CN107276982B

CN107276982B - Abnormal login detection method and device

Info

Publication number: CN107276982B
Application number: CN201710318612.9A
Authority: CN
Inventors: 何为舟
Original assignee: Weimeng Chuangke Network Technology China Co Ltd
Current assignee: Weimeng Chuangke Network Technology China Co Ltd
Priority date: 2017-05-08
Filing date: 2017-05-08
Publication date: 2020-10-30
Anticipated expiration: 2037-05-08
Also published as: CN107276982A

Abstract

The embodiment of the invention provides an abnormal login detection method and device, wherein the method comprises the following steps: when a certain user login is detected, acquiring a user login log of a current user; acquiring multidimensional attribute data logged by a current user according to a user login log of the current user; according to the multidimensional attribute data of the current user login, carrying out abnormal scoring on the current user login by using the established user login machine learning model, and acquiring the abnormal scoring value of the current user login; if the abnormal score value is judged to be within the set abnormal score threshold range, initiating an inquiry whether the current user is allowed to log in to the current user; and processing whether the current user is allowed to log in or not according to the inquiry feedback result of the current user. The technical scheme has the following beneficial effects: by introducing a machine learning mode into abnormal login detection, the problem of single dimension of the traditional method is solved, and excessive manual work can be avoided.

Description

Abnormal login detection method and device

Technical Field

The invention relates to the technical field of internet, in particular to an abnormal login detection method and device.

Background

With the continuous development of the internet, the challenge brought by the network security is more and more serious. Once an attacker steals the account and password of the user by means of fishing, fraud and the like, the personal information and property of the user are seriously threatened. Therefore, abnormal user login behaviors are found in time, and appropriate protective measures are taken for the account of the user, so that the method has great significance for protecting the privacy and property of the user. However, how to detect the abnormal logging behavior is always a major research problem in the industry.

The simplest method for detecting abnormal login behavior is threshold detection. That is, counting the number of initiated login times and the proportion of abnormal behaviors (including absence of user, password error, off-site login, etc.) in a certain entry or IP, and if the proportion exceeds a certain threshold, it can be considered that the login behaviors initiated by the IP are all abnormal. The principle behind this is that an attacker often needs to try all the usernames/passwords that it owns to log in, and if the login is successful, an account can be stolen. Because of the large amount of data, the attacker makes login attempts at a very fast speed, thus guaranteeing its own benefits. A significant portion of these attempts have failed. For normal users, a large amount of login cannot be initiated in a short time, and a large amount of failures cannot occur (in fact, the number of the failed users does not account for a large proportion). The method for specifying a threshold value for distinguishing through the behavior difference is a simple and easy method and is adopted by a large number of companies at present. The threshold value is often set according to the number of times, for example, 10 times of login failures exceed 90%, 100 times of login failures exceed 70%, and the like.

Although the threshold detection method is simple and easy, the following disadvantages exist:

1) fixing a threshold value: the setting of the threshold value is often summarized empirically and artificially. But the hacker itself can also guess the target server threshold through his experience. For example, if a hacker is disabled more than 100 logins, it may guess that the threshold is roughly around 100, and then circumvent it by reducing the frequency of attacks, replacing IP, etc., so that the threshold-based defense is completely defeated.

2) The threshold value is not continuous: the segmentation of the threshold is due to the fact that the more times, the greater the doubtability and therefore the lower the allowable failure ratio. However, this discontinuity causes a large problem. For example, if a segmentation point of a threshold is 100, the allowable failure rate is 90% for times below 100, and the allowable failure rate is only 70% for times above 100. Then for the hacker, once it guesses this fragmentation criterion, it can set its number of attempts to 99, thereby maximizing the efficiency of the attack.

3) The threshold value is artificially set: the threshold value is often set by human experience, and thus the cost is increased a lot. In addition, the hacking behavior is always changed, the artificial processing mode means the response hysteresis, and it is likely that an hacking behavior is completed when the artificial response comes. Similarly, if one wants to migrate the same set of policies to different services, different threshold settings are required. In this time, the manual setting will also greatly limit the expansibility of the defense system itself.

In addition to determining abnormal login behavior from the ip perspective, detection may also be performed from the user perspective. For example, the common login place, the common login time, and the like of the user can be analyzed according to the historical login record of the user. When a user logs in, the login place or the login time is abnormally changed, and the abnormal login behavior is determined.

The benefit of this strategy is that it is not limited to attacker-initiated login behavior, but is considered directly from the user's own perspective. Therefore, even if the attacker logs in only once, the attacker can find out abnormal login behaviors in time. Moreover, since the user information grasped by the attacker is often limited, the user cannot accurately simulate the habitual login behavior of the user. Thus, the cost to the attacker is greatly increased.

User-based policies also suffer from certain disadvantages:

1) the false alarm rate and the missing report rate are higher: if the analysis is performed from only a few dimensions, false alarm or false alarm can be easily caused. For example, when a user suddenly goes to another city on a certain day, it is likely that abnormal login behavior will be triggered. Such frequent false positives can have a significant negative impact on the user experience. On the other hand, if the attacker happens to match the user's usual login, a false negative will be generated. The same problem exists with regular login times, where a user logs in all day long, the time-dimension equivalent protection is completely disabled.

2) Cold start problem: the problem of cold start and how to determine the place and time of the frequent login for a new user when the history data is lacking. This is because the judgment of the common use place often requires a comprehensive judgment of the log-in place of the user history to be able to give an accurate result. The problem of cold start directly results in that new users cannot be effectively protected, thereby having a serious influence on the growth of users.

In the process of implementing the invention, the inventor finds that at least the following problems exist in the prior art: the traditional abnormal login detection technical scheme has single dimension and needs a lot of manual work.

Disclosure of Invention

The embodiment of the invention provides an abnormal login detection method and device, which are used for solving the problem of single dimension of the traditional technical scheme and avoiding excessive manual work.

In one aspect, an embodiment of the present invention provides an abnormal login detection method, where the method includes:

when a certain user login is detected, acquiring a user login log of a current user;

acquiring multidimensional attribute data logged by a current user according to a user login log of the current user;

according to the multidimensional attribute data of the current user login, carrying out abnormal scoring on the current user login by using the established user login machine learning model, and acquiring the abnormal scoring value of the current user login;

if the abnormal score value is judged to be within the set abnormal score threshold range, initiating an inquiry whether the current user is allowed to log in to the current user;

and processing whether the current user is allowed to log in or not according to the inquiry feedback result of the current user.

In another aspect, an embodiment of the present invention provides an abnormal login detection apparatus, where the apparatus includes:

the device comprises a preprocessing unit, a log processing unit and a log processing unit, wherein the preprocessing unit is used for acquiring a user login log of a current user when a certain user login is detected; acquiring multidimensional attribute data logged by a current user according to a user login log of the current user;

the machine learning unit is used for carrying out abnormal scoring on the current user login by utilizing the established user login machine learning model according to the multidimensional attribute data of the current user login to obtain an abnormal scoring value of the current user login;

the active learning unit is used for initiating an inquiry whether the current user is allowed to log in or not to the current user if the abnormal score value is judged to be within the set abnormal score threshold range;

and the exception processing unit is used for processing whether the current user is allowed to log in or not according to the inquiry feedback result of the current user.

The technical scheme has the following beneficial effects: by introducing a machine learning mode into abnormal login detection, the problem of single dimension of the traditional method is solved, and excessive manual work can be avoided.

Drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments of the present invention, and for those skilled in the art, other drawings can be obtained according to the drawings without creative efforts.

FIG. 1 is a flowchart of an abnormal login detection method according to an embodiment of the present invention;

FIG. 2 is a schematic structural diagram of an abnormal login detection apparatus according to an embodiment of the present invention;

FIG. 3 is a diagram illustrating a structure of a machine learning unit according to an embodiment of the present invention;

FIG. 4 is a schematic structural diagram of an active learning unit according to an embodiment of the present invention;

fig. 5 is a schematic overall flow chart of an abnormal login detection method according to an application example of the present invention.

Detailed Description

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.

As shown in fig. 1, a flowchart of an abnormal login detection method according to an embodiment of the present invention is shown, where the method includes:

101. when a certain user login is detected, acquiring a user login log of a current user;

102. acquiring multidimensional attribute data logged by a current user according to a user login log of the current user;

103. according to the multidimensional attribute data of the current user login, carrying out abnormal scoring on the current user login by using the established user login machine learning model, and acquiring the abnormal scoring value of the current user login;

104. if the abnormal score value is judged to be within the set abnormal score threshold range, initiating an inquiry whether the current user is allowed to log in to the current user;

105. and processing whether the current user is allowed to log in or not according to the inquiry feedback result of the current user.

Preferably, the method for establishing the user login machine learning model includes: obtaining a plurality of sample user login logs; acquiring multidimensional attribute data and login results of the login of the plurality of sample users according to the login logs of the plurality of sample users; and performing machine learning by using the multidimensional attribute data and the login results of the login of the plurality of sample users and adopting an incremental machine learning algorithm to establish a user login machine learning model.

Preferably, the method further comprises: and taking the multidimensional attribute data and the login result of the current user as a training set, performing machine learning by adopting an incremental machine learning algorithm, and correcting the login machine learning model of the user.

Preferably, the method further comprises the following steps: if the abnormal score value is judged to be higher than the maximum value in the set abnormal score threshold range, processing is directly carried out according to abnormal login; and if the abnormal score value is judged to be lower than the minimum value in the set abnormal score threshold range, allowing login.

Preferably, the multidimensional attribute data comprises: whether the login belongs to a common login place, whether the login belongs to common login time, whether the login belongs to common login equipment, and dimension data are counted; the statistical dimensional data comprises: error rate within preset time, login times within preset time;

if the abnormal score value is judged to be within the set abnormal score threshold range, before the inquiry of whether the current user is allowed to log in is sent to the current user, the method further comprises the following steps: the current user is forcibly authenticated through at least one of the following modes: verifying a password, a mobile phone number, an identity card number, a user head portrait and a gesture; and confirms that the forced authentication passed. If the forced authentication is not passed, the login is determined to be abnormal, and the inquiry whether the current user is allowed to login is not sent to the current user.

Corresponding to the method embodiment, as shown in fig. 2, a schematic structural diagram of an abnormal login detection apparatus according to an embodiment of the present invention is shown, where the apparatus includes:

the preprocessing unit 21 is configured to, when a certain user login is detected, obtain a user login log of a current user; acquiring multidimensional attribute data logged by a current user according to a user login log of the current user;

the machine learning unit 22 is used for performing abnormal scoring on the current user login by using the established user login machine learning model according to the multidimensional attribute data of the current user login to obtain an abnormal scoring value of the current user login;

the active learning unit 23 is configured to, if it is determined that the abnormal score value is within the set abnormal score threshold range, initiate an inquiry to a current user as to whether the current user is allowed to log in;

and the exception handling unit 24 is configured to handle whether to allow the current user to log in according to an inquiry feedback result of the current user.

Preferably, the preprocessing unit 21 is further configured to obtain a plurality of sample user login logs; acquiring multidimensional attribute data and login results of the login of the plurality of sample users according to the login logs of the plurality of sample users; acquiring a plurality of user login logs; acquiring multidimensional attribute data logged by the user according to the multiple user login logs;

as shown in fig. 3, which is a schematic structural diagram of a machine learning unit according to an embodiment of the present invention, the machine learning unit 22 includes:

and the user login machine learning model establishing module 221 is configured to perform machine learning by using the multidimensional attribute data and login results of the multiple sample user logins and adopting an incremental machine learning algorithm, and establish the user login machine learning model.

Preferably, the machine learning unit 22 further includes:

and a user login machine learning model modification module 222, configured to use the multidimensional attribute data and the login result of the current user as a training set, perform machine learning by using an incremental machine learning algorithm, and modify the user login machine learning model.

Preferably, the exception handling unit 24 is further configured to, if it is determined that the exception score value is higher than a maximum value in a set exception score threshold range, directly perform processing according to an exception entry;

the exception handling unit 24 is further configured to allow login if it is determined that the exception score value is lower than a minimum value in a set exception score threshold range.

as shown in fig. 4, which is a schematic structural diagram of an active learning unit according to an embodiment of the present invention, the active learning unit 23 includes:

and a forced authentication module 231, configured to, if it is determined that the abnormal score value is within the set abnormal score threshold range, perform forced authentication on the current user in at least one of the following manners before initiating an inquiry to the current user as to whether the current user is allowed to log in: verifying a password, a mobile phone number, an identity card number, a user head portrait and a gesture; and confirms that the forced authentication passed.

The technical scheme has the following beneficial effects: by introducing a machine learning mode into abnormal login detection, the problem of single dimension of the traditional method is solved, and excessive manual work can be avoided. Importantly, in consideration of the influence of the training set on the machine learning effect, the embodiment of the invention also provides a mode for collecting the training set through user feedback, so that the problem of collecting the training set in the process of applying the machine learning can be effectively solved. By introducing user feedback and considering user experience to a certain extent, accurate training data can be collected most efficiently, and the overall effect of machine learning is effectively improved.

The above technical solution of the embodiment of the present invention is explained in detail by the following application examples:

as shown in fig. 5, an overall flow diagram of an abnormal login detection method according to an application example of the present invention specifically includes:

1. and preprocessing each log. This preprocessing may include determining whether the current login belongs to a common login location, or whether it belongs to a common time; some statistical features such as error rate in a short time, log-in times, etc. may also be included. After preprocessing, the original log is converted into a dimension attribute, and the dimension attribute can be directly used for processing in machine learning.

2. And performing abnormal scoring on the current login by using a user login machine learning model through machine learning. The specific machine learning algorithm used herein is not the focus of the present invention, and only an incremental machine learning algorithm, such as a Hoeffding tree, is required.

3. After the abnormal score is obtained, whether consultation is needed for the user is judged through active learning. Active learning maintains a threshold score, and when the anomaly score is above the threshold, processing is directed. Otherwise, consultation is initiated to the user. Therefore, the phenomenon that too much consultation is initiated to the user and the user experience is influenced can be avoided.

4. And after user feedback is obtained, taking the multidimensional attribute data and the login result of the current user as a training set, performing machine learning by adopting an incremental machine learning algorithm, and correcting the user login machine learning model. In this way, the model for machine learning can be continuously enhanced through continuous user feedback.

The above technical solution of the embodiment of the present invention is detailed below:

pretreatment:

the preprocessing stage mainly converts simple log logs into data with relatively comprehensive information. For example, whether the device belongs to a commonly used login place is determined according to the logged-in ip, and whether the device belongs to a commonly used device is determined according to the logged-in user substitution. Meanwhile, some statistical information can be collected in ip or user dimensions. For example, the login times of the current ip within 5 minutes, the failure frequency, and the previous login time interval of the current user. Only when the log is converted into data consisting of a large number of dimensional attributes, the current login behavior can be accurately and comprehensively described in a data form, and a necessary data base is made for machine learning.

Machine learning and user feedback:

machine learning belongs to a large domain category, and is commonly used to solve classification problems in multiple dimensions. The present invention is not limited to any modification of the machine learning algorithm portion, nor to any particular or class of algorithms, and is therefore described at a high level. The machine learning algorithm generates a usable model by learning the training set. Then, for new data, a score can be given directly through the model. The accuracy of this score is directly related to the number, dimensions, steps, etc. of the training set.

However, in practical applications, the collection process of the training set is not simple. First, there is a large log of logins each day, with only a small fraction of them behaving as abnormal logins. If the random extraction is simply performed, the training data of abnormal login is too little to be recognized well. In addition, even if the determination is made manually, it is difficult to accurately determine whether or not the login behavior is abnormal in some cases. After all, the staff cannot directly ask the user himself, and only an estimation can be made by means of the collected relevant information. Therefore, in this case, how to collect an accurate and comprehensive training set becomes one of the main challenges for introducing the machine learning algorithm.

The application example of the invention solves this problem by means of user feedback. First, the log is converted into multidimensional data available for machine learning, and then the user is queried in the form of mail, short message or private message. Let the user decide whether this login behavior was initiated by oneself. According to the result selected by the user, the multidimensional data can be marked as abnormal or normal and then directly put into a training set. If an incremental machine learning algorithm is adopted, training data can be immediately input into the machine learning algorithm, and then the machine learning algorithm continuously evolves a model thereof according to continuous data, so that the classification result is more and more accurate.

Active learning:

the way of asking the user, although directly effective, can have a certain impact on the user experience. In order to control the scope of this effect, the number of queries must be limited. At the same time, it must be ensured that machine learning is adequately trained. To meet these two requirements, the present invention introduces a way of active learning.

The active learning is to judge whether the current data needs to be accurately marked and retrained by people according to the scoring result of the machine learning. For example, if the abnormal score of a datum is 0 or 100, it means that the current result is well determined by machine learning, and if the datum is artificially labeled and retrained, it does not produce great gain to the evolution of the model. Conversely, if a data score is 50, it indicates that machine learning is not certain that the current login is abnormal, and human labeling and retraining can have a large impact on machine learning. In other words, it can be said that the data with an abnormal score of 50 points has a higher training value than the data with an abnormal score of 100 points.

Based on the principle, active learning maintains a threshold range of scores, and when the scores are within the threshold range, the data is high in training value, and the user needs to be consulted and retrained. The threshold value is adjusted continuously with the number of consultation times to ensure that only a certain percentage of users receive consultation requests. For example, the initial threshold value is 40-60, and only 20% of users are configured to receive the consultation request. Then, assuming that the proportion of users who have been consulted currently has reached 20%, and the abnormal score of the new login is 60%, the active learning strategy first determines that the users need to be consulted. Then, since the advisory rate has exceeded 20% at this time, active learning shrinks the threshold range, such as to 41-59. In this way, less data may be determined to require consultation, thereby limiting the continued growth in the proportion of users that consult. Conversely, if the current advisory rate is below 20%, the threshold range may be gradually relaxed until the advisory rate returns to 20%. Thus, active learning is equivalent to maintaining a self-adjusting threshold system, by which the training value of the training set can be maximized on the premise of ensuring the proportion of consulting users.

Feedback verification:

it should be noted that through the active learning screening, the queried user may have abnormal login behavior. This means that when the user is queried, it is possible that a malicious attacker is queried instead of the queried real user. Obviously, an attacker may try to give false feedback to affect the final detection effect of the machine learning system. Therefore, certain authentication thresholds must be set to prevent the attacker from giving false feedback when performing the challenge.

In order to collect enough feedback data, the entire feedback process (including verification auditing) must be completed through an automated process. As described above, there is a certain similarity between the problem of recognizing the abnormal feedback and the problem of recognizing the abnormal registration which the present invention attempts to solve. But, in contrast, for the login scenario, more needs to be taken into account for the impact of the user experience. While for feedback some strong authentication mechanisms can be added that impair the user experience. Because the feedback system belongs to an auxiliary system of the whole detection mechanism, the use of the product by the user is not directly influenced. For products with huge user bases, even a small part of users are willing to participate in the whole feedback mechanism, which is enough to promote the self-learning process. Therefore, this process can be prevented from being overly complicated by the introduction of a new anomaly feedback detection method again through a strong verification mechanism and appropriate product design. Partially trusted strong authentication mechanisms include: a verification password, a mobile phone or an identification number, etc. Even the verification effect can be enhanced by verifying the head portrait, the gesture and other novel verification technologies at present and making the user operate more easily.

Finally, the verification process is limited to automated procedures, so that one hundred percent correctness cannot be guaranteed. However, the processing of noise is a common problem in the field of machine learning, and most mainstream algorithms already have relatively mature noise processing solutions. Therefore, as long as the guarantee accuracy can be at a high level through the verification mechanism, a small amount of false feedback generated by the attacker can be regarded as noise, and the influence of the false feedback can be automatically eliminated by the machine learning algorithm.

The application example of the invention provides a user feedback-based abnormal login self-learning detection method. By introducing a machine learning mode into abnormal login detection, the problem of single dimension of the traditional method is solved, and excessive manual work can be avoided. More importantly, in consideration of the influence of the training set on the machine learning effect, the application example of the invention also provides a mode of collecting the training set through user feedback, so that the problem of collecting the training set in the process of applying the machine learning can be effectively solved. By introducing user feedback and considering user experience to a certain extent, accurate training data can be collected most efficiently, and the overall effect of machine learning is effectively improved.

It should be understood that the specific order or hierarchy of steps in the processes disclosed is an example of exemplary approaches. Based upon design preferences, it is understood that the specific order or hierarchy of steps in the processes may be rearranged without departing from the scope of the present disclosure. The accompanying method claims present elements of the various steps in a sample order, and are not intended to be limited to the specific order or hierarchy presented.

In the foregoing detailed description, various features are grouped together in a single embodiment for the purpose of streamlining the disclosure. This method of disclosure is not to be interpreted as reflecting an intention that the claimed embodiments of the subject matter require more features than are expressly recited in each claim. Rather, as the following claims reflect, invention lies in less than all features of a single disclosed embodiment. Thus, the following claims are hereby expressly incorporated into the detailed description, with each claim standing on its own as a separate preferred embodiment of the invention.

The previous description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the present invention. To those skilled in the art; various modifications to these embodiments will be readily apparent, and the generic principles defined herein may be applied to other embodiments without departing from the spirit or scope of the disclosure. Thus, the present disclosure is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

What has been described above includes examples of one or more embodiments. It is, of course, not possible to describe every conceivable combination of components or methodologies for purposes of describing the aforementioned embodiments, but one of ordinary skill in the art may recognize that many further combinations and permutations of various embodiments are possible. Accordingly, the embodiments described herein are intended to embrace all such alterations, modifications and variations that fall within the scope of the appended claims. Furthermore, to the extent that the term "includes" is used in either the detailed description or the claims, such term is intended to be inclusive in a manner similar to the term "comprising" as "comprising" is interpreted when employed as a transitional word in a claim. Furthermore, any use of the term "or" in the specification of the claims is intended to mean a "non-exclusive or".

Those of skill in the art will further appreciate that the various illustrative logical blocks, units, and steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, computer software, or combinations of both. To clearly illustrate the interchangeability of hardware and software, various illustrative components, elements, and steps have been described above generally in terms of their functionality. Whether such functionality is implemented as hardware or software depends upon the particular application and design requirements of the overall system. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present embodiments.

The various illustrative logical blocks, or elements, described in connection with the embodiments disclosed herein may be implemented or performed with a general purpose processor, a digital signal processor, an Application Specific Integrated Circuit (ASIC), a field programmable gate array or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general-purpose processor may be a microprocessor, but in the alternative, the processor may be any conventional processor, controller, microcontroller, or state machine. A processor may also be implemented as a combination of computing devices, e.g., a digital signal processor and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a digital signal processor core, or any other similar configuration.

The steps of a method or algorithm described in connection with the embodiments disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module may be stored in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. For example, a storage medium may be coupled to the processor such the processor can read information from, and write information to, the storage medium. In the alternative, the storage medium may be integral to the processor. The processor and the storage medium may reside in an ASIC, which may be located in a user terminal. In the alternative, the processor and the storage medium may reside in different components in a user terminal.

In one or more exemplary designs, the functions described above in connection with the embodiments of the invention may be implemented in hardware, software, firmware, or any combination of the three. If implemented in software, the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium. Computer-readable media includes both computer storage media and communication media that facilitate transfer of a computer program from one place to another. Storage media may be any available media that can be accessed by a general purpose or special purpose computer. For example, such computer-readable media can include, but is not limited to, RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to carry or store program code in the form of instructions or data structures and which can be read by a general-purpose or special-purpose computer, or a general-purpose or special-purpose processor. Additionally, any connection is properly termed a computer-readable medium, and, thus, is included if the software is transmitted from a website, server, or other remote source via a coaxial cable, fiber optic cable, twisted pair, Digital Subscriber Line (DSL), or wirelessly, e.g., infrared, radio, and microwave. Such discs (disk) and disks (disc) include compact disks, laser disks, optical disks, DVDs, floppy disks and blu-ray disks where disks usually reproduce data magnetically, while disks usually reproduce data optically with lasers. Combinations of the above may also be included in the computer-readable medium.

The above-mentioned embodiments are intended to illustrate the objects, technical solutions and advantages of the present invention in further detail, and it should be understood that the above-mentioned embodiments are merely exemplary embodiments of the present invention, and are not intended to limit the scope of the present invention, and any modifications, equivalent substitutions, improvements and the like made within the spirit and principle of the present invention should be included in the scope of the present invention.

Claims

1. An abnormal login detection method, characterized in that the method comprises:

if the abnormal score value is judged to be within the set abnormal score threshold range, initiating an inquiry whether the current user is allowed to log in to the current user, wherein the abnormal score threshold range is adjusted according to the proportion of the user who has been inquired currently, if the proportion of the user who has been inquired currently exceeds the set proportion, contracting the threshold range, and if the proportion of the user who has been inquired currently is lower than the set proportion, widening the threshold range;

processing whether the current user is allowed to log in or not according to the inquiry feedback result of the current user;

the method for establishing the user login machine learning model comprises the following steps:

obtaining a plurality of sample user login logs;

acquiring multidimensional attribute data and login results of the login of the plurality of sample users according to the login logs of the plurality of sample users;

and performing machine learning by using the multidimensional attribute data and the login results of the login of the plurality of sample users and adopting an incremental machine learning algorithm to establish a user login machine learning model.

2. The abnormal login detection method of claim 1, the method further comprising:

and taking the multidimensional attribute data and the login result of the current user as a training set, performing machine learning by adopting an incremental machine learning algorithm, and correcting the login machine learning model of the user.

3. The abnormal login detection method of claim 1, further comprising:

if the abnormal score value is judged to be higher than the maximum value in the set abnormal score threshold range, processing is directly carried out according to abnormal login;

and if the abnormal score value is judged to be lower than the minimum value in the set abnormal score threshold range, allowing login.

4. The abnormal login detection method of any one of claims 1-3, wherein the multi-dimensional attribute data comprises: whether the login belongs to a common login place, whether the login belongs to common login time, whether the login belongs to common login equipment, and dimension data are counted; the statistical dimensional data comprises: error rate within preset time, login times within preset time;

if the abnormal score value is judged to be within the set abnormal score threshold range, before the inquiry of whether the current user is allowed to log in is sent to the current user, the method further comprises the following steps:

the current user is forcibly authenticated through at least one of the following modes: verifying a password, a mobile phone number, an identity card number, a user head portrait and a gesture; and are

And confirming that the forced verification is passed.

5. An abnormal login detection apparatus, the apparatus comprising:

the active learning unit is used for initiating an inquiry about whether the current user is allowed to log in or not to the current user if the abnormal score value is judged to be within a set abnormal score threshold range, the abnormal score threshold range is adjusted according to the proportion of the user who has been inquired currently, if the proportion of the user who has been inquired currently exceeds a set proportion, the threshold range is contracted, and if the proportion of the user who has been inquired currently is lower than the set proportion, the threshold range is widened;

the exception handling unit is used for processing whether the current user is allowed to log in or not according to the inquiry feedback result of the current user;

the preprocessing unit is also used for acquiring a plurality of sample user login logs; acquiring multidimensional attribute data and login results of the login of the plurality of sample users according to the login logs of the plurality of sample users;

the machine learning unit includes:

and the user login machine learning model establishing module is used for performing machine learning by using the multidimensional attribute data and login results of the login of the plurality of sample users and adopting an incremental machine learning algorithm to establish the user login machine learning model.

6. The abnormal login detection device of claim 5,

the machine learning unit further comprises:

and the user login machine learning model correction module is used for performing machine learning by using the multidimensional attribute data and the login result of the current user as a training set and adopting an incremental machine learning algorithm to correct the user login machine learning model.

7. The abnormal login detection device of claim 5,

the abnormality processing unit is also used for directly processing according to the abnormal login if the abnormal score value is judged to be higher than the maximum value in the set abnormal score threshold range;

and the exception handling unit is also used for allowing login if the exception score value is judged to be lower than the minimum value in the set exception score threshold range.

8. The abnormal login detection apparatus of any one of claims 5-7, wherein the multi-dimensional attribute data comprises: whether the login belongs to a common login place, whether the login belongs to common login time, whether the login belongs to common login equipment, and dimension data are counted; the statistical dimensional data comprises: error rate within preset time, login times within preset time;

the active learning unit includes:

and the forced authentication module is used for performing forced authentication on the current user in at least one of the following modes before an inquiry whether the current user is allowed to log in is sent to the current user if the abnormal score value is judged to be within the set abnormal score threshold range: verifying a password, a mobile phone number, an identity card number, a user head portrait and a gesture; and confirms that the forced authentication passed.