Account risk behavior detection method and device, equipment, medium and product

Abstract

The invention relates to the technical field of information security, and discloses an account risk behavior detection method and device, equipment, a medium and a product, and the method comprises the steps: obtaining account real-time data; a preset first list is loaded, and the preset first list comprises the first risk behavior; and detecting the account real-time data based on a preset first list to determine a risk detection result of the account. According to the method, the preset first list for implementing risk behavior detection is formulated, and after the account real-time data are collected, the account real-time data are detected through the preset first list, so that whether the account has the risk behavior or not is judged, the processing measures corresponding to the risk behavior are executed, and the security of the account is ensured.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to account risk behavior detection methods, devices, equipment, media and products. Background Art

[0002] The cloud computing operation and maintenance platform can uniformly manage and operate network resources by integrating cloud computing technology, automated management tools, and monitoring methods. Account risk behavior detection is crucial in the cloud computing operation and maintenance platform. It can detect abnormal account behavior and prevent potential security threats in a timely manner. Accurate account risk behavior detection can avoid false alarms and false blocking, ensure that the normal use of legitimate users is not affected, and thus improve user satisfaction.

[0003] Currently, the main way to identify account risks is to monitor the account's past login and operation behaviors. These technologies usually use log analysis and other means to monitor and analyze account behaviors offline, which can easily misjudge normal behaviors, and offline analysis cannot meet the requirements of detecting real-time risk behaviors that may exist in cloud computing operation and maintenance platform accounts. Summary of the invention

[0004] In view of this, the present invention provides an account risk behavior detection method, apparatus, computer equipment and storage medium to solve the problem that account risk behavior detection cannot be performed in real time.

[0005] In a first aspect, the present invention provides a method for detecting account risk behavior, the method comprising:

[0006] Get real-time account data;

[0007] Loading a preset first list, wherein the preset first list includes a first risk behavior;

[0008] The real-time data of the account is detected based on the preset first list to determine the risk detection result of the account.

[0009] In some optional implementations, the detecting the real-time data of the account based on the preset first list to determine the risk detection result of the account includes:

[0010] Matching the real-time account data with the preset first list to obtain a matching result;

[0011] A processing measure for the account is determined based on the matching result.

[0012] In some optional implementations, determining a processing measure for the account based on the matching result includes:

[0013] If the real-time account data matches the first risk behavior in the preset first list, obtaining a processing measure corresponding to the first risk behavior;

[0014] Execute the processing measures corresponding to the first risk behavior.

[0015] In some optional implementations, the first risk behavior in the preset first list includes at least: abnormal login behavior, privileged behavior, abnormal data access behavior, abnormal permission change, abnormal network communication behavior, abnormal program behavior, abnormal file operation, high-frequency activity behavior, abnormal session behavior, and malicious attack behavior.

[0016] In some optional embodiments, the method further comprises:

[0017] Aggregating the real-time data of the account based on a preset period to determine periodic data;

[0018] Loading a preset second list, wherein the preset second list includes a second risk behavior;

[0019] The periodic data is tested based on the preset second list to determine a periodic risk test result of the account.

[0020] In some optional implementations, the periodic data is detected based on the preset second list to determine the periodic risk detection result of the account, including:

[0021] matching the periodic data with the preset second list;

[0022] If the periodic data matches the second risk behavior in the preset second list, the processing measures corresponding to the second risk behavior are obtained, and the processing measures corresponding to the second risk behavior are executed.

[0023] The account risk behavior detection method provided in this embodiment obtains real-time account data; loads a preset first list, wherein the preset first list includes a first risk behavior; and detects the account real-time data based on the preset first list to determine the risk detection result of the account. The present invention has formulated a preset first list for implementing risk behavior detection. After collecting the real-time account data, the real-time account data is detected through the preset first list to determine whether the account has risk behavior, and executes the corresponding processing measures for the risk behavior to ensure the security of the account.

[0024] In a second aspect, the present invention provides an account risk behavior detection device, the device comprising:

[0025] Data acquisition module, used to obtain real-time account data;

[0026] A list loading module, used to load a preset first list, wherein the preset first list includes a first risk behavior;

[0027] The data detection module is used to detect the real-time data of the account based on the preset first list to determine the risk detection result of the account.

[0028] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor are communicatively connected to each other, computer instructions are stored in the memory, and the processor executes the account risk behavior detection method of the above-mentioned first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0029] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the account risk behavior detection method of the first aspect or any corresponding embodiment thereof.

[0030] In a fifth aspect, the present invention provides a computer program product, comprising computer instructions, wherein the computer instructions are used to enable a computer to execute the account risk behavior detection method of the above-mentioned first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0032] Figure 1 is a flow chart of a method for detecting account risk behavior according to an embodiment of the present invention;

[0033] Figure 2 is a flow chart of another account risk behavior detection method according to an embodiment of the present invention;

[0034] Figure 3 is a flow chart of another account risk behavior detection method according to an embodiment of the present invention;

[0035] Figure 4 is a schematic diagram of an account risk behavior detection method according to an embodiment of the present invention;

[0036] Figure 5 is a structural block diagram of an account risk behavior detection device according to an embodiment of the present invention;

[0037] Figure 6It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0039] In the field of account risk behavior detection systems for cloud computing operation and maintenance platforms, the existing technology mainly identifies account risks by detecting login and operation behaviors of account history records. Log analysis is usually used to perform offline detection and analysis of account behaviors. Due to the analysis of logs, it may be difficult to accurately identify risky behaviors, misjudge normal behaviors as risky behaviors, or fail to discover potential risky behaviors in a timely manner. The way to analyze logs is usually to detect historical behaviors, which cannot be done in real time. Based on this, an embodiment of the present invention provides an account risk behavior detection method, including: obtaining real-time account data; loading a preset first list, wherein the preset first list includes a first risky behavior; and detecting the account real-time data based on the preset first list to determine the risk detection result of the account. An embodiment of the present invention is applied to a cloud computing operation and maintenance platform.

[0040] According to an embodiment of the present invention, an embodiment of an account risk behavior detection method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0041] In this embodiment, a method for detecting account risk behavior is provided, which can be used in the above-mentioned cloud computing operation and maintenance platform. Figure 1 is a flow chart of a method for detecting account risk behavior according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0042] Step S101, obtaining real-time account data.

[0043] Account real-time data may include account information and account operation data, where account information includes the login IP address (Internet Protocol Address), login device information, account location information, etc.; account operation data may include account real-time operation behavior data, specifically, account operation data includes creating data, modifying data, deleting data, changing access rights, etc. Account real-time data includes but is not limited to the above-mentioned contents.

[0044] The cloud computing operation and maintenance platform has a detection function. Specifically, a corresponding detection tool system or a log recording system can be deployed. The detection tool system can be deployed in the cloud computing operation and maintenance platform in the form of a database or an API (Application Programming Interface). After the detection function is enabled, corresponding technical means are used to obtain data.

[0045] Specifically, after the user logs in to the account, the cloud computing operation and maintenance platform will enable the detection function to collect real-time data of the account. The cloud computing operation and maintenance platform can detect multiple connected accounts and conduct risk behavior detection for each account.

[0046] In some optional implementations, after the real-time account data is collected, the acquired real-time account data may be preprocessed, such as cleaning and formatting, to ensure the consistency and accuracy of the data. Specifically, the preprocessing operation may include removing invalid data, processing missing values, converting data types, and the like.

[0047] In some optional implementations, after acquiring and preprocessing the real-time account data, the preprocessed data may be stored in a preset area, such as a memory database, a cache system, or a temporary table, for subsequent detection and analysis.

[0048] Step S102, loading a preset first list.

[0049] The preset first list is a risk behavior list that contains a series of rules and indicators for detecting the login and operation behaviors of platform accounts and identifying possible risk behaviors. The preset first list includes the first risk behavior. The preset first list is pre-set and contains content representing account risk behaviors. The risk behaviors stored in the preset first list are defined as first risk behaviors. The preset first list can be stored in the cloud computing operation and maintenance platform in the form of a database or file.

[0050] In some optional implementations, the preset first list may be stored in a corresponding database or configuration center corresponding to the detection function of the cloud computing operation and maintenance platform.

[0051] In some optional implementations, the first risk behavior in the preset first list may exist in the form of text, code or structured data.

[0052] When loading the preset first list, firstly, the preset first list is obtained from the location where the preset first list is stored, and the preset first list is parsed to extract the first risk behavior stored therein from the preset first list.

[0053] In some optional implementations, after extracting the first risk behavior, the parsed first risk behavior may also be stored in a memory or an appropriate storage structure so as to be quickly accessed later.

[0054] In some optional implementations, the first risk behavior in the preset first list includes at least: abnormal login behavior, privileged behavior, abnormal data access behavior, abnormal permission change, abnormal network communication behavior, abnormal program behavior, abnormal file operation, high-frequency activity behavior, abnormal session behavior, and malicious attack behavior.

[0055] Each first risk behavior has a corresponding response processing operation, and the response processing operation can also be stored in a preset first list.

[0056] Step S103: detect the real-time data of the account based on the preset first list to determine the risk detection result of the account.

[0057] By traversing the real-time data of the account, each piece of data can be matched with the risk behavior in the preset first list, and the account can be judged whether there is a risk based on the matching result. If a certain data of the account matches the first risk behavior, the account can be considered to have a risk behavior. The risk detection results can be recorded for subsequent analysis and processing. The risk detection results may include whether there is a risk, the risk type, the risk level, etc.

[0058] Based on the risk detection results, corresponding processing measures for risky behaviors can be executed, including triggering alarms, suspending account use, notifying administrators, etc.

[0059] In some optional implementations, if an abnormal situation is encountered (such as data format mismatch, manifest parsing error, etc.), targeted exception handling is required to ensure that the process proceeds smoothly.

[0060] In some optional implementations, a report may be generated based on the risk detection results, including information such as a list of risk accounts, risk type, risk level, and recommended measures.

[0061] The account risk behavior detection method provided in this embodiment obtains real-time account data; loads a preset first list, wherein the preset first list includes a first risk behavior; and detects the account real-time data based on the preset first list to determine the risk detection result of the account. The present invention has formulated a preset first list for implementing risk behavior detection. After collecting the real-time account data, the real-time account data is detected through the preset first list to determine whether the account has risk behavior, and executes the corresponding processing measures for the risk behavior to ensure the security of the account.

[0062] In this embodiment, a method for detecting account risk behavior is provided, which can be used in the above-mentioned cloud computing operation and maintenance platform. Figure 2 is a flow chart of a method for detecting account risk behavior according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0063] Step S201, obtain real-time account data. For details, see Figure 1 Step S101 of the illustrated embodiment will not be described in detail here.

[0064] Step S202: loading a preset first list.

[0065] For details, please see Figure 1 Step S102 of the illustrated embodiment will not be described in detail here.

[0066] Step S203: detect the real-time data of the account based on the preset first list to determine the risk detection result of the account.

[0067] Specifically, the above step S203 includes:

[0068] Step S2031, matching the real-time account data with the preset first list to obtain a matching result.

[0069] Step S2032, determining the handling measures for the account based on the matching result.

[0070] Match and detect the real-time account data to see if the behavior matches the first risk behavior in the preset first list, and take different treatment measures according to the detection results. The treatment measures may include triggering an alarm, suspending account use, notifying the administrator, etc. When matching, a suitable matching algorithm may be used, such as string matching, pattern matching, and machine learning algorithms.

[0071] In some optional implementations, the above step S2032 includes:

[0072] Step a1: If the real-time account data matches the first risk behavior in the preset first list, the processing measures corresponding to the first risk behavior are obtained.

[0073] If it is found that the account behavior matches the first risk behavior in the preset first list, a processing measure corresponding to the first risk behavior may be taken.

[0074] Step a2: executing the processing measures corresponding to the first risk behavior.

[0075] The first risk behavior and corresponding treatment measures in the preset first list provided by the embodiment of the present invention are as follows:

[0076] Regarding abnormal login behavior, if the login frequency is detected to be greater than 30 seconds each time or login occurs from an unfamiliar geographical location, additional authentication steps will be automatically triggered, such as verification code or multi-factor authentication.

[0077] Regarding privileged behavior, strict permission management and auditing measures are implemented for privileged operations of administrators or specific users, and the records of these operations are monitored to detect abnormal behavior in a timely manner.

[0078] Regarding abnormal data access behavior, if a user accesses unauthorized sensitive data, their access rights can be immediately interrupted, and relevant personnel and security teams can be notified for investigation and handling.

[0079] Regarding abnormal permission changes, once abnormal permission changes are discovered, they should be reviewed and investigated immediately, and appropriate measures should be taken, such as revoking the privileged permissions of unauthorized users and repairing the modified permission configuration.

[0080] Regarding abnormal network communication behavior, for abnormal behaviors such as communication with known malicious IP addresses or large amounts of data transmission, communication with the malicious IP addresses can be blocked or the data transmission rate can be limited, and the security team can be notified for further investigation.

[0081] Regarding abnormal program behaviors, for abnormal program behaviors such as executing unauthorized scripts and system commands, the session can be immediately interrupted and further investigated and analyzed to prevent the spread or damage of malicious activities.

[0082] Regarding abnormal file operations, such as deleting or modifying key system files, uploading malicious files, etc., the relevant operations can be interrupted immediately and the corresponding system recovery and repair can be performed.

[0083] Regarding high-frequency activities, for multiple password resets and account lock and unlock behaviors within 10 minutes, measures such as adding identity authentication steps and limiting activity frequency are taken.

[0084] Regarding abnormal session behavior, if the session time is too long (more than two hours) or there are more than five sessions with unfamiliar accounts within an hour, the session will be automatically terminated and the user will be required to re-authenticate to ensure the security of the session.

[0085] Regarding malicious attacks, corresponding security protection measures can be taken, such as blocking access from malicious IP addresses, detecting and blocking malicious requests, etc.

[0086] The account risk behavior detection method provided in this embodiment determines whether the account has risky behavior by matching the real-time account data with the preset first list, and takes corresponding processing measures for the risky behavior, so as to timely process it according to the real-time situation and improve the security of the account.

[0087] In this embodiment, a method for detecting account risk behavior is provided, which can be used in the above-mentioned cloud computing operation and maintenance platform. Figure 3 is a flow chart of a method for detecting account risk behavior according to an embodiment of the present invention. Figure 3 As shown, the process includes the following steps:

[0088] Step S301, summarizing the real-time data of the account based on a preset period to determine the periodic data.

[0089] The preset period is a time range set in advance, such as daily, weekly, monthly, etc., for periodic data collection. In this embodiment, the preset period is not specifically limited. Account real-time data is various data generated by the account during the operation process after login, such as the number of logins, frequency of operation types, data access volume, cumulative operation data volume, etc., which are stored in a specific area. For the same account, all real-time data of the account are regularly summarized based on the preset period, and the summarized data is stored as periodic data in a specific area.

[0090] Step S302, loading a preset second list.

[0091] Among them, the preset second list includes the second risk behavior.

[0092] The preset second list is a risk behavior list that contains a series of rules and indicators for detecting the login and operation behaviors of platform accounts and identifying possible risk behaviors. The preset second list includes second risk behaviors. The preset second list is pre-set and contains content representing account risk behaviors. The risk behaviors stored in the preset second list are defined as second risk behaviors. The preset second list can be stored in the cloud computing operation and maintenance platform in the form of a database or file.

[0093] In some optional implementations, the preset second list may be stored in a corresponding database or configuration center corresponding to the detection function of the cloud computing operation and maintenance platform.

[0094] In some optional implementations, the second risk behavior in the preset second list may exist in the form of text, code or structured data.

[0095] When loading the preset second list, firstly, the preset second list is obtained from the location where the preset second list is stored, and the preset second list is parsed to extract the second risk behavior stored therein from the preset second list.

[0096] In some optional implementations, after extracting the second risk behavior, the parsed second risk behavior may be stored in a memory or an appropriate storage structure so as to be quickly accessed later.

[0097] In some optional implementations, the second risk behavior is a staged risk behavior, and the second risk behaviors in the preset second list include at least: abnormal data download volume, frequent location changes, abnormal login time patterns, high-frequency account operations, abnormal file access, accumulation of high-risk operations, abnormal account associations, abnormal data upload behavior, staged password brute force cracking, and abnormal data deletion behavior.

[0098] Each second risk behavior has a corresponding response processing operation, and the response processing operation can also be stored in a preset second list.

[0099] Step S303: Check the periodic data based on the preset second list to determine the periodic risk detection result of the account.

[0100] By traversing the real-time data of the account, each piece of data can be matched with the second risk behavior in the preset second list, and the account can be judged whether there is a risk based on the matching result. If a certain data of the account matches the second risk behavior, it can be considered that the account has a staged risk behavior. The risk detection results can be recorded for subsequent analysis and processing, and the risk detection results may include whether there is a risk, risk type, risk level, etc.

[0101] Based on the risk detection results, corresponding processing measures for risky behaviors can be executed, including triggering alarms, suspending account use, adding verification, notifying administrators, etc.

[0102] In some optional implementations, if an abnormal situation is encountered (such as data format mismatch, manifest parsing error, etc.), targeted exception handling is required to ensure that the process proceeds smoothly.

[0103] In some optional implementations, a report may be generated based on the risk detection results, including information such as a list of risk accounts, risk type, risk level, and recommended measures.

[0104] Specifically, the above step S303 includes:

[0105] Step 401, matching the periodic data with the preset second list;

[0106] Step 402: If the periodic data matches the second risk behavior in the preset second list, the processing measures corresponding to the second risk behavior are obtained and executed.

[0107] Match and detect the real-time account data to see if the behavior matches the second risk behavior in the preset second list, and take different treatment measures according to the detection results. The treatment measures may include triggering an alarm, suspending account use, notifying the administrator, etc. When matching, a suitable matching algorithm may be used, such as string matching, pattern matching, and machine learning algorithms.

[0108] The second risk behavior and corresponding processing measures in the preset second list provided by the embodiment of the present invention are as follows:

[0109] Abnormal data download volume: If the user has downloaded more than 100M of sensitive data in total during this period, the download behavior will be interrupted and the relevant personnel and security team will be notified to conduct further investigation and review the legality of the user's behavior.

[0110] Frequent location changes: If more than three logins are detected within 10 minutes and the login locations are not in the same city, the user will be required to re-authenticate during login to ensure the security of the account. At the same time, the relevant personnel and security team will be notified for further investigation and handling.

[0111] Abnormal login time pattern: If a user logs in 5 times between 0-6 o'clock, an alert is sent to notify relevant personnel, requiring the user to authenticate, and automatically triggering additional authentication steps, verification codes and multi-factor authentication.

[0112] High-frequency account operations: For users who frequently perform account operations in a short period of time, such as changing passwords multiple times, frequently adding or deleting contacts, etc., the rationality of these operations can be reviewed and necessary measures can be taken, such as adding identity authentication steps, limiting the frequency of activities, etc.

[0113] Abnormal file access: If a user accesses files or directories that are not related to his or her business five times within a week, a warning will be issued during subsequent operations, and relevant personnel and the security team will be notified to investigate and handle the issue.

[0114] Accumulation of high-risk operations: If a user accesses a sensitive system five times or frequently executes privileged commands within a week, a warning and verification will be displayed at the next login.

[0115] Abnormal account association: If more than three accounts are detected to share the same device, IP address, or contact within one hour, the account association will be further verified, the access rights of the relevant accounts will be interrupted, and the relevant personnel and security team will be notified for investigation and handling.

[0116] Abnormal data upload behavior: If a user uploads more than 500M of abnormal data within 1 week, it may indicate data leakage or abuse. The user's upload permission will be suspended, and relevant personnel and the security team will be notified for further investigation and processing.

[0117] Periodic password brute force cracking: If multiple failed logins and password resets are found within 2 hours, it may indicate that the password has been maliciously cracked or brute-forced. Immediately interrupt the user's session and require the user to reset the password and authenticate.

[0118] Abnormal data deletion behavior: If a user deletes irrelevant personal data or important data more than three times in a week, it may indicate data abuse or erasure. In this case, the user's session will be immediately interrupted and the relevant personnel and security team will be notified for further investigation and handling.

[0119] The account risk behavior detection method provided in the embodiment of the present invention regularly summarizes the account behavior data and sets a stage-by-stage risk behavior list, that is, a preset second list. The real-time data of the account is detected by the preset second list to determine whether the account has risky behavior, and the corresponding processing measures for the risky behavior are executed to ensure the security of the account.

[0120] In this embodiment, a method for detecting account risk behavior is provided. Figure 4 As shown, a staged risk behavior list and a real-time risk detection list are pre-set, and the method includes: loading the real-time risk behavior list, obtaining real-time data used by users when logging in in real time, matching and detecting the real-time behavior with the real-time risk behavior list; loading the staged risk behavior list, periodically counting the behavior data of each user's use, and summarizing it within each preset time. Matching and detecting the counted behavior with the staged risk behavior list.

[0121] In this embodiment, an account risk behavior detection device is also provided, which is used to implement the above embodiments and preferred implementations, and will not be repeated here. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0122] This embodiment provides an account risk behavior detection device, such as Figure 5 As shown, including:

[0123] Data acquisition module 501, used to acquire real-time account data;

[0124] A list loading module 502 is used to load a preset first list, wherein the preset first list includes a first risk behavior;

[0125] The data detection module 503 is used to detect the real-time data of the account based on the preset first list to determine the risk detection result of the account.

[0126] In some optional implementations, the data detection module 503 includes:

[0127] A first matching unit, used for matching the real-time account data with the preset first list to obtain a matching result;

[0128] The first processing unit is used to determine a processing measure for the account based on the matching result.

[0129] In some optional implementations, the first processing unit includes:

[0130] A measure acquisition subunit, configured to acquire a processing measure corresponding to the first risk behavior if the real-time account data matches the first risk behavior in the preset first list;

[0131] The execution subunit is used to execute the processing measures corresponding to the first risk behavior.

[0132] In some optional implementations, the first risk behavior in the preset first list includes at least: abnormal login behavior, privileged behavior, abnormal data access behavior, abnormal permission change, abnormal network communication behavior, abnormal program behavior, abnormal file operation, high-frequency activity behavior, abnormal session behavior, and malicious attack behavior.

[0133] In some optional embodiments, the device further comprises:

[0134] A periodic data acquisition module, used to aggregate the real-time data of the account based on a preset period to determine periodic data;

[0135] A second list loading module, used to load a preset second list, wherein the preset second list includes a second risk behavior;

[0136] The second detection module is used to detect the periodic data based on the preset second list to determine the periodic risk detection result of the account.

[0137] In some optional embodiments, the second detection module includes:

[0138] A second matching unit, configured to match the periodic data with the preset second list;

[0139] A measure acquisition unit is used to acquire the processing measure corresponding to the second risk behavior if the periodic data matches the second risk behavior in the preset second list, and execute the processing measure corresponding to the second risk behavior.

[0140] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0141] The account risk behavior detection device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0142] The embodiment of the present invention also provides a computer device having the above Figure 5 The account risk behavior detection device shown.

[0143] See also Figure 6 , Figure 6 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 6 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 6 A processor 10 is taken as an example.

[0144] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0145] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0146] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0147] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0148] The computer device further comprises a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0149] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0150] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0151] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention. Such modifications and variations are all within the scope defined by the present invention.

Claims

1. A method for detecting account risk behavior, characterized in that: The method comprises: Get real-time account data; Loading a preset first list, wherein the preset first list includes a first risk behavior; The real-time data of the account is detected based on the preset first list to determine the risk detection result of the account.

2. The method according to claim 1, characterized in that The detecting the real-time data of the account based on the preset first list to determine the risk detection result of the account includes: Matching the real-time account data with the preset first list to obtain a matching result; A processing measure for the account is determined based on the matching result.

3. The method according to claim 2, characterized in that The determining of a processing measure for the account based on the matching result includes: If the real-time account data matches the first risk behavior in the preset first list, obtaining a processing measure corresponding to the first risk behavior; Execute the processing measures corresponding to the first risk behavior.

4. The method according to claim 1, characterized in that: The first risk behaviors in the preset first list include at least: abnormal login behavior, privileged behavior, abnormal data access behavior, abnormal permission change, abnormal network communication behavior, abnormal program behavior, abnormal file operation, high-frequency activity behavior, abnormal session behavior, and malicious attack behavior.

5. The method according to claim 1, characterized in that The method further comprises: Aggregating the real-time data of the account based on a preset period to determine periodic data; Loading a preset second list, wherein the preset second list includes a second risk behavior; The periodic data is tested based on the preset second list to determine a periodic risk test result of the account.

6. The method according to claim 5, characterized in that The periodic data is tested based on the preset second list to determine the periodic risk test result of the account, including: matching the periodic data with the preset second list; If the periodic data matches the second risk behavior in the preset second list, the processing measures corresponding to the second risk behavior are obtained, and the processing measures corresponding to the second risk behavior are executed.

7. An account risk behavior detection device, characterized in that: The device comprises: Data acquisition module, used to obtain real-time account data; A list loading module, used to load a preset first list, wherein the preset first list includes a first risk behavior; The data detection module is used to detect the real-time data of the account based on the preset first list to determine the risk detection result of the account.

8. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the account risk behavior detection method according to any one of claims 1 to 6 by executing the computer instructions.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the account risk behavior detection method according to any one of claims 1 to 6.

10. A computer program product, characterized in that It comprises computer instructions, and the computer instructions are used to enable a computer to execute the account risk behavior detection method according to any one of claims 1 to 6.

Images