CN114465977A - Method, device, equipment and storage medium for detecting mailbox login abnormity - Google Patents

Abstract

The invention discloses a method, device, equipment and storage medium for detecting abnormality of mailbox login, comprising: acquiring all login records of a user's mailbox, and establishing a trusted IP list and standard according to normal emails preset in the user's mailbox User portrait; according to the preset geographic information database of the login IP, obtain the longitude and latitude of the corresponding area of each login record; wherein, each login record includes a login IP and a login time; The switching speed of the latitude and longitude of the region corresponding to the secondary login record, and screen out suspicious login records according to a preset speed threshold; according to the trusted IP list and the standard user portrait, the suspicious login records are eliminated. The suspicious login records after the removal operation are regarded as abnormal records. The invention solves the technical problem of low detection accuracy of log-in abnormality for log-in area switching in the prior art.

Description

A method, device, device and storage medium for detecting abnormality of mailbox login

technical field

The invention relates to the field of network information technology security, and in particular, to a method, device, device and storage medium for detecting abnormality of mailbox login.

Background technique

Unauthorized login detection of e-mail is an important application in the field of email security. The application of e-mail is very extensive, and the security of enterprise e-mail is more related to the interests of companies, enterprises, etc. Most enterprises, government departments, scientific research units, etc. use enterprise e-mails for official document delivery, modification and approval. Many highly confidential data contains in it. However, during the transmission process of e-mail, it needs to be forwarded on different mail servers, which brings opportunities for attackers. There are many ways to leak email passwords, including but not limited to phishing emails (deceiving users to click an unknown URL in the email to an illegal login page and stealing the user's account password), brute force cracking (using a large number of IPs to quickly try a large number of A large number of account passwords, there is a certain probability that some email accounts with simple passwords can be cracked), Trojans (install Trojans on client machines through email or other download methods and steal user account passwords), credential stuffing (users account passwords in multiple After the website is shared, one of the website backgrounds is compromised and the account password is stolen, and the same password can be used to log in to other systems or the corresponding mail system). Due to the endless emergence of attack methods, it can only be considered that some users must have their corresponding mailbox account passwords stolen for some of the above reasons. Therefore, a method is needed to determine whether the user is currently logged in or other unauthorized users.

At present, the vast majority of email account login risk control security detections are aimed at a specific leakage route. For example, the attacker's IP address is obtained by clustering and other methods, and the common login IP of the suspicious mailbox is finally determined to determine the attacker. However, for attackers with a large number of agents suspected of logging into stolen accounts from different IPs, or low-frequency continuous monitoring attacks targeting a small number of high-value accounts, the method based on common login IP may not be able to capture such abnormal logins; for brute force cracking, for the same One IP tries a large number of different accounts and a large number of different passwords, and a certain threshold is set; for remote login risk control, additional two-factor authentication is required for the logged in user, but for users who may use VPN and other proxies, when switching the corresponding geographical location, Or based on different IP geographic unknown information bases, there is a certain probability that the wrong IP corresponding geographic location will be returned, resulting in complicated login process or even failure.

Therefore, there is an urgent need for a strategy for detecting the login anomaly of an enterprise mailbox, so as to solve the situation in the prior art that the user uses an agent to switch the login area and cause false alarms, which makes the detection inaccurate.

SUMMARY OF THE INVENTION

The present invention provides a method, device, device and storage medium for detecting abnormality of mailbox login, so as to solve the technical problem of low detection accuracy of login abnormality for login area switching in the prior art.

In order to solve the above technical problems, an embodiment of the present invention provides a method for detecting abnormality of mailbox login, including:

Acquire all login records of the user's mailbox, and establish a trusted IP list and standard user portraits according to the normal emails preset in the user's mailbox;

Obtain the latitude and longitude of the region corresponding to each login record according to the preset geographic information database of the login IP; wherein, each login record includes a login IP and a login time;

According to the login time, successively calculate the switching speed of the latitude and longitude of the area corresponding to each adjacent two login records, and filter out suspicious login records according to a preset speed threshold;

According to the trusted IP list and the standard user portrait, the suspicious login record is eliminated, and the suspicious login record after the elimination operation is regarded as an abnormal record.

As a preferred solution, after the suspicious login records after the removal operation are regarded as abnormal records, the method further includes:

In response to the mailbox login operation of the current user, a first login record is generated, and according to the trusted IP list and the standard user portrait, it is judged whether the first login record is normal;

If the first login record is normal, save the login record;

If the first login record is abnormal, two-factor authentication is triggered, so that the current user confirms the login.

As a preferred solution, after generating a first login record in response to the current user's mailbox login operation, and judging whether the first login record is normal according to the trusted IP list and the standard user portrait, the method further includes:

The number of login records generated within a first preset time period is recorded, and if the number of generated login records is greater than a preset first threshold, the mailbox of the current user is banned.

As a preferred solution, after obtaining the latitude and longitude of the region corresponding to each login record according to the preset geographic information database of the login IP, it also includes:

Obtaining all login records of failed logins within the second preset time period, and classifying all the login records of failed logins according to the preset brute force cracking rules, to obtain brute force cracking records and non-brute force cracking records;

If the brute force cracking record exceeds the preset second threshold, then mark all login IPs in the brute force cracking record as a brute force cracking IP list;

The abnormal record is updated according to the login record corresponding to the login IP that matches the brute force IP list.

As a preferred solution, obtaining all the login records of the user mailbox, establishing a trusted IP list and standard user portraits according to the normal emails preset in the user mailbox, specifically:

Obtain the number of unique senders corresponding to the IPs of all preset normal mails in the user's mailbox, take the IPs whose number of the unique senders is greater than the third threshold as a trusted IP seed, and send all messages from the The client ID of the mail that trusts IP is used as a list of trusted IDs; wherein, each login record also contains a client ID;

According to the trusted IP seed and the trusted ID list, take each trusted IP seed as a vertex, and the weight of each vertex is the unique distribution corresponding to each trusted IP seed The number of trusted people is used to construct a reputation transmission graph, and the reputation transmission graph is iteratively grown and propagated until the number of iterations reaches a preset value, the weight of each vertex after the iteration is obtained, and the weight of each vertex after the iteration is obtained. Weight, get a list of trusted IPs;

According to the trusted IP list, a standard user portrait is obtained by calculation.

As a preferred solution, the standard user portrait is calculated and obtained according to the trusted IP, specifically:

Obtain all the login records of the user's mailbox, and filter out the login records that meet the trusted IP list according to the trusted IP list;

According to the login records conforming to the trusted IP list, the feature vector of the user is calculated as a standard user portrait.

As a preferred solution, according to the login time, successively calculate the switching speed of the latitude and longitude of the area corresponding to each adjacent two login records, and filter out suspicious login records according to a preset speed threshold, specifically:

According to the login time, sort all the login records, calculate the switching speed of the latitude and longitude of the area corresponding to each adjacent login records in turn, and filter out the speed greater than the preset speed threshold according to the preset speed threshold. The two adjacent login records corresponding to the switching speed are regarded as suspicious login records.

Correspondingly, the present invention also provides a detection device for mailbox login abnormality, including: a list portrait module, a regional location module, a suspicious login module and an abnormality record module;

The list portrait module is used to obtain all login records of the user mailbox, and establish a trusted IP list and standard user portraits according to the normal emails preset in the user mailbox;

The regional location module is used to obtain the latitude and longitude of the corresponding region of each login record according to the preset geographic information database of the login IP; wherein, each login record includes a login IP and a login time;

The suspicious login module is used to sequentially calculate the switching speed of the latitude and longitude of the region corresponding to each adjacent two login records according to the login time, and filter out suspicious login records according to a preset speed threshold;

The abnormality record module is used for removing the suspicious login records according to the trusted IP list and the standard user portrait, and taking the suspicious login records after the removal operation as abnormal records.

Correspondingly, the present invention also provides a terminal device, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, the processor being implemented when the computer program is executed The method for detecting abnormality of mailbox login as described in any one of the above.

Correspondingly, the present invention also provides a computer-readable storage medium, the computer-readable storage medium includes a stored computer program; wherein, the computer program controls the device where the computer-readable storage medium is located to execute the The method for detecting abnormality of mailbox login described in any one of the preceding items.

Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

The technical scheme of the present invention obtains all login records of a user's mailbox, and establishes a trusted IP list and a standard user portrait according to the normal emails preset in the user's mailbox, so as to detect abnormal mailbox logins from the user's habit of using mailboxes The detection improves the accuracy of the login anomaly detection, and calculates according to the switching speed of the latitude and longitude of the region corresponding to the two adjacent login records, thereby screening out suspicious login records and improving the screening accuracy of the two login records. According to the trusted IP list and the standard user portrait, the suspicious login records are eliminated, so as to avoid false positives in the detection abnormality caused by switching the login area after using the proxy in the prior art, and improve the user's ability to use mailboxes. Experience and improve the detection accuracy of mailbox login anomalies.

Description of drawings

FIG. 1 is a flowchart of steps of a method for detecting abnormality of mailbox login provided by an embodiment of the present invention;

FIG. 2 is an IP reputation propagation diagram in an initial state in a method for detecting abnormality of mailbox login provided by an embodiment of the present invention;

3 is a schematic diagram of reputation propagation of IP1 in a method for detecting abnormality of mailbox login provided by an embodiment of the present invention;

4 is a schematic diagram of reputation propagation of IP2 in a method for detecting abnormality of mailbox login provided by an embodiment of the present invention;

5 is a schematic diagram of reputation propagation of IP3 in a method for detecting abnormality of mailbox login provided by an embodiment of the present invention;

FIG. 6 is a schematic structural diagram of an apparatus for detecting abnormality of mailbox login provided by an embodiment of the present invention.

Detailed ways

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

Example 1

Referring to FIG. 1, a method for detecting abnormality of mailbox login provided by an embodiment of the present invention includes the following steps:

S101: Acquire all login records of a user mailbox, and establish a trusted IP list and a standard user portrait according to normal emails preset in the user mailbox.

Specifically, the number of unique senders corresponding to the IPs of all preset normal mails in the user's mailbox is obtained, and the IPs whose number of unique senders is greater than the third threshold are used as trusted IP seeds, and all messages sent from The client ID of the mail of the trusted IP is used as a trusted ID list; wherein, each login record also includes a client ID; according to the trusted IP seed and the trusted ID list, each of the The trusted IP seed is used as a vertex, and the weight of each vertex is the number of unique senders corresponding to each trusted IP seed, so as to construct a reputation transfer graph, and iteratively grow and iteratively grow the reputation transfer graph. Propagating until the number of iterations reaches a preset value, obtain the weight of each vertex after the iteration, and obtain a trusted IP list according to the weight of each vertex after the iteration; calculate the standard according to the trusted IP list User portrait.

It should be noted that the default normal emails are: emails in the outbox that the recipient and the sender have sent and received with each other for many times. Through the preset normal email, it can be guaranteed that the IP when the normal email is sent is the IP of the user himself, so as to ensure the generation of an accurate and trusted IP list and user portrait with credible value. Obtain the number of unique senders corresponding to the IPs of all preset normal mails in the user's mailbox, and use the IP whose number of unique senders is greater than the third threshold as a trusted IP seed, preferably, in practice, For corporate mailboxes, it is generally found that most of these IPs are the common export IPs of the company office. Among them, the number of unique senders corresponding to the IPs of normal emails can be understood as that each normal email has an IP, and the number of unique senders corresponding to the same IP is counted.

In this embodiment, after obtaining the number of unique senders corresponding to the IPs of all normal mails in the user's mailbox, the IPs with the number of the unique senders greater than the third threshold are used as trusted IP seeds, and the unique senders are eliminated The number of IPs is too small, and the client IDs of all emails sent from the trusted IPs are used as the trusted ID list, with the trusted IP seed as the vertex, and the weight of the vertex is the number of unique senders of the corresponding IP, that is, the reputation Size, trusted ID list for each edge between vertices to build an initial reputation propagation graph. Then, the reputation transmission graph is iteratively grown and propagated until the number of iterations reaches a preset value, the weight of each vertex after the iteration is obtained, and the trusted IP list is obtained according to the weight of each vertex after the iteration.

As a preferred solution of this embodiment, please refer to FIG. 2 , which is a reputation propagation diagram in an initial state. In this preferred solution, a total of four IPs are obtained, namely IP1, IP2, IP3 and IP4. Among them, IP1 has 100 unique senders, the initial reputation is 100, and there are a total of 100 trusted IDs, that is, 100 edges, and IP2 Connect 7 sidelines, that is, have 7 common IDs with IP2, and connect 3 sidelines with IP3, that is, have 3 common IDs with IP3; IP2 has 10 unique senders, the initial reputation is 10, and a total of 10 trusted IDs, That is, 10 edges, 7 edges are connected to IP1, and the remaining 3 edges are connected to other external IPs; IP3 has 0 unique senders, the initial reputation is 0, and only 3 edges are connected to IP1; IP4 has no unique sender, The initial reputation is 0, and there is no common client with IP1, IP2, and IP3, so there is no reputation propagation for IP4. Reputation propagation is performed for IP1, IP2 and IP3 respectively. The reputation size of each propagation is propagated according to the proportion of the number of edge connections with each IP. Each IP performs reputation propagation once as an iterative process. Preferably, please refer to FIG. 3 , which is a schematic diagram of reputation propagation from IP1 to IP2 and IP3. IP2 obtains the 100*(7/100)=7 reputation from IP1, that is, the current reputation of IP2 is 17, and IP3 obtains the reputation from IP1. 100*(3/100)=3 reputation, that is IP3 current reputation 3; please refer to Figure 4, which is a schematic diagram of reputation spreading from IP2 to IP1, IP1 obtains 17*(7/10)=11.9 from IP2 Reputation, that is, the current reputation of IP1 is 111.9; please refer to Figure 5, which is a schematic diagram of reputation propagation from IP3 to IP1. IP1 obtains 3*(3/3)=3 reputation from IP3, that is, the current reputation of IP1 is 114.9; in this In a preferred embodiment, all IPs complete a reputation propagation, that is, an iterative process of reputation calculation is performed.

Preferably, the number of iterations reaches 4, the ranking of the reputation value of each IP is basically stable and convergent, and the top 80% IPs with the largest reputation value ranking are reserved as a list of trusted IPs.

Through the reputation transfer process, the reputation value of the trusted IP can be propagated to other trusted IPs, including but not limited to the situation where the user uses a network proxy to change the IP, and a relatively trusted IP list can be obtained. In order to avoid potential factors such as subjective factors In the cheating process, only the IPs with the highest reputation value after the reputation spread are retained, and the IPs with lower reputation are eliminated, and the retained ratio is determined according to the actual situation.

Specifically, obtain all the login records of the user's mailbox, and filter out the login records that conform to the trusted IP list according to the trusted IP list; calculate the login records that conform to the trusted IP list according to the login records The feature vector of the user is obtained as a standard user portrait.

It should be noted that the login record also includes the login time, the login country, the login city, the C segment of the login IP, and the login client ID. According to the login record conforming to the trusted IP list, preferably, through the method of item2vec , and calculate the feature vector of the user as a standard user portrait.

S102: Acquire the longitude and latitude of the region corresponding to each login record according to the preset geographic information database of the login IP; wherein, each login record includes a login IP and a login time.

As a preferred solution of this embodiment, after obtaining the longitude and latitude of the region corresponding to each log-in record according to the preset geographic information database of the log-in IP, the method further includes: obtaining all log-in records of failed log-ins within the second preset time period, According to the preset brute force cracking rules, classify all the login records that failed to log in to obtain brute force cracking records and non-brute force cracking records; if the brute force cracking records exceed the preset second threshold, the brute force cracking records will be All login IPs in the cracking records are marked as a brute force cracking IP list; the abnormal records are updated according to the login records corresponding to the login IPs that match the brute force cracking IP list.

Preferably, the preset brute force cracking rules classify all failed login records, which are divided into four cases. The first case a: a hacker may use a small number of IPs to crack the same account with a large number of different passwords. A large number of failure records; the second case b: the hacker may use a small number of IPs to try to crack a large number of different accounts with the same password, and there will be a large number of failure records; the third case c: the hacker may use a small number of IPs with a large number of different accounts Password cracking of a large number of different accounts will result in a large number of failure records; the fourth case d: normal users may forget to change the password of their email client after changing the mailbox password, resulting in a single IP trying the same password with the same password account, and there are some failure records. The preset brute force rules classify a, b, and c as brute force records, and d as non-brute force records. When the brute force cracking record a, b or c exceeds the second threshold, the IP corresponding to the brute force cracking record a, b or c will be marked as the brute force cracking IP list, so that all logins will be processed according to the brute force cracking IP list. The IP is analyzed, and the login record of the IP corresponding to the brute force IP list is used as a new abnormal record to update the abnormal record obtained in step S104.

S103: According to the login time, sequentially calculate the switching speed of the latitude and longitude of the region corresponding to each adjacent login records, and filter out suspicious login records according to a preset speed threshold.

Specifically, according to the login time, sort all the login records, sequentially calculate the switching speed of the latitude and longitude of the area corresponding to each adjacent two login records, and filter out a speed greater than the preset speed threshold according to the preset speed threshold. The two adjacent login records corresponding to the switching speed of the speed threshold are regarded as suspicious login records.

It should be noted that the preset speed threshold is the maximum reasonable moving speed. Preferably, the speed threshold is 800km/h, which is the average speed of the aircraft. threshold, the two login records are regarded as suspicious login records. The switching speed of the latitude and longitude of the area corresponding to the two adjacent login records is obtained by the ratio of the geographic difference between the latitude and longitude and the difference between the two login times.

S104: Perform a culling operation on the suspicious login records according to the trusted IP list and the standard user portrait, and use the suspicious login records after the culling operation as abnormal records.

As a preferred solution of this embodiment, after taking the suspicious login record after the elimination operation as the abnormal record, the method further includes: in response to the mailbox login operation of the current user, generating a first login record, according to the trusted IP list and The standard user portrait, to determine whether the first login record is normal; if the first login record is normal, save the login record; if the first login record is abnormal, trigger two-factor authentication, so that all Confirm the login by the current user.

It should be noted that, in response to the current user's mailbox login operation, the generated first login record is the login record of the current user's mailbox login operation. During the login process, the current user's trusted IP list and standard user portrait will be used. , to judge whether the first login record is normal; if it is not normal, two-factor authentication will be triggered. Two-factor authentication methods include but are not limited to mobile phone verification codes and telephone voice verification.

As a preferred solution of this embodiment, after the first login record is generated in response to the current user's mailbox login operation, it is determined whether the first login record is normal according to the trusted IP list and the standard user portrait. , and further comprising: recording the number of login records generated within a first preset time period, and if the number of generated login records is greater than a preset first threshold, banning the mailbox of the current user.

It should be noted that after each login operation, the number of login records generated within the first preset time period will be recorded and detected. The first preset time period and the preset first threshold are based on actual needs. If the number of login records generated in the first preset time period is greater than the preset first threshold, that is, there are multiple login records in the first preset time period, the mailbox of the current user will be blocked. , the current user is not allowed to use the mailbox until the current user retrieves and modifies the password using two-factor authentication.

Implementing the embodiment of the present invention has the following effects:

The embodiment of the present invention acquires all the login records of the user mailbox, establishes a trusted IP list and standard user portraits according to the normal emails preset in the user mailbox, and conducts the trusted IP list by means of a reputation propagation map. Iterative calculation improves the accuracy and reliability of the trusted IP list, and realizes the detection of mailbox login anomalies from the user's habit of using mailboxes, which improves the accuracy of login anomaly detection. The switching speed of the latitude and longitude of the corresponding area is recorded for calculation, thereby screening out suspicious login records, and eliminating the suspicious login records, which improves the user's experience of using mailboxes and improves the detection accuracy of abnormal mailbox logins.

Embodiment 2

Correspondingly, referring to FIG. 6 , the present invention further provides an apparatus for detecting abnormality of mailbox login, including: a list portrait module 201 , a regional location module 202 , a suspicious login module 203 and an abnormality recording module 204 .

The list portrait module 201 is used to obtain all login records of the user mailbox, and establish a trusted IP list and standard user portrait according to the normal emails preset in the user mailbox.

As a preferred solution of the present embodiment, the acquisition of all the login records of the user's mailbox, according to the preset normal mail in the user's mailbox, establishes a trusted IP list and a standard user portrait, specifically:

Obtain the number of unique senders corresponding to the IPs of all preset normal mails in the user's mailbox, take the IPs whose number of the unique senders is greater than the third threshold as a trusted IP seed, and send all messages from the The client ID of the mail of the trusted IP is used as a trusted ID list; wherein, each login record also includes a client ID; according to the trusted IP seed and the trusted ID list, each trusted IP The seed is used as a vertex, and the weight of each vertex is the number of unique senders corresponding to each of the trusted IP seeds, so as to construct a reputation transmission graph, and iteratively grow and propagate the reputation transmission graph until When the number of iterations reaches a preset value, the weight of each vertex after the iteration is obtained, and according to the weight of each vertex after the iteration, a trusted IP list is obtained; according to the trusted IP list, a standard user portrait is obtained by calculation.

As a preferred solution of this embodiment, the standard user portrait is calculated and obtained according to the trusted IP, specifically:

Obtain all the login records of the user's mailbox, and filter out the login records that conform to the trusted IP list according to the trusted IP list; The user's feature vector, as a standard user portrait.

The regional location module 202 is configured to obtain the latitude and longitude of the region corresponding to each login record according to the preset geographic information database of the login IP; wherein, each login record includes a login IP and a login time.

As a preferred solution of the present embodiment, after obtaining the latitude and longitude of the region corresponding to each login record according to the preset geographic information database of the login IP, the method further includes:

Acquire all login records of failed logins within the second preset time period, and classify all login records of failed logins according to the preset brute force cracking rules to obtain brute force cracking records and non-brute force cracking records; If the cracking record exceeds the preset second threshold, then mark all the login IPs in the brute force cracking record as the brute force cracking IP list; update all the login IPs corresponding to the login IPs that meet the brute force cracking IP list. the exception record.

The suspicious login module 203 is configured to sequentially calculate the switching speed of the latitude and longitude of the region corresponding to each adjacent two login records according to the login time, and filter out suspicious login records according to a preset speed threshold.

As a preferred solution of this embodiment, according to the login time, the switching speed of the latitude and longitude of the region corresponding to each adjacent two login records is sequentially calculated, and the suspicious login records are screened out according to the preset speed threshold, which is specifically: :

According to the login time, sort all the login records, calculate the switching speed of the latitude and longitude of the area corresponding to each adjacent login records in turn, and filter out the speed greater than the preset speed threshold according to the preset speed threshold. The two adjacent login records corresponding to the switching speed are regarded as suspicious login records.

The abnormality record module 204 is configured to perform a culling operation on the suspicious login records according to the trusted IP list and the standard user portrait, and use the suspicious login records after the culling operation as an abnormality record.

As a preferred solution of the present embodiment, after the suspicious login record after the removal operation is regarded as an abnormal record, it further includes:

In response to the current user's mailbox login operation, generate a first login record, and determine whether the first login record is normal according to the trusted IP list and the standard user portrait; if the first login record is normal, save it The login record; if the first login record is abnormal, two-factor authentication is triggered, so that the current user confirms the login.

As a preferred solution of this embodiment, after the first login record is generated in response to the current user's mailbox login operation, it is determined whether the first login record is normal according to the trusted IP list and the standard user portrait. ,Also includes:

The number of login records generated within a first preset time period is recorded, and if the number of generated login records is greater than a preset first threshold, the mailbox of the current user is banned.

Those skilled in the art can clearly understand that, for the convenience and brevity of description, for the specific working process of the device described above, reference may be made to the corresponding process in the foregoing method embodiments, which will not be repeated here.

Implement the above embodiment, have the following effects:

The embodiment of the present invention acquires all the login records of the user mailbox, establishes a trusted IP list and standard user portraits according to the normal emails preset in the user mailbox, and conducts the trusted IP list by means of a reputation propagation map. Iterative calculation improves the accuracy and reliability of the trusted IP list, and realizes the detection of mailbox login anomalies from the user's habit of using mailboxes, which improves the accuracy of login anomaly detection. Record the switching speed of the latitude and longitude of the corresponding area for calculation, thereby screening out suspicious login records, eliminating the suspicious login records, and detecting the login operation of the current user. The factor authentication avoids the situation that two-factor authentication is required for each login in the prior art, thereby reducing the user experience.

Embodiment 3

An embodiment of the present invention further provides a terminal device, the terminal device includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, where the processor executes the The computer program implements the method for detecting abnormality of mailbox login described in any of the above embodiments.

Preferably, the computer program can be divided into one or more modules/units (eg computer program, computer program), the one or more modules/units are stored in the memory, and are executed by the processor Execute to complete the present invention. The one or more modules/units may be a series of computer program instruction segments capable of performing specific functions, and the instruction segments are used to describe the execution process of the computer program in the terminal device.

The processor may be a central processing unit (Central Processing Unit, CPU), other general-purpose processors, a digital signal processor (Digital Signal Processor, DSP), an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), an off-the-shelf processor Programmable Gate Array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor, or the processor may be any A conventional processor, which is the control center of the terminal equipment, uses various interfaces and lines to connect various parts of the terminal equipment.

The memory mainly includes a program storage area and a data storage area, wherein the program storage area can store an operating system, an application program required for at least one function, and the like, and the data storage area can store related data and the like. In addition, the memory may be a high-speed random access memory, and may also be a non-volatile memory, such as a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) card, and a flash memory card ( Flash Card), etc., or the memory can also be other volatile solid-state storage devices.

It should be noted that the above-mentioned terminal equipment may include, but is not limited to, a processor and a memory. Those skilled in the art can understand that the above-mentioned terminal equipment is only an example, and does not constitute a limitation on the terminal equipment, and may include more or less parts, or a combination of certain parts, or different parts.

Embodiment 4

An embodiment of the present invention further provides a computer-readable storage medium, where the computer-readable storage medium includes a stored computer program; wherein, the computer program controls a device where the computer-readable storage medium is located to execute the above-mentioned operation when running. The monitoring method for mailbox login abnormality described in any one of the embodiments.

The specific embodiments described above further describe the purpose, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above descriptions are only specific embodiments of the present invention, and are not intended to limit the protection scope of the present invention. . It is particularly pointed out that for those skilled in the art, any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention should be included within the protection scope of the present invention.

Claims (10)

1. an abnormal detection method of mailbox login, is characterized in that, comprises: Acquire all login records of the user's mailbox, and establish a trusted IP list and standard user portraits according to the normal emails preset in the user's mailbox; Obtain the latitude and longitude of the region corresponding to each login record according to the preset geographic information database of the login IP; wherein, each login record includes a login IP and a login time; According to the login time, successively calculate the switching speed of the latitude and longitude of the area corresponding to each adjacent two login records, and filter out suspicious login records according to a preset speed threshold; According to the trusted IP list and the standard user portrait, the suspicious login record is eliminated, and the suspicious login record after the elimination operation is regarded as an abnormal record. 2. The method for detecting abnormality of mailbox login as claimed in claim 1, characterized in that, after said taking the suspicious login record after the elimination operation as the abnormal record, it also comprises: In response to the mailbox login operation of the current user, a first login record is generated, and according to the trusted IP list and the standard user portrait, it is judged whether the first login record is normal; If the first login record is normal, save the login record; If the first login record is abnormal, two-factor authentication is triggered, so that the current user confirms the login. 3. the detection method of a kind of mailbox login abnormality as claimed in claim 2, it is characterized in that, in described in response to the mailbox login operation of current user, generate the first login record, according to described trusted IP list and described The standard user portrait, after judging whether the first login record is normal, also includes: The number of login records generated within a first preset time period is recorded, and if the number of generated login records is greater than a preset first threshold, the mailbox of the current user is banned. 4. the abnormal detection method of a kind of mailbox login as claimed in claim 1, is characterized in that, after described according to the preset geographic information database of login IP, after obtaining the latitude and longitude of each login record corresponding area, also comprises: Obtaining all login records of failed logins within the second preset time period, and classifying all the login records of failed logins according to the preset brute force cracking rules, to obtain brute force cracking records and non-brute force cracking records; If the brute force cracking record exceeds the preset second threshold, then mark all login IPs in the brute force cracking record as a brute force cracking IP list; The abnormal record is updated according to the login record corresponding to the login IP that matches the brute force IP list. 5. the detection method of a kind of mailbox login abnormality as claimed in claim 1, is characterized in that, described obtaining all login records of user mailbox, according to the normal mail preset in described user mailbox, establish trusted IP list and Standard user portrait, specifically: Obtain the number of unique senders corresponding to the IPs of all preset normal mails in the user's mailbox, take the IPs whose number of the unique senders is greater than the third threshold as a trusted IP seed, and send all messages from the The client ID of the mail that trusts IP is used as a list of trusted IDs; wherein, each login record also contains a client ID; According to the trusted IP seed and the trusted ID list, take each trusted IP seed as a vertex, and the weight of each vertex is the unique distribution corresponding to each trusted IP seed The number of trusted people is used to construct a reputation transmission graph, and the reputation transmission graph is iteratively grown and propagated until the number of iterations reaches a preset value, the weight of each vertex after the iteration is obtained, and the weight of each vertex after the iteration is obtained. Weight, get a list of trusted IPs; According to the trusted IP list, a standard user portrait is obtained by calculation. 6. the detection method of a kind of mailbox login abnormality as claimed in claim 5, is characterized in that, described according to described trusted IP, calculate and obtain standard user portrait, be specifically: Obtain all the login records of the user's mailbox, and filter out the login records that meet the trusted IP list according to the trusted IP list; According to the login records conforming to the trusted IP list, the feature vector of the user is calculated as a standard user portrait. 7. the detection method of a kind of mailbox log-in abnormality as claimed in claim 1, is characterized in that, described according to described log-in time, successively calculates the switching speed of the latitude and longitude of each adjacent two log-in records corresponding area, and according to The preset speed threshold to filter out suspicious login records, specifically: Sort all the log-in records according to the log-in time, sequentially calculate the switching speed of the latitude and longitude of the region corresponding to each adjacent two log-in records, and filter out the speed greater than the preset speed threshold according to the preset speed threshold. The two adjacent login records corresponding to the switching speed are regarded as suspicious login records. 8. An abnormality detection device for mailbox login, comprising: a list portrait module, a regional location module, a suspicious login module and an abnormal recording module; The list portrait module is used to obtain all login records of the user mailbox, and establish a trusted IP list and standard user portraits according to the normal emails preset in the user mailbox; The regional location module is used to obtain the latitude and longitude of the corresponding region of each login record according to the preset geographic information database of the login IP; wherein, each login record includes a login IP and a login time; The suspicious login module is configured to sequentially calculate the switching speed of the latitude and longitude of the region corresponding to each adjacent two login records according to the login time, and screen out suspicious login records according to a preset speed threshold; The abnormality record module is used for removing the suspicious login records according to the trusted IP list and the standard user portrait, and taking the suspicious login records after the removal operation as abnormal records. 9. A terminal device, characterized in that it comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, the processor implementing the following when executing the computer program. The method for detecting abnormality of mailbox login according to any one of claims 1-7. 10. A computer-readable storage medium, characterized in that the computer-readable storage medium comprises a stored computer program; wherein, the computer program controls a device where the computer-readable storage medium is located to execute the method described in the claim when running. The method for detecting an abnormality in mailbox login according to any one of requirements 1 to 7 is required.

Images