TWM590732U - Account stealing detection system - Google Patents

Abstract

The present disclosure provides an account stealing detection system, including: a server; and an electronic device coupled to the server. The electronic device login to the server through an account, and the server detects a user behavior after the account login to the server. The server searches a historical user behavior corresponding to the account, and determines whether the user behavior matches the historical user behavior. When the server determines the user behavior does not match the historical user behavior, the server transmits an authentication request to the electronic device, and receives an authentication information corresponding to the authentication request from the electronic device in a predetermined time interval after sending the authentication request. If the authentication information matches a predetermined authentication information corresponding to the account, the server adds the user behavior into the historical user behavior corresponding to the account.

Description

Account theft detection system

This disclosure relates to an abnormal state detection system, and in particular to an account theft detection system.

With the development of technology, more and more users are now using smartphones to log in to mobile banks for financial-related operations. Although Mobile Banking provides a convenient interface for users to perform financial-related operations, there are endless cases of user accounts being stolen. Therefore, how to prevent user accounts from being misappropriated by unscrupulous persons is the goal of those skilled in the art.

In view of this, the present disclosure provides a theft detection system that can issue a warning message when an abnormal login is found.

The present disclosure proposes an account fraud detection system, including: a server; and an electronic device, coupled to the server. The electronic device logs into the server through the account, and the server detects the user behavior after the account logs into the server. The server searches the historical user behavior of the corresponding account and determines whether the user behavior is consistent with the historical user behavior. When the server determines that the user behavior does not match the historical user behavior, the server sends an authentication request to the electronic device, and receives authentication information corresponding to the authentication request from the electronic device within a predetermined time interval after sending the authentication request. If the authentication information matches the default authentication information of the corresponding account, the server adds the user behavior to the historical user behavior of the corresponding account.

Based on the above, the disclosed account theft detection system determines whether the user behavior is consistent with the historical user behavior after the user logs in to the server. If the server determines that the user's behavior does not match the historical user's behavior, the server will perform the authentication process and require the user to complete the authentication within a predetermined time interval. If the user completes the authentication, the server can add the new user behavior to the historical user behavior of this account to update the historical user behavior.

In order to make the above-mentioned features and advantages of the present disclosure more comprehensible, the embodiments are specifically described below and described in detail in conjunction with the accompanying drawings.

FIG. 1 is a block diagram of an account theft detection system according to an embodiment of the present disclosure.

Referring to FIG. 1, an account fraud detection system 100 according to an embodiment of the present disclosure includes a server 110 and an electronic device 120. The electronic device 120 is coupled to the server 110 through wired or wireless communication. The server 110 is, for example, a bank server, and the electronic device 120 is, for example, a user's smartphone, tablet computer, personal computer, or other similar device. The user can log in to the server 110 using the electronic device 120 to perform various operations.

In one embodiment, the user uses the electronic device 120 to log in to the server 110 through the account to perform financial-related operations, browsing operations, or other operations, and the server 110 detects the user behavior after the account is logged in to the server 110. The user behavior includes user login related information and various operations after the user logs in to the server 110. The server 110 searches the historical user behavior of the corresponding account and determines whether the user behavior is consistent with the historical user behavior. When the server 110 determines that the user behavior does not match the historical user behavior, the server 110 sends an authentication request to the electronic device 120 to request the user to enter the authentication code and biometrics (eg, fingerprint, voiceprint, iris, vein information) Or other authentication data, and receive the corresponding authentication request authentication information from the electronic device 120 within a predetermined time interval (for example, five minutes) after the authentication request is sent. If the authentication information matches the default authentication information of the corresponding account, the server 110 adds the user behavior to the historical user behavior of the corresponding account. In this way, the new user behavior with successful authentication will be updated to the historical user behavior, so that the server 110 can more accurately determine whether the user account has been stolen later.

On the other hand, when the server 110 does not receive the authentication information from the electronic device 120 within a predetermined time interval or the authentication information does not match the default authentication information of the corresponding account, the server 110 generates a warning message corresponding to the account.

In one embodiment, the user behavior includes the device identification code of the electronic device 120. The device identification code is, for example, an International Mobile Equipment Identity (IMEI). When the device identification code is different from the default device identification code of the corresponding account, the server 110 determines that the user behavior does not match the historical user behavior. If the user logs into the server 110 with another electronic device (for example, a new mobile phone) and the authentication is successful, the server 110 will add the device identification code of the user's new mobile phone to the historical user behavior, so it will not An alert message is generated when logging in again with a new mobile phone.

In one embodiment, the user behavior includes login location. The server 110 can obtain positioning information of the electronic device 120 from a Global Positioning System (GPS) module of the electronic device 120. The server 110 can determine that the electronic device 120 has turned on the GPS function before allowing login, otherwise the user will be prompted to turn on the GPS function before logging in. When the distance difference between the login location and the multiple historical login locations of the corresponding account is greater than the distance threshold, the server 110 determines that the user behavior does not match the historical user behavior, and therefore further issues an authentication request. If the user sends correct authentication information and the authentication is successful, the server 110 may add this login location to the historical login location.

In addition, the server 110 can also obtain the login time point corresponding to the login location and the previous login time point and the previous login location of the account previous login server 110, and calculate the time difference and correspondence between the previous login time point and the login time point The last login location and the minimum travel time of the login location. If the time difference is less than the shortest traffic time, the server 110 determines that the user behavior does not match the historical user behavior. In other words, when the server 110 determines that the two login locations at different times have changed and the distance between the two login locations is not within the current transportation mode, the server 110 can directly issue a warning message and can suspend this All functions of the account.

In one embodiment, user behavior includes login time. The server 110 obtains an account to log in to the login area of the server 110 at the login time (for example, abroad). If the login time is within a predetermined period of time in the login area (for example, 0AM to 6AM in foreign countries), the server 110 determines that the user behavior does not match the historical user behavior.

In one embodiment, the user behavior includes a user data change operation after the account is logged into the server 110. When the account does not receive the push notification from the server 110 before performing the user data change operation, the server 110 determines that the user behavior does not match the historical user behavior. User data change operations include password change operations or mobile phone number change operations.

In one embodiment, the user behavior includes the transaction amount. When the transaction amount of this transaction is greater than the threshold value of multiple historical transactions of the corresponding account (for example, the historical transaction amount of this account is below 100,000 yuan, but the transaction amount is 500,000 yuan), the server 110 It is judged that the user behavior is inconsistent with the historical user behavior.

In summary, the disclosed account theft detection system determines whether the user behavior is consistent with the historical user behavior after the user logs in to the server. If the server determines that the user's behavior does not match the historical user's behavior, the server will perform the authentication process and require the user to complete the authentication within a predetermined time interval. If the user completes the authentication, the server can add the new user behavior to the historical user behavior of this account to update the historical user behavior.

Although this disclosure has been disclosed as above with examples, it is not intended to limit this disclosure. Anyone who has ordinary knowledge in the technical field should make some changes and retouching without departing from the spirit and scope of this disclosure. The scope of protection disclosed in this disclosure shall be subject to the scope defined in the appended patent application.

100‧‧‧Account theft detection system 110‧‧‧Server 120‧‧‧Electronic device

FIG. 1 is a block diagram of an account theft detection system according to an embodiment of the present disclosure.

100‧‧‧Account theft detection system

110‧‧‧Server

120‧‧‧Electronic device

Claims (10)

An account theft detection system, including: A server; and An electronic device coupled to the server, wherein The electronic device logs into the server through an account, and the server detects a user behavior after the account logs into the server, The server searches for a historical user behavior corresponding to the account and determines whether the user behavior matches the historical user behavior, When the server judges that the user behavior does not match the historical user behavior, the server sends an authentication request to the electronic device, and receives the pair from the electronic device within a predetermined time interval after sending the authentication request A piece of authentication information that should be requested for authentication, If the authentication information matches the default authentication information corresponding to the account, the server adds the user behavior to the historical user behavior corresponding to the account. The account theft detection system as described in item 1 of the patent application scope, wherein when the server does not receive the authentication information from the electronic device within the predetermined time interval or the authentication information does not meet the preset corresponding to the account During authentication, the server generates a warning message corresponding to the account. The account theft detection system as described in item 1 of the patent application scope, wherein the user behavior includes at least one of a device identification code, a login location, a login time, a user data change operation, and a transaction amount . The account theft detection system as described in item 1 of the patent application scope, wherein the authentication information includes at least one of an authentication code and a biological feature. The account theft detection system as described in item 1 of the patent application scope, wherein the user behavior includes a device identification code of the electronic device, when the device identification code is different from a default device identification code corresponding to the account, The server determines that the user behavior does not match the historical user behavior, where the device identification code includes an international mobile device identification code. The account theft detection system as described in item 1 of the patent application scope, wherein the user behavior includes a login location, when the distance between the login location and the multiple historical login locations corresponding to the account is greater than a distance threshold At this time, the server determines that the user behavior does not match the historical user behavior. An account theft detection system as described in item 6 of the patent application scope, wherein the server obtains a login time point corresponding to the login location and a previous login time point and a previous time of the previous login of the account to the server The login location, and calculate a time difference between the previous login time point and the login time point and a shortest traffic time corresponding to the previous login point and the login location, if the time difference is less than the shortest traffic time, the server determines the The user behavior does not match the historical user behavior. The account theft detection system as described in item 1 of the patent application scope, wherein the user behavior includes a login time, the server obtains a login area where the account is logged into the server at the login time, if the login time is During a predetermined period of time in the login area, the server determines that the user behavior does not match the historical user behavior. The account theft detection system as described in item 1 of the patent application scope, wherein the user behavior includes a user data change operation after the account is logged into the server, but the account does not perform the user data change operation before Receiving a push notification from the server, the server determines that the user behavior does not match the historical user behavior. The user data change operation includes a password change operation or a mobile phone number change operation. The account fraud detection system as described in item 1 of the patent application scope, wherein the user behavior includes a transaction amount, and when the transaction amount is greater than the threshold value of multiple historical transaction amounts corresponding to the account, the server determines The user behavior does not match the historical user behavior.

Images