Web login anomaly detection method

Abstract

The invention discloses a Web login anomaly detection method, which comprises the following steps: in response to a Web login request of a user, collecting a login password of the user and login flow data generated by login operation of the user; respectively encrypting the login password and the login traffic data by using a preset key to obtain an encrypted login password and encrypted login traffic data; signing the encrypted login password and the encrypted login flow data by using the registration information of the user on the corresponding Web server to obtain corresponding signature data; and sending the encrypted login password, the encrypted login flow data and the signature data to the Web server, so that the Web server detects whether the user has login abnormity or not.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a Web login anomaly detection method. Background Art

[0002] When users browse web pages on the Internet using a web client such as a browser, most web login methods use simple encryption of login passwords. The encryption algorithm is easy to crack and has low login security. Malicious attacks can imitate login passwords to enter the web server and perform internal damage, steal user data, cause irreparable losses to the operator of the web server, and affect the stability and reliability of the web server.

[0003] The Web login method based on login password is simple and only serves as user authentication, which cannot meet market demand. In addition, the functionality of the Web server is low and lacks the ability to monitor user login behavior, resulting in illegal users being able to take various means to bypass or deceive Web login authentication.

[0004] How to provide a Web login anomaly detection method to strictly monitor the login behavior of the Web server, prevent illegal users from accessing, and achieve Web security login is a technical problem that needs to be solved at present. Summary of the invention

[0005] The purpose of the embodiment of the present application is to provide a Web login anomaly detection method to solve the problem of low security of existing Web logins.

[0006] In order to solve the above technical problems, this specification is implemented as follows: In a first aspect, a Web login anomaly detection method is provided, which is executed on a Web client and includes: In response to a user's Web login request, collecting the user's login password and login traffic data generated by the user's login operation; Using a preset key to encrypt the login password and the login flow data respectively to obtain an encrypted login password and encrypted login flow data; Signing the encrypted login password and the encrypted login flow data using the user's registration information on the corresponding Web server to obtain corresponding signature data; The encrypted login password, encrypted login flow data and signature data are sent to the Web server so that the Web server can detect whether there is any login anomaly of the user.

[0007] Optionally, before collecting the login password of the user and the login traffic data generated by the login operation of the user in response to the Web login request of the user, the method further includes: Based on the Web login request of the user, determining whether the user has registered on the Web server; If the user has registered on the Web server, collecting the user's login password and login traffic data generated by the user's login operation in response to the user's Web login request; If the user has not registered with the Web server, a registration is initiated with the Web server.

[0008] Optionally, the initiating registration to the Web server includes: Collecting the identity ID of the user; Sending a registration request carrying the Web login request and the identity ID to the Web server; The registration information of the user and the preset key are received, which are returned by the Web server in response to the registration request.

[0009] In a second aspect, a Web login anomaly detection method is provided, which is executed on a Web server and includes: Verify the signature data sent by the Web client; If the signature data passes the verification, the encrypted login password and the encrypted login flow data sent by the Web client are received, wherein the signature data is obtained by the Web client signing the encrypted login password and the encrypted login flow data using the user's registration information on the Web server, and the encrypted login flow data is obtained by encrypting the login flow data generated by the user's login operation on the Web client; Based on the encrypted login traffic data, detecting whether the user has login anomalies; If the user has a login anomaly, the user authority corresponding to the decrypted encrypted login password is adjusted.

[0010] Optionally, before verifying the signature data sent by the Web client, the method further includes: Receive a registration request from the Web client, where the registration request carries the Web login request of the user and the identity ID of the user; Sending the identity ID to a target trusted institution for entity registration to receive a preset key generated by the target trusted institution, where the preset key is a public key in a public-private key pair generated by the target trusted institution using an asymmetric homomorphic encryption algorithm; Sending the public key and the registration information generated based on the public key and the identity ID to the Web client, wherein the public key is used to encrypt the login password and login flow data; After receiving the signature data from the Web client, the target trusted authority is called to verify the signature data based on the public key.

[0011] Optionally, the detecting whether the user has a login abnormality based on the encrypted login traffic data includes: Performing format conversion on the encrypted login traffic data according to a preset data packet verification structure to obtain a ciphertext text of the data packet; A multi-task learning model based on the MMOE algorithm is used to perform login anomaly detection on each ciphertext element in the ciphertext text of the data packet to obtain the corresponding login anomaly detection prediction score; Based on the sum of the login anomaly detection prediction scores of the ciphertext elements of each data packet, detect whether the user has a login anomaly.

[0012] Optionally, the adjusting the user rights corresponding to the encrypted login password after decryption includes: Determine a legitimate user login password and user authority in a target login verification database that matches the encrypted login password after decryption, wherein the target login verification database stores multiple legitimate user login passwords and corresponding user authorities that have passed authentication; The matching legitimate user login password and user authority are downgraded or added to a blacklist to update the target login verification database.

[0013] Optionally, it also includes: If there is no login exception for the user, then according to the user authority matched after decryption of the encrypted login password, a service call function corresponding to the matched user authority is returned to the Web client.

[0014] Optionally, it also includes: Collecting the historical access data of each user with a time sequence relationship corresponding to the Web server, wherein the historical access data of each user includes the historical access record of the user to the Web server and the corresponding IP address, and the historical access record of each user includes the user login password; Determine the target user's historical access data that has access anomalies in each user's historical access data; Determine a legitimate user login password and corresponding user authority in the target login verification database that matches the user login password of the target user's historical access data; The matching legitimate user login password and user authority are downgraded or added to a blacklist to update the target login verification database.

[0015] Optionally, determining the target user's historical access data having access anomalies in the historical access data of each user includes: Inputting the user's historical access data into the long short-term memory convolutional network layer for feature extraction to obtain the time features of the user's historical access data; Constructing a graph node set based on the IP addresses in the user historical access data, and using the user historical access records corresponding to each IP address as node attributes; Inputting the hypergraph of the user's historical access data constructed based on the graph node set and node attributes into the hypergraph wavelet convolution layer for feature extraction to obtain the spatial features of the user's historical access data; Classification is performed based on the spatiotemporal features obtained by fusing the temporal features and the spatial features to identify the target user's historical access data with access anomalies in the historical access data of each user.

[0016] In the embodiment of the present application, a signature verification mechanism is added on the basis of asymmetric homomorphic encryption technology to sign the data transmitted by the Web client to the Web server. The encryption mechanism and the signature verification mechanism are combined to encrypt and authenticate the transmitted data, providing a double guarantee for the Web server. While avoiding the leakage of transmitted data, it can accurately distinguish the attack data disguised as the transmitted data, avoid the attack data disguised as the login password of the user to be authenticated to attack the Web server, and improve the security of the Web server. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings: Figure 1 It is a flowchart of the Web login anomaly detection method of the first embodiment of the present application.

[0018] Figure 2 It is a flowchart of the Web login anomaly detection method of the second embodiment of the present application.

[0019] Figure 3 It is a schematic diagram of the preset key generation process of an embodiment of the present application.

[0020] Figure 4 It is a flowchart of detecting user login anomalies based on encrypted login traffic data according to an embodiment of the present application.

[0021] Figure 5 It is a flowchart of detecting user access anomalies based on user historical access data according to an embodiment of the present application.

[0022] Figure 6 It is a schematic diagram of the overall process of the Web login anomaly detection method according to an embodiment of the present application.

[0023] Figure 7 It is a structural block diagram of the Web login anomaly detection system of an embodiment of the present application.

[0024] Figure 8 It is a structural block diagram of a Web login anomaly detection device according to an embodiment of the present application. DETAILED DESCRIPTION

[0025] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application. The numbering of the drawings in this application is only used to distinguish the various steps in the scheme, and is not used to limit the execution order of the various steps. The specific execution order is subject to the description in the specification.

[0026] In order to solve the problems existing in the prior art, the embodiments of the present application provide a Web login anomaly detection method, device, system, readable storage medium and computer program product.

[0027] Figure 1 This is a flow chart of a Web login anomaly detection method of the first embodiment of the present application. In this embodiment, the Web login anomaly detection method is executed on a Web client. The Web client can be installed on a user's terminal device. The user connects to the Web server through the Web client on the terminal device, so that the user can access the application on the Web server through a Web client such as a browser.

[0028] like Figure 1 As shown, the Web login anomaly detection method of this embodiment includes the following steps 102 to 108.

[0029] Step 102: In response to a Web login request from a user, the login password of the user and login traffic data generated by the login operation of the user are collected.

[0030] Before accessing a Web server, a user needs to log in to the Web server through a Web client. The user operates the corresponding login control on the Web client and enters the login password, triggering a Web login request. Thus, the Web client responds to the Web login request and collects the user's login password and login traffic data generated by the user's login operation.

[0031] In one embodiment, before responding to the user's Web login request and collecting the user's login password and the login traffic data generated by the user's login operation, the method also includes: judging whether the user has been registered on the Web server based on the user's Web login request; if the user has been registered on the Web server, collecting the user's login password and the login traffic data generated by the user's login operation in response to the user's Web login request; if the user has not been registered on the Web server, initiating registration with the Web server.

[0032] If the user connects to the Web server through the Web client for the first time, he / she needs to register with the Web server when requesting to log in; for registered users, the user's login password and login traffic data are collected directly in response to the Web login request.

[0033] Specifically, the initiating registration to the Web server includes: collecting the identity ID of the user; sending a registration request carrying the Web login request and the identity ID to the Web server; and receiving the user's registration information and the preset key returned by the Web server in response to the registration request.

[0034] Registration information returned by the web server The corresponding formula is:

[0035] in, is a random number, is the random base point value for registering the prime domain, For registration parameters, is the registration ID, ID is the user's identity ID, is the preset key, is a hash function, is a prime number.

[0036] In one embodiment, the Web server can register the user through the target trusted structure, and the target trusted structure generates a preset key. , and generate the above registration information in combination with the user's identity ID , and returns to the web server.

[0037] The web client performs encryption and signing in subsequent steps based on the registration information and the preset key, respectively, as will be described below.

[0038] Step 104: Use a preset key to encrypt the login password and the login traffic data respectively to obtain an encrypted login password and encrypted login traffic data.

[0039] The user's login password needs to be sent to the Web server for authentication. Assuming that the user's login password is represented by pass and the login traffic data is represented by Q, the preset key is used. After encrypting the login password pass and login traffic data Q respectively, the encrypted login password is obtained. and encrypted login traffic data .

[0040] Step 106: Use the user's registration information on the corresponding Web server to sign the encrypted login password and the encrypted login traffic data to obtain corresponding signature data.

[0041] Continuing with the login password pass and login flow data Q in step 104 as an example, specifically, the user's registration information Encrypted login password and encrypted login traffic data After signing, get the corresponding signature data .

[0042] The corresponding formula is:

[0043] in, is a random number, Signature parameters, is the hash function, is a prime number.

[0044] Step 108, sending the encrypted login password, encrypted login flow data and signature data to the Web server, so that the Web server can detect whether there is any login abnormality of the user.

[0045] Specifically, the encrypted login password , Encrypted login traffic data and signature data The encrypted login password, encrypted login traffic data, and signature data are used to detect whether the user has login anomalies, as described below.

[0046] If the Web server detects that the user has no login anomaly, the Web client will receive the service call function returned by the Web server to provide the user with a path to access the Web server. If the Web server detects that the user has a login anomaly, the Web client cannot access the Web server normally, avoiding the risk of illegal users using cracking software to crack the login password and attack the Web server, thereby improving the effectiveness of secure login and the security of the Web server.

[0047] In an embodiment of the present application, the Web client collects the user's login password and the login traffic data generated by the user's login operation in response to the user's Web login request; uses a preset key to encrypt the login password and the login traffic data respectively to obtain the encrypted login password and the encrypted login traffic data; uses the user's registration information on the corresponding Web server to sign the encrypted login password and the encrypted login traffic data to obtain corresponding signature data; sends the encrypted login password, the encrypted login traffic data and the signature data to the Web server, so that the Web server can detect whether the user has a login anomaly, thereby strictly monitoring the login behavior of the Web server, preventing illegal users from accessing, avoiding the risk of illegal users using cracking software to crack the login password and attack the Web server, realizing Web security login, and improving the effectiveness of security login and the security of the Web server.

[0048] Figure 2 1 is a flow chart of a Web login anomaly detection method according to a second embodiment of the present application. In this embodiment, the Web login anomaly detection method is executed on a Web server. The steps executed by the components with the same names in this embodiment are the same as those in the above embodiment. To avoid repetition, the relevant description is appropriately omitted.

[0049] like Figure 2 As shown, the Web login anomaly detection method of this embodiment includes the following steps 202 to 208.

[0050] Step 202: Verify the signature data sent by the Web client.

[0051] The Web client will send the encrypted login password, encrypted login traffic data and signature data related to the user's login request to the Web server, and the Web server will first verify the signature data.

[0052] In one embodiment, the Web server can register the user through the target trusted structure, and the target trusted structure generates a preset key. , and generate the above registration information in combination with the user's identity ID Accordingly, the Web server can verify the signature data through the target trusted structure.

[0053] Specifically, before verifying the signature data sent by the Web client, it also includes: receiving a registration request from the Web client, the registration request carrying the user's Web login request and the user's identity ID; sending the identity ID to a target trusted organization for entity registration to receive a preset key generated by the target trusted organization, the preset key being a public key in a public-private key pair generated by the target trusted organization using an asymmetric homomorphic encryption algorithm; sending the public key and the registration information generated based on the public key and the identity ID to the Web client, the public key being used to encrypt a login password and login traffic data; after receiving the signature data from the Web client, calling the target trusted organization to verify the signature data based on the public key.

[0054] When the Web server receives the registration request, it sends the corresponding user ID to the target trusted institution for entity registration and returns the corresponding registration information to the Web client. and the public key pre-generated by the target trusted authority .

[0055] In the above embodiment, the target trusted institution uses an asymmetric homomorphic encryption algorithm to generate a public-private key pair, and uses the public key in the public-private key pair as a preset key to encrypt the original login password and login flow data, and obtain the encrypted login password and encrypted login flow data. In addition, the public key is also used to generate registration information.

[0056] The target trusted institution uses an asymmetric homomorphic encryption algorithm to generate a public-private key pair and sends the public key in the public-private key pair to Publishing to a Web server includes steps such as Figure 3 As shown, Figure 3 It is a schematic diagram of the preset key generation process of an embodiment of the present application.

[0057] like Figure 3 As shown, the following steps are included: S2-1: Use a trusted authority TA to select security parameters and the penalized cyclic group ; S2-2: Perform bilinear mapping based on the penalty cyclic group to obtain mapping parameters and generators ; S2-3: According to the mapping parameters and generators , use asymmetric homomorphic encryption algorithm to generate public-private key pairs, the formula is:

[0058] In the formula, are the public and private keys of a public-private key pair, is the i-th attribute name, is a random parameter, is the attribute value of the i-th attribute name; S2-4: The private key in the public-private key pair Store the public key locally Publish to a web server.

[0059] The target trusted institution can generate registration information based on the following formula : , The definitions of the parameters in the above formula can refer to the above text.

[0060] Step 204: If the signature data passes the verification, the encrypted login password and encrypted login traffic data sent by the Web client are received. The signature data is obtained by the Web client signing the encrypted login password and the encrypted login traffic data using the user's registration information on the Web server. The encrypted login traffic data is obtained by encrypting the login traffic data generated by the user's login operation on the Web client.

[0061] After receiving the signature data sent by the Web client, the Web server calls the target trusted organization to authenticate the signature data. If the signature verification result returned by the target trusted organization is that the signature verification is passed, the Web server receives the encrypted login password. and encrypted login traffic data , the formula is:

[0062] In the formula, It is the doubt symbol for signature verification. If they are equal, the signature verification is successful.

[0063] If the signature data verification is successful, the Web server can normally receive the encrypted login password and encrypted login traffic data transmitted by the Web client to the Web server.

[0064] In the embodiment of the present application, a signature verification mechanism is added on the basis of asymmetric homomorphic encryption technology to sign the data transmitted by the Web client to the Web server. The encryption mechanism and the signature verification mechanism are combined to encrypt and authenticate the transmitted data, providing a double guarantee for the Web server. While avoiding the leakage of transmitted data, it can accurately distinguish the attack data disguised as the transmitted data, avoid the attack data disguised as the login password of the user to be authenticated to attack the Web server, and improve the security of the Web server.

[0065] Step 206: Based on the encrypted login traffic data, detect whether there is any login anomaly for the user.

[0066] Specifically, based on the encrypted login traffic data, detecting whether the user has a login anomaly includes: converting the format of the encrypted login traffic data according to a preset data packet verification structure to obtain a data packet ciphertext text; using a multi-task learning model constructed based on the MMOE algorithm to perform login anomaly detection on each data packet ciphertext element in the data packet ciphertext text to obtain a corresponding login anomaly detection prediction score; based on the sum of the login anomaly detection prediction scores of each data packet ciphertext element, detecting whether the user has a login anomaly.

[0067] The web server can verify the structure according to the preset data packet , for encrypted login traffic data Perform format conversion to obtain the ciphertext text of the data packet , the formula is:

[0068] In the formula, is the text mapping matrix, is the bth element in the text mapping matrix, is the data packet ciphertext element in the data packet ciphertext text, is the text mapping function, For text mapping elements, Maps attribute values ​​to text, for The corresponding text map attribute value, is the hash function, is a random number, and T is the corresponding function of the permutation.

[0069] Then, a multi-task learning model is used to train each data packet ciphertext element in the data packet ciphertext text. Login anomaly detection is performed separately. The multi-task learning model can be built based on the multi-gate mixture-of-experts (MMOE) algorithm, including several expert modules and tower modules. Each tower module corresponds to a task, that is, the ciphertext element of the data packet. Login anomaly detection.

[0070] Specific steps reference Figure 4 , including the following steps: S10-1: Encrypt the data packet Input the Expert module, obtain the weight of the Expert module, and obtain the login anomaly detection features output by each Expert module. The formula is:

[0071] In the formula, is the weight of the Expert module, Ciphertext element of the data packet The weight function of , softmax is the classification function; S10-2: Input the login anomaly detection features output by the Expert module into the corresponding Tower module to obtain the corresponding login anomaly detection prediction score. The formula is:

[0072] In the formula, Predict scores for login anomaly detection; is the Tower function; It is an Expert function; S10-3: According to the sum of all the login anomaly detection prediction scores, the final login anomaly detection prediction total value, that is, the login anomaly detection result, is obtained. If the login anomaly detection prediction total value is greater than the threshold, login anomaly information is detected, that is, the user login anomaly is detected. The corresponding formula is:

[0073] In the formula, Predict the total value for login anomaly detection.

[0074] Step 208: If the user has a login anomaly, the user authority corresponding to the decrypted encrypted login password is adjusted.

[0075] After determining that the user has a login anomaly based on the encrypted login traffic data, the Web server uses the public key Encrypted login password Decrypt it and get the decrypted login password pass.

[0076] Optionally, the adjustment of the user rights corresponding to the decrypted encrypted login password includes: determining a legitimate user login password and user rights in a target login verification database that match the decrypted encrypted login password, the target login verification database storing multiple authenticated legitimate user login passwords and corresponding user rights; downgrading or adding the matching legitimate user login password and user rights to a blacklist to update the target login verification database.

[0077] The target login verification database stores multiple legitimate user login passwords and corresponding user permissions that have been registered and authenticated on the Web server. Web services are customized for users with different permissions, and service call functions corresponding to users with different permissions are formulated according to the user permission mapping table, which improves the user experience.

[0078] The user authority mapping table stores user authority information, including a user identity, M user role identifiers mapped to the user identity, a user authority identifier mapped to each user role identifier, and N service call function authority identifiers mapped to each user authority identifier.

[0079] The Web server matches the decrypted login password pass with the legitimate user login password stored in the target login verification database to determine whether the decrypted login password pass is a legitimate user login password. If it is, it means that the login password pass stored in the target login verification database is currently abnormal, and it is necessary to update the user rights corresponding to the login password pass, restrict the corresponding user's access rights by downgrading the user rights, or add the login password pass and user rights to the blacklist to prohibit the corresponding user from accessing.

[0080] Furthermore, the method further comprises: if there is no login anomaly for the user, then according to the user authority matched after decryption of the encrypted login password, returning a service call function corresponding to the matched user authority to the Web client.

[0081] If it is determined that the decrypted login password pass belongs to a legitimate user login password, it means that the login password pass stored in the target login verification database is currently normal, and the user authority corresponding to the login password pass remains unchanged. The service call function corresponding to the user authority is returned to the Web client, allowing the corresponding user to access.

[0082] Combination Figure 4 , including the following steps: S10-4: If abnormal login information is detected, the decrypted login password of the user to be authenticated and the matching user information are downgraded or added to the blacklist, and the login verification database is updated; S10-5: If the total predicted value of the login anomaly detection is less than or equal to the threshold, there is no login anomaly information, and the corresponding service call function is returned to the browser client of the user terminal according to the user authority mapping table.

[0083] Through the above method, while performing login password verification, real-time login anomaly detection is performed on the login traffic data generated by the user's login action, thereby avoiding illegal users from using cracking software to crack the login password, thereby improving the effectiveness of secure login and the security of the Web server.

[0084] In addition, in one embodiment, the Web server can also identify access anomalies based on historical user access data, and then dynamically manage corresponding user rights in the target login verification database.

[0085] Furthermore, the method also includes: collecting historical access data of each user with a time series relationship corresponding to the Web server, the user historical access data including the user historical access record of the Web server and the corresponding IP address, the user historical access record including the user login password; determining the target user historical access data with access anomalies in each user historical access data; determining the legitimate user login password and corresponding user authority in the target login verification database that matches the user login password of the target user historical access data; downgrading or adding the matching legitimate user login password and user authority to a blacklist to update the target login verification database.

[0086] In the Web server, a corresponding login verification database is set for several authenticated users. When the user authority update cycle arrives, the abnormal access data in the corresponding user's historical access data is screened.

[0087] Specifically, the method of determining the target user historical access data with access anomalies in each user's historical access data includes: inputting the user historical access data into a long short-term memory convolutional network layer for feature extraction to obtain the time characteristics of the user historical access data; constructing a graph node set based on the IP addresses in the user historical access data, and using the user historical access records corresponding to each IP address as node attributes; inputting a hypergraph of the user historical access data constructed based on the graph node set and the node attributes into a hypergraph wavelet convolution layer for feature extraction to obtain the spatial characteristics of the user historical access data; and classifying based on the spatiotemporal characteristics obtained by fusing the time characteristics and the spatial characteristics to identify the target user historical access data with access anomalies in each user's historical access data.

[0088] Combination Figure 5 , the process of detecting user access anomalies based on user historical access data in the embodiment of the present application is described. Figure 5 As shown, the following steps are included: S1-2: When the user permission update cycle arrives, a graph node set is constructed based on the IP address in the user's historical access data in the login verification database, and the corresponding user historical access record is used as the node attribute; the user's login IP address is used as the location identifier to construct a graph node to characterize the performance of the user's historical access data in the spatial dimension. By analyzing the spatial distribution of the data, the accuracy of access anomaly identification can be improved.

[0089] S1-3: Construct a hypergraph of user historical access data based on the graph node set and node attributes formed by all user historical access data, including the following steps: Use the farthest point sampling method to collect several key points in the graph node set ; Take each key point as the center of the hypergraph, construct a hyperedge, and define the sampling radius of the hypergraph center. The formula is:

[0090] In the formula, SuperMap Center The minimum radius of is the distance from the center of the hypergraph The nearest key point; SuperMap Center The maximum radius of is the distance from the center of the hypergraph The farthest key point; SuperMap Center The sampling radius of is the hypergraph parameter; is the Euclidean distance function; Connect the hyperedges of all hypergraph centers in order to obtain several hypergraphs of user historical access data, and the association formula between hypergraphs is:

[0091] In the formula, For key points With super edge The correlation function of ; i and j are both indicators.

[0092] The local correlation and isomorphism of user historical access data in the spatial dimension are used to unify the data in a hypergraph, which can characterize the characteristics of the data in spatial distribution and improve the accuracy of mining and identifying access anomaly information in the spatial dimension.

[0093] S1-4: Input several hypergraphs of user historical access data into the hypergraph wavelet convolution layer for feature extraction to obtain the spatial features of user historical access data. The formula is:

[0094] In the formula, is the spatial feature output of the lth and l-1th wavelet convolutional layers; is a nonlinear activation function; is the wavelet scale The relevant Chebyshev coefficient; m is the indicated quantity; M is the total number of indicated quantities; is the Chebyshev recursive polynomial; is the filter parameter matrix; is the wavelet convolution parameter.

[0095] The hypergraph wavelet convolution layer can adjust the scale to extract more effective spatial feature embedding, promote local feature smoothing, and avoid network overfitting, thereby improving the accuracy and computational efficiency of hypergraph-based spatial feature extraction; S1-5: Input the user's historical access data with time series relationship into the long short-term memory convolutional network layer for feature extraction to obtain the time features of the user's historical access data. The formula is:

[0096] In the formula, is the output value of the basic unit of the long short-term memory network at time t and t-1; is the convolution function; is a learnable parameter; is the input value at time t; is the hidden state value at the t-1th moment; is the memory parameter; The long short-term memory convolutional network layer can eliminate the periodic drift and random interference of users' historical access data in the time dimension, and improve the accuracy of mining and identifying access anomaly information in the time dimension.

[0097] S1-6: Input the spatial features and temporal features of the user's historical access data into the fully connected layer for feature fusion to obtain the spatiotemporal features, and input the spatiotemporal features of the user's historical access data into the normalized exponential function (Softmax) layer for classification to obtain the access anomaly recognition results.

[0098] The fusion of spatial features and temporal features avoids the defects of long short-term memory convolutional network layer losing spatial features and hypergraph wavelet convolution layer losing temporal features. Combining the advantages of both, it mines and identifies access anomaly information in temporal and spatial dimensions, improving the accuracy and efficiency of access anomaly identification.

[0099] S1-7: If there is access anomaly information in the access anomaly identification result, the corresponding user information and the legitimate user login password in the login verification database will be downgraded or added to the blacklist to complete the update of the user authority information.

[0100] By detecting the user's historical access data, the user's access behavior is automatically monitored. If an abnormality is found, the user's permission information is updated, and the user's permissions are kept updated at all times. This avoids the identification and detection of illegal users due to static user permission restrictions, and the risk of Web servers being exposed to attacks due to user account loss, thereby improving the data security of the Web server.

[0101] Combine the following Figure 6 , the overall process of the Web login anomaly detection method of the embodiment of the present application is described. Figure 6 As shown, the following steps are included: S1: In the Web server, a corresponding login verification database is set for several authenticated user information, and the user authority information stored in the login verification database is updated regularly; S2: Use the trusted institution TA to generate a public-private key pair using an asymmetric homomorphic encryption algorithm and use the public key in the public-private key pair Publish to a Web server; S3: If the user terminal, i.e., the user, connects to the Web server through the browser client for the first time, the identity ID and login request of the user terminal are collected, and the identity ID and login request are sent to the Web server; S4: If the Web server receives the login request, it sends the corresponding identity ID to the trusted institution TA for entity registration, and returns the corresponding registration information and the public key pre-generated by the trusted institution TA to the user terminal; S5: If the user terminal has completed entity registration, the user login password and login flow data to be authenticated are collected, and the user login password and login flow data to be authenticated are encrypted using the public key respectively; S6: Use the registration information of the user terminal to sign the encrypted user login password to be authenticated and the encrypted login traffic data, obtain corresponding signature data, and send it to the Web server; S7: The Web server calls the trusted authority TA to perform signature authentication on the signature data. If the signature authentication result returned by the trusted authority TA is that the signature authentication is passed, the Web server is used to receive the encrypted user login password to be authenticated and the encrypted login traffic data; S8: Decrypt the encrypted user login password to be authenticated using the public key to obtain the decrypted user login password to be authenticated, and match the corresponding valid user login password in the login verification database to obtain user information of the user terminal; S9: Based on the Web server, according to the preset data packet verification structure, the encrypted login traffic data is Perform format conversion to obtain the ciphertext text of the data packet; S10: Use the multi-task learning model to detect login anomalies on the ciphertext of the data packet, and return the corresponding service call function to the browser client according to the user authority mapping table.

[0102] In an embodiment of the present application, the Web server verifies the signature data sent by the Web client; if the signature data passes the verification, the encrypted login password and encrypted login traffic data sent by the Web client are received, the signature data is obtained by the Web client signing the encrypted login password and the encrypted login traffic data using the user's registration information on the Web server, and the encrypted login traffic data is obtained by encrypting the login traffic data generated by the user's login operation on the Web client; based on the encrypted login traffic data, it is detected whether the user has a login anomaly; if the user has a login anomaly, the user authority corresponding to the decrypted encrypted login password is adjusted, thereby strictly monitoring the login behavior of the Web server, preventing illegal users from accessing, avoiding the risk of illegal users using cracking software to crack the login password and attack the Web server, achieving Web security login, and improving the effectiveness of security login and the security of the Web server.

[0103] Alternatively, if Figure 7 As shown, the embodiment of the present application also provides a Web login anomaly detection system 1000, including a Web client 1200 and a Web server 1400. The Web client 1200 is used to collect the login password of the user and the login flow data generated by the login operation of the user in response to the Web login request of the user; encrypt the login password and the login flow data respectively using a preset key to obtain an encrypted login password and encrypted login flow data; sign the encrypted login password and the encrypted login flow data using the registration information of the user in the corresponding Web server to obtain corresponding signature data; send the encrypted login password, the encrypted login flow data and the signature data to the Web server, so that the Web server can detect whether the user has a login anomaly; The Web server 1400 is used to verify the signature data sent by the Web client; if the signature data passes the verification, it receives the encrypted login password and encrypted login traffic data sent by the Web client, the signature data is obtained by the Web client signing the encrypted login password and the encrypted login traffic data using the user's registration information on the Web server, and the encrypted login traffic data is obtained by encrypting the login traffic data generated by the user's login operation on the Web client; based on the encrypted login traffic data, it is detected whether the user has a login anomaly; if the user has a login anomaly, the user authority corresponding to the decrypted encrypted login password is adjusted.

[0104] The web client 1200 implements the above Figure 1 The steps of the Web login anomaly detection method embodiment can achieve the same technical effect. To avoid repetition, they are not repeated here. Figures 2 to 5 The various steps of the Web login anomaly detection method embodiment can achieve the same technical effect, and to avoid repetition, they are not repeated here.

[0105] Alternatively, if Figure 8 As shown, the embodiment of the present application also provides a Web login anomaly detection device 2000, including a processor 2400 and a memory 2200, and the memory 2200 stores a program or instruction that can be run on the processor 2400. When the program or instruction is executed by the processor 2400, the various steps of the above-mentioned Web login anomaly detection method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0106] The embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored, and when the program or instruction is executed by a processor, each process of any of the above-mentioned Web login anomaly detection method embodiments is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. Among them, the readable storage medium includes a computer-readable storage medium, such as a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, etc.

[0107] The embodiment of the present application also provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program. The computer program can be operated to enable a computer to implement each process of any of the above-mentioned Web login anomaly detection method embodiments when executed, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0108] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0109] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0110] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. A Web login anomaly detection method, characterized in that: Executed on the Web client, including: In response to a user's Web login request, collecting the user's login password and login traffic data generated by the user's login operation; Using a preset key to encrypt the login password and the login flow data respectively to obtain an encrypted login password and encrypted login flow data; Signing the encrypted login password and the encrypted login flow data using the user's registration information on the corresponding Web server to obtain corresponding signature data; The encrypted login password, encrypted login flow data and signature data are sent to the Web server so that the Web server can detect whether there is any login anomaly of the user.

2. The method according to claim 1, characterized in that Before collecting the login password of the user and the login traffic data generated by the login operation of the user in response to the Web login request of the user, the method further includes: Based on the Web login request of the user, determining whether the user has registered on the Web server; If the user has registered on the Web server, collecting the user's login password and login traffic data generated by the user's login operation in response to the user's Web login request; If the user has not registered with the Web server, a registration is initiated with the Web server.

3. The method according to claim 2, characterized in that The initiating registration to the Web server includes: Collecting the identity ID of the user; Sending a registration request carrying the Web login request and the identity ID to the Web server; The registration information of the user and the preset key are received, which are returned by the Web server in response to the registration request.

4. A Web login anomaly detection method, characterized in that: Executed on the Web server, including: Verify the signature data sent by the Web client; If the signature data passes the verification, the encrypted login password and the encrypted login flow data sent by the Web client are received, wherein the signature data is obtained by the Web client signing the encrypted login password and the encrypted login flow data using the user's registration information on the Web server, and the encrypted login flow data is obtained by encrypting the login flow data generated by the user's login operation on the Web client; Based on the encrypted login traffic data, detecting whether the user has login anomalies; If the user has a login anomaly, the user authority corresponding to the decrypted encrypted login password is adjusted.

5. The method according to claim 4, characterized in that Before verifying the signature data sent by the Web client, the method further includes: Receive a registration request from the Web client, where the registration request carries the Web login request of the user and the identity ID of the user; Sending the identity ID to a target trusted institution for entity registration to receive a preset key generated by the target trusted institution, where the preset key is a public key in a public-private key pair generated by the target trusted institution using an asymmetric homomorphic encryption algorithm; Sending the public key and the registration information generated based on the public key and the identity ID to the Web client, wherein the public key is used to encrypt the login password and login flow data; After receiving the signature data from the Web client, the target trusted authority is called to verify the signature data based on the public key.

6. The method according to claim 4, characterized in that The detecting whether the user has a login abnormality based on the encrypted login traffic data includes: Performing format conversion on the encrypted login traffic data according to a preset data packet verification structure to obtain a ciphertext text of the data packet; A multi-task learning model based on the MMOE algorithm is used to perform login anomaly detection on each ciphertext element in the ciphertext text of the data packet to obtain the corresponding login anomaly detection prediction score; Based on the sum of the login anomaly detection prediction scores of the ciphertext elements of each data packet, detect whether the user has a login anomaly.

7. The method according to claim 4, characterized in that The adjusting of the user rights corresponding to the encrypted login password after decryption includes: Determine a legitimate user login password and user authority in a target login verification database that matches the encrypted login password after decryption, wherein the target login verification database stores multiple legitimate user login passwords and corresponding user authorities that have passed authentication; The matching legitimate user login password and user authority are downgraded or added to a blacklist to update the target login verification database.

8. The method according to claim 7, characterized in that Also includes: If there is no login exception for the user, then according to the user authority matched after decryption of the encrypted login password, a service call function corresponding to the matched user authority is returned to the Web client.

9. The method according to claim 7, characterized in that: Also includes: Collecting the historical access data of each user with a time sequence relationship corresponding to the Web server, wherein the historical access data of each user includes the historical access record of the user to the Web server and the corresponding IP address, and the historical access record of each user includes the user login password; Determine the target user's historical access data that has access anomalies in each user's historical access data; Determine a legitimate user login password and corresponding user authority in the target login verification database that matches the user login password of the target user's historical access data; The matching legitimate user login password and user authority are downgraded or added to a blacklist to update the target login verification database.

10. The method according to claim 9, characterized in that The determining of the target user's historical access data having access anomalies in the historical access data of each user includes: Inputting the user's historical access data into the long short-term memory convolutional network layer for feature extraction to obtain the time features of the user's historical access data; Constructing a graph node set based on the IP addresses in the user historical access data, and using the user historical access records corresponding to each IP address as node attributes; Inputting the hypergraph of the user's historical access data constructed based on the graph node set and node attributes into the hypergraph wavelet convolution layer for feature extraction to obtain the spatial features of the user's historical access data; Classification is performed based on the spatiotemporal features obtained by fusing the temporal features and the spatial features to identify the target user's historical access data with access anomalies in the historical access data of each user.

Images