Account security checking method based on ssh protocol

Abstract

This invention relates to the field of security management technology, specifically disclosing an account security check method based on the SSH protocol. The method includes performing an individual security check on each user. The individual security check process includes account analysis and anomaly analysis. The account analysis classifies user accounts into dangerous, abnormal, and safe accounts based on the number of abnormal IP address jumps. The anomaly analysis involves analyzing login parameters to obtain habit coefficients and using these coefficients to make habit judgments on abnormal accounts. The individual security check results are then combined with these habit judgments to obtain the final result. This invention combines a general security baseline check with dynamic individual risk assessment based on behavioral profiles, utilizes habit coefficients to achieve fine-grained anomaly detection, and introduces upper-level account correlation analysis. This effectively compensates for the shortcomings of traditional static strategies in identifying latent internal threats and lateral movement behaviors, significantly improving adaptive security protection capabilities in SSH login scenarios.

Description

Technical Field

[0001] This invention relates to the field of security management technology, and more specifically, to a method for account security checks based on the SSH protocol. Background Technology

[0002] With the continuous improvement of enterprise informatization, Linux servers are widely deployed in critical infrastructure sectors such as government, finance, and power. Account security is one of the core elements of Linux system security, encompassing multiple dimensions such as password policies, account locking, access control, and login auditing. Existing account security management technologies typically lock accounts based on abnormal IP changes or operational habits to protect account security. While this approach can effectively protect account security to a certain extent, it suffers from several drawbacks, including a lack of comparative analysis of historical baseline data, inability to detect dynamic changes in account permissions, over-protection that fails to meet some temporary needs, the requirement for local installation of automated auditing tools for specific distributions, making remote auditing impossible, and low efficiency in executing multiple checks sequentially, failing to meet the needs of rapid large-scale asset audits.

[0003] In view of this, the present invention proposes an account security check method based on the SSH protocol, which realizes remote automated account security checks based on Linux servers through remote monitoring, thereby improving account usage efficiency. Summary of the Invention

[0004] The purpose of this invention is to provide an account security check method based on the SSH protocol, and to solve the following technical problems: How can we achieve automated remote account security checks based on Linux servers through remote monitoring methods to improve account usage efficiency?

[0005] The objective of this invention can be achieved through the following technical solutions: The account security check method based on the SSH protocol includes the following steps: The control center receives login parameters from the device requesting the user's login account. The login parameters include username, password, host information, keystroke logging, IP address, port, and historical user list. The control center establishes an SSH connection with the login machine via the SSH protocol. Start the login log collection thread and execute each security check item in sequence. The security check items include password policy, account policy, security log, system configuration and permission settings. Each user undergoes an individual security check, which includes account analysis and anomaly analysis. The account analysis classifies user accounts into dangerous accounts, abnormal accounts, and safe accounts based on the number of abnormal IP jumps. The anomaly analysis is based on data analysis of login parameters to obtain a habit coefficient, and the abnormal accounts are judged according to the habit coefficient. The habit judgment results include those that conform to habits and those that do not conform to habits. Collect task information of abnormal accounts and their superior accounts, and combine it with habit judgment results to obtain individual security check results.

[0006] Based on the above technical solution, a multi-layered secure login management mechanism based on the SSH protocol is proposed. The control center first collects complete parameters of the user's login device (including username, password, host information, keystrokes, IP address, port, and historical user list). After establishing an SSH connection, it starts a log collection thread and sequentially performs general security checks such as password policy, account policy, security logs, system configuration, and permission settings. On this basis, an individual security check is performed on each user. Accounts are classified into three categories—dangerous, abnormal, and secure—based on the number of abnormal IP address jumps. A habit coefficient is calculated based on login parameters to determine the habit compliance of abnormal accounts. Finally, the individual security check results are output by combining the task information of the abnormal account and its parent account. The advantages of this solution are: combining general security baseline checks with dynamic individual risk assessment based on behavioral profiles, utilizing habit coefficients to achieve fine-grained anomaly detection, and introducing parent account correlation analysis. This effectively compensates for the shortcomings of traditional static strategies in identifying internal latent threats and lateral movement behaviors, significantly improving the adaptive security protection capability in SSH login scenarios.

[0007] As a further technical solution of the present invention: the process of classifying dangerous accounts, abnormal accounts, and safe accounts based on the number of abnormal IP hops includes: User accounts whose IP address jumps more than the safe limit are marked as dangerous accounts. User accounts with zero abnormal IP address jumps are marked as secure accounts; Accounts with an IP address that has an abnormal number of jumps between zero and a safe value are marked as abnormal accounts.

[0008] As a further technical solution of the present invention: the security check items include: Password policies include: password complexity check, minimum password length check, minimum password expiration time check, password history check, and password validity period policy check. Account policies: Account lockout threshold check, Guest account status check, Root account default name check, empty password account check, account login IP stability check, unused account check; Permission settings: Sudo permission allocation check, regular user su command usage restriction check, weak privilege configuration account check; System configuration: SSH key authentication check, root remote SSH login restriction check; Security logs: User activity audit log checks, login log anomaly analysis.

[0009] As a further technical solution of the present invention: the process of obtaining the habit coefficient based on login parameters through data analysis includes: The keyboard should be divided into sections, with each section including at least the primary key area and the numeric keypad. The hardware scan codes in the keystroke logs of the login parameters are collected and matched with each key on the login machine's keyboard; Data analysis is performed based on the time interval between adjacent input characters when abnormal accounts output passwords to obtain a habit coefficient.

[0010] As a further technical solution of the present invention: the process of data analysis based on the time interval between adjacent input characters when an abnormal account outputs a password includes: Record the key positions of adjacent input characters and calculate the first step length, the second step length, and the third step length. The first step length is the sum of key distances with the fewest steps when the key positions of adjacent input characters are all within the main keyboard area. The second step length is the sum of key distances with the fewest steps when the key positions of adjacent input characters are all within the numeric area. The third step length is a fixed value used to indicate that the key positions of adjacent input characters are in the main keyboard area and the numeric area, respectively. Cluster analysis is performed on the time taken for different values ​​of the first step length and the second step length based on the current user's historical data to obtain the standard duration of the first step length and the second step length; Data analysis was conducted by comparing the actual time taken for users with abnormal account status to enter their passwords with the standard duration.

[0011] As a further technical solution of the present invention, the data analysis process also includes: The difference between the actual time it takes for a user to press adjacent characters when entering a password under abnormal account status and the standard duration of the same partition and synchronization length is used as the first sequence value, and an analysis sequence is constructed. The analysis sequence is sorted and partition values ​​are selected to divide the sorted analysis sequence into two parts, left and right. Then, the second sequence value is obtained based on the difference between the first sequence value and the partition value of the two parts, and the habit coefficient is obtained based on the second sequence value.

[0012] As a further technical solution of the present invention: the process of obtaining the habit coefficient includes: For a single login attempt by an abnormal user, the formula is used: ; Obtain the corresponding habit coefficient ,in It is the number of values ​​in the first sequence on the left, where i is not greater than... nonzero natural numbers, The number of values ​​in the first sequence on the right, j is not greater than nonzero natural numbers, It is a piecewise function that outputs 0 or -1, and It is the i-th value of the first sequence on the left. If the value is less than the preset first judgment value, the output is -1; otherwise, the output is 0. It is a piecewise function that outputs 0 or -1. It is the j-th value of the first sequence on the right. If the value is greater than the preset second judgment value, the output is -1; otherwise, the output is 0. It is the mean of the second sequence values ​​on the left. It is the mean of the second sequence values ​​on the right. and These are the preset first adjustment coefficient and the second adjustment coefficient, respectively.

[0013] It should be noted that both the first and second judgment values ​​are preset values ​​used to filter the data, remove and replace obviously abnormal data. The specific values ​​are set according to the actual debugging process and are not subject to specific restrictions.

[0014] The above technical solution provides a process for obtaining the habit coefficient. The habit coefficient of this invention is obtained by analyzing the first sequence. By setting the partition value, the first sequence is divided into a left part and a right part. The values ​​of the left and right parts are positive and negative, which will cancel each other out to a certain extent, thereby screening out people who intentionally maintain the typing time and excluding them from the security check results, thus achieving better security management.

[0015] As a further technical solution of the present invention: the process of judging the habit of abnormal accounts based on the habit coefficient includes: The judgment interval (a, b) is set based on the range of the habit coefficient. If the habit coefficient is greater than b, the habit judgment result is output as not conforming to habit. If the habit coefficient falls within the judgment interval (a, b), then the habit judgment is output as conforming to habit. If the habit coefficient is less than a, a second judgment is required.

[0016] As a further technical solution of the present invention: the secondary judgment process includes: Get the variance of the first sequence value. If the variance is less than 0.6, output "Conforms to convention"; otherwise, output "Does not conform to convention".

[0017] The above technical solution enables remote inspection based on the SSH protocol, requiring no software installation on the target host, thus being non-intrusive to the production environment. It is also cross-distribution compatible, uniformly supporting mainstream Linux distributions such as Ubuntu and CentOS. A single system covers heterogeneous environments and provides comprehensive inspection coverage, encompassing 18 security check items including password policies, account management, permission configuration, login auditing, and embedded credentials. The inspection dimensions are complete. Furthermore, this invention can execute concurrently efficiently, significantly shortening inspection time through multi-threaded parallel scanning, adapting to large-scale asset inspection scenarios. In particular, this invention can provide detailed analysis for personnel who occasionally need to travel, offering greater convenience to those with stable office work schedules who occasionally require business trips.

[0018] As a further technical solution of the present invention: the process of selecting partition values ​​includes: Obtain the number of third-step characters and the number of character types in the password input of abnormal users; Partition values ​​are obtained through formulas To retrieve the value, where C is the partition value. is the mean of the first sequence values, d is the number of third steps in the input password, and t is the number of character types in the password. It is a preset correction factor.

[0019] The beneficial effects of this invention are: (1) This invention collects complete parameters of the user's login device (including username, password, host information, keystrokes, IP, port, and historical user list) through the control center. After establishing an SSH connection, it starts a log collection thread and performs general security checks such as password policy, account policy, security log, system configuration, and permission settings in sequence. On this basis, it conducts individual security checks on each user, classifies accounts into three categories—dangerous, abnormal, and safe—based on the number of abnormal IP jumps, calculates a habit coefficient based on login parameters, and determines the habit compliance of abnormal accounts. Finally, it outputs the individual security check results by combining the task information of abnormal accounts and their superior accounts. The advantages of this scheme are: combining general security baseline checks with individual dynamic risk assessment based on behavioral profiles, using habit coefficients to achieve fine-grained anomaly detection, and introducing superior account correlation analysis, which effectively makes up for the shortcomings of traditional static strategies in identifying internal latent threats and lateral movement behaviors, and significantly improves the adaptive security protection capability in SSH login scenarios.

[0020] (2) The present invention provides a process for obtaining the habit coefficient. The habit coefficient of the present invention is obtained by analyzing the first sequence. By setting the partition value, the first sequence is divided into the left and right parts. The values ​​of the left and right parts are positive and negative, which will cancel each other out to a certain extent, thereby screening out the people who intend to maintain the typing time and excluding them from the security check results, so as to better achieve security management.

[0021] (3) This invention realizes remote inspection based on the SSH protocol without installing any software on the target host, without intruding on the production environment, and is compatible with cross-distribution, uniformly supporting mainstream Linux distributions such as Ubuntu and CentOS. One system covers heterogeneous environments and provides comprehensive inspection coverage: covering 18 security inspection items such as password policy, account management, permission configuration, login audit, and embedded credentials. The inspection dimensions are complete. In addition, this invention can be executed efficiently and concurrently, and the inspection time is significantly shortened by multi-threaded parallel scanning, which is suitable for large-scale asset inspection scenarios. In particular, this invention can perform detailed analysis on personnel who occasionally need to travel for business, providing more convenience for personnel with stable office status who occasionally need to travel for business. Attached Figure Description

[0022] The invention will now be further described with reference to the accompanying drawings.

[0023] Figure 1 This is a schematic diagram of the steps of the security inspection method of the present invention. Detailed Implementation

[0024] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0025] Please see Figure 1 As shown, in one embodiment, an account security check method based on the SSH protocol is provided, including the following steps: S100: The control center receives the login parameters of the device requested by the user to log in to the account. The login parameters include username, password, host information, keystroke logging, IP, port and historical user list. The control center establishes an SSH connection with the login machine through the SSH protocol. Specifically, in this embodiment, the SSH connection can be encapsulated by SSHWrapper to execute shell commands on the target host in an agentless manner and obtain the output results. All checks are implemented through remote command execution without the need to install any software on the target host. It should be noted that the SSH protocol is a network protocol with encryption capabilities, mainly used to achieve secure remote login and command execution in insecure networks (such as the Internet), to ensure that data is not tampered with or forged during transmission.

[0026] S200: Start the login log collection thread and execute each security check item in sequence. The security check items include password policy, account policy, security log, system configuration and permission settings. S300. Perform individual security checks on each user. The individual security check process includes account analysis and anomaly analysis. Account analysis classifies user accounts into dangerous accounts, abnormal accounts, and safe accounts based on the number of abnormal IP jumps. Anomaly analysis is based on data analysis of login parameters to obtain habit coefficients and makes habit judgments on abnormal accounts based on habit coefficients. The habit judgment results include those that conform to habits and those that do not conform to habits. S400: Collect task information of abnormal accounts and their superior accounts, and obtain individual security check results by combining the habit judgment results. For abnormal accounts that meet the habit and whose superior accounts do have out-of-town tasks and whose actual login time matches the out-of-town time recorded by the superior accounts, output the individual security check result as safe.

[0027] The above technical solution proposes a multi-layered secure login management mechanism based on the SSH protocol in this embodiment. The control center first collects complete parameters of the user's login device (including username, password, host information, keystrokes, IP address, port, and historical user list). After establishing an SSH connection, it starts a log collection thread and sequentially performs general security checks such as password policy, account policy, security logs, system configuration, and permission settings. Based on this, an individual security check is performed on each user. Accounts are classified into three categories—dangerous, abnormal, and secure—based on the number of abnormal IP address jumps. A habit coefficient is calculated based on login parameters to determine the habit compliance of abnormal accounts. Finally, the individual security check results are output by combining the task information of the abnormal account and its parent account. The advantages of this solution are: combining general security baseline checks with dynamic risk assessment based on behavioral profiles, utilizing habit coefficients to achieve fine-grained anomaly detection, and introducing parent account correlation analysis. This effectively compensates for the shortcomings of traditional static strategies in identifying internal latent threats and lateral movement behaviors, significantly improving the adaptive security protection capability in SSH login scenarios.

[0028] Safety checks include: S210. Password policy: Password complexity check, minimum password length check, minimum password expiration time check, password history check, password validity period policy check (password validity period shall not exceed 90 days). S220, Account Policy: Account lockout threshold check, Guest account status check, Root account default name check, empty password account check, account login IP stability check, unused account check; S230, Permission Settings: Sudo permission allocation check, ordinary user su command usage restriction check, weak permission configuration account check; S240, System Configuration: SSH key authentication check, Root remote SSH login restriction check; S250, Security Log: User activity audit log inspection, login log anomaly analysis (number of failed login attempts, abnormal IP address changes).

[0029] The process of classifying accounts into dangerous, abnormal, and safe accounts based on the number of abnormal IP address jumps includes: S310 User accounts whose IP address has changed abnormally more than the security value are marked as dangerous accounts. The security value ranges from 2 to 5, and is usually set to 3. S320 User accounts with zero abnormal IP hop counts are marked as secure accounts; S330 Accounts with an abnormal number of IP address jumps between zero and a safe value are marked as abnormal accounts.

[0030] The process of obtaining habit coefficients through data analysis based on login parameters includes: S340. Divide the keyboard into sections, each section including at least the main key area and the numeric keypad. The numeric keypad is the area on the right side of the keyboard containing the numbers 0-9. The main key area refers to the set of other keys that are not in the numeric keypad. S350 collects the hardware scan codes from the keystroke logs of login parameters and matches them with each key on the login machine's keyboard. It should be noted that in Linux systems, lower-level keystroke logging tools can use the evdev interface to read raw events from the kernel. These raw events contain hardware scan codes, which provide a unique "identity ID" for each physical key. S360. Obtain the habit coefficient by analyzing the time interval between adjacent input characters when outputting passwords for abnormal accounts.

[0031] S361. The process of data analysis based on the time interval between adjacent input characters when outputting passwords for abnormal accounts includes: S362. Record the key positions of adjacent input characters and calculate the first step length, the second step length, and the third step length. The first step length is the sum of key distances with the fewest steps when the key positions of adjacent input characters are all within the main keyboard area. The second step length is the sum of key distances with the fewest steps when the key positions of adjacent input characters are all within the numeric keypad area. The third step length is a fixed value used to indicate that the key positions of adjacent input characters are in the main keyboard area and the numeric keypad area respectively. It should be noted that the fewest steps refer to the fewest number of calculations. For example, between z and e, if it is zxse, it will be calculated three times, while zse only needs to be calculated twice. In this way, the step length between each key can be recorded with the same standard. It should be noted that the password contains hidden steps, such as changes in capitalization, which require the addition of letter lock steps.

[0032] S363. Based on the current user's historical data, perform cluster analysis on the time taken for different values ​​of the first step length and the second step length to obtain the standard duration of the first step length and the second step length. S364. Data analysis is performed based on the comparison between the actual time and the standard duration when a user in an abnormal account state enters their password.

[0033] The process of conducting data analysis also includes: The difference between the actual time it takes for a user to press adjacent characters when entering a password under abnormal account status and the standard duration of the same partition and synchronization length is used as the first sequence value, and an analysis sequence is constructed. The analysis sequence is sorted and partition values ​​are selected to divide the sorted analysis sequence into two parts, left and right. Then, the second sequence value is obtained based on the difference between the first sequence value and the partition value of the two parts, and the habit coefficient is obtained based on the second sequence value.

[0034] The process of obtaining the habit coefficient includes: For a single login attempt by an abnormal user, the formula is used: ; Get the habit coefficient of this login ,in It is the number of values ​​in the first sequence on the left, where i is not greater than... nonzero natural numbers, The number of values ​​in the first sequence on the right, j is not greater than nonzero natural numbers, It is a piecewise function that outputs 0 or -1, and It is the i-th value of the first sequence on the left. If the value is less than the preset first judgment value, the output is -1; otherwise, the output is 0. It is a piecewise function that outputs 0 or -1. It is the j-th value of the first sequence on the right. If the value is greater than the preset second judgment value, the output is -1; otherwise, the output is 0. It is the mean of the second sequence values ​​on the left. It is the mean of the second sequence values ​​on the right. and These are the preset first adjustment coefficient and the second adjustment coefficient, respectively, with a value range of (1,2).

[0035] It should be noted that both the first and second judgment values ​​are preset values ​​used to filter the data, remove and replace obviously abnormal data. The specific values ​​are set according to the actual debugging process and are not subject to specific restrictions.

[0036] The above technical solution provides a process for obtaining the habit coefficient in this embodiment. The habit coefficient of the present invention is obtained by analyzing the first sequence. By setting the partition value, the first sequence is divided into the left and right parts. The values ​​of the left and right parts are positive and negative, which will cancel each other out to a certain extent, thereby screening out people who intend to maintain the typing time and excluding them from the security check results, which can better achieve security management.

[0037] The process of judging the habits of abnormal accounts based on the habit coefficient includes: The judgment interval (a, b) is set based on the range of the habit coefficient. If the habit coefficient is greater than b, the habit judgment result is output as not conforming to habit. It should be noted that a and b are selected through an iterative method. The initial values ​​are arbitrary, and a and b are optimized through the iteration results. If the habit coefficient falls within the judgment interval (a, b), then the habit judgment is output as conforming to habit. If the habit coefficient is less than a, a second judgment is required.

[0038] The process of secondary judgment includes: Get the variance of the first sequence value. If the variance is less than 0.6, output "Conforms to convention"; otherwise, output "Does not conform to convention".

[0039] The above technical solution enables remote inspection based on the SSH protocol, requiring no software installation on the target host, thus being non-intrusive to the production environment. It is also cross-distribution compatible, uniformly supporting mainstream Linux distributions such as Ubuntu and CentOS. A single system covers heterogeneous environments and provides comprehensive inspection coverage, encompassing 18 security check items including password policies, account management, permission configuration, login auditing, and embedded credentials. The inspection dimensions are complete. Furthermore, this invention can execute concurrently efficiently, significantly shortening inspection time through multi-threaded parallel scanning, adapting to large-scale asset inspection scenarios. In particular, this invention can provide detailed analysis for personnel who occasionally need to travel, offering greater convenience to those with stable office work schedules who occasionally require business trips.

[0040] The process of selecting partition values ​​includes: Obtain the number of third-step characters and the number of character types in the password input of abnormal users; Partition values ​​are obtained through formulas To retrieve the value, where C is the partition value. is the mean of the first sequence values, d is the number of third steps in the input password, and t is the number of character types in the password. It is a preset correction coefficient, set based on the historical key press data of different account users. The partition value setting allows the partition to be dynamically adjusted according to the complexity of the password. The more complex the password, the more difficult it is to enter. By adjusting the redundancy of the partition, individualized security assessment can be achieved for different people and different accounts.

[0041] It should be noted that the control center serializes all inspection results into JSON format, concatenates the list of security inspection results and the list of user information using delimiters, and returns them to the caller.

[0042] The foregoing has provided a detailed description of one embodiment of the present invention, but this description is merely a preferred embodiment and should not be construed as limiting the scope of the invention. All equivalent variations and modifications made within the scope of the claims of this invention should still fall within the patent coverage of this invention.

Claims

1. A method for account security checks based on the SSH protocol, characterized in that, Includes the following steps: The control center receives login parameters from the user's login account, including username, password, host information, keystroke logging, and historical user list. It then establishes an SSH connection between the control center and the login machine via the SSH protocol. Start the login log collection thread and execute each security check item in sequence. The security check items include account policies, security logs, system configuration and permission settings. The security log check items include user activity audit log check and login log anomaly analysis. Each user undergoes an individual security check. The individual security check process includes account analysis and anomaly analysis. The account analysis classifies user accounts into dangerous accounts, abnormal accounts, and safe accounts based on the number of abnormal IP jumps. The anomaly analysis is based on data analysis of login parameters to obtain a habit coefficient and then makes a habit judgment on abnormal accounts based on the habit coefficient. The habit judgment result includes conforming to habit and not conforming to habit. Collect task information of abnormal accounts and their superior accounts, and combine it with habit judgment results to obtain individual security check results; The process of obtaining the habit coefficient includes: For a single login attempt by an abnormal user, the formula is used: Obtain the corresponding habit coefficient ,in It is the number of values ​​in the first sequence on the left, where i is not greater than... nonzero natural numbers, The number of values ​​in the first sequence on the right, j is not greater than nonzero natural numbers, It is a piecewise function that outputs 0 or -1, and It is the i-th value of the first sequence on the left. If the value is less than the preset first judgment value, the output is -1; otherwise, the output is 0. It is a piecewise function that outputs 0 or -1. It is the j-th value of the first sequence on the right. If the value is greater than the preset second judgment value, the output is -1; otherwise, the output is 0. It is the mean of the second sequence values ​​on the left. It is the mean of the second sequence values ​​on the right. and These are the preset first and second adjustment coefficients, respectively. The process of judging the habits of abnormal accounts based on the habit coefficient includes: The judgment interval (a, b) is set based on the range of the habit coefficient. If the habit coefficient is greater than b, the habit judgment result is output as not conforming to habit. If the habit coefficient falls within the judgment interval (a, b), then the habit judgment is output as conforming to habit. If the habit coefficient is less than a, a second judgment is required; The process of secondary judgment includes: Get the variance of the first sequence value. If the variance is less than 0.6, output "Conforms to convention"; otherwise, output "Does not conform to convention".

2. The account security check method based on the SSH protocol according to claim 1, characterized in that, The process of classifying accounts into dangerous, abnormal, and safe accounts based on the number of abnormal IP address jumps includes: User accounts whose IP address jumps more than the safe limit are marked as dangerous accounts. User accounts with zero abnormal IP address jumps are marked as secure accounts; Accounts with an IP address that has an abnormal number of jumps between zero and a safe value are marked as abnormal accounts.

3. The account security check method based on the SSH protocol according to claim 1, characterized in that, The security check items include: Permission settings: Sudo permission allocation check, regular user su command usage restriction check, weak privilege configuration account check; System configuration: SSH key authentication check, root remote SSH login restriction check; Security logs: User activity audit log checks, login log anomaly analysis.

4. The account security check method based on the SSH protocol according to claim 1, characterized in that, The process of obtaining habit coefficients through data analysis based on login parameters includes: The keyboard should be divided into sections, with each section including at least the primary key area and the numeric keypad. The hardware scan codes in the keystroke logs of the login parameters are collected and matched with each key on the login machine's keyboard; Data analysis is performed based on the time interval between adjacent input characters when abnormal accounts output passwords to obtain a habit coefficient.

5. The account security check method based on the SSH protocol according to claim 4, characterized in that, The process of data analysis based on the time interval between adjacent input characters when abnormal accounts output passwords includes: Record the key positions of adjacent input characters and calculate the first step length, the second step length, and the third step length. The first step length is the sum of key distances with the fewest steps when the key positions of adjacent input characters are all within the main keyboard area. The second step length is the sum of key distances with the fewest steps when the key positions of adjacent input characters are all within the numeric area. The third step length is a fixed value used to indicate that the key positions of adjacent input characters are in the main keyboard area and the numeric area, respectively. Cluster analysis is performed on the time taken for different values ​​of the first step length and the second step length based on the current user's historical data to obtain the standard duration of the first step length and the second step length; Data analysis was conducted by comparing the actual time taken for users with abnormal account status to enter their passwords with the standard duration.

6. The account security check method based on the SSH protocol according to claim 5, characterized in that, The process of conducting data analysis also includes: The difference between the actual time it takes for a user to press adjacent characters when entering a password under abnormal account status and the standard duration of the same partition and synchronization length is used as the first sequence value, and an analysis sequence is constructed. The analysis sequence is sorted and partition values ​​are selected to divide the sorted analysis sequence into two parts, left and right. Then, the second sequence value is obtained based on the difference between the first sequence value and the partition value of the two parts, and the habit coefficient is obtained based on the second sequence value.

7. The account security check method based on the SSH protocol according to claim 6, characterized in that, The process of selecting partition values ​​includes: Obtain the number of third-step characters and the number of character types in the password input of abnormal users; Partition values ​​are obtained through formulas To retrieve the value, where C is the partition value. is the mean of the first sequence values, d is the number of third steps in the input password, and t is the number of character types in the password. It is a preset correction factor.

Images