Management method for computer abnormal behavior recognition
By combining historical login data and multiple verification methods, the system determines the abnormality of user login behavior, solving the problem of misjudgment in the identification of abnormal computer behavior in existing technologies and improving the accuracy and security of identification.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-31
- Publication Date
- 2026-03-31
AI Technical Summary
Existing technologies for identifying abnormal computer behavior suffer from misjudgments, leading to a decrease in recognition accuracy.
By acquiring information about a user's current login behavior and combining it with historical login datasets, we can determine differences in login methods and times, monitor resource scheduling behavior, and improve the security and accuracy of login behavior by utilizing multiple verification methods.
It improves the accuracy of identifying abnormal computer behavior, reduces false positives, and enhances the security and rationality of login behavior.
Smart Images
Figure CN121770877A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of computer technology, and in particular to a management method for identifying abnormal computer behavior. Background Technology
[0002] Abnormal computer behavior typically refers to various phenomena in which the operating state of a system, software, or hardware deviates from the expected or normal range, including abnormal logins, account theft, and system blue screens.
[0003] In related technologies, the identification of abnormal computer behavior mainly involves collecting, modeling, and analyzing behavioral data generated by a computer system or its operating environment to discover and mark events that deviate from the "normal" behavior pattern. The core idea is to first establish a baseline of normal behavior (statistical features, probability models, or machine learning features) for subjects such as users, processes, or networks, and then compare real-time or offline behavior with this baseline. When the deviation exceeds a set threshold or does not conform to the learned pattern, it is judged as abnormal behavior and corresponding alarms or actions are taken.
[0004] Regarding the aforementioned technologies, since computer use is controlled by the user, computers may deviate from their "normal" behavior mode during use. This can lead to misjudgments when identifying abnormal computer behavior based on the initial baseline of normal behavior, resulting in reduced accuracy and requiring improvement. Summary of the Invention
[0005] To improve the accuracy of identifying abnormal computer behavior, this application provides a management method for identifying abnormal computer behavior.
[0006] This application provides a management method for identifying abnormal computer behavior, which adopts the following technical solution: A management method for identifying abnormal computer behavior includes: Obtain login information for the user's current login behavior; the login information includes account information, login method, and login time; The database is matched with the account information in the login information to obtain the historical login dataset with login status information for that account. The login status of the latest login data in the historical login dataset is then determined. If the account is offline, the login method in the login information is checked to determine whether the current login behavior is an account recovery login. If the login method is not account recovery login, the current login behavior will be verified according to the regular verification process, and the current login behavior will be determined as abnormal based on the verification result. If the current login method is account recovery login, then the current login method will be matched with the historical login dataset to determine the frequency data of the corresponding login method in the historical login records; Based on the historical login dataset and the login time of this login, the time difference between the most recent login and the current login is determined. The time difference data is then compared with the frequency data to determine the deviation value between the time difference data and the frequency data. This deviation value is then used as the first outlier of this login. Based on the account information, the nature of the account is determined. If the nature of the account is resource-damaging, the resource data of the logged-in account is monitored to determine the rationality of resource scheduling, and the rationality data obtained is used as the second abnormal value of the current login behavior. The security of the current login behavior is determined based on the first and second outliers. If the current login behavior is determined to be insecure, then the current login behavior is determined to be abnormal.
[0007] Preferably, the time interval between the current login behavior and the most recent login behavior is determined based on the historical login dataset to obtain time data; Obtain the server address of the most recent login behavior and the server address of the current login behavior from the historical login dataset, and determine the distance data between the two. The user's movement rate is determined based on time and distance data, and then compared with a built-in speed threshold to determine the feasibility of the account owner logging in from another user. If the movement speed exceeds the speed threshold, it is determined that it is not feasible for the account owner to log in from another user; if the movement speed is below the speed threshold, it is determined that it is feasible for the account owner to log in from another user. If it is determined that unauthorized login is not feasible, the built-in verification process is matched according to the current login method to perform security verification on the current login behavior and determine the security of the current login behavior. If the verification process is completed, the current login behavior is considered normal; otherwise, if the verification process is not completed, the current login behavior is considered abnormal.
[0008] Preferably, the current login method is matched with the historical login dataset to identify historical login records under the same login method, and these are recorded as the first login record and its first time point; Based on the first time point, the historical login dataset is matched with adjacent login records to obtain the second time point of the second login record located before the first time point; The time difference between the first and second time points is calculated to determine the time interval, and the average of the time intervals corresponding to the first login record is calculated to determine the frequency data under this login method.
[0009] Preferably, when an account sends a resource allocation request to the data center, the request signaling output by the account from the time of successful login to the time of the resource allocation request is read to determine the account's operation behavior after login, which is recorded as the first operation behavior; Based on this login method, the data center is read, and the operation behavior after adopting the same login method in the data center is determined and recorded as the second operation behavior; Machine learning is used to analyze the second operation to determine the user's behavioral logic after logging into the account using this login method. The first operational behavior and behavioral logic are input into the probabilistic graphical model to determine the rationality of the account's operational behavior after login, obtain rationality data, and use this rationality data as the second outlier of this login.
[0010] Preferably, if the account type is non-resource-damaging, then the account's permission requests should be monitored; When the account sends a permission change request to the service center, the permission change request is matched with the login method to determine whether the permissions of the current login method meet the permission change request. If it is determined that the permissions of this login method do not meet the permission change request, the built-in verification database is matched with the permission change request and this login method to determine the verification process required when the corresponding permissions change. The system performs security authentication on users based on the verification process. If the authentication is successful, a permission change request is executed. If the authentication fails, the first abnormal value is compared with the built-in abnormal threshold. If the first abnormal value is higher than the abnormal threshold, the current login behavior is determined to be abnormal.
[0011] Preferably, if the account's current login status is online, the frequency of operations during the continuous online state is determined, and the frequency of operations is used as the account's activity level during the current login state. Compare the current login behavior with the activity level to determine whether the account was active when the current login behavior was performed. If the current login activity occurs during the account's active period, a remote login request verification is sent to the server address where the active account is located, and the login request verification result is obtained. If the login request verification result is allowed, then the login method is judged. If the login method is account recovery login, then the current login behavior of the account is judged to be abnormal. If the login method this time is not account recovery login, then the current login behavior of the account is considered normal; If the current login behavior is not during the account's active period, obtain the server address of the current login behavior and the server address of the current login status, and determine the location distance between the two based on their server addresses. Match activity level with location distance to determine whether a user can move to a corresponding location distance while maintaining their current account activity level; If the activity level and location distance do not match, the current login behavior is considered abnormal. If the activity level matches the location distance, the current login behavior is considered normal.
[0012] Preferably, the first outlier and the second outlier are added together to obtain a sum, and the sum is compared with a built-in outlier threshold. If the sum of the data exceeds the abnormal threshold, the current login behavior is determined to be abnormal; if the sum of the data is below the abnormal threshold, the current login behavior is determined to be normal.
[0013] In summary, this application includes at least one of the following beneficial technical effects: 1. By initially judging the login method in the login behavior, the security of the account login behavior is initially determined. When the login method is determined to be account recovery login, the historical login records of the account are queried by using the login method to determine the time interval of the account owner's account recovery login in the past. The time interval of the historical state (frequency data) is compared with the time interval of the current state (time difference data), thereby determining the abnormal situation of this login from the time level (first anomaly). Then, by monitoring the resource data of the already logged-in account and judging the rationality of the login user's resource scheduling behavior, the abnormal situation of this login is determined from the behavior level (second anomaly). Combining the first anomaly and the second anomaly makes the judgment of the anomaly of this login behavior more accurate, thereby improving the accuracy of computer abnormal behavior identification. 2. By calculating the time difference between adjacent historical login records and the current login behavior, as well as the distance between the server addresses at the time of the two logins, the required movement speed of the user from the time of logging off in the historical login record to the server address where the current login behavior is located is determined. Then, by judging the movement speed, the feasibility of the alternative login between the two logins is determined. If the alternative login is not feasible, multiple verification methods are used to perform multiple verifications on the current login behavior to determine the security of the current login behavior, thereby improving the accuracy of abnormal login identification. 3. By monitoring the resource allocation requests of logged-in users and using these requests as behavioral judgment signals, all request signaling from successful account login to the request period is read to clarify the user's actions after successful login. Once a resource allocation request is confirmed, all historical operation data in the data center is read under the same conditions to filter out the second operation behavior of other users with the same conditions. Machine learning is then used to determine the general behavioral logic of users after login, and this logic is used to evaluate the first operation behavior, determining the deviation between the first operation behavior and the general behavioral logic. This deviation is then used to determine the rationality of the user's actions after account login, enabling the identification of abnormal login behavior based on the user's actions, thereby improving the accuracy of abnormal login behavior identification. Attached Figure Description
[0014] Figure 1 This is a flowchart of the steps in the management method for identifying abnormal computer behavior in this embodiment. Detailed Implementation
[0015] The following is in conjunction with the appendix Figure 1 This application will be described in further detail.
[0016] This application discloses a management method for identifying abnormal computer behavior.
[0017] Example: Figure 1 As shown, the present invention provides a management method for identifying abnormal computer behavior, comprising: S1, Obtain login information for the user's current login behavior; the login information includes account information, login method, and login time; S2, Match the database with the account information in the login information to obtain the historical login dataset with login status information for the account, and judge the login status of the latest login data in the historical login dataset; S3. If the login status of the account is offline, then the login method in the login information is judged to determine whether the current login behavior is an account recovery login. S4. If the login method is not account recovery login, the current login behavior will be verified according to the regular verification process, and the current login behavior will be determined as abnormal based on the verification result. Among them, non-account recovery login refers to login methods such as password login and verification code login.
[0018] S5. If the current login method is account recovery login, then match the current login method with the historical login dataset to determine the frequency data of the corresponding login method in the historical login records; where account recovery login refers to login methods such as password recovery for forgotten passwords.
[0019] S6. Based on the historical login dataset and the login time of this login, determine the time difference data between the most recent login behavior and the current login behavior, compare the time difference data with the frequency data, determine the deviation value between the time difference data and the frequency data, and use the deviation value as the first outlier of this login. S7. Based on account information, determine the account nature. If the account nature is resource-damaging, monitor resource data for logged-in accounts to determine the rationality of resource scheduling, and use the determined rationality data as the second abnormal value of the current login behavior. Resource-damaging refers to account types where, after successful login, assets, data, or other resources within the account can be transferred or damaged by others. Examples include mobile banking accounts allowing fund transfers, database administrator accounts allowing database content modification, and data leaks. Accounts without fund storage functions, such as game accounts, can be classified as non-resource-damaging.
[0020] S8. Based on the first and second outliers, determine the security of the current login behavior. If the current login behavior is determined to be insecure, then the current login behavior is deemed abnormal. In determining the security of the current login behavior based on the first and second outliers, the security status can be determined directly by adding the first and second outliers together and then comparing the sum with a built-in outlier threshold.
[0021] In this embodiment, when a user logs in to an account, information about the current login behavior is collected to identify the account information and login method. The known account information is then used to determine the login status of the corresponding account in the database, thus performing a first verification of the login behavior's credibility. If the account's login status in the database is determined to be offline, the login method is assessed for a second verification of the login behavior's credibility. If the login method is not account recovery-based, further security verification can be performed according to the standard verification process to ensure account login security. If the login method is account recovery-based, the historical login dataset is used to verify the current login method. Matching is used to determine the time interval (frequency data) required for the current login method to appear in historical login records. By comparing the login time of the current login with the login time of the most recent login behavior in the historical login dataset, the time difference between the current login and the most recent login is determined. This time difference data is then matched with frequency data to identify any time-related anomalies in the current login method. Furthermore, by monitoring the resource data of the account information, the rationality of the user's resource allocation behavior in the account after login is determined, thereby judging the user's operational behavior. By combining the login method in the login behavior and making a comprehensive judgment from both the time and user behavior perspectives, the judgment of anomalies in the current login behavior becomes more accurate.
[0022] The security of an account login is initially determined by first judging the login method. When the login method is determined to be an account recovery login, the historical login records of the account are queried to determine the time intervals at which the account owner made account recovery logins in the past. The time intervals in the historical state (frequency data) are compared with the time intervals in the current state (time difference data) to determine the abnormal situation of this login from the time level (first anomaly). Then, by monitoring the resource data of already logged-in accounts and judging the rationality of the login user's resource scheduling behavior, the abnormal situation of this login is determined from the behavior level (second anomaly). Combining the first and second anomalies makes the judgment of the anomaly of this login behavior more accurate and improves the accuracy of computer abnormal behavior identification.
[0023] For example, when assessing the login risk of an account, the information of the account that needs to log in is first recorded, so that accounts with login risk can be identified based on the account information. After the user's login behavior is recorded, the login information is obtained. There are multiple ways to log in to an account, but they can be broadly divided into two types: password login (including account + password, account + verification code, and linked account verification) and account recovery login (commonly known as forgetting password). During the process of determining the security of the current login behavior of an account, the user fills in basic login information (account information) through the login window. After receiving the account information, the database performs database matching to determine the current login status of the account information in the database.
[0024] If the account is already online, logging in again may pose a risk; if the account is offline, it may indicate that the account owner has logged in again.
[0025] When an account is determined to be offline, if it is determined whether there is any abnormality in this login behavior, the login method is first judged. If the login method is password login, it indicates that the login user has a high level of knowledge about the account. At the same time, since the security level of password login is higher than that of account recovery login, when the login user chooses password login, the current login behavior can be verified by conventional verification methods. If the login method is account recovery login, it indicates that the user has a low level of understanding of the account information, and the login method of the user is more likely to be abnormal. Therefore, when using account recovery login, the current login method is matched with the historical login dataset to determine the time interval between each time the account needs to use account recovery login in the past. For example, if account A uses a password to log in at time T, and uses account recovery login again at time T+1 a year later, it can be determined that the user forgets the password for this account at a rate of 1 year. Therefore, if the time interval between the current login time and the previous login time is more than 1 year, it can be determined that the use of account recovery login is reasonable. Conversely, if the time interval between the current login time and the previous login time is less than 1 year, and the larger the time difference, the greater the possibility of abnormality in the current login behavior. Then, the first abnormal value of the current login is determined based on the deviation value between the two.
[0026] After a user successfully logs into the account using the account recovery login method, the system determines whether the account is a resource-damaged account by assessing its nature. If a resource-damaged account is hacked, the hacker will most likely prioritize transferring the account's assets and resources after logging in, thus achieving the goal of stealing the account.
[0027] Therefore, resource data monitoring is conducted for this type of account behavior. If the account transfers resources immediately after being recovered, it can be determined that the account is at risk, thus obtaining a second anomaly value under this operation. Finally, the first and second anomalies are combined to determine the abnormal situation of this login behavior.
[0028] By using the first outlier to determine the abnormal situation of the login method, and by using the second outlier to determine the abnormal situation of the operation behavior after successful login, the two are combined to make a comprehensive judgment on the abnormal situation of the current login behavior.
[0029] In step S4, if the login method is not account recovery login, the current login behavior is verified according to the regular verification process, and the abnormality of the current login behavior is determined based on the security verification result, including the following steps: S41, Determine the time interval between the current login behavior and the most recent login behavior based on the historical login dataset to obtain time difference data; S42, obtain the server address of the most recent login behavior and the server address of the current login behavior in the historical login dataset, and determine the distance data between the two; S43, based on time difference data and distance data, determines the user's movement rate, compares the movement rate with the built-in speed threshold, and determines the feasibility of the account owner logging in from another side; S44. If the movement speed exceeds the speed threshold, it is determined that the account owner's unauthorized login is not feasible; if the movement speed is below the speed threshold, it is determined that the account owner's unauthorized login is feasible. S45. If it is determined that unauthorized login is not feasible, then the built-in verification process is matched according to the current login method to perform security verification on the current login behavior and determine the security of the current login behavior; wherein, the verification process can be password verification, historical question verification, verification code verification, email verification, etc.
[0030] S46. If the verification process is completed, the current login behavior is determined to be normal; otherwise, if the verification process is not completed, the current login behavior is determined to be abnormal.
[0031] In this embodiment, by calculating the time difference between adjacent historical login records and the current login behavior, as well as the distance between the server addresses at the time of the two logins, the required movement speed of the user from the time of logging off in the historical login record to the server address where the current login behavior is located is determined. Then, by judging the movement speed, the feasibility of the alternative login between the two logins is determined. If the alternative login is not feasible, multiple verification methods are used to perform multiple verifications on the current login behavior to determine the security of the current login behavior, thereby improving the accuracy of abnormal login identification.
[0032] For example, when the current login is performed using a password, the distance data is obtained by calculating the distance between the server address of the current login and the server address of the most recent login. Then, the time data of the end of the most recent login is read from the historical login dataset, and the difference between the current login time and this time data is calculated to determine the time span data between the current login and the most recent login. Assuming that the most recent login was on device A and the current login is on device B, and assuming that the user immediately switches to device B after logging off on device A, the movement rate of the user when immediately switching to device B after logging off on device A is determined based on the time span data and the distance data. Then, the movement rate is judged to determine whether the movement rate meets the user's normal movement speed. For example, if the calculated movement speed is 1500 km / h (exceeding the 800 km / h speed of an airplane), which is beyond the speed of conventional transportation, then the probability of the account owner logging off from device A and logging in from device B is determined to be 0, meaning unauthorized login is not feasible. Conversely, if the calculated movement speed is 360 km / h (below the 800 km / h speed of an airplane), which is consistent with the speed of conventional transportation, then the possibility of the account owner logging off from device A and logging in from device B is determined to be feasible. For example, traveling by plane and then transferring to reach the destination.
[0033] When unauthorized login is deemed infeasible, more stringent security verification is required to determine if the login behavior is known to the user. For example, borrowing a user account by renting it to someone else can achieve an infeasible unauthorized login. If the unauthorized login passes the more stringent security verification, the current login behavior is considered normal; otherwise, it is considered abnormal, and login is denied for abnormal behavior. More stringent security verification could include additional verification codes or email addresses after password verification.
[0034] In step S5, if the current login method is account recovery login, then the current login method is matched with the historical login dataset to determine the frequency data of the corresponding login method in the historical login records, including the following steps: S51, match the current login method with the historical login dataset, identify the historical login records under the same login method, and record them as the first login record and its first time point; S52, Match adjacent login records in the historical login dataset based on the first time point to obtain the second time point of the second login record located before the first time point; S53, calculate the time difference between the first time point and the second time point to determine the time interval, and calculate the average of the time intervals corresponding to the first login record to determine the frequency data under this login method.
[0035] For example, when the current login behavior is an account recovery login (e.g., password recovery for a forgotten password), when matching the current login method with the historical login dataset, the system first determines the historical login records unique to the account based on the account information, and then determines the login records with the same login method and their time points (i.e., the first login record and the first time point) based on the login method. Since password verification is only required at the moment of login and not during subsequent use, when determining the frequency in the historical login dataset, the system calculates the time difference between the first time point of the first login record and the login records that are adjacent to the first login record, thereby determining the time interval required for each account recovery login.
[0036] For example, there is a login t0 at time T and a login t1 at time T+1. Assuming login t1 was a password recovery login, the difference between time T+1 of login t1 and time T of login t0 is calculated, resulting in a difference of "1". This difference "1" represents the time interval between each password recovery login attempt. Assuming the unit of this difference "1" is years, it indicates that the user forgets their password about once a year. By averaging the differences from each login attempt in the historical login dataset, the average password forgetting rate (frequency data) for the user is determined. Therefore, when the actual login interval is lower than the average forgetting rate, it indicates an anomaly in the current login behavior. For example, if a user logged in yesterday and forgot their password today and attempted password recovery, this login behavior is highly likely to be an anomaly, thus improving the accuracy of anomaly login identification.
[0037] In step S7, the account nature is determined based on the account information. If the account nature is resource-damaging, resource data monitoring is performed on the logged-in account to determine the rationality of resource scheduling. The rationality data obtained is used as the second outlier of the current login behavior, including the following steps: S71, when an account sends a resource allocation request to the data center, the request signaling output by the account from the time of successful login to the time of the resource allocation request is read to determine the account's operation behavior after login, which is recorded as the first operation behavior; S72, based on the current login method, read the data center and determine the operation behavior after adopting the same login method in the data center, which is recorded as the second operation behavior; S73, perform machine learning on the second operation to determine the user's behavioral logic after logging into the account using this login method; S74. Compare the first operation behavior with the behavior logic to determine the rationality of the operation behavior of the account after login, obtain rationality data, and use the rationality data as the second abnormal value of this login.
[0038] In this embodiment, by monitoring the resource allocation requests of the logged-in user and using these requests as behavioral judgment signals, all request signaling from the successful account login to the resource allocation request is read to clarify the user's operational behavior after successful login. After confirming that the account has a resource allocation request, all historical operation data in the data center are read under the same conditions to filter out the second operational behavior of other users with the same conditions. Then, machine learning is used to determine the general behavioral logic of the user after login, and this is used as a standard to evaluate the first operational behavior, thereby determining the deviation between the first operational behavior and the general behavioral logic. This deviation is then used to determine the rationality of the user's operational behavior after account login, enabling the judgment of abnormal login behavior based on the user's operational behavior, thereby further improving the accuracy of abnormal login behavior judgment.
[0039] For example, suppose the account is a stock account containing stock assets. A hacker can buy and sell these stock assets, causing changes in the account's assets and potentially resulting in asset losses. Therefore, to ensure the security of the assets in the account, it is necessary to monitor the account's resource data and ensure that every change to the account's resource data is legitimate.
[0040] When a stock account is re-logged in via account recovery, the system reads and judges each operation request of the user. When it is determined that the account has sent a resource allocation request to the data center, the system reads all request signaling from the time the user successfully logs in until the resource allocation request is sent, thereby obtaining the user's operation behavior after logging in (first operation behavior).
[0041] The first operational behavior is logically judged to determine its rationality. By statistically analyzing and learning from the operational behaviors of other users who log in using the same login method with the same account type, the short-term operational behavior of a user re-logging into a stock account under normal circumstances is determined. Using user operational behavior based on big data as a standard, accounts requiring security verification are judged. The behavioral logic summarized from these judgments is learned using a probabilistic graphical model, and then used as a standard to judge the first operational behavior. This determines whether the first operational behavior conforms to the normal behavioral logic of a user re-logging in through account recovery. Based on deviations, the rationality data of the first operational behavior is determined, improving the accuracy of abnormal behavior identification when judging abnormal account logins based on the user's operational behavior after logging in.
[0042] A management method for identifying abnormal computer behavior further includes the following steps: If the account's nature is non-resource-damaging, then the account's permission requests will be monitored. When the account sends a permission change request to the service center, the permission change request is matched with the login method to determine whether the permissions of the current login method meet the permission change request. If it is determined that the permissions of this login method do not meet the permission change request, the built-in verification database is matched with the permission change request and this login method to determine the verification process required when the corresponding permissions change. The system performs security authentication on users based on the verification process. If the authentication is successful, a permission change request is executed. If the authentication fails, the first abnormal value is compared with the built-in abnormal threshold. If the first abnormal value is higher than the abnormal threshold, the current login behavior is determined to be abnormal.
[0043] In this embodiment, when the account is determined to be non-resource-damaging, the system monitors the account's permission change requests and compares the detected requests with the permission scope of the corresponding login method. This restricts the user's permission change capabilities to the security level of the corresponding login method, ensuring that every permission change made by the user is a secure one. Furthermore, when the current login method's permission scope cannot satisfy the user's permission change request, the request is compared with the built-in verification database, thus ensuring both the normal execution of permissions and the security of permission execution.
[0044] For example, suppose the account is an unchangeable game account that does not have a recharge option. In this case, the account is classified as non-resource-damage type. This means that a hacker can only take possession of the game resources by changing the password, but cannot delete or modify them. In other words, they can only add game resources to the account, not delete them. In this situation, by monitoring the account's permission requests, it can be determined whether the user performs actions such as changing the password after successfully logging in, thereby altering the account's ownership.
[0045] By reading and analyzing each user's actions, it is determined whether there is a corresponding permission change request. When a permission change request is detected, it is compared with the corresponding login method (account recovery login) to determine whether the login method can satisfy the user's permission change request, thereby restricting the user's behavior within a controllable range. When the permissions requested by the user exceed the current login method, the verification database is matched based on the permission change request and the current login method (account recovery login) to determine the verification process required to grant the user the necessary permissions under this login method.
[0046] For example, account recovery login only has permissions a and b. If the user wants to change permission c, since the permissions corresponding to account recovery login do not include permission c, permission c needs to be matched against the verification database. Assuming that permission c in the verification database requires CAPTCHA verification in addition to account recovery login, CAPTCHA verification is included as a necessary verification process. If the user cannot accurately enter the CAPTCHA, the permission change request is considered abnormal; otherwise, it is considered correct. When verification is successful, only the first abnormal value corresponding to the account recovery login method needs to be checked to verify whether the current login method is abnormal. For example, if the account owner performed password and CAPTCHA verification yesterday, but today requires account recovery to complete the account login, it indicates a very high probability that today's account login behavior is abnormal. Therefore, this login behavior can be determined as abnormal, improving the accuracy of abnormal login behavior identification.
[0047] A management method for identifying abnormal computer behavior further includes the following steps: If the account is currently logged in as online, the frequency of operations performed during the period of being online will be determined, and this frequency will be used as the account's activity level during the current login state. Compare the current login behavior with the activity level to determine whether the account was active when the current login behavior was performed. If the current login action is in an active account state, a remote login request verification is sent to the server address where the active account is located, and the login request verification result is obtained; If the login request verification result is allowed, then the login method is judged. If the login method is account recovery login, then the current login behavior of the account is judged to be abnormal. If the login method is not account recovery login, then the current login behavior of the account is considered normal.
[0048] If the current login behavior is not in an active account state, obtain the server address of the current login behavior and the server address of the current login state, and determine the location distance between the two based on the server addresses of the two. Match activity level with location distance to determine whether a user can move to a corresponding location distance while maintaining their current account activity level; If the activity level and location distance do not match, the current login behavior is considered abnormal. If the activity level matches the location distance, the current login behavior is considered normal.
[0049] In this embodiment, when an account attempts to log in from a different location while online, the current login behavior is compared with the account's activity level to determine whether the account owner can respond to the login request in a timely manner. Different verification methods are applied based on the response time. If the login request verification result allows login, the login method is re-evaluated to determine the inconsistency between the current login method and the login request verification result. If there is an inconsistency, the account's current login behavior is deemed abnormal; otherwise, it is deemed normal. This makes the identification of abnormal login behavior more accurate. Furthermore, when the account owner cannot respond to the login request in a timely manner, the location distance between the two servers is assessed using the activity level of the already logged-in client to determine the reasonableness of the relationship between activity level and location distance. If changes in activity level and location distance cannot be simultaneously satisfied, the current login behavior is deemed abnormal, making the judgment of location distance based on activity level more accurate and improving the accuracy of identifying abnormal login behavior.
[0050] For example, when an account is currently logged in as online, assuming the current login behavior is an unauthorized login by a hacker, the abnormality of the unauthorized login behavior can be determined by notifying the account owner when the hacker logs in from a different location.
[0051] When verifying login from a different location to an already logged-in client, it is necessary to first confirm the user activity level of the already logged-in client to determine the verification efficiency when making a login request verification from a different location to an already logged-in client.
[0052] By judging the frequency of user actions while the account is online, the user's activity level can be determined. The more frequently a user operates within a unit of time, the higher their activity level. This also indicates that when a login request is made from a different location, the account owner will detect and respond more promptly.
[0053] By comparing the login time of the current login behavior with the account's activity status, assuming the current login behavior is within the account's active state, a remote login request is sent to the already logged-in client to obtain the account owner's verification result. If the login request verification result is "allowed," it indicates that the account owner is aware of someone else logging in from a different location and approves of their login behavior. This suggests that the person logging in from a different location knows the account owner. Therefore, the login method is further examined to verify the current login behavior. If the current login behavior is a password login, the current login behavior can be determined to be normal. However, if the current login behavior is an account recovery login, it indicates that the login user does not know the account password. Given that the login user knows the account owner, not knowing the password when logging in is logically abnormal, and therefore the current login behavior can be determined to be abnormal.
[0054] If the current login activity is not within the account's active state, it indicates that there may be a problem with timely response when verifying a remote login request from an already logged-in client. Therefore, by matching the account's activity level with the geographical distance between the two servers, it is determined whether the user can move to the appropriate location while meeting the account's activity requirements. Assume the most recent login record is on year a month a day at time a, login client A, and its active period ends on year a month a+10 day at time a, with no further activity. The current login activity is a remote login from login client B on year a month a+11 day at time a. Calculate the geographical distance L between login clients A and B, and calculate the time interval (1 day) between the current login activity and the active period. Then, it is necessary to determine whether the user can travel from login client A to login client B within 1 day. If they can (successful match), the current login activity is considered normal; otherwise, it is considered abnormal.
[0055] Compared with existing management methods for identifying abnormal computer behavior, this invention improves the accuracy of identifying abnormal account login behavior.
[0056] The above are all preferred embodiments of this application, and are not intended to limit the scope of protection of this application. Therefore, all equivalent changes made in accordance with the structure, shape and principle of this application should be covered within the scope of protection of this application.
Claims
1. A management method of computer abnormal behavior recognition, characterized by, The method comprises the following steps: obtaining login information of current login behavior of a user; the login information comprises account information, login mode and login time; matching a database according to the account information in the login information to obtain a historical login data set of the account with login state information, and judging the login state of the latest login data in the historical login data set; if the login state of the account is an offline state, judging the login mode in the login information to determine whether the login mode of the current login behavior is an account recovery type login; if the current login mode is a non-account recovery type login, performing security verification on the current login behavior according to a regular verification process, and determining whether the current login behavior is abnormal according to the security verification result; if the current login mode is an account recovery type login, matching the current login mode with the historical login data set to determine frequency data of the corresponding login mode in the historical login record; determining time difference data between the latest login behavior and the current login behavior according to the historical login data set and the login time of the current login, comparing the time difference data with the frequency data, determining a deviation value between the time difference data and the frequency data, and taking the deviation value as a first abnormal value of the current login; determining the nature of the account based on the account information, if the nature of the account is a resource damage type, performing resource data monitoring on the logged-in account to determine the rationality of resource scheduling, and taking the determined rationality data as a second abnormal value of the current login behavior; determining the security of the current login behavior according to the first abnormal value and the second abnormal value, if it is determined that the current login behavior is not safe, it is determined that the current login behavior is abnormal.
2. The management method of computer abnormal behavior recognition according to claim 1, characterized in that: if the current login mode is a non-account recovery type login, performing security verification on the current login behavior according to a regular verification process, and determining whether the current login behavior is abnormal according to the security verification result, comprising: determining the time interval between the current login behavior and the latest login behavior according to the historical login data set to obtain time data; obtaining the server address of the latest login behavior in the historical login data set and the server address of the current login behavior to determine the distance data between the two; determining the moving speed of the user based on the time data and the distance data, comparing the moving speed with the built-in speed threshold to determine the feasibility of the account owner's abnormal login; if the moving speed exceeds the speed threshold, it is determined that the account owner's abnormal login is not feasible; if the moving speed is lower than the speed threshold, it is determined that the account owner's abnormal login is feasible; if it is determined that the abnormal login is not feasible, matching the built-in verification process according to the current login mode to perform security verification on the current login behavior to determine the security of the current login behavior; if the verification process is completed, it is determined that the current login behavior is normal; otherwise, if the verification process is not completed, it is determined that the current login behavior is abnormal.
3. The method of claim 1, wherein: if the current login mode is an account recovery type login, matching the current login mode with the historical login data set to determine frequency data of the corresponding login mode in the historical login record, comprising: Match the login method this time with the historical login data set, determine the historical login record under the same login method, and record it as the first login record and its first time point; According to the first time point, match the adjacent login records of the historical login data set to obtain the second time point of the second login record before the first time point; Calculate the time difference between the first time point and the second time point to determine the time interval, and calculate the mean value of the time interval corresponding to the first login record to determine the frequency data under the login method this time.
4. The management method of computer abnormal behavior recognition according to claim 1, characterized in that: Determine the nature of the account based on the account information. If the nature of the account is resource damage type, monitor the resource data of the logged-in account to determine the rationality of resource scheduling, and take the rationality data obtained by judgment as the second abnormal value of the current login behavior, including: When the account sends a resource mobilization request to the data center, read the request signaling output by the account from the login success to the resource mobilization request process to determine the operation behavior of the account after login, which is recorded as the first operation behavior; Read the data center based on the login method this time to determine the operation behavior after taking the same login method in the data center, which is recorded as the second operation behavior; Machine learning on the second operation behavior to determine the behavior logic of the user after logging in the account with the login method this time; Input the first operation behavior and behavior logic into the probabilistic graph model to determine the rationality of the operation behavior of the account after login, obtain the rationality data, and take the rationality data as the second abnormal value of the current login.
5. The management method of computer abnormal behavior recognition according to claim 1, characterized in that, Also includes: If the nature of the account is non-resource damage type, monitor the permission request of the account; When the account sends a permission change request to the service center, match the permission change request with the login method to determine whether the permission of the login method this time meets the permission change request; If it is determined that the permission of the login method this time does not meet the permission change request, match the built-in verification database according to the permission change request and the login method this time to determine the verification process required when the corresponding permission changes; Based on the verification process, the user is authenticated, and if the authentication is successful, the permission change request is executed; If the authentication fails, compare the first abnormal value with the built-in abnormal threshold value. If the first abnormal value is higher than the abnormal threshold value, it is determined that the current login behavior is abnormal.
6. The management method of computer abnormal behavior recognition according to claim 1, wherein, Also includes: If the current login state of the account is online state, judge the operation frequency of the operation behavior during the current online state, and take the operation frequency as the activity of the account during the current login state; Compare the current login behavior with the activity to determine whether the account is in active state when logging in; If the current login behavior is in the active period of the account, send a remote login request verification to the server address where the account is in active state to obtain a login request verification result; If the login request verification result is to allow login, judge the login method this time. If the login method this time is account recovery type login, it is determined that the current login behavior of the account is abnormal. If the current login mode is a non-account recovery login, it is determined that the current login behavior of the account is normal; If the current login behavior is not in the active period of the account, the server address of the current login behavior and the server address of the current login state are obtained, and the location distance between the two is determined according to the server addresses of the two; The activity and the location distance are matched to determine whether the user can move the corresponding location distance while maintaining the current activity of the account; If it is determined that the activity and the location distance do not match, it is determined that the current login behavior is abnormal; If it is determined that the activity and the location distance match, it is determined that the current login behavior is normal.
7. The management method of computer abnormal behavior recognition according to claim 6, characterized in that, According to the first abnormal value and the second abnormal value, the security of the current login behavior is determined, if it is determined that the current login behavior is not safe, it is determined that the current login behavior is abnormal, including: adding the first abnormal value and the second abnormal value to obtain the sum value data, and comparing the sum value data with the built-in abnormal threshold value; If the sum value data exceeds the abnormal threshold value, it is determined that the current login behavior is abnormal, and if the sum value data is lower than the abnormal threshold value, it is determined that the current login behavior is normal.