CN103532797B

CN103532797B - A kind of User logs in method for monitoring abnormality and device

Info

Publication number: CN103532797B
Application number: CN201310546009.8A
Authority: CN
Inventors: 曹鲁; 张红泽; 董海疆; 崔坤
Original assignee: Netease Information Technology Beijing Co Ltd
Current assignee: Netease Information Technology Beijing Co Ltd
Priority date: 2013-11-06
Filing date: 2013-11-06
Publication date: 2017-07-04
Anticipated expiration: 2033-11-06
Also published as: CN103532797A

Abstract

Embodiments of the present invention provide a kind of User logs in method for monitoring abnormality, including：Can be according to the request in response to being associated with user account, judge that user currently logs in whether behavior is abnormal login behavior using historical log information corresponding with user account, if, abnormal login information corresponding with the abnormal login behavior is then preserved, and prompt message is sent using the abnormal login information generation prompt message for preserving and to user.The method that the present invention is provided pre-sets conventional login ground without user, the judgement and prompting of user's abnormal login behavior can be automatically performed according to user's history log-on message, the risk stolen so as to significantly reduce user account, improve the security of user account, and the complexity of the operation of user is reduced, is that user brings preferably experience.Additionally, embodiments of the present invention provide a kind of User logs in exception monitoring device.

Description

A kind of User logs in method for monitoring abnormality and device

Technical field

Embodiments of the present invention are related to network technique field, more specifically, embodiments of the present invention are related to a kind of use Family logs in method for monitoring abnormality and device.

Background technology

This part is it is intended that the embodiments of the present invention stated in claims provide background or context.Herein Description may include the concept that can be probed into, but be not necessarily the concept for having contemplated that or having probed into before.Therefore, unless This points out that the content otherwise described in this part is not existing skill for the description and claims of this application Art, and not because just recognizing it is prior art in being included in this part.

In network application, in order to realize to the identification and checking of user identity, it is necessary to user is input into user in client Name and password, are verified by server end to the username and password that user submits to, check the user name correspondence that user submits to Password it is whether consistent with the password that server end is preserved, if unanimously, it is determined that user is validated user, return is logined successfully Message；If it is inconsistent, determining that user is illegal user, refusal log messages are returned.After User logs in success, then may be used Corresponding application service is enjoyed with using network application.At present, such as E-mail address, online game, online payment, microblogging etc. Using being to provide the user application service using this login mechanism.

However, when the username and password of user account is revealed or is stolen, existing login method can not be protected Demonstrate,prove the safety of user account.In order to improve the security of user account, a kind of existing method of prior art is set in advance by user Conventional login ground is put or selected, after the logging request of user is received, judges whether this address for logging in of user is user The conventional login ground for pre-setting, if it is not, then can judge this time to log in exception, issues the user with prompting.

The content of the invention

But, can judge whether this login is different because prior art needs user to pre-set the conventional ground that logs in Often, when user is not provided with conventional login ground, prior art can not ensure the safety of user account, thus bring user The problem that account security is low, risk is high.

Therefore in the prior art, user account safety is protected in process of user login, is very bothersome mistake Journey.

Therefore, a kind of improved User logs in method for monitoring abnormality and device are highly desirable to, to monitor the process that accesses to your account In abnormal behaviour, improve user account security.

In the present context, embodiments of the present invention are expected to provide a kind of User logs in method for monitoring abnormality and device.

In the first aspect of embodiment of the present invention, there is provided a kind of method, including：

In response to the request associated with user account, historical log information corresponding with the user account is obtained；

Judge that user currently logs in whether behavior is abnormal stepping on according to historical log information corresponding with the user account Record behavior；

When judging user currently to log in behavior being abnormal login behavior, preserve related to the abnormal login behavior different Normal log-on message；

Prompt message being generated using the abnormal login information for preserving and sending the prompt message, the prompt message is used for Abnormal login behavior described in user is pointed out when user gets the prompt message.

Preferably, the request includes：

For the logging request of the user account；Or

For the preset data operation requests of the user account.

Preferably, methods described also includes, when judging user currently to log in behavior being abnormal login behavior, feedback refusal The message of the request.

Preferably, basis historical log information corresponding with the user account judges that user currently logs in behavior and is No is that abnormal login behavior includes：

According to historical log information corresponding with the user account according to the login position information of user and stepping on for user At least one of record frequency information judges that user currently logs in whether behavior is abnormal login behavior.

Preferably, basis historical log information corresponding with the user account according to user login position information Judge that user currently logs in whether behavior is that abnormal login behavior includes with least one of the login frequency information of user：

Determine the historical log number of times of the user account；

Whether the historical log number of times is judged more than the first given threshold, to obtain the first judged result；And

When it is not any active ues that first judged result shows the user account, it is determined that the user currently steps on Record behavior is normally to log in behavior；

Wherein, any active ues are user account of the historical log number of times more than first given threshold.

Determined described the according to corresponding with the user account historical log information in the first prefixed time interval User's history login position information in one prefixed time interval；

Judge pre- described first according to the user's history login position information in first prefixed time interval If whether the quantity of user's history login position is more than the second given threshold in time interval, to obtain the second judged result；With And

The user's history for determining the user account according to historical log information corresponding with the user account logs in position Confidence ceases；

Determine that user currently logs in the current login position information of the corresponding user of behavior；

Judge that user currently logs in the historical log number of days of the current login position of the corresponding user of behavior and takes that family is all goes through Whether the ratio of the total number of days of historical log of history login position is less than the 3rd given threshold, to obtain the 3rd judged result；

When the 3rd judged result and second judged result are when being, it is determined that the user currently logs in row To be abnormal login behavior.

History corresponding with the user account in the prefixed time interval of behavior second is currently logged in according in distance users Log-on message, it is determined that currently logging in user's history login position letter in the prefixed time interval of behavior second apart from the user Breath；

Judging distance user currently log in user's history login position in the prefixed time interval of behavior second quantity whether More than the 4th given threshold, to obtain the 4th judged result；

When the 3rd judged result and the 4th judged result are when being, it is determined that user currently logs in behavior is Abnormal login behavior.

Whether the Successful login frequency corresponding with the current login position of user is judged according to user's history login position information More than the 5th given threshold, to obtain the 5th judged result；

Judge that the abnormal login frequency corresponding with the current login position of user accounts for institute according to user's history login position information Whether the ratio of the Successful login frequency is stated more than the 6th given threshold, to obtain the 6th judged result；

When the 5th judged result and the 6th judged result are when being, it is determined that user currently logs in behavior is Abnormal login behavior.

Judge whether current login position is consistent with the login position in default abnormal login list of locations, to obtain Seven judged results；Wherein, the corresponding abnormal login frequency in login position in the default abnormal login list of locations is more than 7th given threshold；

When the 7th judged result is to be, it is determined that it is abnormal login behavior that user currently logs in behavior.

Preferably, the abnormal login information using preservation generates prompt message and sends the prompt message and includes：

Prompt message is generated using the abnormal login information for preserving, the prompt message is at least believed including abnormal login position Breath and/or abnormal login temporal information；

The prompt message is sent to prompt message recipient corresponding with the user account.

Preferably, it is described to include to prompt message recipient corresponding with the user account transmission prompt message：

Obtain mobile terminal identification information corresponding with the user account；

The prompt message is sent to mobile terminal corresponding with the mobile terminal identification information；Wherein, the movement Terminal identification information is the user account and mobile terminal identification information preserved according to the bindings request in response to user Corresponding relation and obtain；Or, obtain corresponding with user account user bound account information, to the binding The corresponding addresses of items of mail of user account information sends the prompt message.

Generation checking information；

The checking information is sent using the abnormal login information for preserving and cause corresponding with the abnormal login behavior The corresponding client of user account shows the checking information.

Preferably, methods described also includes：

Receive the checking information of user input；

Judge whether the checking information of user input is correct, obtains the 8th judged result；

When the 8th judged result shows that the checking information of user input is correct, then feedback agrees to disappearing for the request Breath；

When the described 8th judges to show the checking information mistake of user input, then feedback refuses the message of the request.

Preferably, it is described when judging user currently to log in behavior being abnormal login behavior, preserve and the abnormal login The related abnormal login information of behavior includes：

When judging user currently to log in behavior being abnormal login behavior, by the exception related to the abnormal login behavior Log-on message is stored in local memory queue；

The abnormal login information that will be stored in local memory queue is sent into Message Queuing server, described to cause Message Queuing server preserves the abnormal login information；

The abnormal login information being stored in the Message Queuing server is obtained using consumer program module, and The abnormal login information is processed, is stored in abnormal login information database.

Preferably, before the prompt message is sent, methods described also includes：

Judge whether the corresponding user account of the abnormal login information meets filter condition, if met, do not send The prompt message.

Preferably, acquisition historical log information corresponding with the user account includes：

Obtain the historical log information in the 3rd prefixed time interval corresponding with the user account.

In the second aspect of embodiment of the present invention, there is provided a kind of device, including：

First acquisition module, is configured to the request in response to being associated with user account, obtains and the user account pair The historical log information answered；

First judge module, is configured to judge that user is current according to historical log information corresponding with the user account Whether login behavior is abnormal login behavior；

Memory module, is configured to, when judging user currently to log in behavior being abnormal login behavior, preserve different with described Often log in the related abnormal login information of behavior；

Reminding module, is configured to using the abnormal login information generation prompt message for preserving and sends the prompting letter Breath, the prompt message is used to point out abnormal login behavior described in user when user gets the prompt message.

Preferably, first acquisition module is configured to：

In response to the logging request for the user account, historical log letter corresponding with the user account is obtained Breath；Or, in response to the preset data operation requests for the user account, obtain history corresponding with the user account Log-on message.

Preferably, described device also includes：

Feedback module, is configured to when judging user currently to log in behavior being abnormal login behavior, and feedback refusal is described The message of request.

Preferably, first judge module is configured to：

Preferably, first judge module includes：

First determination subelement, is configured to determine the historical log number of times of the user account；

Whether first judgment sub-unit, be configured to judge the historical log number of times more than the first given threshold, to obtain Obtain the first judged result；

Second determination subelement, is configured to show that the user account is not any active ues when first judged result When, it is determined that it is normally to log in behavior that the user currently logs in behavior；Wherein, any active ues are that the historical log number of times is big In the user account of first given threshold.

Preferably, first judge module includes：

3rd determination subelement, is configured to be gone through according to corresponding with the user account in the first prefixed time interval History log-on message determines the user's history login position information in first prefixed time interval；

Second judgment sub-unit, is configured to log in position according to the user's history in first prefixed time interval Whether confidence breath judges the quantity of the user's history login position in first prefixed time interval more than the second given threshold, To obtain the second judged result；

4th determination subelement, is configured to determine the use according to historical log information corresponding with the user account The user's history login position information of family account；

5th determination subelement, is configured to determine that user currently logs in the current login position letter of the corresponding user of behavior Breath；

3rd judgment sub-unit, is configured to judge that user currently logs in going through for the behavior current login position of corresponding user Whether the ratio that history logs in the total number of days of historical log that number of days takes all historical log positions in family is less than the 3rd given threshold, with Obtain the 3rd judged result；

6th determination subelement, is configured to be when being when second judged result and the 3rd judged result, It is abnormal login behavior then to determine that the user currently logs in behavior.

Preferably, first judge module includes：

7th determination subelement, be configured to according to distance users currently log in the prefixed time interval of behavior second with The corresponding historical log information of the user account, it is determined that currently logging in the prefixed time interval of behavior second apart from the user Interior user's history login position information；

4th judgment sub-unit, is configured to judging distance user and currently logs in user in the prefixed time interval of behavior second Whether the quantity of historical log position is more than the 4th given threshold, to obtain the 4th judged result；

8th determination subelement, is configured to be when being when the 3rd judged result and the 4th judged result, It is abnormal login behavior then to determine that user currently logs in behavior.

Preferably, first judge module includes：

5th judgment sub-unit, is configured to be judged and the current login position of user according to user's history login position information Whether the corresponding Successful login frequency is more than the 5th given threshold, to obtain the 5th judged result；

6th judgment sub-unit, is configured to be judged and the current login position of user according to user's history login position information Whether the corresponding abnormal login frequency accounts for the ratio of the Successful login frequency more than the 6th given threshold, to obtain the 6th judgement As a result；

9th determination subelement, is configured to be when being when the 5th judged result and the 6th judged result, It is abnormal login behavior then to determine that user currently logs in behavior.

Preferably, first judge module includes：

7th judgment sub-unit, be configured to judge current login position whether with default abnormal login list of locations in Login position it is consistent, to obtain the 7th judged result；Wherein, the login position in the default abnormal login list of locations The corresponding abnormal login frequency is more than the 7th given threshold；

Tenth determination subelement, is configured to when the 7th judged result is to be, it is determined that user currently logs in row To be abnormal login behavior.

Preferably, the reminding module includes：

First prompt message generation unit, is configured to using the abnormal login information generation prompt message for preserving, described Prompt message at least includes abnormal login positional information and/or abnormal login temporal information；

First prompt message transmitting element, is configured to be sent to prompt message recipient corresponding with the user account The prompt message.

Preferably, the first prompt message transmitting element is configured to：

Mobile terminal identification information corresponding with the user account is obtained, to corresponding with the mobile terminal identification information Mobile terminal send the prompt message；Wherein, the mobile terminal identification information is according to the binding behaviour in response to user The user account asking and preserve and the corresponding relation of mobile terminal identification information and obtain；Or, obtain and the use The corresponding user bound account information of family account, carries to described in addresses of items of mail corresponding with user bound account information transmission Show information.

Preferably, the reminding module includes：

Second prompt message generation unit, is configured to generate checking information；

Second prompt message transmitting element, is configured to send the checking information simultaneously using the abnormal login information for preserving So that the corresponding client of corresponding with abnormal login behavior user account shows the checking information.

Preferably, described device also includes：

Receiver module, is configured to receive the checking information of user input；

Second judge module, is configured to judge whether the checking information of user input is correct, obtains the 8th judged result；

Then the feedback module is additionally operable to：

When the 8th judged result shows that the checking information of user input is correct, then feedback agrees to disappearing for the request Breath；When the described 8th judges to show the checking information mistake of user input, then feedback refuses the message of the request.

Preferably, the memory module includes：

Local memory queue, is configured to when judging user currently to log in behavior being abnormal login behavior, in local Deposit and preserve the abnormal login information related to the abnormal login behavior in queue；

Message Queuing server, is configured to receive the abnormal login information from local memory queue, and preserve described Abnormal login information；

Consumer program module, is configured to obtain the abnormal login letter being stored in the Message Queuing server Breath, and the abnormal login information is processed, send the abnormal login after the treatment to abnormal login information database Information；

Abnormal login information database, the abnormal login information after being processed for storage.

Preferably, described device also includes：

3rd judge module, for before the prompt message is sent, judging the corresponding use of the abnormal login information Whether family account meets filter condition, if met, the prompt message is not sent.

Preferably, first acquisition module is configured to：

In response to the request associated with user account, obtain in the 3rd prefixed time interval corresponding with the user account Historical log information.

User logs in method for monitoring abnormality and device according to embodiment of the present invention, can according in response to user's account Number association request, using historical log information corresponding with user account judge user currently log in behavior whether be extremely step on Record behavior, if it is, abnormal login information corresponding with the abnormal login behavior is preserved, and using the abnormal login for preserving Information generates prompt message and sends prompt message to user.The method and apparatus that the present invention is provided, pre-set without user It is conventional to log in ground, the judgement and prompting of user's abnormal login behavior can be automatically performed according to user's history log-on message, so that The stolen risk of user account is significantly reduced, the security of user account is improve, and reduce the operation of user Complexity, be user bring preferably experience.

Brief description of the drawings

Detailed description below, above-mentioned and other mesh of exemplary embodiment of the invention are read by reference to accompanying drawing , feature and advantage will become prone to understand.In the accompanying drawings, if showing by way of example, and not by way of limitation of the invention Dry implementation method, wherein：

Fig. 1 schematically shows the block diagram of the computing system 100 for being adapted for carrying out embodiment of the present invention；

Fig. 2 schematically shows the application scenarios of the embodiment of the present invention；

Fig. 3 schematically shows the flow chart of User logs in method for monitoring abnormality according to an embodiment of the invention；

Fig. 4 schematically shows the flow chart of the abnormal login information storage means according to further embodiment of this invention；

Fig. 5 schematically shows User logs in exception monitoring device block diagram according to yet another embodiment of the invention.

In the accompanying drawings, identical or corresponding label represents identical or corresponding part.

Specific embodiment

Principle of the invention and spirit are described below with reference to some illustrative embodiments.It should be appreciated that providing this A little implementation methods are used for the purpose of better understood when those skilled in the art and then realizing the present invention, and not with any Mode limits the scope of the present invention.Conversely, these embodiments are provided so that the disclosure is more thorough and complete, and energy It is enough that the scope of the present disclosure is intactly conveyed into those skilled in the art.

Fig. 1 shows the block diagram of the exemplary computer system 100 for being adapted for carrying out embodiment of the present invention.As shown in figure 1, meter Calculation system 100 can include：CPU（CPU）101st, random access memory（RAM）102nd, read-only storage（ROM） 103rd, system bus 104, hard disk controller 105, KBC 106, serial interface controller 107, parallel interface controller 108th, display controller 109, hard disk 110, keyboard 111, serial peripheral equipment 112, concurrent peripheral equipment 113 and display 114. In these equipment, what is coupled with system bus 104 has CPU101, RAM102, ROM103, hard disk controller 105, KBC 106th, serial interface controller 107, parallel interface controller 108 and display controller 109.Hard disk 110 and hard disk controller 105 Coupling, keyboard 111 is coupled with KBC 106, and serial peripheral equipment 112 is coupled with serial interface controller 107, parallel outer Portion's equipment 113 is coupled with parallel interface controller 108, and display 114 is coupled with display controller 109.It should be appreciated that figure Structured flowchart described in 1 is used for the purpose of the purpose of example, without limiting the scope of the present invention.In some cases, may be used To increase or decrease some equipment as the case may be.

Art technology technical staff knows that embodiments of the present invention can be implemented as a kind of system, method or calculating Machine program product.Therefore, the disclosure can be implemented as following form, i.e.,：Complete hardware, complete software（Including solid Part, resident software, microcode etc.）, or the form that hardware and software is combined, referred to generally herein as " circuit ", " module " or " it is System ".Additionally, in certain embodiments, the present invention is also implemented as the calculating in one or more computer-readable mediums The form of machine program product, includes computer-readable program code in the computer-readable medium.

Can be using any combination of one or more computer-readable media.Computer-readable medium can be calculated Machine readable signal medium or computer-readable recording medium.Computer-readable recording medium for example may be, but not limited to, The system of electricity, magnetic, optical, electromagnetic, infrared ray or semiconductor, device or device, or it is any more than combination.Computer-readable The more specifically example of storage medium（Non-exhaustive examples）Can for example include：Portable computer diskette, hard disk, arbitrary access Memory（RAM）, read-only storage (ROM), erasable programmable read only memory (EPROM or flash memory), Portable, compact magnetic Disk read-only storage (CD-ROM), light storage device, magnetic memory device or above-mentioned any appropriate combination.In presents In, computer-readable recording medium can be it is any comprising or storage program tangible medium, the program can be commanded execution System, device or device are used or in connection.

Computer-readable signal media can include the data-signal propagated in a base band or as a carrier wave part, Wherein carry computer-readable program code.The data-signal of this propagation can take various forms, including but not limit In electromagnetic signal, optical signal or above-mentioned any appropriate combination.Computer-readable signal media can also be that computer can Read any computer-readable medium beyond storage medium, the computer-readable medium can send, propagates or transmit to be used for Used by instruction execution system, device or device or program in connection.

The program code included on computer-readable medium can use any appropriate medium to transmit, including but not limited to without Line, electric wire, optical cable, RF etc., or above-mentioned any appropriate combination.

Computer for performing present invention operation can be write with one or more programming language or its combination Program code, described program design language includes object oriented program language-such as Java, Smalltalk, C++, Also including conventional procedural programming language-such as " C " language or similar programming language.Program code can be with Fully perform on the user computer, part performs or exists completely on the remote computer on the user computer for part Performed on remote computer or server.In the situation for being related to remote computer, remote computer can be by any kind Network（Including LAN (LAN) or wide area network (WAN)）Subscriber computer is connected to, or, it may be connected to outside calculates Machine（For example using ISP come by Internet connection）.

Below with reference to the flow chart and equipment of the method for the embodiment of the present invention（Or system）Block diagram describe of the invention Implementation method.It should be appreciated that in each square frame and flow chart and/or block diagram of flow chart and/or block diagram each square frame combination Can be realized by computer program instructions.These computer program instructions can be supplied to all-purpose computer, special-purpose computer Or the processor of other programmable data processing units, so as to produce a kind of machine, these computer program instructions are by meter Calculation machine or other programmable data processing units are performed, and generate work(specified in the square frame realized in flow chart and/or block diagram The device of energy/operation.

The storage of these computer program instructions can also caused computer or other programmable data processing units In the computer-readable medium for working in a specific way, so, the instruction stored in computer-readable medium just produces one It is individual including realizing flow chart and/or block diagram in square frame specified in function/operation command device product.

Computer program instructions can also be loaded into computer, other programmable data processing units or miscellaneous equipment On so that series of operation steps is performed on computer, other programmable data processing units or miscellaneous equipment, in terms of producing The process that calculation machine is realized, so that the instruction performed on computer or other programmable devices can be provided and realize flow chart And/or the process of function/operation specified in the square frame in block diagram.

According to the embodiment of the present invention, it is proposed that a kind of method and apparatus of User logs in exception monitoring.

Herein, any number of elements in accompanying drawing is used to example and unrestricted, and any name is only used for Distinguish, without any limitation.

Below with reference to some representative embodiments of the invention, principle of the invention and spirit are explained in detail.

Summary of the invention

The inventors discovered that, can judge that this is logged in because prior art needs user to pre-set the conventional ground that logs in Whether abnormal, when user is not provided with conventional login ground, prior art can not ensure the safety of user account, thus band Carry out the problem that security of user account is low, risk is high.For existing in the prior art, security of user account is low, user's operation is multiple Miscellaneous problem, the invention provides a kind of User logs in method for monitoring abnormality and device, can according in response to user account The request of association, judges that user currently logs in whether behavior is abnormal login using historical log information corresponding with user account Behavior, if it is, abnormal login information corresponding with the abnormal login behavior is preserved, and using the abnormal login letter for preserving Breath generation prompt message simultaneously sends prompt message to user.The method and apparatus that the present invention is provided, pre-set often without user With ground is logged in, the judgement and prompting of user's abnormal login behavior can be automatically performed according to user's history log-on message, so that aobvious Reduce the stolen risk of user account with writing, improve the security of user account, and reduce the operation of user Complexity, is that user brings preferably experience.

After general principle of the invention is described, lower mask body introduces various non-limiting embodiment party of the invention Formula.

Application scenarios overview

With reference first to Fig. 2, the adaptable scene of embodiment of the present invention for example can be scene as shown in Figure 2, its In, the client in Fig. 2 may be used to provide login interface and display reminding information, the server that the present invention is provided（In figure It is not shown）For realizing User logs in exception monitoring.

Illustrative methods

With reference to the application scenarios of Fig. 2, the User logs according to exemplary embodiment of the invention is described with reference to Figure 3 The method of exception monitoring.It should be noted that above-mentioned application scenarios be for only for ease of understand spirit and principles of the present invention and Show, embodiments of the present invention are unrestricted in this regard.Conversely, embodiments of the present invention can apply to fit Any scene.

As shown in figure 3, being the flow chart of the User logs in method for monitoring abnormality according to an embodiment of the present invention, the method Specifically can for example include：

S301, in response to the request associated with user account, obtains historical log information corresponding with the user account.

S302, judges that user currently logs in whether behavior is different according to historical log information corresponding with the user account Often log in behavior.

S303, when judging user currently to log in behavior being abnormal login behavior, preserves and the abnormal login behavior phase The abnormal login information of pass.

S304, generates prompt message and sends the prompt message using the abnormal login information for preserving, the prompting letter Cease for pointing out abnormal login behavior described in user when user gets the prompt message

Detailed realization of the invention is illustrated below against Fig. 3.

When the present invention is implemented, when the request associated with user account is received, then in response to user account The request of association, obtains historical log information corresponding with the user account.The request associated with user account is specific Can include：For the logging request of the user account, or, for the preset data operation requests of the user account. Wherein, the preset data operation requests for user account can for example include：For password modification request, the pin of user account Balance transfer request to user account, the article dealing request etc. for user account.It should be noted that default data Operation requests can be pre-set by server, it is also possible to be pre-set by client by user, be not defined herein.Its In, obtain historical log information corresponding with user account and be specifically as follows：Obtain the corresponding with the user account the 3rd pre- If the historical log information in time interval.3rd prefixed time interval can be preset by server, for example, can be 6 Month, 3 months etc..It should be noted that can further include the first prefixed time interval, second pre- in the embodiment of the present invention If the concept of time interval, wherein, the first prefixed time interval, the second prefixed time interval are respectively less than equal to the 3rd Preset Time Interval.It can also obtain the corresponding with user account all of preservation to go through to obtain historical log information corresponding with user account History log-on message.The historical log information of user can be obtained from User logs in daily record, and User logs in daily record is used to record to be used The details that family logs in every time, including account name, log in the information such as IP, login time, log duration.Correspondingly, Yong Huli History log-on message can also include user account, log in IP（Or login position）, login time, in the information such as log duration One or more.

When step S302 is implemented, judge that user is current according to historical log information corresponding with the user account Whether login behavior is that abnormal login behavior can specifically include：Pressed according to historical log information corresponding with the user account At least one of login frequency information of login position information and user according to user judges whether user currently logs in behavior It is abnormal login behavior.It should be noted that the login frequency information of the login position information and/or user according to user judges It is only a kind of exemplary implementation method of the invention that user currently logs in behavior, is not intended as limitation of the present invention.This area Other implementations that technical staff obtains in the case where creative work is not paid belong to protection scope of the present invention.

In a kind of possible implementation of the present invention, according to historical log information corresponding with the user account according to At least one of the login position information of user and the login frequency information of user judge user currently log in behavior whether be Abnormal login behavior includes：Determine the historical log number of times of the user account；Judge whether the historical log number of times is more than First given threshold, to obtain the first judged result；And, when first judged result shows that the user account is not living During jump user, it is determined that it is normally to log in behavior that the user currently logs in behavior；Wherein, any active ues are the historical log User account of the number of times more than first given threshold.It is non-for being defined as in order to prevent erroneous judgement in this implementation The user account of any active ues, then directly determine that its current login behavior is normally to log in behavior.Wherein, any active ues are history More than the user account of the first given threshold, inactive users is historical log number of times less than or equal to the first setting threshold to login times The user account of value.First given threshold can be set as needed, not limited herein.

In a kind of possible implementation of the present invention, according to historical log information corresponding with the user account according to At least one of the login position information of user and the login frequency information of user judge user currently log in behavior whether be Abnormal login behavior includes：Determined according to the historical log information corresponding with the user account in the first prefixed time interval The user's history login position information in first prefixed time interval；According to described in first prefixed time interval User's history login position information judges whether the quantity of the user's history login position in first prefixed time interval is big In the second given threshold, to obtain the second judged result；And, it is true according to historical log information corresponding with the user account The user's history login position information of the fixed user account；Determine that user currently logs in the corresponding user of behavior and currently logs in position Confidence ceases；Judge that user currently logs in the historical log number of days occupancy all history in family of the current login position of the corresponding user of behavior Whether the ratio of the total number of days of historical log of login position is less than the 3rd given threshold, to obtain the 3rd judged result；When described Second judged result and the 3rd judged result are when being, it is determined that it is abnormal login row that the user currently logs in behavior For.

When implementing, the login IP that the historical log position of user can be in user's history log-on message is obtained, Historical log position can for example be made a distinction in units of administrative division in units of province, city.In order to calculate convenience, When determining the corresponding historical log number of days in User logs in position, same login position can be set（For example it is same inside the province）One day nothing By logging in several times, all only it is recorded as once.In order to reduce the amount of storage of data, when login position is recorded, N can be at most recorded Individual login position, N can be preset, and the few login position of login times is not recorded then.When judging when first is default Between in interval the quantity of user's history login position currently log in the corresponding user of behavior more than the second given threshold and user and work as The ratio that the historical log number of days of preceding login position takes the total number of days of historical log of all historical log positions in family is less than the 3rd During given threshold, it is determined that user currently logs in behavior for abnormal login behavior.First prefixed time interval can preset, It for example can be 1 month.When specifically judging, is gone through according to corresponding with the user account in the first prefixed time interval first History log-on message determines the user's history login position information in first prefixed time interval, then according to described first User's history login position information judges that user's history is stepped in first prefixed time interval in prefixed time interval Whether the quantity for recording position is more than the second given threshold, to obtain the second judged result.Similarly, also first according to user's history Log-on message determines the user's history login position information of user account, determines the current login location of user, then judges user Whether the ratio of the total number of days of historical log that the historical log number of days of current login position takes all historical log positions in family is big In the 3rd given threshold, to obtain the 3rd judged result.Wherein, the second given threshold and the 3rd given threshold can be according to warps Test or need setting.When the quantity for judging the user's history login position in the first prefixed time interval is more than the second given threshold When, then illustrate that user account is frequently logged in different login positions；When the historical log day for judging the current login position of user When the ratio that number takes the total number of days of historical log of all historical log positions in family is less than three given thresholds, then explanation is currently stepped on Land position is not the conventional login location of user.When two conditions meet simultaneously, it is determined that current login behavior is stepped on for abnormal Record behavior.Illustrated with an example, when judging that user distance this time logs in the quantity in the province logged in behavior one month More than the number of days that the login number of days of the second given threshold and this province for logging in of user takes all provinces of family historical log When ratio is less than three given thresholds, then can determine that user this login behavior is abnormal login behavior.

In the implementation of another possibility of the present invention, according to historical log information corresponding with the user account Judge that user currently logs in behavior and is according to the login position information of user and at least one of the login frequency information of user No is that abnormal login behavior includes：The use of the user account is determined according to historical log information corresponding with the user account Family historical log positional information；Determine that user currently logs in the current login position information of the corresponding user of behavior；According in distance User currently logs in historical log information corresponding with the user account in the prefixed time interval of behavior second, it is determined that in distance The user currently logs in user's history login position information in the prefixed time interval of behavior second；Judge that user currently logs in row For the historical log number of days of the current login position of corresponding user takes the total number of days of historical log of all historical log positions in family Ratio whether be less than the 3rd given threshold, to obtain the 3rd judged result；It is pre- that judging distance user currently logs in behavior second If whether the quantity of user's history login position is more than the 4th given threshold in time interval, to obtain the 4th judged result；When 3rd judged result and the 4th judged result are when being, it is determined that it is abnormal login row that user currently logs in behavior For.

When implementing, when the historical log number of days that user currently logs in the current login position of the corresponding user of behavior takes The ratio of the total number of days of historical log of all historical log positions in family is less than the 3rd given threshold and distance users currently log in row When being more than four given thresholds for the quantity of user's history login position in the second prefixed time interval, it is determined that user currently steps on Record behavior is abnormal login behavior.Wherein, the second prefixed time interval can preset, for example, can be 24 hours.Need Illustrate, the second prefixed time interval is less than or equal to the 3rd prefixed time interval.Second prefixed time interval is generally less than One prefixed time interval.It is of course also possible to be other more flexible settings.When the history for judging the current login position of user is stepped on When the ratio that record number of days takes the total number of days of historical log of all historical log positions in family is less than three given thresholds, then explanation is worked as Preceding login location is not the conventional login location of user.When the current prefixed time interval of login behavior second of judging distance user When the quantity of interior user's history login position is more than four given thresholds, then illustrate that the account of user is stepped in difference in the short term Record position is frequently logged on.When two conditions meet simultaneously, it is determined that current to log in behavior for abnormal login behavior.With one Example is illustrated, when the number of days for logging in all provinces of number of days occupancy family historical log for judging this province for logging in of user Ratio currently logs in behavior less than the 3rd given threshold and distance users, and the quantity in User logs in province is more than in 24 hours forward During four given thresholds, then can determine that user currently logs in behavior for abnormal login behavior.

In the implementation of another possibility of the present invention, according to historical log information corresponding with the user account Judge that user currently logs in behavior and is according to the login position information of user and at least one of the login frequency information of user No is that abnormal login behavior includes：The use of the user account is determined according to historical log information corresponding with the user account Family historical log positional information；Determine that user currently logs in the current login position information of the corresponding user of behavior；Gone through according to user History login position information judges whether the Successful login frequency corresponding with the current login position of user is more than the 5th given threshold, with Obtain the 5th judged result；Abnormal login corresponding with the current login position of user is judged according to user's history login position information Whether the frequency accounts for the ratio of the Successful login frequency more than the 6th given threshold, to obtain the 6th judged result；When described Five judged results and the 6th judged result are when being, it is determined that it is abnormal login behavior that user currently logs in behavior.

When implementing, when judging the corresponding Successful login frequency in the current login position of user more than the 5th given threshold and When the ratio that the corresponding abnormal login frequency in the current login position of user accounts for the Successful login frequency is more than six given thresholds, It is abnormal login behavior then to determine that user currently logs in behavior.For example, work as judging that user currently logs in the corresponding success of IP address Login times are big more than the ratio that the frequency of the abnormal login that the 5th given threshold and this IP address are caused accounts for Successful login number of times When six given thresholds, then it is assumed that the IP address Successful login number of times is excessive, and this is likely to be the attack of robot, this When, it is determined that user currently logs in behavior for abnormal login behavior.

In the implementation of another possibility of the present invention, according to historical log information corresponding with the user account Judge that user currently logs in behavior and is according to the login position information of user and at least one of the login frequency information of user No is that abnormal login behavior includes：Determine that user currently logs in the current login position information of the corresponding user of behavior；Judge current Whether login position is consistent with the login position in default abnormal login list of locations, to obtain the 7th judged result；Wherein, The corresponding abnormal login frequency in login position in the default abnormal login list of locations is more than the 7th given threshold；Work as institute When stating the 7th judged result to be, it is determined that it is abnormal login behavior that user currently logs in behavior.

When implementing, abnormal stepping on can be set according to user's history log-on message and/or the abnormal login information of storage Record list of locations.Wherein, the corresponding abnormal login frequency in login position in abnormal login list of locations is more than the 7th setting threshold Value.7th given threshold can rule of thumb set.When the login position of user（Correspondence logs in IP address）The exception for causing is stepped on When the record frequency is more than seven given thresholds, then illustrate that the abnormal login number of times that this login IP address is caused is excessive.Carrying out exception When login judges, the current login position information of user can be obtained, then by the current login position of user and abnormal login position Login position in list is compared, if consistent with least one of abnormal login list of locations information, it is determined that when The corresponding login behavior in preceding login position is abnormal login behavior.

When implementing, above-mentioned determination methods may be used alone, can also be used in combination.

For example, in the alternatively possible implementation of the present invention, according to historical log corresponding with the user account Information judges that user currently logs in row according to the login position information of user and at least one of the login frequency information of user Whether to be that abnormal login behavior includes：Determine the historical log number of times of the user account；Judge the historical log number of times Whether the first given threshold is more than, to obtain the first judged result；And, when first judged result shows user's account When number being not any active ues, it is determined that it is normally to log in behavior that the user currently logs in behavior；When first judged result When to show the user account be any active ues, according to the history corresponding with the user account in the first prefixed time interval Log-on message determines the user's history login position information in first prefixed time interval；According to when described first is default Between in interval user's history login position information judge the user's history login position in first prefixed time interval Quantity whether be more than the second given threshold, to obtain the second judged result；And, gone through according to corresponding with the user account History log-on message determines the user's history login position information of the user account；Determine that user currently logs in the corresponding use of behavior The current login position information in family；Judge that user currently logs in the historical log number of days of the current login position of the corresponding user of behavior and accounts for Whether the ratio of the total number of days of historical log of all historical log positions of user is less than the 3rd given threshold, to obtain the 3rd judgement As a result；When second judged result and the 3rd judged result are when being, it is determined that the user currently logs in behavior It is abnormal login behavior.

And for example, in another possible implementation of the invention, according to historical log corresponding with the user account Information judges that user currently logs in row according to the login position information of user and at least one of the login frequency information of user Whether to be that abnormal login behavior includes：Determine the historical log number of times of the user account；Judge the historical log number of times Whether the first given threshold is more than, to obtain the first judged result；And, when first judged result shows user's account When number being not any active ues, it is determined that it is normally to log in behavior that the user currently logs in behavior；When first judged result When to show the user account be any active ues, the user is determined according to historical log information corresponding with the user account The user's history login position information of account；Determine that user currently logs in the current login position information of the corresponding user of behavior；Root Historical log information corresponding with the user account in the prefixed time interval of behavior second is currently logged in according in distance users, really It is scheduled on and currently logs in user's history login position information in the prefixed time interval of behavior second apart from the user；Judge that user works as The history that the historical log number of days of the corresponding current login position of user of preceding login behavior takes all historical log positions in family is stepped on Whether the ratio of total number of days is recorded less than the 3rd given threshold, to obtain the 3rd judged result；Judging distance user currently logs in row For whether the quantity of user's history login position in the second prefixed time interval is more than the 4th given threshold, to obtain the 4th judgement As a result；When the 3rd judged result and the 4th judged result are when being, it is determined that it is different that user currently logs in behavior Often log in behavior.

It should be noted that these are only that exemplary type is illustrated, when the present invention is implemented, other method reality is may also take on The judgement of existing abnormal login.Other implementations that those skilled in the art obtain in the case where creative work is not paid belong to this The protection domain of invention.

Fig. 4 schematically shows the flow chart of the abnormal login information storage means according to further embodiment of this invention.

When the present invention is implemented, the prompting of the judgement of user's abnormal login behavior and abnormal login behavior is carried out Decoupling, there is provided the memory module of abnormal login information so that the storage of abnormal login information and abnormal login point out it is asynchronous enter OK, to improve response and the processing speed of server end, and the real-time login behavior of user is not influenceed.

When implementing, when judging user currently to log in behavior being abnormal login behavior, preserve and the abnormal login The related abnormal login information of behavior includes：When judging user currently to log in behavior being abnormal login behavior, will be different with described The related abnormal login information of normal login behavior is stored in local memory queue；The exception in local memory queue will be stored in Log-on message is sent into Message Queuing server, to cause that the Message Queuing server preserves the abnormal login information； The abnormal login information being stored in the Message Queuing server is obtained using consumer program module, and to described different Normal log-on message is processed, and is stored in abnormal login information database.

Illustrate more detail below.When the present invention is implemented, by the prompting of abnormal login information and abnormal login The judgement decoupling of information, because the judgement of abnormal login is one operated than faster, and the prompting of abnormal login is then One than relatively time-consuming action, for example can be including sending short messages and sending out the network operations such as mail.In order to be not to allow time-consuming carrying Show operation obstruction application server, response time and the concurrency of application server are reduced, it is therefore necessary to the two are operated Asynchronization.Additionally, storage is carried out to abnormal login information can carry out persistent storage by abnormal login information, facilitate follow-up Statistics and analysis are used.

When the present invention is realized, inventor has found, the transmission and storage of abnormal login information should ensure that abnormal login is believed Breath as far as possible timely get off by persistent storage, certain concurrent and handling capacity is ensured again, while also to abnormal login information Reliability have certain requirement.In order to meet above-mentioned requirements, the present invention has been used when abnormal login information Store is carried out and disappeared Breath queue（Message Queue）, message queue is used for the non real-time business of those complexity with online real-time main Business separate, there is provided abundant characteristic and scalability.

Introduced in detail with reference to Fig. 4.In Fig. 4, application server is the server of the service that provides the user.Disappear Breath queue server is the server for caching abnormal login information.Consumer program module is to take out Message Queuing server In abnormal login information, and by the part of abnormal login information Store to database.Backstage abnormity prompt program module again may be used It is for generating prompt message according to abnormal login information and sending the part of the prompt message to be referred to as reminding module.These Module or program can be deployed in server side.It is abnormal login when judging that user currently logs in behavior when implementing During behavior, local abnormal login information to be sent is cached using memory queue（Sent toward memory queue/pushed（put）Disappear Breath）, while the proprietary thread pool on backstage sends the information to the corresponding queue of Message Queuing server.In why introducing Queue is deposited, main purpose is that when preventing network connectivity fai_lure, the normal work thread of application server can frequently be attempted creating Connection, so as to the request for causing user cannot be responded.Wherein, abnormal login message queue is to be located at message queue（MQ）Service It is used to store the queue of abnormal login information in device, can be with right and wrong persistence queue.Consumer program module is used to step on extremely Abnormal login information in record message queue is taken out, and is changed by form, is stored in database, and in theory, consumer process can be with Have any number of, for accelerating to consume.Backstage abnormity prompt program module is properly termed as reminding module for from database again The abnormal login information occurred in a period of time recently is extracted, according to certain strategy, is pointed out to corresponding user.Below Mode to pointing out is illustrated.

When the present invention is implemented, in a kind of possible implementation, step S304 can specifically include：Using guarantor The abnormal login information generation prompt message deposited, the prompt message at least includes that abnormal login positional information and/or exception are stepped on Record temporal information；The prompt message is sent to prompt message recipient corresponding with the user account.

Wherein, sending the prompt message to prompt message recipient corresponding with the user account includes：Obtain with The corresponding mobile terminal identification information of the user account；Sent to mobile terminal corresponding with the mobile terminal identification information The prompt message；Wherein, the mobile terminal identification information is preserved according to the bindings request in response to user The corresponding relation of user account and mobile terminal identification information and obtain.When implementing, can be bound to user account Mobile terminal send prompt message.For example, to the sending short message by mobile phone prompt message bound with user account, for pointing out to use Family abnormal login positional information and/or abnormal login temporal information.Prompt message can further include and ask the user whether Need the information such as Modify password.

Wherein, sending the prompt message to prompt message recipient corresponding with the user account includes：Obtain with The corresponding user bound account information of the user account, sends to addresses of items of mail corresponding with the user bound account information The prompt message.When implementing, prompt message can be sent to other accounts bound with user account.For example, to The corresponding addresses of items of mail of other accounts of active user's account binding sends e-mail alert information, for pointing out user abnormal login Positional information and/or abnormal login temporal information.Prompt message can further include and ask the user whether to need modification close The information such as code.

When the present invention is implemented, in a kind of possible implementation, step S304 can specifically include：Generation is tested Card information；The checking information is sent using the abnormal login information for preserving and cause use corresponding with the abnormal login behavior Account corresponding client in family shows the checking information.

When implementing, send the checking information using the abnormal login information for preserving and cause and the abnormal login The corresponding client of the corresponding user account of behavior shows that the checking information can include：In the corresponding client of user account （It is corresponding with server, at least including display login interface）Display checking information, or prompt message is sent to mobile terminal, with So that mobile terminal display reminding information.In former implementation, after prompt message is generated, in the visitor that user is used Checking information is shown on the User logs in interface at family end or on user interface, when the correct checking information of user input, Then allow the request of user；When the checking information of user input mistake, then refuse the request of user.In latter implementation In, user account corresponding with the abnormal login behavior is obtained, obtain mobile terminal identification corresponding with the user account Information, the checking information is sent to mobile terminal corresponding with the mobile terminal identification information, described mobile whole to cause The end display checking information.For example, can be to the sending short message by mobile phone prompt message bound with user account, for pointing out to use Family input validation code.Further, the prompt message can be also used for pointing out user's abnormal login positional information and/or exception Login time information.

Further, the method that the present invention is provided can also include：Receive the checking information of user input；Judge that user is defeated Whether the checking information for entering is correct, obtains the 8th judged result；When the 8th judged result shows the checking letter of user input When ceasing correct, then feedback agrees to the message of the request；When the described 8th judges to show the checking information mistake of user input, Then feedback refuses the message of the request.The checking information of user input can come from corresponding with login interface or operation interface Client, it is also possible to from the mobile terminal bound with user, when the checking information of feedback is received, then judge user input Checking information it is whether correct, if correctly, the information of feedback consenting user request；If mistake, feedback refusal user The information of request.

Further, before the prompt message is sent, methods described also includes：Judge the abnormal login information pair Whether the user account answered meets filter condition, if met, the prompt message is not sent.When implementing, filtering Condition can for example include：User logs in position corresponding with particular ip address；Or, it has been transmitted across carrying in Preset Time Show the user account of information；Or, the not abnormal login information within the current prompting cycle；Or, setting does not carry out abnormal stepping on Record user account of prompting etc..The setting of filter condition can be very flexible, can be configured as needed.Need Bright, when the prompting of abnormal login is carried out, it is necessary to meet prompting in time, point out by all kinds of means, and needs are taken into account and are avoided excessively Harassing and wrecking user.Therefore, when implementing, the present invention can pre-set the prompting cycle to ensure prompting in time, and using only Vertical thread is pointed out.In order to avoid excessive prompting, the frequency of prompting mode can be set, for example short message prompt 3 days once, postal Part points out one day envelope etc..After user performs specific operation, abnormal login information is recalculated.For example, user's Modify password After recalculate abnormal login information.

Further, methods described also includes：When judging user currently to log in behavior being abnormal login behavior, feedback is refused The message of the exhausted request.It is that feedback agrees to disappearing for the request when normally logging in behavior when judging that user currently logs in behavior Breath.

Further, the method that the present invention is provided can also include：Abnormal login information to storing is counted and divided Analysis.Can for example include：Statistics the previous day abnormal login scale, new increment, prompt message amount etc..The present invention further can be with Including：Inquiry abnormal login information, there is provided Exception Type distribution, abnormal login product slates, abnormal login information of home location point The statistics of cloth, analysis and inquire about.

Example devices

After the method according to exemplary embodiment of the invention is described, next, with reference to Fig. 5 to according to the present invention Illustrative embodiments, illustrated for the device of User logs in exception monitoring.

A kind of device, including：

First acquisition module 501, is configured to the request in response to being associated with user account, obtains and the user account Corresponding historical log information；

First judge module 502, is configured to judge user according to historical log information corresponding with the user account Whether current login behavior is abnormal login behavior；

Memory module 503, is configured to when judging user currently to log in behavior being abnormal login behavior, preserve with it is described The related abnormal login information of abnormal login behavior；

Reminding module 504, is configured to using the abnormal login information generation prompt message for preserving and sends the prompting Information, the prompt message is used to point out abnormal login behavior described in user when user gets the prompt message.

Wherein, first acquisition module is configured to：

Further, described device also includes：

Further, first judge module is configured to：

Further, first judge module includes：

6th determination subelement, is configured to be when being when the 3rd judged result and the 4th judged result, It is abnormal login behavior then to determine that the user currently logs in behavior.

Further, first judge module includes：

Further, the reminding module includes：

Further, the first prompt message transmitting element is configured to：

Further, the reminding module includes：

Further, described device also includes：

Then the feedback module is additionally operable to：

Further, the memory module includes：

Further, described device also includes：

Further, first acquisition module specifically for：

In response to the request associated with user account, obtain in the 3rd prefixed time interval corresponding with the user account Historical log information

If although it should be noted that being referred to the equipment for drying or sub-device of equipment, this stroke in above-detailed Divide only not enforceable.In fact, according to the embodiment of the present invention, the feature of above-described two or more devices Can be embodied in one apparatus with function.Conversely, the feature and function of an above-described device can further draw It is divided into by multiple devices embodying.

Additionally, although the operation of the inventive method is described with particular order in the accompanying drawings, this do not require that or Hint must be performed according to the particular order these operation, or the operation having to carry out shown in whole could realize it is desired As a result.Conversely, the step of describing in flow chart can change execution sequence.Additionally or alternatively, it is convenient to omit some steps, Multiple steps are merged into a step to perform, and/or a step is decomposed into execution of multiple steps.

Referred in application documents verb " including ", "comprising" and its paradigmatic using being not excluded for except application documents Described in those elements or element or step outside step presence.Article "a" or "an" before element is not excluded for many The presence of individual this element.

Although describing spirit and principles of the present invention by reference to some specific embodiments, it should be appreciated that, this Invention is not limited to disclosed specific embodiment, and the division to each side does not mean that the feature in these aspects can not yet Combination is this to divide merely to the convenience of statement to be benefited.It is contemplated that cover appended claims spirit and In the range of included various modifications and equivalent arrangements.Scope of the following claims meets broadest explanation, so that comprising All such modifications and equivalent structure and function.

Claims

1. a kind of method, including：

Judge that user currently logs in whether behavior is abnormal login row according to historical log information corresponding with the user account For；

When judging user currently to log in behavior being abnormal login behavior, preserve the exception related to the abnormal login behavior and step on Record information；

Prompt message being generated using the abnormal login information for preserving and sending the prompt message, the prompt message is used to work as to be used Abnormal login behavior described in prompting user when family gets the prompt message；

Wherein, basis historical log information corresponding with the user account judges that user currently logs in whether behavior is different Normal login behavior with it is described using the abnormal login information for preserving generation prompt message and send the prompt message be it is asynchronous enter Capable；

Wherein, basis historical log information corresponding with the user account judges that user currently logs in whether behavior is different Normal login behavior includes：According to historical log information corresponding with the user account according to user login position information and use At least one of the login frequency information at family judges that user currently logs in whether behavior is abnormal login behavior；

Wherein, basis historical log information corresponding with the user account is according to the login position information of user and user At least one of login frequency information judge that user currently logs in whether behavior is that abnormal login behavior at least includes：

Determine the historical log number of times of the user account；Whether the historical log number of times is judged more than the first given threshold, To obtain the first judged result；And, when it is not any active ues that first judged result shows the user account, then really It is normally to log in behavior that the fixed user currently logs in behavior；When first judged result shows that the user account is active During user, determined described first according to the historical log information corresponding with the user account in the first prefixed time interval User's history login position information in prefixed time interval；Stepped on according to the user's history in first prefixed time interval Whether record positional information judges the quantity of the user's history login position in first prefixed time interval more than the second setting Threshold value, to obtain the second judged result；And, the user is determined according to historical log information corresponding with the user account The user's history login position information of account；Determine that user currently logs in the current login position information of the corresponding user of behavior；Sentence The historical log number of days that disconnected user currently logs in the current login position of the corresponding user of behavior takes all historical log positions in family The total number of days of historical log ratio whether be less than the 3rd given threshold, to obtain the 3rd judged result；When the described second judgement Result and the 3rd judged result are when being, it is determined that it is abnormal login behavior that the user currently logs in behavior；Or,

Determine the historical log number of times of the user account；Whether the historical log number of times is judged more than the first given threshold, To obtain the first judged result；And, when it is not any active ues that first judged result shows the user account, then really It is normally to log in behavior that the fixed user currently logs in behavior；When first judged result shows that the user account is active During user, the user's history login position of the user account is determined according to historical log information corresponding with the user account Information；Determine that user currently logs in the current login position information of the corresponding user of behavior；Row is currently logged in according in distance users It is historical log information corresponding with the user account in the second prefixed time interval, it is determined that currently being stepped on apart from the user User's history login position information in the prefixed time interval of record behavior second；Judge that user currently logs in the corresponding user of behavior and works as Whether the ratio that the historical log number of days of preceding login position takes the total number of days of historical log of all historical log positions in family is less than 3rd given threshold, to obtain the 3rd judged result；Judging distance user currently logs in the prefixed time interval of behavior second and uses Whether the quantity of family historical log position is more than the 4th given threshold, to obtain the 4th judged result；When the described 3rd judgement knot Fruit and the 4th judged result are when being, it is determined that it is abnormal login behavior that user currently logs in behavior；Or,

The user's history login position letter of the user account is determined according to historical log information corresponding with the user account Breath；Determine that user currently logs in the current login position information of the corresponding user of behavior；Sentenced according to user's history login position information Whether the Successful login frequency corresponding with the current login position of user of breaking is more than the 5th given threshold, to obtain the 5th judgement knot Really；Judge that the abnormal login frequency corresponding with the current login position of user accounts for the success according to user's history login position information Whether the ratio for logging in the frequency is more than the 6th given threshold, to obtain the 6th judged result；When the 5th judged result and institute State the 6th judged result and be when being, it is determined that it is abnormal login behavior that user currently logs in behavior；Or,

Determine that user currently logs in the current login position information of the corresponding user of behavior；Judge current login position whether with it is default Abnormal login list of locations in login position it is consistent, to obtain the 7th judged result；Wherein, the default abnormal login The corresponding abnormal login frequency in login position in list of locations is more than the 7th given threshold；When the 7th judged result is yes When, it is determined that it is abnormal login behavior that user currently logs in behavior.

2. method according to claim 1, wherein, the request includes：

For the logging request of the user account；Or

For the preset data operation requests of the user account.

3. method according to claim 1, methods described also includes：

When judging user currently to log in behavior being abnormal login behavior, the message of the feedback refusal request.

4. method according to claim 1, wherein, it is described concurrent using the abnormal login information for preserving generation prompt message Sending the prompt message includes：

Prompt message is generated using the abnormal login information for preserving, the prompt message at least includes abnormal login positional information And/or abnormal login temporal information；

5. method according to claim 4, wherein, it is described to be sent out to prompt message recipient corresponding with the user account Sending the prompt message includes：

The prompt message is sent to mobile terminal corresponding with the mobile terminal identification information；Wherein, the mobile terminal Identification information is that the user account preserved according to the bindings request in response to user is right with mobile terminal identification information Should be related to and obtain；

Or

User bound account information corresponding with the user account is obtained, to postal corresponding with the user bound account information Part address sends the prompt message.

6. method according to claim 1, wherein, it is described concurrent using the abnormal login information for preserving generation prompt message Sending the prompt message includes：

Generation checking information；

The checking information is sent using the abnormal login information for preserving and cause user corresponding with the abnormal login behavior The corresponding client of account shows the checking information.

7. method according to claim 6, methods described also includes：

Receive the checking information of user input；

When the 8th judged result shows that the checking information of user input is correct, then feedback agrees to the message of the request；

8. method according to claim 1, wherein, described is abnormal login behavior when judge that user currently logs in behavior When, preserving the abnormal login information related to the abnormal login behavior includes：

When judging user currently to log in behavior being abnormal login behavior, by the abnormal login related to the abnormal login behavior Information is stored in local memory queue；

The abnormal login information that will be stored in local memory queue is sent into Message Queuing server, to cause the message Queue server preserves the abnormal login information；

The abnormal login information being stored in the Message Queuing server is obtained using consumer program module, and to institute State abnormal login information to be processed, store in abnormal login information database.

9. method according to claim 1, before the prompt message is sent, methods described also includes：

Judge whether the corresponding user account of the abnormal login information meets filter condition, if met, do not send described Prompt message.

10. method according to claim 1, wherein, it is described to obtain historical log information corresponding with the user account Including：

A kind of 11. devices, including：

First acquisition module, is configured to the request in response to being associated with user account, obtains corresponding with the user account Historical log information；

First judge module, is configured to judge that user currently logs according to historical log information corresponding with the user account Whether behavior is abnormal login behavior；

Memory module, is configured to when judging user currently to log in behavior being abnormal login behavior, and preservation is stepped on the exception The related abnormal login information of record behavior；

Reminding module, is configured to using the abnormal login information generation prompt message for preserving and sends the prompt message, institute Prompt message is stated for pointing out abnormal login behavior described in user when user gets the prompt message；

Wherein, the first judge module specifically for：Determine the historical log number of times of the user account；Judge the historical log Whether number of times is more than the first given threshold, to obtain the first judged result；And, when first judged result shows the use When family account is not any active ues, it is determined that it is normally to log in behavior that the user currently logs in behavior；When the described first judgement Result shows the user account when being any active ues, according to corresponding with the user account in the first prefixed time interval Historical log information determines the user's history login position information in first prefixed time interval；According to pre- described first If user's history login position information judges that user's history is logged in first prefixed time interval in time interval Whether the quantity of position is more than the second given threshold, to obtain the second judged result；And, according to corresponding with the user account Historical log information determine the user's history login position information of the user account；Determine that user currently logs in behavior correspondence The current login position information of user；Judge that user currently logs in the historical log day of the current login position of the corresponding user of behavior Whether the ratio that number takes the total number of days of historical log of all historical log positions in family is less than the 3rd given threshold, to obtain the 3rd Judged result；When second judged result and the 3rd judged result are when being, it is determined that the user currently logs in Behavior is abnormal login behavior；Or,

12. devices according to claim 11, wherein, first acquisition module is configured to：

In response to the logging request for the user account, historical log information corresponding with the user account is obtained；Or Person, in response to the preset data operation requests for the user account, obtains historical log corresponding with the user account Information.

13. devices according to claim 11, described device also includes：

First feedback module, is configured to when judging user currently to log in behavior being abnormal login behavior, and feedback refusal is described The message of request.

14. devices according to claim 11, wherein, the reminding module includes：

First prompt message generation unit, is configured to using the abnormal login information generation prompt message for preserving, the prompting Information at least includes abnormal login positional information and/or abnormal login temporal information；

First prompt message transmitting element, is configured to send described to prompt message recipient corresponding with the user account Prompt message.

15. devices according to claim 14, wherein, the first prompt message transmitting element is configured to：

Mobile terminal identification information corresponding with the user account is obtained, to shifting corresponding with the mobile terminal identification information Dynamic terminal sends the prompt message；Wherein, the mobile terminal identification information is asked according to the bindings in response to user The user account asking and preserve and the corresponding relation of mobile terminal identification information and obtain；Or, obtain and user's account Number corresponding user bound account information, the prompting letter is sent to addresses of items of mail corresponding with the user bound account information Breath.

16. devices according to claim 11, wherein, the reminding module includes：

Second prompt message transmitting element, is configured to send the checking information using the abnormal login information for preserving and cause The corresponding client of corresponding with abnormal login behavior user account shows the checking information.

17. devices according to claim 16, described device also includes：

Second feedback module, for when the 8th judged result shows that the checking information of user input is correct, then feeding back same Anticipate the message of the request；

3rd feedback module, for when the described 8th judges to show the checking information mistake of user input, then feedback to refuse institute State the message of request.

18. devices according to claim 11, wherein, the memory module includes：

Local memory queue, is configured to when judging user currently to log in behavior being abnormal login behavior, it is described it is local in Deposit and preserve the abnormal login information related to the abnormal login behavior in queue；

Message Queuing server, is configured to receive the abnormal login information sent from local memory queue, and preserve described different Normal log-on message；

Consumer program module, is configured to obtain the abnormal login information being stored in the Message Queuing server, And the abnormal login information is processed, the abnormal login after the treatment is sent to abnormal login information database and is believed Breath；

Abnormal login information database, is configured to the abnormal login information after storage treatment.

19. devices according to claim 11, described device also includes：

3rd judge module, for before the prompt message is sent, judging the corresponding user's account of the abnormal login information Number whether meet filter condition, if met, the prompt message is not sent.

20. devices according to claim 11, wherein, first acquisition module is configured to：

In response to the request associated with user account, going through in the 3rd prefixed time interval corresponding with the user account is obtained History log-on message.