Abnormal analysis method and device for user login behavior and electronic equipment

Abstract

The invention discloses a user login behavior anomaly analysis method and apparatus, and an electronic device. The method comprises the steps of obtaining user login data; the user login data comprises part or all of a login mode, a login terminal type, a login IP, login time and user identity agent information; inputting the user login data into a pre-constructed integrated learning model; the integrated learning model comprises at least one random forest classifier, and the training sample comprises a normal cluster and a negative sample cluster which are determined after clustering N pieces of historical login data included in a historical login data set; and determining whether a user login behavior indicated by the user login data is abnormal or not according to an output result of the integrated learning model. The process does not need manual operation, and is simple to implement and high in accuracy.

Description

Technical Field

[0001] The present application relates to the field of machine learning technology, and in particular to a method, device and electronic device for analyzing abnormalities in user login behavior. Background Art

[0002] In various systems, user behaviors can be roughly divided into two categories: login (login, logout) behavior and access behavior. Among them, user login behavior is a special access behavior, which is the basis of various other access behaviors. Only when the user is logged in, the system can perform operations according to the authority and trust of different users. Therefore, the legitimacy of user login behavior and the identification of abnormal login behavior are crucial.

[0003] Due to the variety of login methods, the identification attributes carried by different login behaviors may differ or be missing, making it difficult to quantify and refine the analysis of abnormal user behaviors. Data analysis rules are also difficult to determine and often rely on the experience of analysts. This makes traditional data analysis-based methods difficult to accurately determine and have poor comprehensibility. Summary of the invention

[0004] In an exemplary embodiment of the present application, a method, device and electronic device for analyzing abnormality of user login behavior are provided to improve the accuracy of determining whether the user login behavior is abnormal.

[0005] In a first aspect, an embodiment of the present application provides a method for analyzing abnormalities in user login behavior, including:

[0006] Obtain user login data; wherein the user login data includes part or all of the login method, login terminal type, login IP, login time and user identity proxy information;

[0007] Inputting the user login data into a pre-built integrated learning model; wherein the integrated learning model includes at least one random forest classifier, and the training samples include a normal cluster and a negative sample cluster determined after clustering N historical login data included in the historical login data set; N is an integer greater than 2;

[0008] Determine whether the user login behavior indicated by the user login data is abnormal based on the output result of the integrated learning model.

[0009] In a second aspect, an embodiment of the present application provides a device for analyzing abnormalities in user login behavior, including:

[0010] A data acquisition unit is used to: acquire user login data; wherein the user login data includes part or all of the login method, login terminal type, login IP, login time and user identity proxy information;

[0011] The data analysis unit is used to: input the user login data into a pre-built integrated learning model; wherein the integrated learning model includes at least one random forest classifier, and the training samples include a normal cluster and a negative sample cluster determined after clustering N historical login data included in the historical login data set; N is an integer greater than 2;

[0012] A data processing unit is used to determine whether the user login behavior indicated by the user login data is abnormal according to the output result of the integrated learning model.

[0013] In a third aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of any of the above methods when executing the computer program.

[0014] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having computer program instructions stored thereon, which implement the steps of any of the above methods when executed by a processor.

[0015] In the embodiment of the present application, after the user login behavior occurs, the user login data is obtained, and the user login data includes multi-dimensional features such as login mode, login terminal type, login IP, login time, and user identity proxy information, and the user login data is input into a pre-built integrated learning model. Since the training samples of the integrated learning model are determined after clustering N historical login data in the historical login data set, it is possible to determine whether the user login behavior indicated by the user login data is abnormal based on the output results of the integrated learning model. This process does not require manual operation, is simple to implement, and has high accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0017] Figure 1 A schematic diagram of a random forest classifier provided in an embodiment of the present application is exemplarily shown;

[0018] Figure 2 The following is a schematic diagram showing the structure of a decision tree provided in an embodiment of the present application;

[0019] Figure 3 A flowchart of a method for analyzing abnormalities in user login behavior provided by an embodiment of the present application is exemplified;

[0020] Figure 4 A flowchart of a method for determining a training sample provided by an embodiment of the present application is exemplified;

[0021] Figure 5 A flowchart of a method for determining restricted operations of a user provided in an embodiment of the present application is exemplarily shown;

[0022] Figure 6 The following is a schematic diagram showing the structure of a device for analyzing abnormalities in user login behavior provided in an embodiment of the present application;

[0023] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is exemplarily shown. DETAILED DESCRIPTION

[0024] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0025] For ease of understanding, the terms involved in the embodiments of the present application are explained below:

[0026] (1) Ensemble Learning (EL): Ensemble learning can effectively improve the generalization ability of neural networks by combining multiple neural networks. It constructs multiple base learners with average performance and integrates these base learners to solve the problem, thus obtaining an ensemble learning model with better performance, which effectively improves the overall accuracy of the system. The general steps for constructing an ensemble learning model are: first generate several base learners with a specific strategy, and then integrate these base learners with weaker performance to form a strong learner with stronger performance. There are many ways to combine base learners in ensemble learning, and commonly used methods include averaging method and voting method.

[0027] In classification tasks, ensemble learning models generally use voting to obtain the final result from the output results of each base learner. Commonly used voting methods include absolute majority voting and relative majority voting. The former has more stringent conditions and is difficult to achieve for extremely multi-classification tasks, so the latter is more effective.

[0028] (2) Random Forest (RF): Breiman proposed the random forest algorithm by using random attribute selection in the training of bagging ensemble decision trees. Random forest is based on two random ideas: the bagging ensemble method of autonomous sampling and the attribute subspace idea. Figure 1 Schematic diagram of a random forest classifier in an embodiment of the present application.

[0029] Random forest can also be called a "black box". For most data sets, when the number of trees is 100, the classification accuracy can meet the requirements. Let P represent the number of trees in the random forest. When P is small, the classification and performance of the random forest are relatively poor. According to its overfitting characteristics, making P as large as possible can ensure the diversity of the random forest. However, if P is too large, the training time will be too long and the interpretability will be weakened.

[0030] Out-of-bag (OOB) data can be used to evaluate the performance of the random forest model without the need to divide the test set separately. For a random forest consisting of K decision trees, there are a total of K sub-training sample sets Each sub-training sample set D d The original training set D is sampled by the Bootstrap method. After K samplings, about 36.8% of the samples in D will not appear in D d This part of data is D d Out-of-bag data. Use the constructed random forest model to classify OOB data. For the data sample (x d ,y d ), the classification result is recorded as f(x d ,y d ), representing all tree pairs in the random forest data sample (x d ,y d ) is the relative majority voting result. For the original data set D, the OOB error of the random forest model is defined as:

[0031]

[0032] in,

[0033] (3) Decision tree: A decision tree is a tree structure model. Each tree has only one root node, and there are several decision nodes under the root node. Each branching path represents the attribute value of a certain classification. Finally, according to the classification of the attribute value, all the data falls on the leaf node, thus completing the decision classification process of the decision tree. Figure 2 A schematic diagram of the structure of a decision tree provided in an embodiment of the present application.

[0034] (4) Bagging algorithm: Bagging algorithm means bootstrap aggregating, Bagging, which is one of the most commonly used integration strategies in ensemble learning. The pseudo code of the Bagging algorithm using the relative majority voting method is as follows:

[0035] Train:Input: with C categories ω i ={w1,w2,...,w c} dataset S, base learner

[0036] WeakLearner, number of training rounds T, Bootstrap sampling percentage F

[0037] for t=1to T do

[0038] 1. St←Boostrap(S,F) / / Use the Bootstrap method to sample F% data from the data set S

[0039] Get the sub-dataset St

[0040] 2.ht←WeakLearner(St) / / Call the base learner WeakLearner with St as the data set

[0041] Get the classifier ht

[0042] 3.ε←AddModel(ht) / / Add ht to the integrated model ε

[0043] end

[0044] Test:Input:Test sample x

[0045] 1.v←ε(x) / / Use the integrated model ε={h1,h2,...,h n}Evaluation sample x

[0046] 2. for t = 1 to T do

[0047] 2.1. / / Let v tj is the base learner h t For class ω j Voting

[0048] 2.2.end

[0049] 3 / / Get the total number of votes for each class

[0050] 4.return:argmax j∈[0,T-1] V j / / Return the class with the highest number of votes

[0051] The Bootstrap method randomly selects one sample from the sample set each time and adds it to the sampling sub-set, then puts the sample back into the sample set, and repeats this z times to obtain a sampling data set with a capacity of z. When faced with a sample set with a small number of samples and uneven distribution, the Bootstrap method can sample multiple sampling data sets, which are samples of the original sample set. Therefore, applying it to multiple appropriate learners and integrating them can achieve better results.

[0052] In various systems, the user's access behavior can be uniquely determined by the user's unique identifier, access method identifier, access IP, access source identifier, access terminal identifier, access time identifier, access session identifier, access resource and auxiliary identifier. Among them, the user's login behavior can be regarded as the access behavior of accessing the resource as login. In recent years, login methods such as user name, mobile phone number, and code scanning of different application software have been continuously expanded, and login terminal types such as PC browser, PC client, mobile browser, mobile APP, WeChat public account and WeChat applet have emerged in an endless stream.

[0053] Due to the variety of login methods, the identification attributes carried by different login behaviors may differ or be missing, making it difficult to quantify and refine the analysis of abnormal user behaviors. Data analysis rules are also difficult to determine and often rely on the experience of analysts. This makes traditional data analysis-based methods difficult to accurately determine and have poor comprehensibility.

[0054] At present, there are a number of user login behaviors in the application system services at all times, among which there are many abnormal attacks simulating user logins in order to break into the application system to steal user data and endanger system security. Therefore, it is necessary to identify abnormal login behaviors in a timely manner. To this end, the embodiment of the present application provides an abnormal analysis method for user login behaviors. In this method, the user login data obtained in real time can be input into a pre-built integrated learning model, and whether the user login behavior is abnormal is determined according to the output result of the model. In this integrated learning model, random forests are applied to automatically distinguish discrete user login behaviors based on different behavioral characteristics in user login behaviors, which saves manpower, has high accuracy and strong comprehensibility.

[0055] To further illustrate the technical solution provided by the embodiment of the present application, this is described in detail below in conjunction with the accompanying drawings and specific implementation methods. Although the embodiment of the present application provides the method operation steps shown in the following embodiments or drawings, more or fewer operation steps may be included in the method based on routine or no creative labor. In the steps where there is no necessary causal relationship logically, the execution order of these steps is not limited to the execution order provided in the embodiment of the present application.

[0056] Combine the following Figure 1-Figure 2 As shown, reference Figure 3 A flowchart of a method for analyzing abnormalities in user login behavior is shown to illustrate the technical solution provided in an embodiment of the present application.

[0057] S301: Obtain user login data.

[0058] S302: Inputting user login data into a pre-built integrated learning model.

[0059] S303: Determine whether the user login behavior indicated by the user login data is abnormal according to the output result of the integrated learning model.

[0060] In the embodiment of the present application, after the user login behavior occurs, the user login data is obtained, and the user login data includes multi-dimensional features such as login mode, login terminal type, login IP, login time, and user identity proxy information, and the user login data is input into a pre-built integrated learning model. Since the training samples of the integrated learning model are determined after clustering N historical login data in the historical login data set, it is possible to determine whether the user login behavior indicated by the user login data is abnormal based on the output results of the integrated learning model. This process does not require manual operation, is simple to implement, and has high accuracy.

[0061] In S301, the user's access (login) behavior can be regarded as time-series data with a sequential relationship. If the user login is detected, the user login behavior characteristics can be analyzed and extracted to generate user login data. Among them, the user login behavior characteristics are discrete behavior characteristics. The user login data includes part or all of the login method, login terminal type, login IP, login time and user identity proxy information.

[0062] In S302, the integrated learning model includes at least one random forest classifier, and the training samples include a normal cluster and a negative sample cluster determined after clustering N historical login data included in the historical login data set; N is an integer greater than 2.

[0063] Figure 4 A flow chart of a method for determining training samples provided in an embodiment of the present application.

[0064] S401: Obtain a historical login data set.

[0065] Each historical login data includes part or all of the login method, login terminal type, login IP, login time, and user identity agent information. The user identity agent information here can also be called login UA information, where U refers to User and A refers to Agent. Each historical login data can also include user request links, etc.

[0066] In order to perform clustering better, each historical login data in the historical login data set may also be standardized.

[0067] S402: Clustering N pieces of historical login data to obtain a target clustering result.

[0068] In the embodiments of the present application, clustering methods such as hierarchical clustering may be used, which is not limited here.

[0069] In a specific example, N can be 100, and each historical login behavior generates a historical login data. Each historical login data can be represented by a feature vector Ci->(c1,c2,c3,c4,c5), and the dimensions of the vector represent the login method, login terminal type, login IP, login time, and user identity proxy information. Multiple clustering is performed on these 100 historical data to obtain the target clustering result.

[0070] Optionally, for each clustering result, perform the following operations:

[0071] A1: For the M clusters included in the clustering results, calculate the inter-cluster distance between any two clusters, and merge the two clusters with the smallest distance into one cluster.

[0072] The average linkage method can be used to calculate the inter-cluster distance. The inter-cluster distance between any two clusters is the average of the distances between all data points in the two clusters. The inter-cluster distance calculated by this method is smoother and more reasonable.

[0073] After obtaining the inter-cluster distance between any two clusters, the two clusters with the smallest distance can be merged into one cluster.

[0074] A2: Calculate the evaluation index based on the merged k clusters.

[0075] After clustering the M clusters again, k clusters are obtained, and the evaluation index is calculated based on the k clusters. Optionally, P is an integer greater than 2 and less than or equal to M.

[0076] Exemplarily, the evaluation index may be part or all of the Calinski-Harabaz index, the DBI (Davies-Bouldin Index) index, the silhouette coefficient, the Rand coefficient, etc. In the embodiments of the present application, the reverse Calinski-Harabaz index and the DBI index are used as examples for illustration.

[0077] Optionally, the Calinski-Harabaz index is also called the Variance Ratio Criterion, which is positively correlated with clustering performance, and scores higher when clusters are dense and well separated. For k clusters, the Calinski-Harabaz score s is calculated by the ratio between the between-clusters dispersion mean and the within-cluster dispersion. The formula for calculating the Variance Ratio Criterion is as follows:

[0078]

[0079] Among them, B k represents the inter-cluster diffusion matrix, W k is the intra-cluster diffusion matrix, N is the number of historical login data, C q is the set of points in cluster q, c q is the center of cluster q, c is the center of k clusters, n q is the number of historical login data in cluster q.

[0080] Optionally, the DBI index is also called the clustering certainty index, which is used to evaluate the similarity within a cluster and the difference between clusters. The smaller the DBI value, the higher the similarity within a cluster and the difference between clusters, and the better the clustering performance. The DBI formula is as follows:

[0081]

[0082] Among them, d(M c ,M i ) represents the Euclidean distance between cluster centers, d(X c ), d(X i ) are the means of the Euclidean distances within the clusters.

[0083] A3: If the evaluation index is greater than the set evaluation index threshold, clustering ends and k clusters are taken as clustering results.

[0084] The above two evaluation indicators each correspond to a set evaluation index threshold, and one of the evaluation indexes can be used. When the evaluation index is greater than the set evaluation index threshold, it can be determined that the clustering effect can meet the requirements and the clustering is terminated.

[0085] In addition, it is also possible to manually determine whether clustering is finished. For example, a visualization tool is used to draw a clustering effect diagram, and a person determines whether the clustering result meets the requirements. If so, clustering is determined to be finished.

[0086] S403: Process the target clustering results to obtain positive sample clusters and negative sample clusters.

[0087] Optionally, the clustering results can be processed as follows:

[0088] If the evaluation index is the contrast ratio criterion evaluation index, then for each of the k clusters, the inter-cluster diffusion mean between the cluster and other clusters is calculated. If the inter-cluster diffusion mean is greater than the first threshold, the cluster is determined to be a negative sample cluster; if the inter-cluster diffusion mean is less than or equal to the first threshold, the cluster is determined to be a positive sample cluster.

[0089] If the evaluation index is the clustering certainty index, then for each of the k clusters, the average value of the distance between the cluster and other clusters is calculated. If the average value is greater than the second threshold, the cluster is determined to be a negative sample cluster; if the average value is less than or equal to the second threshold, the cluster is determined to be a positive sample cluster.

[0090] Therefore, the negative sample cluster can be called an abnormal cluster, that is, a cluster that is far away from other clusters and has a small amount of data. After obtaining the positive sample cluster and the negative sample cluster, the ensemble learning model can be used to bag the user behavior data and train the random forest ensemble classification model. The specific model training algorithm can refer to the fine-tuning of the relevant model algorithm.

[0091] During the training process, several random forest classifiers are established, and the classification result of the user login behavior is obtained by the relative majority voting method. The login behavior with a voting result exceeding the threshold is marked as abnormal behavior. For most data sets, it is necessary to strike a balance between the training time and accuracy of the model. In addition, the depth of the decision tree will also affect its classification performance, and when the tree depth is too large, it will cause the tree to fall into overfitting. In this embodiment, the number of trees P is set to 100 and the tree depth is set to 6, which can achieve a better balance between the training time and accuracy of the model. Abnormal events are generated for data with abnormal majority voting results, that is, abnormal user login behavior.

[0092] In the embodiment of the present application, a random forest classifier is applied, and the base classifier generated by parallelization makes it fast in training speed, low in model complexity and efficient in prediction. The attribute subset enables it to process high-dimensional data, and it also has good fault tolerance when facing noise and outliers. The adoption of attribute subsets further increases the differences between base learners in random forests, thereby improving its versatility. The traditional decision tree selects the best attribute for splitting from the attribute set of the current node; while in the random forest, each base classifier selects the best partitioning attribute from the attribute subset randomly selected from the attribute set of the current node when partitioning the attribute.

[0093] This involves S303: determining whether the user login behavior indicated by the user login data is abnormal according to the output result of the integrated learning model.

[0094] After determining that the user login behavior is abnormal, the abnormal event will be broadcasted and an abnormal reminder will be sent to the administrator or user. At the same time, the corresponding operations of the abnormal event of this abnormal login behavior will be restricted. For example, if multiple abnormal events are triggered within a certain period of time, the restriction measures will be upgraded, such as restricting login, limiting login time upgrade, locking accounts, disabling accounts, etc.

[0095] Optionally, the restriction method may be an adaptive weighted access restriction algorithm. Figure 5 A flowchart of a method for determining restricted operations of a user provided in an embodiment of the present application, Figure 5 At least the following steps are included:

[0096] S501: Apply mathematical library functions, adjustment coefficients, weights of various resources accessed by the user, and the number of abnormal accesses corresponding to each resource to calculate the restriction level of the user.

[0097] Optionally, the user's restriction level is calculated using the following formula:

[0098]

[0099] Among them, L is the user's restriction level, floor It is a math library function. The user rounds down to an integer. i is the i-th resource and the total number of resources is I. i is the weight of the i-th resource, c i is the number of abnormal accesses to the i-th resource, and β is the adjustment coefficient, which is used to control the speed of increasing the restriction level.

[0100] For any one of the multiple resources, taking the first resource (resource i) as an example, the process of determining the weight of the first resource is described. In this process, the adjustment method of the weight of the first resource includes the following three situations:

[0101] Case 1: If it is detected that the user login behavior is abnormal, the weight of the first resource is adjusted according to the first adjustment logic.

[0102] Optionally, the first adjustment logic is determined according to a set proportional coefficient and the number of abnormal accesses corresponding to the first resource, and the formula of the first adjustment logic is as follows:

[0103] w i(n) =w i(n-1) +αlg(1+C i(n-1) )

[0104] Among them, w i(n) is the weight of the first resource after the nth abnormal user login behavior, w i(n-1) is the weight of the first resource after the abnormal login behavior of the n-1th user, α is the set proportional coefficient, C i(n-1)is the number of abnormal accesses to the first resource after the nth abnormal user login behavior. lg(1+C i(n-1) ) can ensure the smoothness of weight changes.

[0105] In addition, in the first adjustment logic, the number of abnormal accesses corresponding to the first resource is incremented, that is, each time an abnormal user login behavior is detected, the number of abnormal accesses is incremented by 1.

[0106] Case 2: If it is detected that the user login behavior is normal, the weight of the first resource is adjusted according to the second adjustment logic.

[0107] Optionally, the second adjustment logic is determined according to a set proportional coefficient and the number of abnormal accesses corresponding to the first resource. The formula of the second adjustment logic is as follows:

[0108] w i(m) =w i(m-1) -αlg(1+C i(m-1) )

[0109] Among them, w i(m) is the weight of the first resource after the mth user login behavior is normal, w i(m-1) is the weight of the first resource after the m-1th user login behavior is normal, α is the set proportional coefficient, C i(m-1) is the number of abnormal accesses to the first resource after the mth user login behavior is normal.

[0110] In addition, in the second adjustment logic, the number of abnormal accesses corresponding to the first resource is decreasing. That is, each time a normal user login behavior is detected, the number of abnormal accesses is reduced by 1. In this way, normal access can be gradually restored.

[0111] Case 3: The weight of the first resource is periodically attenuated.

[0112] Optionally, the formula for periodically decaying the weight is as follows:

[0113] w i(t) =w i(t-1) ·e -λΔt

[0114] Among them, w i(t) is the weight of the first resource at time t, w i(t-1) is the weight of the first resource at time t-1, λ is the attenuation coefficient, and Δt is the unit time interval.

[0115] Optionally, the initial weight may be determined by the algorithm based on resource importance and sensitivity, or determined by humans based on experience, resource importance and sensitivity, etc. Alternatively, the algorithm first assigns an initial weight, and then humans fine-tune it based on prior knowledge.

[0116] S502: Determine the restricted operations of the user according to the restriction level of the user.

[0117] Among them, you can set the restriction level for different restriction means (restrict login, limit login time upgrade, lock account, disable account), and make corresponding restrictions on the user's access behavior according to the restriction level.

[0118] After discovering abnormal user login behavior, related technologies often use time window and threshold methods to handle it. Within a certain time window, behaviors that exceed the threshold will be restricted. This method has a coarse granularity and cannot achieve fine control. In the embodiment of the present application, different control strategies are implemented for the user's login / access operations based on the judgment results.

[0119] In the embodiment of the present application, the weights of several base classifiers are controlled by random forests, combined with user feedback. Compared with the traditional method of using a single classifier and the method of manual intervention, the limiting means can be upgraded according to the frequency of abnormal triggering. Compared with the traditional method based on the time window threshold, it is more sensitive to time, and the behavior that frequently triggers abnormalities in a short period of time can be restricted step by step, which can improve the discrimination accuracy and security of the system. It avoids the problem that it is difficult to quantify, refine data, and determine data analysis rules in traditional methods, and often relies on the experience of analysts, and is taken over by the integrated learning model. New user behavior features do not need to add judgment rules, and only one iteration of the model is needed to meet new needs. The user's continuously accumulated login behavior can also continuously update the behavior features and iteratively optimize the model. Identify abnormal user login behavior, and implement different control strategies for the discrimination results to ensure the security of the system and user assets. In addition, the system security is improved to avoid user data leakage. It does not affect the main process of user login, and the user is unaware of the whole process. When the user behavior features are expanded, the adaptability is strong.

[0120] It should be noted that, since the user login behavior is a special user access behavior, the embodiment of the present application can also be applied to the user access behavior. At this time, the relevant data can be replaced with the data corresponding to the user access behavior.

[0121] like Figure 6 As shown, based on the same inventive concept, an embodiment of the present application provides an abnormal analysis device for user login behavior, including a data acquisition unit 61, a data analysis unit 62 and a data processing unit 63.

[0122] The data acquisition unit 61 is used to: acquire user login data; wherein the user login data includes part or all of the login method, login terminal type, login IP, login time and user identity proxy information;

[0123] The data analysis unit 62 is used to: input the user login data into a pre-built integrated learning model; wherein the integrated learning model includes at least one random forest classifier, and the training samples include a normal cluster and a negative sample cluster determined after clustering N historical login data included in the historical login data set; N is an integer greater than 2;

[0124] The data processing unit 63 is used to determine whether the user login behavior indicated by the user login data is abnormal according to the output result of the integrated learning model.

[0125] In an optional implementation, the data acquisition unit 61 is further configured to:

[0126] Obtain a collection of historical login data; each piece of historical login data includes part or all of the login method, login terminal type, login IP, login time, and user identity proxy information;

[0127] Cluster N historical login data to obtain the target clustering result;

[0128] The target clustering results are processed to obtain positive sample clusters and negative sample clusters.

[0129] In an optional implementation, the data acquisition unit 61 is specifically configured to perform the following operations for each clustering result:

[0130] For the M clusters included in the clustering result, calculate the inter-cluster distance between any two clusters, and merge the two clusters with the smallest distance into one cluster; where M is an integer greater than 2;

[0131] Calculate the evaluation index based on the merged k clusters; where P is an integer greater than 2 and less than or equal to M;

[0132] If the evaluation index is greater than the set evaluation index threshold, clustering ends and k clusters are taken as clustering results; wherein the evaluation index is the contrast ratio criterion evaluation index or the clustering certainty index.

[0133] In an optional implementation, the data acquisition unit 61 is specifically used to:

[0134] If the evaluation index is the contrast ratio criterion evaluation index, then for each of the k clusters, the inter-cluster diffusion mean between the cluster and other clusters is calculated. If the inter-cluster diffusion mean is greater than the first threshold, the cluster is determined to be a negative sample cluster; if the inter-cluster diffusion mean is less than or equal to the first threshold, the cluster is determined to be a positive sample cluster;

[0135] If the evaluation index is the clustering certainty index, then for each of the k clusters, the average value of the distance between the cluster and other clusters is calculated. If the average value is greater than the second threshold, the cluster is determined to be a negative sample cluster; if the average value is less than or equal to the second threshold, the cluster is determined to be a positive sample cluster.

[0136] In an optional implementation, the data processing unit 63 is further configured to:

[0137] Apply mathematical library functions, adjustment coefficients, and the weights of each resource accessed by the user, as well as the number of abnormal accesses to each resource, to calculate the user's restriction level;

[0138] Determine the operations that are restricted for the user based on the user's restriction level.

[0139] In an optional implementation, the data processing unit 63 is further configured to:

[0140] If an abnormal user login behavior is detected, the weight of the first resource is adjusted according to the first adjustment logic; wherein the first resource is any one of the multiple resources indicated by the user behavior;

[0141] If it is detected that the user login behavior is normal, the weight of the first resource is adjusted according to the second adjustment logic;

[0142] Periodically attenuating the weight of the first resource;

[0143] A weight of the first resource is determined.

[0144] In an optional implementation, the first adjustment logic and the second adjustment logic are determined according to a set proportionality coefficient and the number of abnormal accesses corresponding to the first resource;

[0145] In the first adjustment logic, the number of abnormal accesses corresponding to the first resource is increasing;

[0146] In the second adjustment logic, the number of abnormal accesses corresponding to the first resource is decreasing

[0147] The device for abnormal analysis of user login behavior proposed in the embodiment of the present application and the method for abnormal analysis of user login behavior mentioned above adopt the same inventive concept and can achieve the same beneficial effects, which will not be repeated here.

[0148] Based on the same inventive concept as the above-mentioned method for analyzing abnormalities in user login behavior, the present application embodiment also provides an electronic device, which may be a desktop computer, a portable computer, a smart phone, a tablet computer, a personal digital assistant (PDA), a server, etc. Figure 7 As shown, the electronic device may include a processor 71 and a memory 72 .

[0149] The processor 71 may be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, and may implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0150] The memory 72 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (Random Access Memory, RAM), static random access memory (Static Random Access Memory, SRAM), programmable read-only memory (Programmable Read Only Memory, PROM), read-only memory (Read Only Memory, ROM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), magnetic memory, disk, optical disk, etc. The memory is any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 42 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, used to store program instructions and / or data.

[0151] A person of ordinary skill in the art can understand that: all or part of the steps of implementing the above method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiments; the above computer storage medium can be any available medium or data storage device that can be accessed by a computer, including but not limited to: mobile storage devices, random access memory (RAM, Random Access Memory), magnetic storage (such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO)), optical storage (such as CD, DVD, BD, HVD, etc.), and semiconductor storage (such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state drive (SSD)) and other media that can store program codes.

[0152] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods of each embodiment of the present application. The aforementioned storage medium includes: a mobile storage device, a random access memory (RAM, Random Access Memory), a magnetic storage device (such as a floppy disk, a hard disk, a magnetic tape, a magneto-optical disk (MO), etc.), an optical storage device (such as CD, DVD, BD, HVD, etc.), and a semiconductor memory (such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), a solid-state drive (SSD)) and other various media that can store program codes.

[0153] The above embodiments are only used to introduce the technical solutions of the present application in detail, but the description of the above embodiments is only used to help understand the methods of the embodiments of the present application and should not be understood as limiting the embodiments of the present application. Any changes or substitutions that can be easily thought of by a person skilled in the art should be included in the protection scope of the embodiments of the present application.

Claims

1. A method for analyzing abnormalities in user login behavior, characterized in that: include: Obtain user login data; wherein the user login data includes part or all of the login method, login terminal type, login IP, login time and user identity proxy information; Inputting the user login data into a pre-built integrated learning model; wherein the integrated learning model includes at least one random forest classifier, and the training samples include a normal cluster and a negative sample cluster determined after clustering N historical login data included in the historical login data set; N is an integer greater than 2; Determine whether the user login behavior indicated by the user login data is abnormal according to the output result of the integrated learning model.

2. The method according to claim 1, characterized in that The method further comprises: Obtain a collection of historical login data; each piece of historical login data includes part or all of the login method, login terminal type, login IP, login time, and user identity proxy information; Clustering the N pieces of historical login data to obtain a target clustering result; The target clustering results are processed to obtain positive sample clusters and negative sample clusters.

3. The method according to claim 2, characterized in that Clustering the N pieces of historical login data to obtain a target clustering result includes: For each clustering result, perform the following operations: For the M clusters included in the clustering result, calculate the inter-cluster distance between any two clusters, and merge the two clusters with the smallest distance into one cluster; wherein M is an integer greater than 2; Calculate the evaluation index based on the merged k clusters; where P is an integer greater than 2 and less than or equal to M; If the evaluation index is greater than a set evaluation index threshold, clustering ends and the k clusters are taken as clustering results; wherein the evaluation index is a contrast ratio criterion evaluation index or a clustering certainty index.

4. The method according to claim 3, characterized in that The target clustering results are processed to obtain positive sample clusters and negative sample clusters, including: If the evaluation index is a contrast ratio criterion evaluation index, then for each of the k clusters, the inter-cluster diffusion mean between the cluster and other clusters is calculated, and if the inter-cluster diffusion mean is greater than a first threshold, the cluster is determined to be a negative sample cluster; if the inter-cluster diffusion mean is less than or equal to the first threshold, the cluster is determined to be a positive sample cluster; If the evaluation index is a clustering certainty index, then for each of the k clusters, the average value of the distance between the cluster and other clusters is calculated. If the average value is greater than a second threshold, the cluster is determined to be a negative sample cluster; if the average value is less than or equal to the second threshold, the cluster is determined to be a positive sample cluster.

5. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: Applying mathematical library functions, adjustment coefficients, and weights of various resources accessed by the user, as well as the number of abnormal accesses corresponding to each resource, to calculate the restriction level of the user; According to the restriction level of the user, the operation restricted for the user is determined.

6. The method according to claim 5, characterized in that The method further comprises: If an abnormal user login behavior is detected, adjusting the weight of a first resource according to a first adjustment logic; wherein the first resource is any one of the multiple resources indicated by the user behavior; If it is detected that the user login behavior is normal, adjusting the weight of the first resource according to the second adjustment logic; Periodically attenuating the weight of the first resource; A weight of the first resource is determined.

7. The method according to claim 6, characterized in that The first adjustment logic and the second adjustment logic are determined according to a set proportional coefficient and the number of abnormal accesses corresponding to the first resource; In the first adjustment logic, the number of abnormal accesses corresponding to the first resource is increasing; In the second adjustment logic, the number of abnormal accesses corresponding to the first resource is decreasing.

8. A device for analyzing abnormalities in user login behavior, characterized in that: include: A data acquisition unit is used to: acquire user login data; wherein the user login data includes part or all of the login mode, login terminal type, login IP, login time and user identity proxy information; A data analysis unit, configured to: input the user login data into a pre-built integrated learning model; wherein the integrated learning model includes at least one random forest classifier, and the training samples include a normal cluster and a negative sample cluster determined after clustering N historical login data included in the historical login data set; N is an integer greater than 2; A data processing unit is used to determine whether the user login behavior indicated by the user login data is abnormal according to the output result of the integrated learning model.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images