Method and device for determining abnormal login of user account based on time sequence
By using a time-series-based method to identify abnormal user account logins, a recurrent neural network model is employed to predict login time intervals and combine this with other contact methods for confirmation. This approach addresses the risk of unauthorized logins due to leaked user account passwords and improves account login security.
Patent Information
- Application Number
- CN202510727291.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-06-03
- Publication Date
- 2025-10-31
AI Technical Summary
In existing technologies, the risk of unauthorized logins due to leaked user account passwords cannot be effectively monitored, and traditional account password login methods have security vulnerabilities.
By obtaining the time interval sequence of the current and historical login information of the target user account, a recurrent neural network model is used to predict the time interval of the current login. Combined with notification confirmation from other contact methods, it is determined whether the login is abnormal.
Reduce the risk of logins from different locations due to leaked account passwords, improve the security of user account logins, and ensure that legitimate users can quickly identify and handle abnormal logins.
Smart Images
Figure CN120880682A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of artificial intelligence technology, and in particular to a method and apparatus for determining abnormal user account logins based on time series. Background Technology
[0002] User accounts symbolize personal identity in the internet world. In the current context of artificial intelligence and big data, facial recognition, fingerprints, and voiceprints are frequently used for user identification. However, account login remains one of many authentication methods; therefore, user security management in the internet world is particularly important. Currently, various platforms have proposed verification methods such as CAPTCHA recognition, facial recognition, fingerprint recognition, and voiceprint recognition for user security, but the traditional account password login method remains a crucial user account login method, posing higher security requirements for this traditional authentication mode.
[0003] With the development of modern internet technology, personal account security is increasingly valued by major internet platforms, and more and more new technologies are appearing in the world of internet authentication. However, traditional account password login still exists in the internet world, and it is currently impossible to completely eliminate its role. Therefore, monitoring whether account password logins are abnormal has become a pain point. Current technologies typically achieve account security management by setting single-device login, limiting the number of device logins, and requiring QR code confirmation. This solves most of the problems, but when an account login status expires, there is a risk of problems arising from password leaks and subsequent logins from other locations. Summary of the Invention
[0004] This invention provides a method and apparatus for determining abnormal user account logins based on time series, which solves the problem of abnormal user account logins caused by the leakage of user account passwords in the prior art, reduces the risk of others logging in from different locations due to account password leakage, and thus increases the security of user account logins.
[0005] A method for determining abnormal user account login based on time series, the method comprising: acquiring a first actual time interval for the current input of login information of a target user account, and a first time interval sequence for input of login information within a first historical time period; determining a first predicted time interval for the current input of login information of the target user account based on the first time interval sequence; preliminarily determining whether the current login of the target user account is abnormal based on the first actual time interval and the first predicted time interval; if the current login of the target user account is preliminarily determined to be abnormal, sending a notification to the target user through other contact methods registered by the target user account to determine whether the login is abnormal; and, in response to the target user's judgment operation on the notification, determining whether to determine the current login of the target user account as an abnormal login.
[0006] In one embodiment, determining the first predicted time interval for the current login information input of the target user account based on the first time interval sequence includes: inputting the first time interval sequence into a pre-trained recurrent neural network model to determine the first predicted time interval; the first recurrent neural network model is trained based on multiple second time interval sequences of the target user account, the second time interval sequence being a set of time intervals for each login information input when the target user account logs in normally within a second historical time period; the length of the second time interval sequence is equal to the length of the first time interval sequence.
[0007] In one embodiment, the pre-trained first recurrent neural network model is a recurrent neural network (RNN) or a long short-term memory network (LSTM).
[0008] In one embodiment, the current input login information includes multiple sub-fields, and the first time interval sequence includes a third time interval sequence corresponding to each of the multiple sub-fields. Accordingly, determining the first predicted time interval of the current input login information of the target user account based on the first time interval sequence includes: inputting a pre-trained second recurrent neural network model into the third time interval sequence corresponding to each field to determine the second predicted time interval corresponding to each field; wherein the second recurrent neural network model is trained based on multiple fourth time interval sequences of the target user account, and the fourth time interval sequence is the set of time intervals for each time the target user account normally logs in during a third historical time period; the length of the fourth time interval sequence is equal to the length of the third time interval sequence; and the second predicted time interval of each field is weighted and summed to obtain the first predicted time interval.
[0009] In one embodiment, the step of preliminarily determining whether the current login of the target user account is abnormal based on the first actual time interval and the first predicted time interval includes: preliminarily determining that the current login of the target user account is abnormal when the difference between the first actual time interval and the first predicted time interval is greater than a preset threshold; or, preliminarily determining that the current login of the target user account is normal when the difference between the first actual time interval and the first predicted time interval is less than or equal to a preset threshold.
[0010] In one embodiment, after determining whether the current login of the target user account is determined to be an abnormal login, the method further includes: if the current login of the target user account is determined to be an abnormal login, causing the system interface to display a login abnormality, or causing the system interface to display a login information input interface; or, if the current login of the target user account is determined to be a normal login, causing the system interface to display a normal login interface.
[0011] In one embodiment, the target user's action to determine the login anomaly notification is to reply to an email or SMS. Accordingly, in response to the target user's action to determine the notification, determining whether to identify the target user's current login as an abnormal login includes: identifying the content of the email or SMS reply from the target user, and determining whether to identify the target user's current login as an abnormal login based on the identified content of the email or SMS reply from the target user.
[0012] The present invention also provides a time-series-based device for determining abnormal user account logins. The device includes: an acquisition module, configured to acquire a first actual time interval for the current input of login information by a target user account, and a first time interval sequence for inputting login information within a first historical time period; a first determination module, configured to determine a first predicted time interval for the current input of login information by the target user account based on the first time interval sequence; a second determination module, configured to preliminarily determine whether the current login of the target user account is abnormal based on the first actual time interval and the first predicted time interval; and, if the current login of the target user account is preliminarily determined to be abnormal, to send a notification to the target user through other contact methods registered by the target user account to determine whether the login is abnormal; and a third determination module, configured to determine whether to determine the current login of the target user account as an abnormal login in response to the target user's judgment operation on the notification.
[0013] The present invention also provides a computer device, including a memory and a processor, wherein the memory stores computer-readable instructions, which, when executed by the processor, cause the processor to perform the steps of the time-series-based user account login anomaly determination method described above.
[0014] The present invention also provides a storage medium storing computer-readable instructions, which, when executed by one or more processors, cause the one or more processors to perform the steps of the time-series-based user account login anomaly determination method described above.
[0015] The aforementioned time-series-based method and apparatus for determining abnormal user account logins obtains the target user's login input habits by analyzing the time interval sequence of the target user's login information input over a historical period. This allows for the prediction of the target user's current login input time interval. The predicted time interval is then compared with the actual time interval of the target user's current login input to preliminarily determine whether the current login is abnormal. Further analysis of other contact information registered with the target user account allows the target user to definitively confirm that the current login is abnormal. This ensures that the genuine target user can quickly be aware of and take appropriate action when an abnormal login occurs, reducing the risk of unauthorized logins due to password leaks and increasing user account login security. Attached Figure Description
[0016] Figure 1 This is one of the flowcharts illustrating the time-series-based method for determining abnormal user account logins provided by the present invention.
[0017] Figure 2 A schematic diagram of the framework of the time-series-based user account login anomaly determination device provided by the present invention;
[0018] Figure 3 A schematic diagram of the electronic device provided by the present invention. Detailed Implementation
[0019] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.
[0020] It should be noted that, unless otherwise defined, the technical or scientific terms used in the embodiments of this disclosure should have the ordinary meaning understood by one of ordinary skill in the art to which this disclosure pertains. The terms "first," "second," and similar terms used in the embodiments of this disclosure do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are used only to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.
[0021] The following description, in conjunction with the accompanying drawings, illustrates the method and apparatus for determining abnormal user account logins based on time series data provided by this invention.
[0022] Figure 1 This is a flowchart illustrating a time-series-based method for determining abnormal user account logins according to the present invention. It can be understood that this time-series-based method for determining abnormal user account logins can be executed by a time-series-based device for determining abnormal user account logins. This time-series-based device for determining abnormal user account logins can be a computer device.
[0023] like Figure 1 As shown, in one embodiment, a method for determining user account login anomalies based on time series is proposed, which may specifically include the following steps:
[0024] Step 110: Obtain the first actual time interval for the current login information input of the target user account, and the first time interval sequence for the input of login information within the first historical time period.
[0025] The first historical time period can be understood as a period of time before the target user's account currently enters login information. For example, the first historical time period can be 1 year, 1 month, or 1 week.
[0026] It is understandable that within the first historical time period, the target user account may have logged in multiple times. Each login has a corresponding time interval for entering login information. These time intervals can be saved in chronological order to obtain the corresponding first time interval sequence. The first time interval sequence can be understood as the set of time intervals for each login attempt made by the target user account during the first historical time period.
[0027] Step 120: Based on the first time interval sequence, determine the first predicted time interval for the target user account to currently input login information.
[0028] It is understandable that the target user account may have logged in multiple times within the first historical period. Since the corresponding login habits of the target user account are fixed, the time interval between each login and login information input of the target user account in the previous period can be used to input big data model analysis to predict the time interval between the current login and login information input of the target user account, so as to prepare for subsequent judgment on whether the user's login is abnormal.
[0029] In one embodiment, the step may include: inputting the first time interval sequence into a pre-trained recurrent neural network model to determine the first predicted time interval; the recurrent neural network model is trained based on multiple second time interval sequences of the target user account, the second time interval sequence being a set of time intervals for each login information input when the target user account logs in normally within a second historical time period; the length of the second time interval sequence is equal to the length of the first time interval sequence.
[0030] The second historical time period can be any time period before the first historical time period. Within the second historical time period, the number of normal logins of the target user account is equal to the length of the first time interval sequence, that is, the length of the second time interval sequence is equal to the length of the first time interval sequence.
[0031] The pre-trained recurrent neural network model is either an RNN or an LSTM. Specifically, the training process of the recurrent neural network model can be found in existing technologies, and for the sake of brevity, it will not be elaborated here.
[0032] It's also understandable that, to further improve the accuracy of estimating target users' login input habits, the input login information can be broken down into multiple subfields. For each subfield, the actual time interval and its corresponding time interval sequence are input into a pre-trained recurrent neural network model to determine the predicted time interval for each subfield. Then, the predicted time intervals for each subfield are weighted and summed to determine the predicted time interval for the input login information. Each subfield can be, for example, a user account or password, or a further subdivision of user account and password information.
[0033] Therefore, in another embodiment, the current input login information includes multiple sub-fields, the first actual time interval includes a second actual time interval corresponding to each of the multiple sub-fields, and the first time interval sequence includes a third time interval sequence corresponding to each of the sub-fields. Accordingly, determining the first predicted time interval of the current input login information of the target user account based on the first time interval sequence includes: inputting a pre-trained second recurrent neural network model for each of the third time interval sequences corresponding to each field to determine the second predicted time interval corresponding to each field; and performing a weighted summation of the second predicted time intervals of each field to obtain the first predicted time interval.
[0034] The second recurrent neural network model is trained based on multiple fourth time interval sequences of the target user account. These fourth time interval sequences are the set of time intervals between each login attempt by the target user account during a normal login within a third historical time period. The length of each fourth time interval sequence is equal to the length of the third time interval sequence. The pre-trained second recurrent neural network model can be an RNN or an LSTM.
[0035] The third historical time period can be any time period prior to the first historical time period.
[0036] Specifically, the weighted summation of the second prediction time interval for each subfield can be accomplished using an attention mechanism.
[0037] Step 130: Based on the first actual time interval and the first predicted time interval, preliminarily determine whether the current login of the target user account is abnormal; if it is preliminarily determined that the current login of the target user account is abnormal, send a notification to the target user to determine whether the login is abnormal through other contact methods registered by the target user account.
[0038] Based on the preceding text, the predicted time interval is derived from the sequence of the first time intervals between login information input during a normal login. This can reflect, to some extent, the time interval between login information inputs during a normal login, and therefore can be used to preliminarily determine whether the current login of a target user account is abnormal. Furthermore, if it is preliminarily determined that the current login of the target user account is normal, the system interface will display a normal login screen.
[0039] It is understandable that target user accounts typically have more than one login or contact method when registering for the first time. Therefore, if the current login of the target user account may be abnormal, a notification can be sent to the target user through other contact methods of the target user account to determine whether the login is abnormal. This allows the target user to further confirm whether the login is abnormal, so that the real target user can be quickly informed and take appropriate action when an abnormal login occurs. This reduces the risk of others logging in from different locations due to account password leakage, thereby increasing the security of user account login.
[0040] Other contact methods include email and telephone.
[0041] Step 140: In response to the target user's judgment operation on the notification, determine whether to determine the target user's current login as an abnormal login.
[0042] The action that the target user takes to determine the login anomaly notification can be replying to an email or replying to a text message.
[0043] It is understandable that after receiving a notification indicating whether a login is abnormal, the target user can exclude login attempts made by others without their permission based on whether they are the ones making the operation, thereby ensuring the security of the target user's account.
[0044] The present invention relates to a time-series-based method and apparatus for determining abnormal user account logins. By analyzing the time interval sequence of a target user's login information input over a historical period, the method obtains the target user's login information input habits. This allows for the prediction of the target user's current login information input time interval. The predicted time interval is then compared with the actual time interval of the target user's current login information input to preliminarily determine whether the current login is abnormal. Further analysis, combined with other contact information registered with the target user account, allows the target user to further confirm that the current login is abnormal. This ensures that the genuine target user can quickly be aware of and take appropriate action when an abnormal login occurs, reducing the risk of unauthorized logins due to password leaks and thus increasing user account login security.
[0045] In one embodiment, the step of initially determining whether the current login of the target user account is abnormal based on the first actual time interval and the first predicted time interval includes:
[0046] When the difference between the first actual time interval and the first predicted time interval is greater than a preset threshold, it is preliminarily determined that the current login of the target user account is abnormal; or, when the difference between the first actual time interval and the first predicted time interval is less than or equal to a preset threshold, it is preliminarily determined that the current login of the target user account is normal.
[0047] In one embodiment, after determining whether the current login of the target user account is determined to be an abnormal login, the method further includes: if the current login of the target user account is determined to be an abnormal login, causing the system interface to display a login abnormality, or causing the system interface to display a login information input interface; or, if the current login of the target user account is determined to be a normal login, causing the system interface to display a normal login interface.
[0048] As can be seen from the foregoing, the target user's action to determine the login anomaly notification can be replying to an email or SMS. Therefore, in one embodiment, the step of determining whether to identify the target user's current login as an abnormal login in response to the target user's action to the notification includes: identifying the content of the email or SMS reply from the target user, and determining whether to identify the target user's current login as an abnormal login based on the identified content of the email or SMS reply from the target user.
[0049] Specifically, existing text recognition algorithms can be used to identify the content of emails or text messages replied by the target user. If the identified text is a preset text, such as "is it an abnormal login" or "is not an abnormal login," the identified text can be directly associated with the preset text's corresponding abnormal login judgment rule to determine whether the current login is an abnormal login. If the identified text is not a preset text, existing semantic understanding algorithms can be used to obtain the semantics of the identified text, compare it with the semantics of the preset text, determine the relationship between the identified text and the preset text, and then use this relationship and the preset text's corresponding abnormal login judgment rule to determine whether the current login is an abnormal login.
[0050] The following describes the time-series-based user account login anomaly determination device provided by the present invention. The time-series-based user account login anomaly determination device described below can be referred to in correspondence with the time-series-based user account login anomaly determination method described above.
[0051] like Figure 2 As shown, in one embodiment, a time-series-based user account login anomaly determination device is provided, which may include:
[0052] The acquisition module 210 is used to acquire the first actual time interval of the current login information input of the target user account, and the first time interval sequence of the login information input within the first historical time period;
[0053] The first determining module 220 is used to determine a first predicted time interval for the current input login information of the target user account based on the first time interval sequence;
[0054] The second determining module 230 is used to preliminarily determine whether the current login of the target user account is abnormal based on the first actual time interval and the first predicted time interval; if it is preliminarily determined that the current login of the target user account is abnormal, a notification to the target user is sent to determine whether the login is abnormal through other contact methods registered by the target user account.
[0055] The third determining module 240 is used to determine whether to identify the current login of the target user's account as an abnormal login in response to the target user's judgment operation on the notification.
[0056] The aforementioned time-series-based user account login anomaly determination device obtains the target user's login information input habits by analyzing the time interval sequence of the target user's login information input within a historical time period. This allows for the prediction of the target user's current login information input time interval. The device then compares this predicted time interval with the target user's actual current login information input time interval to preliminarily determine whether the target user's current login is an anomaly. Further analysis, combined with other contact information registered with the target user account, allows the target user to definitively confirm that the current login is an anomaly. This ensures that the genuine target user can quickly be aware of and take appropriate action when an anomaly occurs, reducing the risk of unauthorized logins due to password leaks and thus increasing user account login security.
[0057] In one embodiment, the first determining module 220 includes:
[0058] The first determining unit is used to input the first time interval sequence into a pre-trained recurrent neural network model to determine the first predicted time interval; the first recurrent neural network model is trained based on multiple second time interval sequences of the target user account, the second time interval sequence being a set of time intervals for each login information input when the target user account logs in normally within a second historical time period; the length of the second time interval sequence is equal to the length of the first time interval sequence.
[0059] In one embodiment, the pre-trained first recurrent neural network model is an RNN or an LSTM.
[0060] In one embodiment, the first determining module includes: the currently input login information contains multiple sub-fields, and the first time interval sequence includes a third time interval sequence corresponding to each of the multiple sub-fields; correspondingly, the first determining module 220 includes:
[0061] The second determining unit is used to input a pre-trained second recurrent neural network model into the third time interval sequence corresponding to each field to determine the second prediction time interval corresponding to each field; wherein, the second recurrent neural network model is trained based on multiple fourth time interval sequences of the target user account, the fourth time interval sequence being the set of time intervals for each login information input when the target user account logs in normally within the third historical time period; the length of the fourth time interval sequence is equal to the length of the third time interval sequence;
[0062] The weighted summation unit is used to perform a weighted summation of the second prediction time interval for each field to obtain the first prediction time interval.
[0063] In one embodiment, the second determining module 230 includes:
[0064] The third determining unit is configured to initially determine that the current login of the target user account is abnormal when the difference between the first actual time interval and the first predicted time interval is greater than a preset threshold; or,
[0065] The fourth determining unit is used to preliminarily determine that the current login of the target user account is normal when the difference between the first actual time interval and the first predicted time interval is less than or equal to a preset threshold.
[0066] In one embodiment, the device further includes:
[0067] The first processing module is configured to, upon determining that the current login of the target user account is an abnormal login, either display a login error message on the system interface or display a login information input interface on the system interface; or...
[0068] The second processing module is used to display a normal login interface on the system interface when it is determined that the current login of the target user account is a normal login.
[0069] In one embodiment, the target user's action to determine the login anomaly notification is to reply to an email or SMS message. Accordingly, the third determining module 240 includes:
[0070] The identification and fifth determination unit is used to identify the content of the email or SMS reply from the target user, and based on the identified content of the email or SMS reply from the target user, determine whether to determine the current login of the target user account as an abnormal login.
[0071] Figure 3 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 3As shown, the electronic device may include a processor 310, a communication interface 320, a memory 330, and a communication bus 340, wherein the processor 310, the communication interface 320, and the memory 330 communicate with each other through the communication bus 340. The processor 310 can invoke logical instructions in the memory 330 to execute a time-series-based method for determining abnormal user account logins. This method includes: acquiring a first actual time interval for the current input login information of a target user account, and a first time interval sequence for input login information within a first historical time period; determining a first predicted time interval for the current input login information of the target user account based on the first time interval sequence; preliminarily determining whether the current login of the target user account is abnormal based on the first actual time interval and the first predicted time interval; if the current login of the target user account is preliminarily determined to be abnormal, sending a notification to the target user regarding the abnormal login status through other contact methods registered with the target user account; and, in response to the target user's judgment operation on the notification, determining whether to determine the current login of the target user account as an abnormal login.
[0072] Furthermore, the logical instructions in the aforementioned memory 330 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0073] On the other hand, the present invention also provides a computer program product, the computer program product comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions, wherein when the program instructions are executed by a computer, the computer is able to execute the time-series-based user account login anomaly determination method provided by the present invention, the time-series-based user account login anomaly determination method comprising: obtaining a first actual time interval for the current input of login information of a target user account, and a first time interval sequence for input of login information within a first historical time period; determining a first predicted time interval for the current input of login information of the target user account based on the first time interval sequence; preliminarily determining whether the current login of the target user account is abnormal based on the first actual time interval and the first predicted time interval; in the case that the current login of the target user account is preliminarily determined to be abnormal, sending a notification to the target user through other contact methods registered by the target user account to determine whether the login is abnormal; and in response to the target user's judgment operation on the notification, determining whether to determine the current login of the target user account as an abnormal login.
[0074] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the time-series-based user account login anomaly determination method provided by the present invention. The time-series-based user account login anomaly determination method includes: obtaining a first actual time interval for the current input of login information of a target user account, and a first time interval sequence for input of login information within a first historical time period; determining a first predicted time interval for the current input of login information of the target user account based on the first time interval sequence; preliminarily determining whether the current login of the target user account is abnormal based on the first actual time interval and the first predicted time interval; if the current login of the target user account is preliminarily determined to be abnormal, sending a notification to the target user regarding whether the login is abnormal through other contact methods registered by the target user account; and determining whether to determine the current login of the target user account as abnormal in response to the target user's judgment operation on the notification.
[0075] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.
[0076] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.
[0077] It is understood that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. A method for determining abnormal user account logins based on time series, characterized in that, include: Obtain the first actual time interval of the target user account's current login information input, and the first time interval sequence of login information input within the first historical time period; Based on the first time interval sequence, a first predicted time interval for the current login information input by the target user account is determined; Based on the first actual time interval and the first predicted time interval, it is preliminarily determined whether the current login of the target user account is abnormal; If it is initially determined that the target user's current login is abnormal, a notification to determine whether the login is abnormal will be sent to the target user through other contact methods registered by the target user account; In response to the target user's judgment action on the notification, determine whether to classify the target user's current login as an abnormal login.
2. The method for determining abnormal user account logins based on time series as described in claim 1, characterized in that, The step of determining the first predicted time interval for the current login information input by the target user account based on the first time interval sequence includes: The first time interval sequence is input into a pre-trained recurrent neural network model to determine the first predicted time interval; the first recurrent neural network model is trained based on multiple second time interval sequences of the target user account, the second time interval sequence being the set of time intervals for each login information input when the target user account logs in normally within a second historical time period; the length of the second time interval sequence is equal to the length of the first time interval sequence.
3. The method for determining abnormal user account logins based on time series as described in claim 2, characterized in that, The pre-trained first recurrent neural network model is either an RNN or an LSTM.
4. The method for determining abnormal user account logins based on time series as described in claim 1, characterized in that, The currently entered login information contains multiple sub-fields, and the first time interval sequence includes a third time interval sequence corresponding to each of the multiple sub-fields. Accordingly, determining the first predicted time interval for the currently entered login information of the target user account based on the first time interval sequence includes: For each field, a pre-trained second recurrent neural network model is input into the third time interval sequence to determine the second prediction time interval for each field; wherein, the second recurrent neural network model is trained based on multiple fourth time interval sequences of the target user account, the fourth time interval sequence being the set of time intervals for each login information input when the target user account logs in normally within the third historical time period; the length of the fourth time interval sequence is equal to the length of the third time interval sequence; The first prediction time interval is obtained by weighted summation of the second prediction time intervals for each field.
5. The method for determining abnormal user account logins based on time series as described in claim 1, characterized in that, The preliminary determination of whether the current login of the target user account is abnormal based on the first actual time interval and the first predicted time interval includes: When the difference between the first actual time interval and the first predicted time interval is greater than a preset threshold, it is preliminarily determined that the current login of the target user account is abnormal; or, When the difference between the first actual time interval and the first predicted time interval is less than or equal to a preset threshold, it is preliminarily determined that the current login of the target user account is normal.
6. The method for determining abnormal user account logins based on time series as described in claim 1, characterized in that, After determining whether to classify the current login of the target user account as an abnormal login, the method further includes: If it is determined that the current login of the target user account is an abnormal login, the system interface will display a login error message, or the system interface will display a login information input interface; or, If it is determined that the current login of the target user account is a normal login, the system interface will display a normal login interface.
7. The method for determining abnormal user account logins based on time series as described in claim 1, characterized in that, The target user's action in responding to the login anomaly notification is to reply to an email or SMS message. Accordingly, the step of determining whether to classify the target user's current login as an abnormal login in response to the target user's action includes: Identify the content of emails or text messages replied by the target user, and based on the identified content of emails or text messages replied by the target user, determine whether to identify the current login of the target user's account as an abnormal login.
8. A device for determining abnormal user account logins based on time series, characterized in that, The device includes: The acquisition module is used to acquire the first actual time interval of the current login information input of the target user account, and the first time interval sequence of the login information input within the first historical time period; The first determining module is used to determine a first predicted time interval for the current input login information of the target user account based on the first time interval sequence; The second determining module is used to preliminarily determine whether the current login of the target user account is abnormal based on the first actual time interval and the first predicted time interval; if it is preliminarily determined that the current login of the target user account is abnormal, a notification to the target user is sent to determine whether the login is abnormal through other contact methods registered by the target user account. The third determination module is used to determine, in response to the target user's judgment operation on the notification, whether to determine the target user's current login as an abnormal login.
9. A computer device, comprising a memory and a processor, characterized in that, The memory stores computer-readable instructions that, when executed by the processor, cause the processor to perform the steps of the time-series-based user account login anomaly determination method as described in any one of claims 1 to 7.
10. A storage medium storing computer-readable instructions, characterized in that, When the computer-readable instructions are executed by one or more processors, the one or more processors perform the steps of the time-series-based user account login anomaly determination method as described in any one of claims 1 to 7.