.

[0121] The second institution determining unit is configured to determine that the target account has a login event across a secondary institution when the two second location identifiers of the target account do not match.

[0122] The second time determining unit is configured to determine the preset time interval according to the geographic locations of the two secondary institutions.

[0123] According to an embodiment of the present disclosure, the first determining module further includes a third location confirming unit, a third institution determining unit, and a third time determining unit.

[0124] The third position confirmation unit is configured to determine a matching result of the two third position identifiers in a case where the two first position identifiers of the target account number match and the two second position identifiers match.

[0125] The third institution determination unit is configured to determine that the target account number has a login event across the three-level institutions in a case where the two third position identifiers of the target account number do not match.

[0126] The third time determination unit is configured to determine a preset time interval according to the geographical positions of the two three-level institutions.

[0127] According to an embodiment of the present disclosure, the anomaly detection device further includes a device determination module, an identifier determination module, and an association module.

[0128] The device determination module is configured to determine a target type network device from a plurality of different types of network devices, wherein the target type network device is deployed in each institution, and an internal network identifier of the target type network device corresponds to a geographical position of an institution to which the target type network device belongs.

[0129] The identifier determination module is configured to determine an internal network identifier corresponding to each institution according to an internal network identifier of the target network device.

[0130] The association module is configured to associate the internal network identifier corresponding to each institution and the geographical position corresponding to each institution to obtain an association relationship table.

[0131] According to an embodiment of the present disclosure, the first determination module further includes a query unit.

[0132] The query unit is configured to query, according to the two internal network identifiers, the association relationship table to obtain geographical positions of two belonging institutions corresponding to the two internal network identifiers.

[0133] According to an embodiment of the present disclosure, any of the first obtaining module 410, the second obtaining module 420, the first determining module 430 and the second determining module 440 can be combined in one module, or any of them can be split into multiple modules. Alternatively, at least part of the function of one or more of these modules can be combined with at least part of the function of other modules, and implemented in one module. According to an embodiment of the present disclosure, at least one of the first obtaining module 410, the second obtaining module 420, the first determining module 430 and the second determining module 440 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on chip, a system on board, a system on package, an application specific integrated circuit (ASIC), or any other reasonable way of hardware or firmware that can be integrated or packaged with a circuit, or any one of software, hardware and firmware or any appropriate combination of several of them. Alternatively, at least one of the first obtaining module 410, the second obtaining module 420, the first determining module 430 and the second determining module 440 can be at least partially implemented as a computer program module that can perform corresponding functions when it is run.

[0134] Figure 5 A block diagram of an electronic device suitable for implementing the anomaly detection method according to an embodiment of the present disclosure is schematically shown.

[0135] As shown in Figure 4 The electronic device 500 according to an embodiment of the present disclosure includes a processor 501 that can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 502 or loaded from a storage portion 508 into a random access memory (RAM) 503. The processor 501 can include, for example, a general-purpose microprocessor (such as a CPU), an instruction set processor and / or a related chipset, and / or a special-purpose microprocessor (such as an application specific integrated circuit (ASIC)), and the like. The processor 501 can also include an on-board memory for cache use. The processor 501 can include a single processing unit or multiple processing units for performing different actions of the method processes according to an embodiment of the present disclosure.

[0136] In the RAM 503, various programs and data required for the operation of the electronic device 500 are stored. The processor 501, the ROM 502, and the RAM 503 are connected to each other via the bus 504. The processor 501 performs various operations of the method flow according to the embodiments of the present disclosure by executing the programs in the ROM 502 and / or the RAM 503. It should be noted that the programs can also be stored in one or more memories other than the ROM 502 and the RAM 503. The processor 501 can also perform various operations of the method flow according to the embodiments of the present disclosure by executing the programs stored in the one or more memories.

[0137] According to an embodiment of the present disclosure, the electronic device 500 can further include an input / output (I / O) interface 505, which is also connected to the bus 504. The electronic device 500 can further include one or more of the following components connected to the I / O interface 505: an input part 506 including a keyboard, a mouse, etc.; an output part 507 including a display such as a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage part 508 including a hard disk, etc.; and a communication part 509 including a network interface card such as a LAN card, a modem, etc. The communication part 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the I / O interface 505 as necessary. A removable medium 511 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc. is mounted on the drive 510 as necessary, so that a computer program read out therefrom is installed in the storage part 508 as necessary.

[0138] The present disclosure also provides a computer readable storage medium, which can be included in the device / apparatus / system described in the above embodiments; or can exist separately without being assembled into the device / apparatus / system. The above computer readable storage medium carries one or more programs, when the one or more programs are executed, the method according to the embodiments of the present disclosure is implemented.

[0139] According to an embodiment of the present disclosure, the computer readable storage medium can be a nonvolatile computer readable storage medium, for example, can include, but is not limited to, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a Read Only Memory (ROM), an Erasable Programmable Read Only Memory (EPROM or Flash memory), a portable compact disc read only memory (CD-ROM), an optical storage device, a magnetic storage device, or any appropriate combination thereof. In the present disclosure, the computer readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present disclosure, the computer readable storage medium can include one or more memories, such as the ROM 502 and / or the RAM 503 described above, and / or one or more memory external to the ROM 502 and the RAM 503.

[0140] Embodiments of the present disclosure also include a computer program product, which includes a computer program containing program codes for executing the methods shown in the flowcharts. When the computer program product is run in a computer system, the program codes are used to make the computer system implement the anomaly detection method provided by the embodiments of the present disclosure.

[0141] The above functions defined in the system / apparatus of the embodiments of the present disclosure are performed when the computer program is executed by the processor 501. According to an embodiment of the present disclosure, the system, apparatus, module, unit, etc. described above can be implemented by computer program modules.

[0142] In one embodiment, the computer program can rely on a tangible storage medium, such as an optical storage device, a magnetic storage device, etc. In another embodiment, the computer program can also be transmitted, distributed, and downloaded in the form of a signal on a network medium, and be downloaded and installed through the communication part 509, and / or installed from the detachable medium 511. The program codes contained in the computer program can be transmitted by any appropriate network medium, including but not limited to wireless, wired, etc., or any appropriate combination thereof.

[0143] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 509, and / or installed from the detachable medium 511. When the computer program is executed by the processor 501, the above functions defined in the system of the embodiments of the present disclosure are performed. According to an embodiment of the present disclosure, the system, device, apparatus, module, unit, etc. described above can be implemented by computer program modules.

[0144] According to embodiments of the present disclosure, program code of the computer program for performing the methods provided by the embodiments of the present disclosure can be written in any combination of one or more programming languages, and can be implemented in a computer program product. Specifically, the computer program can be implemented in a high-level procedural and / or object-oriented programming language, and / or in assembly / machine language. The programming language includes, but is not limited to, Java, C++, python, “C” language, or similar programming languages. The program code can execute entirely on the user's computing device, partly on the user's device, and partly on a remote computing device, or entirely on the remote computing device or server. In the latter scenario, the remote computing device can be connected to the user's computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computing device, such as through the Internet using an Internet Service Provider (ISP).

[0145] The computer program product of the present disclosure can be a computer program product, which is a machine-readable medium (or computer readable medium) having stored therein a sequence of instructions readable by a machine (e.g., a computer). The instructions in the machine-readable medium focus on the function of the computer program (e.g., in the form of a program unit) and on the cooperation behavior between such program units. The program can be distributed over networks coupled to one or more processors or computers, and can be stored on computer readable media including computer program products, hard drives, RAMs, or any other device (internal or external) from which a processor or computer reads incoming data or instructions. In addition to being distributed over the Internet, or over any other publicly or privately accessed network, a computer program product can also be distributed over a wireless network, e.g., a wireless personal area network (WPAN), a wireless local area network (WLAN), a wireless metropolitan area network (WMAN), or any other type of wireless network.

[0146] Those skilled in the art will understand that features of the various embodiments and / or claims of the present disclosure can be combined or / and integrated with one another, even though such a combination or integration is not expressly disclosed in the present disclosure. In particular, the features of the various embodiments and / or claims of the present disclosure can be combined or / and integrated with one another in any combination, without departing from the spirit and teachings of the present disclosure. All such combinations and / or integrations are within the scope of the present disclosure.

[0147] The above describes embodiments of the present disclosure. However, these embodiments are merely for illustrative purposes, and are not intended to limit the scope of the present disclosure. Although each embodiment is described above separately, this does not mean that the measures in each embodiment cannot be used advantageously in combination. The scope of the present disclosure is defined by the appended claims and their equivalents. Those skilled in the art can make various substitutions and modifications without departing from the scope of the present disclosure, and these substitutions and modifications should all fall within the scope of the present disclosure.

Claims

1. An anomaly detection method, characterized in that, The method includes: Obtain the login time of the target account used to log in to the target website and the network address of the terminal device used for login; The internal network identifier of the organization to which the terminal device belongs is obtained based on the network address, and the internal network identifier is associated with the geographical location of the organization to which the terminal device belongs; If a mismatch is detected between the two internal network identifiers of the target account, the time interval between the two login times corresponding to the two internal network identifiers is determined; and If the time interval meets a preset time interval threshold, it is determined that the target account has an abnormal login event; The preset time interval threshold is determined based on the distance between two geographical locations associated with the two internal network identifiers; Among them, different first-level organizations have different first position identifiers, subordinate organizations belonging to the same first-level organization have the same first position identifier, and different third-level organizations belonging to the same second-level organization have the same first position identifier, second position identifier, and different third position identifiers. The method further includes: If two first location identifiers of the target account match and two second location identifiers match, the matching result of the two third location identifiers is determined; If the two third location identifiers of the target account do not match, it is determined that the target account has a login event across three levels of organizations; and The preset time interval is determined based on the respective geographical locations of the two third-level institutions.

2. The method according to claim 1, characterized in that, The internal network identifier includes: a first location identifier for associating with the primary organization to which the terminal device belongs; The method further includes: If a mismatch is detected between the first location identifiers of the two internal network identifiers of the target account, it is determined that the target account has a login event across first-level organizations; and The preset time interval threshold is determined based on the respective geographical locations of the two primary institutions.

3. The method according to claim 2, characterized in that, The internal network identifier further includes: a second location identifier for associating the terminal device with the secondary organization to which it belongs; The method further includes: If the first location identifier of each of the two internal network identifiers of the target account is detected to match, the matching result of the two second location identifiers is determined; If the two second location identifiers of the target account do not match, it is determined that the target account has a login event across secondary institutions; and The preset time interval is determined based on the respective geographical locations of the two secondary institutions.

4. The method according to claim 1, characterized in that, The method further includes: A target type network device is identified from multiple different types of network devices, wherein the target type network device is deployed in various organizations, and the internal network identifier of the target type network device corresponds one-to-one with the geographical location of the organization to which the target type network device belongs; Based on the internal network identifier of the target network device, determine the internal network identifier corresponding to each organization; and The internal network identifiers of each organization and their corresponding geographical locations are associated to obtain an association table.

5. The method according to claim 4, characterized in that, The time interval for determining the two login times corresponding to the two internal network identifiers includes, Based on the two internal network identifiers, a query is performed in the association table to obtain the geographical locations of the two affiliated organizations corresponding to the two internal network identifiers.

6. The method according to claim 1, characterized in that, The process of obtaining the login time of the target account used to log in to the target website and the network address of the terminal device used for login includes: Obtain the login logs of the target account from the user authentication information system; and Based on the login logs of the target account, obtain the network address of the terminal device used by the user to log in each time and the login time for each login.

7. An anomaly detection device, characterized in that, The device includes: The first acquisition module is used to acquire the login time of the target account used to log in to the target website and the network address of the terminal device used for login; The second acquisition module is used to acquire the internal network identifier of the organization to which the terminal device belongs based on the network address, wherein the internal network identifier is associated with the geographical location of the organization to which the terminal device belongs; The first determining module, upon detecting a mismatch between the two internal network identifiers of the target account, determines the time interval between two login times corresponding to the two internal network identifiers; and The second determining module is used to determine that the target account has an abnormal login event when the time interval meets a preset time interval threshold. The preset time interval threshold is determined based on the distance between two geographical locations associated with the two internal network identifiers; Among them, different first-level organizations have different first position identifiers, subordinate organizations belonging to the same first-level organization have the same first position identifier, and different third-level organizations belonging to the same second-level organization have the same first position identifier, second position identifier, and different third position identifiers. The first determining module further includes: The third location determination unit is used to determine the matching result of the two third location identifiers when it is detected that two first location identifiers of the target account match and two second location identifiers match; The third-level organization determination unit is used to determine, when the two third-level location identifiers of the target account do not match, that the target account has a login event across three levels of organizations; and The third time determination unit is used to determine the preset time interval based on the respective geographical locations of the two third-level institutions.

8. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, when the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 6.

Images