TWM638019U - Shared IP Checking System - Google Patents

Abstract

This creation is about a shared IP check system, which features a report generation module and a check module; the report generation module can generate a suspected proxy operation report according to time parameters, which includes an input unit, a comparison unit and a generation unit; The checking module is a connection report generation module, which can exclude the white list of legitimate use from the suspected proxy operation report, and generate an abnormal list with abnormal use behaviors, which includes a concatenation unit, a grouping unit, a screening unit, and a generation unit. The purpose of this creation is to provide a common IP checking system, which can efficiently screen out the list of doubts, greatly reduce the time cost of the checking process, and improve the accuracy of the screening.

Description

Shared IP Checking System

This creation is about an information management system, especially about a shared IP checking system.

In the insurance and securities industry, the salesperson tends to actively contact the members. In this case, in order to avoid the existence of acting on behalf of the salesperson and the member privately agreed, the business will compare the login IP and login time of the salesperson and the member. When a salesperson passes the internal system authentication with the same login IP as the member within the time range before and after the login time of the member authentication, there may be a suspected act of acting as an agent.

However, not all shared IP behaviors are acts of acting on behalf of others. With the current shared IP checking method, it is necessary to manually check one by one to exclude legal activities from the list. In this way, a lot of time and cost are needed in the checking process, which cannot be carried out efficiently. At the same time, when processing a large amount of data manually, it is easy to cause human error due to factors such as fatigue, and there is a risk that it is difficult to ensure the accuracy of the exception list.

Therefore, an automated shared IP check system is needed, which can efficiently and accurately compare the shared IP list and generate an exception list to shorten the time spent on the check process and provide a highly accurate exception list.

[Technical problems to be solved by the new model]

In view of the above, the purpose of this creation is to provide a common IP checking system, which can efficiently screen out the list of doubts, greatly reduce the time cost of the checking process, and improve the accuracy of the screening. [Technical means]

A shared IP check system, characterized by including a report generation module and a check module; the report generation module includes: an input unit for an operator to input a time parameter for comparison; a comparison unit, based on the time parameter, to The login time of the member is used as the benchmark, and if there is a salesman using the same login IP as the member within the time parameter range before and after, it is judged that the member and the salesman have suspected acting on behalf of the member; and the generation unit, based on the comparison The judgment result of the unit generates a suspected proxy operation report; the checking module is connected to the report generation module, including: a concatenation unit, which connects the suspected proxy operation report to the database to generate concatenated data; a clustering unit, which The concatenated data is grouped according to the set grouping conditions to generate the grouped data; the screening unit is used to screen the grouped data to generate the filtered data; and the generating unit is used to generate an abnormal list according to the filtered data.

Wherein, the plurality of databases may include policy databases, membership databases, salesperson databases and whitelist databases.

Wherein, the grouping condition is the same member and the same login time.

Wherein, the data department salespersons and members in the white list database are family members living together, for example, spouses, parents and children, brothers and sisters, and grandparents.

Among them, the information in the white list database refers to the members who have visited and confirmed that they are used by themselves. [New type of effect]

In this way, the automated shared IP check system created by this creation can efficiently and accurately compare the shared IP list, greatly shorten the time spent in the check process, and provide a highly accurate exception list.

Next, the specific implementation of the invention will be described with reference to the drawings and examples. It should be understood that the following descriptions are only used to explain the implementation and technical characteristics of this creation, and are not intended to limit the protection scope of this creation.

Fig. 1 is the block diagram of the shared IP checking system 1 of this creation. As shown in Figure 1, shared IP checking system 1 has: report generating module 2 and checking module 3; Report generating module 2 comprises input unit 21, comparing unit 22, generating unit 23 again; Checking module 3 comprises again A concatenation unit 31 , a grouping unit 32 , a screening unit 33 , and a generation unit 34 .

The report generation module 2 can generate reports of suspected proxy operations according to time parameters. The unit of the time parameter is hour, which is for the operator to set by himself through the input unit 21, based on the fact that all agent operations can be included under the minimum amount of data, for example, it can be 3 hours. The method of generating the suspected proxy operation report is to use the comparison unit 22 to compare the login information of the member and the salesman, and take the time point when the member passes the membership authentication as the benchmark, and within the time parameters before and after that, there are salesmen using the same IP as the member. When the internal system is authenticated, it is determined that the member and the salesperson have a suspected proxy operation; then, the generating unit 23 will output the data and generate a suspected proxy operation report.

The verification module 3 is connected to the report generation module 2, which can exclude legitimate user data from the suspected proxy operation report and generate an abnormal list of abnormal usage behaviors. The method for generating the exception list is to first connect the database 4 through the serial connection unit 31, for example, API connection or direct connection to the ERP database can be used. By connecting with the database 4, according to the list of suspected agent operation reports, the detailed information of relevant salespersons and members can be accessed from the database 4, and the connected reports can be generated. The database 4 may be a relational database, for example, may include a policy database, a member database, a salesperson database, a whitelist database, and the like.

Then, the grouping unit 32 is connected to the concatenation unit 31 to consolidate the report data of the same member with the same login time into one, so as to achieve the effect of facilitating the account return. The screening unit 33 is connected to the grouping unit 32 to screen the grouped data. In one embodiment, the screening method can be: according to the preset white list conditions, compare whether the grouped report data meets the conditions, and delete the qualified data; or compare whether it is recorded in the white list database The member list is the same, and the same information will be eliminated. The white list database stores the list of members who have been compared in advance and meets the white list conditions; or use the above two at the same time. Finally, the generating unit 34 generates an abnormal list according to the data filtered by the screening unit 33 . [Example]

Hereinafter, the embodiment of the invention will be further described in detail through examples. Fig. 2 is the flowchart of the shared IP checking system 1 of the embodiment of this creation. As shown in Figure 2, its system operation process includes: step S1 of starting the system, step S21 of inputting parameters, step S22 of preliminary comparison, step S23 of generating preliminary report, step S31 of serial connection, step S311 of output, step S32 of grouping, and step S321 of output , Advanced comparison step S33 and abnormal list generation step S34.

In this embodiment, the shared IP checking system 1 runs on a network server, and uses the Splunk system to manage and record the data of each member and salesperson who uses a mobile phone or computer device to log in to the business system, and stores this login data in the database. The login information includes at least the name of the login person, login IP and login time.

First, the operator turns on and operates the shared IP checking system 1 (S1), and sets the time parameter to 3 hours through the input unit 21 (S21). At this time, the comparison unit 22 compares the AD of the members stored in the Splunk system and passed the membership authentication. (Active Directory) "time and IP" and the "time and IP" of the salesperson through the internal authentication AD (S22), if there is a salesperson with the same IP as the member's login IP, and the login time is 3 hours before or after the member's login time, Then the member and the salesperson are deemed to have "suspected behavior of a salesman acting on behalf of a salesman", and the generating unit 23 outputs the data and generates a suspected operation report (S23). The data includes the member, salesman, login IP, and login time. At this time, the same login IP and login time of a single member may be compared to one or more salespersons.

Next, the verification module 3 is connected to the report generation module 2, and can access the data of the suspected proxy operation report. The serial connection unit 31 can connect the checking module 3 with the "policy database", "policy beneficiary database", "confirmed list database", "salesperson database", "member center data Database 4 such as "White List Database" and "White List Database" are concatenated (S31). After concatenation, the shared IP checking system 1 can access the detailed information of the salesperson and member in the suspected agent operation report from the database, and generate the concatenated report (S311).

Then, the grouping unit 32 outputs the concatenated report data that meet the grouping conditions as a piece of data (S321). In this embodiment, the grouping condition is the data of the same member at the same login time, that is, if one of the When multiple salespersons log in to the same IP within three hours before and after the login time, it will be considered as one transaction. In this way, it is convenient to return to the account, and the list of members and salesmen who have doubts is clearly listed.

The screening unit 33 can use algorithms such as sequential search algorithm, binary tree search algorithm and other algorithms according to requirements to compare whether the data in the concatenated reports after grouping meet the white list conditions and whether they are with the list stored in the white list database match, and exclude the matched data from the list (S33). The generation unit 34 generates an exception list according to the data selected by the screening unit 33 (S34). The list of abnormalities includes the information of members and salespersons that need further investigation, such as: basic information of members, situation of sharing IP, and whether there is any contact information shared with salespersons, etc., so as to facilitate investigators to conduct investigations.

Furthermore, the whitelist database is used to store a list of persons who have been confirmed to be operated by the person and not operated by a salesperson, and may contain information that meets the conditions of the whitelist. The white list conditions include: members and salesmen who share IP are relatives, such as spouses, parents and children, brothers and sisters, and grandchildren; members who meet the following conditions are confirmed by phone interviews, such as account secrets are held and shared by themselves The IP is the IP of the member's workplace, the salesperson himself is the member, etc.; and the member has no policy record, etc. Among them, according to the different conditions for entering the whitelist database, the period of inclusion in the whitelist database is also different. For example, if the member and salesperson who share the IP are relatives, the period of inclusion in the whitelist database can be permanent ; If confirmed by telephone interview, the period of inclusion in the whitelist database can be 6 months.

In the case of report generation module 2 generating 30,000 pieces of data, if the traditional method is used, it will take 21 days for each person to generate the abnormal list by six investigators for common IP checking; using the shared IP checking system 1 of this embodiment , which can reduce the time cost to only one investigator, and the exception list can be generated within a day.

To sum up, the shared IP checking system of this creation can automatically process a large amount of data and generate an abnormal list, which greatly reduces the time cost of the checking process; at the same time, it can also reduce possible errors caused by manual operations.

The above-mentioned implementation modes are only used to illustrate the implementation type of this creation and explain the technical characteristics of this creation, and are not used to limit the protection scope of this creation. Changes or equivalence arrangements that can be easily accomplished by a person with ordinary knowledge in the technical field fall within the scope of this creation, and the protection scope of this creation should be based on the scope of the patent application.

1: Shared IP checking system 2: Report generation module 21: Input unit 22: Comparison unit 23: Generate unit 3: Check module 31: Serial unit 32: Grouping unit 33: Screening unit 34: Generate unit 4: Database S1: Steps to start the system S21: Input parameter step S22: preliminary comparison step S23: Preliminary report generation step S31: Concatenation steps S311: output step S32: grouping step S321: output step S33: Advanced comparison steps S34: Steps for generating the exception list

[Fig. 1] is a block diagram of the shared IP checking system 1 of this creation. [Fig. 2] is the flow chart of the shared IP checking system 1 of the embodiment of this creation.

1: Shared IP checking system

2: Report generation module

21: Input unit

22: Comparison unit

23: Generate unit

3: Check module

31: Serial unit

32: Grouping unit

33: Screening unit

34: Generate unit

4: Database

Claims (6)

A shared IP checking system, characterized in that it includes a report generating module and a checking module; The report generation module includes: Input unit for the operator to input time parameters for comparison; The comparison unit, based on the time parameter, takes the member's login time as the benchmark, and if there is a salesman using the same login IP as the member within the range of the time parameter before and after, it is determined that the member and the salesman are suspected of operating on behalf of the member. conduct; and The generation unit generates a suspected proxy operation report based on the judgment result of the comparison unit; The checking module is connected to the report generating module, including: The concatenating unit is used to concatenate the suspected proxy operation report with the database to generate concatenated data; The grouping unit is used to group the concatenated data according to the set grouping conditions to generate the grouped data; a screening unit for screening the grouped data to generate the screened data; and The generating unit generates an exception list according to the filtered data. The shared IP checking system as described in Claim 1, wherein the database includes a policy database, a member database, a salesperson database and a whitelist database. The shared IP checking system as described in Claim 2, wherein the screening unit excludes and records the grouped data in the white list database... to screen and generate the screened data. The shared IP checking system as described in Claim 1, wherein the grouping conditions are the same member and the same login time. The shared IP checking system as described in Claim 1, wherein the information in the white list database is that the salesperson and the member are family members living together, for example, spouse, parent-child, sibling, grandparent. The shared IP checking system as described in claim item 1, wherein the information in the white list database is the members who have visited and confirmed that they are used by themselves.

Images