CN109862004A - A kind of account usage behavior detection method and device - Google Patents
A kind of account usage behavior detection method and device Download PDFInfo
- Publication number
- CN109862004A CN109862004A CN201910078412.XA CN201910078412A CN109862004A CN 109862004 A CN109862004 A CN 109862004A CN 201910078412 A CN201910078412 A CN 201910078412A CN 109862004 A CN109862004 A CN 109862004A
- Authority
- CN
- China
- Prior art keywords
- account
- usage behavior
- business operation
- logging
- time point
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
Present disclose provides a kind of account usage behavior detection method and device, wherein the described method includes: detecting whether there is the usage behavior for continuously successively logging in multiple accounts；If there is the usage behavior, then the corresponding usage behavior parameter of each account in the multiple account is obtained；According to the usage behavior parameter, determine whether the usage behavior belongs to the target usage behavior that same user completes same business operation process using the multiple account.The disclosure, which can more accurately and efficiently detect whether that there are same users, completes the target usage behavior of same business operation process using multiple accounts, to preferably protect account number safety and data safety.
Description
Technical field
This disclosure relates to account number safety management domain more particularly to a kind of account usage behavior detection method and device.
Background technique
Currently, often there is a user in data share exchange platform using multiple accounts and complete the same business behaviour
The phenomenon that making process, the serious risk for being easy to cause data leak and being destroyed.
But in the prior art only by time interval length judge two operation behaviors whether be the same user row
For, but this mode be unable to judge accurately two operation behaviors whether be the same user behavior, it is same it is even more impossible to detect
User completes the complex scene of the same business operation process using multiple accounts.
Summary of the invention
In view of this, present disclose provides a kind of account usage behavior detection method and device, to solve in the related technology
Deficiency.
According to the first aspect of the embodiments of the present disclosure, a kind of account usage behavior detection method is provided, which comprises
Detect whether there is the usage behavior for continuously successively logging in multiple accounts；
If there is the usage behavior, then the corresponding usage behavior parameter of each account in the multiple account is obtained；
According to the usage behavior parameter, determine whether the usage behavior belongs to same user and use the multiple account
Complete the target usage behavior of same business operation process.
It is optionally, described to detect whether there is the usage behavior for continuously successively logging in multiple accounts, comprising:
In logging in log, the corresponding login time point of all accounts and logout time point are obtained；
Meet continuous successively registration conditions if there is the corresponding login time point of multiple accounts and logout time point,
Then determine the usage behavior for existing and continuously successively logging in multiple accounts.
Optionally, the continuous successively registration conditions include:
It is located at before the login time point of another account in predetermined period there are the logout time of account point；Or
Multiple corresponding login time points of account are located in the predetermined period and are not overlapped, while the multiple account
Number corresponding logout time point is not in target time section；The target time section is earliest in the multiple account
Login time point to the period between login time point the latest.
Optionally, the usage behavior parameter includes:
Log in the business operation executed after the device identification and login of internet protocol address, logging device.
It is optionally, described to obtain the corresponding usage behavior parameter of each account in the multiple account, comprising:
In logging in log, obtain that each account in the multiple account is corresponding to log in setting for IP address and logging device
Standby mark；
Operation log and flowing of access data are analyzed, determine that each account executes after logging in the multiple account
Business operation.
Optionally, described according to the usage behavior parameter, determine whether the usage behavior belongs to same user and use
The multiple account completes the target usage behavior of same business operation process, comprising:
If the corresponding login IP address of each account is identical in the multiple account, logging device device identification phase
The business operation executed after same and login meets same business operation process, it is determined that the usage behavior belongs to same user
The target usage behavior of same business operation process is completed using the multiple account.
Optionally, the business operation for determining that each account executes after logging in the multiple account in the following ways meets
Same business operation process, comprising:
According to the sequencing of the operating time point of business operation, executed after account each in the multiple account is logged in
Business operation successively matched with all business operations included by each business operation process prestored；
If the business operation that each account executes after logging in the multiple account and the business operation stream prestored
All business operation matchings included by journey, it is determined that the business operation symbol that each account executes after logging in the multiple account
One business operation process of contract.
According to the second aspect of an embodiment of the present disclosure, a kind of account usage behavior detection device is provided, described device includes:
First detection module is configured as detecting whether there is the usage behavior for continuously successively logging in multiple accounts；
Parameter acquisition module is configured as then obtaining each account in the multiple account if there is the usage behavior
Number corresponding usage behavior parameter；
Second detection module is configured as determining whether the usage behavior belongs to together according to the usage behavior parameter
One user completes the target usage behavior of same business operation process using the multiple account.
Optionally, the first detection module includes:
First acquisition submodule is configured as in logging in log, obtains the corresponding login time point of all accounts
With logout time point；
First determines submodule, is configured as if there is the corresponding login time point of multiple accounts and logout time
Point meets continuous successively registration conditions, it is determined that there is the usage behavior for continuously successively logging in multiple accounts.
Optionally, the continuous successively registration conditions include:
It is located at before the login time point of another account in predetermined period there are the logout time of account point；Or
Multiple corresponding login time points of account are located in the predetermined period and are not overlapped, while the multiple account
Number corresponding logout time point is not in target time section；The target time section is earliest in the multiple account
Login time point to the period between login time point the latest.
Optionally, the usage behavior parameter includes:
Log in the business operation executed after the device identification and login of internet protocol address, logging device.
Optionally, the parameter acquisition module includes:
Second acquisition submodule is configured as in logging in log, it is corresponding to obtain each account in the multiple account
Log in the device identification of IP address and logging device；
Second determines submodule, is configured as analyzing operation log and flowing of access data, determine the multiple
The business operation that each account executes after logging in account.
Optionally, second detection module includes:
Third determines submodule, if being configured as the corresponding login IP address phase of each account in the multiple account
Business operation that is identical with, the device identification of logging device and executing after logging in meets same business operation process, it is determined that institute
It states usage behavior and belongs to the target usage behavior that same user completes same business operation process using the multiple account.
Optionally, the third determines that submodule includes:
Matching unit is configured as the sequencing of the operating time point according to business operation, will be in the multiple account
The business operation that each account executes after logging in all business operations included by each business operation process prestored successively
Matching；
Determination unit, if being configured as the business operation executed after each account login in the multiple account and prestoring
A business operation process included by the matching of all business operations, it is determined that after each account logs in the multiple account
The business operation of execution meets same business operation process.
According to the third aspect of an embodiment of the present disclosure, a kind of computer readable storage medium is provided, the storage medium is deposited
Computer program is contained, the computer program is for executing account usage behavior detection method described in above-mentioned first aspect.
According to a fourth aspect of embodiments of the present disclosure, a kind of account usage behavior detection device is provided, described device includes:
Processor；
Memory for storage processor executable instruction；
Wherein, the processor is configured to:
Detect whether there is the usage behavior for continuously successively logging in multiple accounts；
If there is the usage behavior, then the corresponding usage behavior parameter of each account in the multiple account is obtained；
According to the usage behavior parameter, determine whether the usage behavior belongs to same user and use the multiple account
Complete the target usage behavior of same business operation process.
The technical scheme provided by this disclosed embodiment can include the following benefits:
It, can be when in the presence of continuously the usage behavior of multiple accounts be successively logged in, according to multiple accounts in the embodiment of the present disclosure
The corresponding usage behavior parameter of each account in number, come determine the usage behavior whether belong to same user use it is the multiple
Account completes the target usage behavior of same business operation process.By the above process, it can more accurately and efficiently detect
The target usage behavior for completing same business operation process using multiple accounts with the presence or absence of same user, to preferably protect
Account number safety and data safety.
It should be understood that above general description and following detailed description be only it is exemplary and explanatory, not
The disclosure can be limited.
Detailed description of the invention
The drawings herein are incorporated into the specification and forms part of this specification, and shows the implementation for meeting the disclosure
Example, and together with specification for explaining the principles of this disclosure.
Fig. 1 is a kind of disclosure account usage behavior detection method flow chart shown according to an exemplary embodiment；
Fig. 2 is the disclosure another account usage behavior detection method flow chart shown according to an exemplary embodiment；
Fig. 3 is the disclosure another account usage behavior detection method flow chart shown according to an exemplary embodiment；
Fig. 4 is a kind of disclosure account usage behavior detection device block diagram shown according to an exemplary embodiment；
Fig. 5 is the disclosure another account usage behavior detection device block diagram shown according to an exemplary embodiment；
Fig. 6 is the disclosure another account usage behavior detection device block diagram shown according to an exemplary embodiment；
Fig. 7 is the disclosure another account usage behavior detection device block diagram shown according to an exemplary embodiment；
Fig. 8 is the disclosure another account usage behavior detection device block diagram shown according to an exemplary embodiment；
Fig. 9 is an a kind of disclosure knot for account usage behavior detection device shown according to an exemplary embodiment
Structure schematic diagram.
Specific embodiment
Example embodiments are described in detail here, and the example is illustrated in the accompanying drawings.Following description is related to
When attached drawing, unless otherwise indicated, the same numbers in different drawings indicate the same or similar elements.Following exemplary embodiment
Described in embodiment do not represent all implementations consistent with this disclosure.On the contrary, they be only with it is such as appended
The example of the consistent device and method of some aspects be described in detail in claims, the disclosure.
It is only to be not intended to be limiting the disclosure merely for for the purpose of describing particular embodiments in the term of disclosure operation.
The "an" of the singular run in disclosure and the accompanying claims book, " described " and "the" are also intended to including majority
Form, unless the context clearly indicates other meaning.It is also understood that the term "and/or" run herein refers to and wraps
It may be combined containing one or more associated any or all of project listed.
It will be appreciated that though various information, but this may be described using term first, second, third, etc. in the disclosure
A little information should not necessarily be limited by these terms.These terms are only used to for same type of information being distinguished from each other out.For example, not departing from
In the case where disclosure range, the first information can also be referred to as the second information, and similarly, the second information can also be referred to as
One information.Depending on context, as run at this word " if " can be construed to " and ... when " or " when ...
When " or " in response to determination ".
The account usage behavior detection method that the embodiment of the present disclosure provides can be used for data share exchange platform.Such as Fig. 1
Shown, Fig. 1 is a kind of account usage behavior detection method shown according to an exemplary embodiment, comprising the following steps:
In a step 101, detect whether there is the usage behavior for continuously successively logging in multiple accounts；
In a step 102, if there is the usage behavior, then obtain in the multiple account that each account is corresponding to be made
Use behavioral parameters；
In step 103, according to the usage behavior parameter, determine whether the usage behavior belongs to same user and use
The multiple account completes the target usage behavior of same business operation process.
It, can be when in the presence of continuously the usage behavior of multiple accounts be successively logged in, according to multiple accounts in above-described embodiment
In the corresponding usage behavior parameter of each account, use the multiple account to determine whether the usage behavior belongs to same user
Number complete the target usage behavior of same business operation process.By the above process, can more accurately and efficiently detect be
No there are same users that the target usage behavior of same business operation process is completed using multiple accounts, to preferably protect account
Number safety and data safety.
For above-mentioned steps 101, as shown in Fig. 2, Fig. 2 is another shown on the basis of aforementioned embodiment illustrated in fig. 1
Kind account usage behavior detection method, step 101 may comprise steps of:
In step 101-1, in logging in log, the corresponding login time point of all accounts and logout time are obtained
Point；
In this step, each account login time point has been had recorded in the login log of data share exchange platform and has been stepped on
The information such as time point out, data share exchange platform can extract the corresponding login of all accounts from the login log
Time point and logout time point, such as shown in table 1.
Table 1
In step 101-2, meets if there is the corresponding login time point of multiple accounts and logout time point and connect
Continuous successively registration conditions, it is determined that there is the usage behavior for continuously successively logging in multiple accounts.
In this step, continuous successively registration conditions may include: in predetermined period memory described in data share exchange platform
Before the logout time point of an account is located at the login time point of another account.Predetermined period can be daily, every 6
Hour etc..
If in current period, there are the logout time of account point be located at another account login time point it
Before, then being assured that user continuously successively logs in the two accounts, it can determine and successively log in multiple accounts in the presence of continuous
Number usage behavior.
Such as predetermined period be it is daily, data share exchange platform is found according to table 1 December 1, and account A's publishes
Time point is located at before the login time point of account B, and the logout time point of account B is located at before the login time point of account C,
Then data share exchange platform can be determined in December 1 user continuously successively login account A, account B and account C, that is, be existed
The usage behavior of continuous successively login account A, account B and account C.
Alternatively, the continuous successively registration conditions may include: that the corresponding login time point of multiple accounts is located at institute
It states in predetermined period and is not overlapped, while the corresponding logout time point of the multiple account is not in target time section
It is interior；The target time section is login time point earliest in the multiple account to the time between login time point the latest
Section.
Such as predetermined period be it is daily, data share exchange platform is found according to table 1 in December 3, account A and account
The corresponding login time point of B is not overlapped, and target time section is by earliest login time point (the login time point of account A)
To the period between login time point (the login time point of account B) 11:00 the latest, account A and account B's steps on 10:05
Time point is not in above-mentioned target time section out.Therefore, data share exchange platform can be determined connects in user on December 3
That is, there is the usage behavior of continuous successively login account B and account C in continuous successively login account B and account C.
For above-mentioned steps 102, in the embodiments of the present disclosure, optionally, usage behavior parameter may include logging in IP
(Internet Protocol, Internet protocol) address, logging device device identification and login after the business operation that executes.
Correspondingly, as shown in figure 3, Fig. 3 is another account use shown on the basis of aforementioned embodiment illustrated in fig. 1
Behavioral value method, step 102 may comprise steps of:
In step 102-1, in logging in log, the corresponding login IP address of each account in the multiple account is obtained
With the device identification of logging device；
In the embodiment of the present disclosure, corresponding login IP address when pre-recorded all accounts log in the login log
With the device identification of logging device.In this step, data share exchange platform is directly by more described in the login log acquisition
The corresponding device identification for logging in IP address and logging device of a each account of account.
For example, there is the usage behavior of successively continuous login account A, account B and account C December 1, data sharing is handed over
It is address 1 that platform, which is changed, from the corresponding login IP address of acquisition account A in log is logged in, and the device identification of logging device is equipment a,
The corresponding login IP address of account B is address 2, and the device identification of logging device is equipment b, the corresponding login IP address of account C
For address 3, the device identification of logging device is equipment c.
In step 102-2, operation log and flowing of access data are analyzed, determined each in the multiple account
The business operation that account executes after logging in.
In the embodiment of the present disclosure, operation log recording is in business operation process performed after all accounts log in
The business operation procedure links of catalogue submission are performed after business operation procedure links, such as account A login.And flowing of access number
Have recorded specific business operation performed every time after all accounts log in, for example, account A log in after perform catalogue and mention
Online editing catalogue, upload catalogue in the business operation procedure links of friendship and three business operations for submitting catalogue.
In this step, data share exchange platform needs binding operation log and flowing of access data while being divided
Analysis, so that it is determined that the business operation that each account executes after logging in the multiple account.Such as account A on December 1, account B
Which specific business operation is performed respectively with account C.
For above-mentioned steps 103,
Data share exchange platform can be according to the sequencing of the operating time point of business operation, by the multiple account
In each account log in after the business operation that executes and all business operations included by each business operation process for prestoring according to
Secondary matching.If the business operation that each account executes after logging in the multiple account and the business operation process prestored
Included all business operations matching, it is determined that the business operation that each account executes after logging in the multiple account meets
Same business operation process.By taking the business operation process of data publication uplink as an example, including business operation link be followed successively by number
It is submitted according to the catalogue of publication department, the audit of the catalogue of data publication department, the center audit of data share exchange platform.Center is examined
It can be carried out the online publication of data after the completion of core.
Each business operation link further includes at least one specific business operation, such as the catalogue of data publication department mentions
Friendship includes online editing catalogue, the business operation for uploading catalogue, submission catalogue.
Data share exchange platform needs the business executed after logging according to account each in predetermined multiple accounts
Operation is successively matched with specific business operation included by each service link in above-mentioned business operation process, such as according to
After the sequencing sequence of operating time point, business operation account A performed after logging in includes data use, online editing mesh
Record uploads catalogue, submits catalogue, wherein the catalogue in three business operations business operation process online with data publication mentions afterwards
All business operation matchings included by cross ring section, it is determined that account A was executed is that catalogue submits link.Certainly, other industry
It may also include that catalogue submits link in operating process of being engaged in, data share exchange platform can determine to be executed after account A is logged in
It is the catalogue submission link in different business operating process.
Whether the business operation executed after respectively logging in it is possible to further determining account B and account C in the manner described above
It is matched with all business operations included by the service link in some business operation process, such as executed after account B login
All business operations included by catalogue audit link in the business operation business operation process online with data publication match,
Included by center audit link in the business operation and the online business operation process of data publication that account C is executed after logging in
All business operation matchings.
Final data shares switching plane and determines the business operation executed after account A, account B and account C login and prestore
The online business operation process of data publication included by all business operations matchings, then being assured that in multiple accounts
The business operation that each account executes after logging in meets same business operation process.
If each account is corresponding in the multiple account logs in that IP address is identical and the device identification phase of logging device
Together, while after logging in the business operation executed meets same business operation process, then data share exchange platform can determine
There is user to use same equipment successively to log in the multiple account to complete same business operation process, it is contemplated that general same
One user will use same equipment, and therefore, above-mentioned usage behavior can determine that belonging to same user uses the multiple account complete
At the target usage behavior of same business operation process.
Above-described embodiment is further illustrated as follows.
Data share exchange platform can extract the corresponding login time point of all accounts in predetermined period and logout time
Point, wherein if there are the login times that the logout time of account point is located at another account in the predetermined period
Before point, then data share exchange platform is assured that in the presence of the usage behavior for continuously successively logging in multiple accounts.Or such as
Fruit multiple corresponding login time points of account in the predetermined period are located in the predetermined period and are not overlapped, simultaneously
The multiple corresponding logout time point of account is not in target time section；The target time section is the multiple
Earliest login time point is to the period between login time point the latest in account, then data share exchange platform can also
To determine the usage behavior for existing and continuously successively logging in multiple accounts.
Further, data share exchange platform can obtain each account pair in above-mentioned multiple accounts from logging in log
The device identification of the login IP address and logging device answered, furthermore it is possible to be carried out simultaneously to operation log and flowing of access data
Analysis determines which specific business operation performed after each account logs in.
By taking the business operation process of data share exchange as an example, the business operation process of data share exchange includes: to propose
The department of data exchange executes exchange audit, proposes that department's execution of data exchange obtains portion corresponding to audit, data exchange
Door executes supply audit, the audit of data share exchange platform implementation center, proposes that the department of data exchange executes data and uses.Most
The business operation process of data exchange is completed eventually.In the business operation process of data exchange each business operation link include to
A few specific business operation.
If data share exchange platform is according to the sequencing of the operating time point of business operation, by the multiple account
In each account log in after the business operation that executes and all business operations included by each business operation process for prestoring according to
Secondary matching finally determines the business operation that each account executes after logging in the multiple account and the data share exchange prestored
Business operation process included by the matching of all business operations, then data share exchange platform is assured that multiple accounts
In each account log in after the business operation that executes meet same business operation process.
Data share exchange platform determines corresponding in the presence of the continuous usage behavior for successively logging in multiple accounts, each account
Log in the business that IP address is identical, logging device device identification is identical, each account executes after logging in the multiple account
At this moment one business operation process of operator contract is assured that the usage behavior belongs to same user and uses the multiple account
Number complete the target usage behavior of same business operation process.
Further, data share exchange platform can be alerted at this time, and there is currently same users to use institute for prompting
State the target usage behavior that multiple accounts complete same business operation process, administrator or fortune convenient for data share exchange platform
Dimension personnel are managed above-mentioned target usage behavior.
Above example implements more accurately and efficiently detect whether that there are same users to complete using multiple accounts
The purpose of the target usage behavior of same business operation process, to preferably protect account number safety and data safety.
In the embodiments of the present disclosure, business operation process include but is not limited to data publication uplink business operation process and
The data service operating process of data share exchange, if determine in the manner described above multiple accounts used by same user,
And the business operation that each account executes after logging in the multiple account meets same business operation process, then can be true
The fixed usage behavior belongs to the target usage behavior that same user completes same business operation process using the multiple account.
Corresponding with preceding method embodiment, the disclosure additionally provides the embodiment of device.
As shown in figure 4, Fig. 4 is a kind of disclosure account usage behavior detection device shown according to an exemplary embodiment
Block diagram, described device include:
First detection module 210 is configured as detecting whether there is the usage behavior for continuously successively logging in multiple accounts；
Parameter acquisition module 220 is configured as then obtaining each in the multiple account if there is the usage behavior
The corresponding usage behavior parameter of account；
Second detection module 230 is configured as determining whether the usage behavior belongs to according to the usage behavior parameter
Same user completes the target usage behavior of same business operation process using the multiple account.
As shown in figure 5, Fig. 5 disclosure another account usage behavior detection device shown according to an exemplary embodiment
Block diagram, on the basis of 4 embodiment of earlier figures, the first detection module 210 includes: the embodiment
First acquisition submodule 211 is configured as in logging in log, obtains the corresponding login time of all accounts
Point and logout time point；
First determines submodule 212, is configured as if there is the corresponding login time point of multiple accounts and publishes
Time point meets continuous successively registration conditions, it is determined that there is the usage behavior for continuously successively logging in multiple accounts.
Optionally, the continuous successively registration conditions include:
It is located at before the login time point of another account in predetermined period there are the logout time of account point；Or
Multiple corresponding login time points of account are located in the predetermined period and are not overlapped, while the multiple
The corresponding logout time point of account is not in target time section；The target time section be in the multiple account most
Early login time point is to the period between login time point the latest.
Optionally, the usage behavior parameter includes:
Log in the business operation executed after the device identification and login of internet protocol address, logging device.
As shown in fig. 6, Fig. 6 disclosure another account usage behavior detection device shown according to an exemplary embodiment
Block diagram, on the basis of 4 embodiment of earlier figures, the parameter acquisition module 220 includes: the embodiment
Second acquisition submodule 221 is configured as in logging in log, and it is corresponding to obtain each account in the multiple account
Login IP address and logging device device identification；
Second determines submodule 222, is configured as analyzing operation log and flowing of access data, determine described more
The business operation that each account executes after logging in a account.
As shown in fig. 7, Fig. 7 disclosure another account usage behavior detection device shown according to an exemplary embodiment
Block diagram, on the basis of 4 embodiment of earlier figures, second detection module 230 includes: the embodiment
Third determines submodule 231, if being configured as the corresponding login IP address of each account in the multiple account
Identical, logging device device identification is identical and the business operation that executes meets same business operation process after logging in, it is determined that
The usage behavior belongs to same user and uses row using the target that the multiple account completes same business operation process
For.
As shown in figure 8, Fig. 8 disclosure another account usage behavior detection device shown according to an exemplary embodiment
Block diagram, for the embodiment on the basis of 7 embodiment of earlier figures, the third determines that submodule 231 includes:
Matching unit 2311 is configured as the sequencing of the operating time point according to business operation, by the multiple account
The business operation that each account executes after logging in number and all business operations included by each business operation process prestored
Successively match；
Determination unit 2312, if be configured as each account executes after logging in the multiple account business operation with
All business operation matchings included by the business operation process prestored, it is determined that each account is stepped in the multiple account
The business operation executed after record meets same business operation process.
For device embodiment, since it corresponds essentially to embodiment of the method, so related place is referring to method reality
Apply the part explanation of example.The apparatus embodiments described above are merely exemplary, wherein being used as separate part description
Unit may or may not be physically separated, component shown as a unit may or may not be
Physical unit, it can it is in one place, or may be distributed over multiple network units.It can be according to the actual needs
Some or all of the modules therein is selected to realize the purpose of disclosure scheme.Those of ordinary skill in the art are not paying wound
In the case that the property made is worked, it can understand and implement.
Correspondingly, the disclosure also provides a kind of computer readable storage medium, the storage medium is stored with computer journey
Sequence, the computer program are used to execute any of the above-described account usage behavior detection method.
Correspondingly, the disclosure also provides a kind of account usage behavior detection device, described device includes:
Processor；
Memory for storage processor executable instruction；
Wherein, the processor is configured to:
Detect whether there is the usage behavior for continuously successively logging in multiple accounts；
If there is the usage behavior, then the corresponding usage behavior parameter of each account in the multiple account is obtained；
According to the usage behavior parameter, determine whether the usage behavior belongs to same user and use the multiple account
Complete the target usage behavior of same business operation process.
As shown in figure 9, Fig. 9 is shown according to an exemplary embodiment a kind of for account usage behavior detection device
900 structural schematic diagram.For example, device 900 may be provided as a data share exchange platform.Referring to Fig. 9, device 900
It further comprise one or more processors including processing component 922, and the money of the memory as representated by memory 932
Source, can be by the instruction of the execution of processing component 922, such as application program for storing.The application program stored in memory 932
May include it is one or more each correspond to one group of instruction module.In addition, processing component 922 is configured as holding
Row instruction, to execute any of the above-described account usage behavior detection method.
Device 900 can also include the power management that a power supply module 926 is configured as executive device 9100, and one has
Line or radio network interface 950 are configured as device 900 being connected to network and input and output (I/O) interface 958.Dress
Setting 900 can operate based on the operating system for being stored in memory 932, such as Windows ServerTM, Mac OS XTM,
UnixTM, LinuxTM, FreeB SDTM or similar.
Those skilled in the art after considering the specification and implementing the invention disclosed here, will readily occur to its of the disclosure
Its embodiment.The disclosure is intended to cover any variations, uses, or adaptations of the disclosure, these modifications, purposes or
Person's adaptive change follows the general principles of this disclosure and including the undocumented common knowledge in the art of the disclosure
Or conventional techniques.The description and examples are only to be considered as illustrative, and the true scope and spirit of the disclosure are by following
Claim point out.
The foregoing is merely the preferred embodiments of the disclosure, not to limit the disclosure, all essences in the disclosure
Within mind and principle, any modification, equivalent substitution, improvement and etc. done be should be included within the scope of disclosure protection.
Claims (16)
1. a kind of account usage behavior detection method, which is characterized in that the described method includes:
Detect whether there is the usage behavior for continuously successively logging in multiple accounts；
If there is the usage behavior, then the corresponding usage behavior parameter of each account in the multiple account is obtained；
According to the usage behavior parameter, determine whether the usage behavior is belonged to same user and completed using the multiple account
The target usage behavior of same business operation process.
2. the method according to claim 1, wherein described detect whether successively to log in multiple accounts in the presence of continuous
Usage behavior, comprising:
In logging in log, the corresponding login time point of all accounts and logout time point are obtained；
Meet continuous successively registration conditions if there is the corresponding login time point of multiple accounts and logout time point, then really
It is fixed to there is the usage behavior for continuously successively logging in multiple accounts.
3. according to the method described in claim 2, it is characterized in that, the continuous successively registration conditions include:
It is located at before the login time point of another account in predetermined period there are the logout time of account point；Or
Multiple corresponding login time points of account are located in the predetermined period and are not overlapped, while the multiple account is each
Self-corresponding logout time point is not in target time section；The target time section is earliest in the multiple account steps on
Record time point to the period between login time point the latest.
4. the method according to claim 1, wherein the usage behavior parameter includes:
Log in the business operation executed after the device identification and login of internet protocol address, logging device.
5. according to the method described in claim 4, it is characterized in that, each account is corresponding in the multiple account of acquisition
Usage behavior parameter, comprising:
In logging in log, the corresponding equipment mark for logging in IP address and logging device of each account in the multiple account is obtained
Know；
Operation log and flowing of access data are analyzed, determine the industry that each account executes after logging in the multiple account
Business operation.
6. according to the method described in claim 5, it is characterized in that, described according to the usage behavior parameter, determine described in make
Whether belong to the target usage behavior that same user completes using the multiple account same business operation process, packet with behavior
It includes:
If the corresponding login IP address of each account is identical in the multiple account, logging device device identification is identical and
The business operation executed after login meets same business operation process, it is determined that the usage behavior belongs to same user and uses institute
State the target usage behavior that multiple accounts complete same business operation process.
7. according to the method described in claim 6, it is characterized in that, determining each account in the multiple account in the following ways
The business operation that executes meets same business operation process after number logging in:
According to the sequencing of the operating time point of business operation, the industry executed after account each in the multiple account is logged in
Business operation is successively matched with all business operations included by each business operation process prestored；
If the business operation that each account executes after logging in the multiple account and the business operation process institute prestored
Including the matching of all business operations, it is determined that the business operation that each account executes after logging in the multiple account meets together
One business operation process.
8. a kind of account usage behavior detection device, which is characterized in that described device includes:
First detection module is configured as detecting whether there is the usage behavior for continuously successively logging in multiple accounts；
Parameter acquisition module is configured as then obtaining each account pair in the multiple account if there is the usage behavior
The usage behavior parameter answered；
Second detection module is configured as determining whether the usage behavior belongs to same use according to the usage behavior parameter
The target usage behavior of same business operation process is completed using the multiple account in family.
9. device according to claim 8, which is characterized in that the first detection module includes:
First acquisition submodule is configured as in logging in log, is obtained the corresponding login time point of all accounts and is stepped on
Time point out；
First determines submodule, is configured as full if there is the corresponding login time point of multiple accounts and logout time point
The continuous successively registration conditions of foot, it is determined that there is the usage behavior for continuously successively logging in multiple accounts.
10. device according to claim 9, which is characterized in that described continuously successively registration conditions include:
It is located at before the login time point of another account in predetermined period there are the logout time of account point；Or
Multiple corresponding login time points of account are located in the predetermined period and are not overlapped, while the multiple account is each
Self-corresponding logout time point is not in target time section；The target time section is earliest in the multiple account steps on
Record time point to the period between login time point the latest.
11. device according to claim 8, which is characterized in that the usage behavior parameter includes:
Log in the business operation executed after the device identification and login of internet protocol address, logging device.
12. device according to claim 11, which is characterized in that the parameter acquisition module includes:
Second acquisition submodule is configured as in logging in log, obtains the corresponding login of each account in the multiple account
The device identification of IP address and logging device；
Second determines submodule, is configured as analyzing operation log and flowing of access data, determines the multiple account
In each account log in after the business operation that executes.
13. device according to claim 12, which is characterized in that second detection module includes:
Third determines submodule, if be configured as, the corresponding login IP address of each account in the multiple account is identical, steps on
The device identification of recording apparatus is identical and the business operation that executes meets same business operation process after logging in, it is determined that described to make
Belong to the target usage behavior that same user completes using the multiple account same business operation process with behavior.
14. device according to claim 13, which is characterized in that the third determines that submodule includes:
Matching unit is configured as the sequencing of the operating time point according to business operation, will be each in the multiple account
The business operation that account executes after logging in successively is matched with all business operations included by each business operation process prestored；
Determination unit, if being configured as the business operation that each account executes after logging in the multiple account and prestore one
All business operation matchings included by a business operation process, it is determined that each account executes after logging in the multiple account
Business operation meet same business operation process.
15. a kind of computer readable storage medium, which is characterized in that the storage medium is stored with computer program, the meter
Calculation machine program is used to execute any account usage behavior detection method of the claims 1-7.
16. a kind of account usage behavior detection device, which is characterized in that described device includes:
Processor；
Memory for storage processor executable instruction；
Wherein, the processor is configured to:
Detect whether there is the usage behavior for continuously successively logging in multiple accounts；
If there is the usage behavior, then the corresponding usage behavior parameter of each account in the multiple account is obtained；
According to the usage behavior parameter, determine whether the usage behavior is belonged to same user and completed using the multiple account
The target usage behavior of same business operation process.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910078412.XA CN109862004B (en) | 2019-01-28 | 2019-01-28 | Account use behavior detection method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910078412.XA CN109862004B (en) | 2019-01-28 | 2019-01-28 | Account use behavior detection method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN109862004A true CN109862004A (en) | 2019-06-07 |
| CN109862004B CN109862004B (en) | 2021-08-24 |
Family
ID=66896375
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910078412.XA Active CN109862004B (en) | 2019-01-28 | 2019-01-28 | Account use behavior detection method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109862004B (en) |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104980400A (en) * | 2014-04-08 | 2015-10-14 | 深圳市腾讯计算机系统有限公司 | Login access control method and login access control server |
| US9183387B1 (en) * | 2013-06-05 | 2015-11-10 | Google Inc. | Systems and methods for detecting online attacks |
| CN106843868A (en) * | 2017-01-13 | 2017-06-13 | 北京奇虎科技有限公司 | Method, device and mobile terminal that a kind of many accounts are logged in |
| CN108055281A (en) * | 2017-12-27 | 2018-05-18 | 百度在线网络技术（北京）有限公司 | Account method for detecting abnormality, device, server and storage medium |
| CN108173847A (en) * | 2017-12-27 | 2018-06-15 | 百度在线网络技术（北京）有限公司 | Multi-accounting number users method for tracing, device, equipment and computer-readable medium |
| CN109005156A (en) * | 2018-07-05 | 2018-12-14 | 泰康保险集团股份有限公司 | The shared determination method and device of account |
-
2019
- 2019-01-28 CN CN201910078412.XA patent/CN109862004B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US9183387B1 (en) * | 2013-06-05 | 2015-11-10 | Google Inc. | Systems and methods for detecting online attacks |
| CN104980400A (en) * | 2014-04-08 | 2015-10-14 | 深圳市腾讯计算机系统有限公司 | Login access control method and login access control server |
| CN106843868A (en) * | 2017-01-13 | 2017-06-13 | 北京奇虎科技有限公司 | Method, device and mobile terminal that a kind of many accounts are logged in |
| CN108055281A (en) * | 2017-12-27 | 2018-05-18 | 百度在线网络技术（北京）有限公司 | Account method for detecting abnormality, device, server and storage medium |
| CN108173847A (en) * | 2017-12-27 | 2018-06-15 | 百度在线网络技术（北京）有限公司 | Multi-accounting number users method for tracing, device, equipment and computer-readable medium |
| CN109005156A (en) * | 2018-07-05 | 2018-12-14 | 泰康保险集团股份有限公司 | The shared determination method and device of account |
Also Published As
| Publication number | Publication date |
|---|---|
| CN109862004B (en) | 2021-08-24 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US11588841B2 (en) | Generating malicious network traffic detection models using cloned network environments | |
| CN105279435B (en) | Webpage leak detection method and device | |
| CN105630977B (en) | Application program recommended method, apparatus and system | |
| CN107402880A (en) | A kind of method of testing and electronic equipment | |
| CN110968864B (en) | Emergency response processing method and device for security event | |
| CN106161096A (en) | Port configuration method and device | |
| CN105787364A (en) | Automated testing method, device and system for task | |
| CN109284227A (en) | A kind of automation method for testing pressure and device calculate equipment and storage medium | |
| CN110347593A (en) | Flow testing method and device | |
| CN110519127A (en) | Detection method, device and the storage medium of network delay | |
| CN109617924A (en) | A kind of account usage behavior detection method and device | |
| CN107612735A (en) | A kind of broadband On-line Fault processing method, server and user terminal | |
| US11921615B2 (en) | Computer-implemented methods, computer-readable media and electronic devices for processing test electronic transactions | |
| CN109600398A (en) | A kind of account usage behavior detection method and device | |
| CN110399723A (en) | Leak detection method and device, storage medium and electronic device | |
| CN109471839A (en) | Inventory management of resources method and device | |
| CN109862004A (en) | A kind of account usage behavior detection method and device | |
| US20210243219A1 (en) | Security handling skill measurement system, method, and program | |
| CN110413526A (en) | A kind of request processing method, device, server and equipment | |
| CN107483294A (en) | Monitor the method and device of network request | |
| JP6977133B2 (en) | Methods and systems for securely conducting digital tests | |
| CN113014587A (en) | API detection method and device, electronic equipment and storage medium | |
| CN109660582A (en) | Method for pushing, device, storage medium and the electronic equipment of account number signal | |
| CN110060070A (en) | The circulation of fresh seasonal vegetable is traced to the source monitoring method and device, storage medium, terminal | |
| CN109818833B (en) | Ethernet test system and Ethernet test method |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |