CN112016078B - A method, device, server and storage medium for detecting a blocking of a login device - Google Patents

Abstract

The embodiment of the invention discloses a method, a device, a server and a storage medium for detecting the blocking of login equipment. Wherein the method comprises the following steps: screening out corresponding reference equipment factors from the equipment factors based on the login floating degree of the blocked equipment library under each equipment factor; and calculating the blocked score of the login device based on the similarity of login parameters of the login device and each blocked device in the blocked device library under the reference device factors. According to the technical scheme provided by the embodiment of the invention, the reliability of the login equipment facing the sealing detection is ensured, each login equipment using the multi-open software is not required to be sealed or clustered, and the hysteresis of the sealing detection is avoided on the basis of ensuring any normal operation of the login equipment, so that the accuracy and the sealing timeliness of the login equipment facing the sealing detection are improved.

Description

A method, device, server and storage medium for detecting a blocking of a login device

Technical Field

Embodiments of the present invention relate to the field of Internet technology, and in particular to a method, device, server and storage medium for detecting a blocking of a login device.

Background technique

With the rapid development of Internet technology, there are basically some network black industry chains (i.e., network black industries) and malicious users in various application (Application, APP) platforms or online communities to spread some illegal information; therefore, in order to limit the illegal behaviors of network black industries and malicious users, the corresponding risk control and punishment logic is usually pre-set. When the illegal accounts used by network black industries and malicious users reach a certain ban level, the illegal accounts and the login devices where the illegal accounts are located will be banned at the same time. At this time, when the user requests to log in to the corresponding account on a certain device, the risk control and punishment logic mainly uses the identification information of the device to determine whether the device is a banned device, but network black industries and malicious users can use various types of multi-opening software to change the identification information of the login device this time, so as to bypass the violation detection of the banned device and continue to perform the corresponding illegal behaviors, which cannot guarantee the information browsing security of normal users.

At present, the following two methods are usually used to solve the above problems: 1) By analyzing the reported information of the login device, determine whether multiple software is used, and then prohibit users from logging in on the login device using multiple software; however, in many APP network scenarios, normal users are supported to use multiple software to change the identification information of the login device. At this time, the user login on each login device using multiple software is prohibited, which directly affects the normal operation of normal users and causes a large number of users to lose. 2) Use a clustering algorithm to classify a large number of login devices, and then ban each login device under the category of banned devices. At this time, the clustering algorithm can only preliminarily define the scope of the banned devices, and cannot guarantee the accuracy of the banned devices. Moreover, the banned device range preliminarily defined by the clustering algorithm has a certain lag, and cannot guarantee that the login devices with violations will be banned in a timely manner.

Summary of the invention

The embodiments of the present invention provide a ban detection method, device, server and storage medium for a login device, which improve the accuracy of ban detection and ban timeliness of the login device on the basis of ensuring the normal operation of the login device.

In a first aspect, an embodiment of the present invention provides a method for detecting a blocking of a login device, the method comprising:

Based on the registration fluctuation of the banned device library under each device factor, a corresponding reference device factor is selected from each of the device factors;

Based on the similarity of the login parameters between the login device and each banned device in the banned device library under each of the reference device factors, a banned score of the login device is calculated.

In a second aspect, an embodiment of the present invention provides a blocking detection device for a login device, the device comprising:

A reference factor screening module, for screening corresponding reference device factors from each of the device factors based on the registration floating degree of the banned device library under each device factor;

The ban detection module is used to calculate the ban score of the login device based on the similarity of the login parameters between the login device and each banned device in the banned device library under each reference device factor.

In a third aspect, an embodiment of the present invention provides a server, the server comprising:

one or more processors;

A storage device for storing one or more programs;

When the one or more programs are executed by the one or more processors, the one or more processors implement the ban detection method for the login device described in any embodiment of the present invention.

In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method for detecting a login device ban as described in any embodiment of the present invention.

The embodiments of the present invention provide a method, apparatus, server and storage medium for detecting a login device being banned. Since the larger the login fluctuation of a banned device library under each device factor, the greater the possibility that the device factor has been tampered with, that is, the lower the reference value of the device factor for banning the login device, based on the login fluctuation of the banned device library under each device factor, the corresponding reference device factor can be screened out from all device factors, and then the ban score of the login device is calculated by analyzing the similarity of the login parameters between the login device and each banned device in the banned device library under each reference device factor, so as to accurately judge the possibility of whether the login device needs to be banned, ensure the reliability of the login device for ban detection, and do not need to ban each login device that uses multiple software, or cluster the login devices. On the basis of ensuring that the login device performs any normal operation, the lag of ban detection is avoided, thereby improving the accuracy of the login device for ban detection and the timeliness of the ban.

BRIEF DESCRIPTION OF THE DRAWINGS

Other features, objects and advantages of the present invention will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings:

FIG1A is a flow chart of a method for detecting a blocking of a login device provided in Embodiment 1 of the present invention;

FIG1B is a schematic diagram showing the principle of a blocking detection process of a login device provided in Embodiment 1 of the present invention;

FIG2A is a flow chart of a method for detecting a blocking of a login device provided in a second embodiment of the present invention;

FIG2B is a schematic diagram showing the principle of a blocking detection process of a login device provided in Embodiment 2 of the present invention;

FIG3A is a flow chart of a method for detecting a blocking of a login device provided in Embodiment 3 of the present invention;

3B is a schematic diagram showing the principle of the dynamic update process of the login floating degree under each device factor and the preset blocking threshold referenced when determining whether to block in the method provided in the third embodiment of the present invention;

FIG4 is a schematic diagram of the structure of a blocking detection device for a login device provided in a fourth embodiment of the present invention;

FIG5 is a schematic diagram of the structure of a server provided in Embodiment 5 of the present invention.

Detailed ways

The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only parts related to the present invention, rather than all structures, are shown in the accompanying drawings. In addition, the embodiments of the present invention and the features in the embodiments may be combined with each other without conflict.

Embodiment 1

FIG1A is a flow chart of a method for detecting a ban on a login device provided in Embodiment 1 of the present invention. This embodiment can be applied to the case of detecting whether the current login device needs to be banned in any login scenario. The method for detecting a ban on a login device provided in this embodiment can be executed by a device for detecting a ban on a login device provided in an embodiment of the present invention. The device can be implemented in software and/or hardware and integrated in a server that executes this method. The server can be a background server of various applications configured with user account registration and login requirements.

Specifically, referring to FIG. 1A , the method may include the following steps:

S110, based on the registration floating degree of the banned device library under each device factor, a corresponding reference device factor is selected from each device factor.

Specifically, in order to limit the illegal behaviors of network black industries and malicious users and avoid the spread of various illegal contents published in the Internet field, when a user registers or logs in to the corresponding account of a certain application on a certain device, it is first necessary to determine whether the device currently used for registration and login is a banned device that has been detected. At this time, any login device that uses multi-opening software to change the identification information of the current login device is usually regarded as a banned device to prohibit the user from performing any account-related operations on the login device. However, in addition to being used by network black industries and malicious users to change device identification information to bypass ban detection, multi-opening software also supports the use of normal users. At this time, the method of banning all login devices using multi-opening software directly affects the routine operations of normal users, and the accuracy of the ban on login devices cannot be guaranteed; or, by analyzing whether the category to which the current login device belongs after clustering is a banned device category, it is determined whether the current login device is a banned device, but the clustering algorithm belongs to a coarse-grained classification, and the accuracy of the ban on login devices cannot be ensured. Moreover, there is a certain lag in the classification of banned devices after the clustering algorithm is used, and the timeliness of the ban detection of login devices cannot be guaranteed. Therefore, in order to avoid the above problems, this embodiment provides a new ban detection method, so that when a user uses a device to register or log in to a corresponding account, there is no need to restrict the user's operations when using multiple software on the login device. While ensuring that the user performs various normal operations on the login device, it can also accurately and timely detect the login device that needs to be banned, and restrict the user from performing any account-related operations on the login device.

At this time, since cybercriminals and malicious users usually use multiple software to change the identification information of the login device to bypass the violation detection of each banned device that has been detected, when logging in to the corresponding user account on various applications of a certain device, the user account will be in the corresponding device environment, that is, when registering or logging in to a user account on different login devices, there will be corresponding device adaptive identification, Internet Protocol (IP) address, Media Access Control (MAC) address, etc. Control, MAC) address, wireless network, client version, operating system, device model and screen resolution and other device factors. It can be understood that when network black industries and malicious users change the login parameters under different device factors on a login device, the tampering costs of login parameters under different device factors are different due to the different development and design difficulties of different device factors. Then the difficulty of tampering with each device factor is also different. That is to say, there will always be device factors whose login parameters are not easy to be tampered with among all the device factors of the device. Therefore, in this embodiment, the device factor whose login parameters are not easy to be tampered with can be used as a reference device factor for banning detection of the login device. At this time, the login parameters used by the login device under the reference device factor are not easy to be maliciously tampered with, and can better represent the real device information. Then, by comparing the similarity between the login parameters of the login device and each detected banned device under each reference device factor, it is possible to accurately determine whether the login device needs to be banned, thereby ensuring the reliability of the login device for ban detection.

It should be noted that if the login parameters used by the login device to log in to various user accounts under a certain device factor are constantly changing, it means that the login parameters under the device factor are less difficult to tamper with, that is, the login parameters under the device factor are easy to tamper with, and therefore cannot be used as a reference device factor for login device ban detection.

In this embodiment, the difficulty of tampering with the device factor can be determined by analyzing the floating of the login parameters used by each banned device under each device factor. At this time, the login floating degree is used in this embodiment to characterize the floating of the historical login parameters used under each device factor when registering or logging in to a user account on each device. At the same time, since the login device will first be banned when registering or logging in to a user account on the login device, it is first necessary to screen out reference device factors with greater reference value for ban detection from all device factors to improve the accuracy of ban detection for the login device. At this time, in the banned device library that has completed the ban detection, the historical login parameters used by each banned device under each device factor when performing any account-related operation and being detected as needing to be banned will be found first. Then, by analyzing the changes in the historical login parameters used by each banned device under each device factor, the login floating degree of the banned device library under each device factor is calculated respectively. At this time, if the banned device library is in a certain The higher the login floating degree under a device factor, the easier it is for the login parameters under the device factor to be maliciously tampered with, that is, the reference value of the device factor for login device ban detection is lower. If the login floating degree of the banned device library under a certain device factor is lower, the login parameters under the device factor are less likely to be maliciously tampered with, that is, the reference value of the device factor for login device ban detection is higher. Therefore, through the login floating degree of the banned device library under each device factor, some device factors with lower login floating degrees can be screened out from all device factors as the reference device factors in this embodiment. At this time, the login parameters adopted by the login device under each reference device factor are not easy to be maliciously tampered with. Subsequently, by analyzing the similarity between the login device and the login parameters adopted by each banned device in the banned devices under each reference device factor, it is possible to accurately determine whether the login device is a banned device in the banned device library, thereby accurately determining the possibility that the login device needs to be banned, thereby ensuring the reliability of the login device for ban detection.

S120, calculating a banned score of the logged-in device based on the similarity of the login parameters of the logged-in device and each banned device in the banned device library under each reference device factor.

Optionally, after registering or logging in to a user account on the login device and selecting the corresponding reference device factor from each device factor, in order to ensure the reliability of the login device for ban detection, this embodiment first finds out the login parameters used by the login device under each reference device factor when performing any account-related operation, and at the same time finds out the login parameters used by each banned device in the banned device library under each reference device factor when it is banned, and then analyzes the similarity between the login device and the login parameters used by each banned device under each reference device factor, to determine whether the login device has banned a banned device in the device library. If the login device has banned a banned device in the device library, The similarity between the login parameters adopted by the recording device and a banned device under each reference device factor is high, indicating that the login device and the banned device are very likely to be the same device. At this time, according to the possibility that the login device and a banned device are the same device, the banned score of the login device can be calculated. There is no need to ban each login device that uses multiple software, or to cluster and ban login devices. On the basis of ensuring that the login device performs any normal operation, the lag of ban detection is avoided. The banned score can be used subsequently to accurately determine whether the login device currently needs to be banned, so as to prohibit the user from performing any account-related operations on the login device.

The technical solution provided by this embodiment is that the larger the login float of the banned device library under each device factor, the greater the possibility that the device factor has been tampered with, that is, the lower the reference value of the device factor for ban detection of the login device. Therefore, based on the login float of the banned device library under each device factor, the corresponding reference device factor can be screened out from all device factors, and then the ban score of the login device is calculated by analyzing the similarity of the login parameters between the login device and each banned device in the banned device library under each reference device factor, so as to accurately judge the possibility of whether the login device needs to be banned, ensure the reliability of the login device for ban detection, and do not need to ban each login device that uses multiple software, or cluster ban the login devices. On the basis of ensuring that the login device performs any normal operation, the lag of ban detection is avoided, thereby improving the accuracy of the login device for ban detection and the timeliness of the ban.

Embodiment 2

FIG2A is a flow chart of a method for detecting a login device ban provided in Embodiment 2 of the present invention, and FIG2B is a schematic diagram of the principle of the login device ban detection process provided in Embodiment 2 of the present invention. This embodiment is optimized on the basis of the above-mentioned embodiment. Specifically, as shown in FIG2A , this embodiment provides a detailed explanation of the specific screening process of the reference device factor and the specific calculation process of the login device ban score.

Optionally, as shown in FIG2A , this embodiment may include the following steps:

S210 , for each device factor, based on the repetition frequency of each historical login parameter of the banned device library under the device factor, calculate the login floating degree of the banned device library under the device factor.

Optionally, since the historical login parameters used by each banned device in the banned device library under each device factor when it is banned may be different, and the login fluctuation degree can characterize the change of the historical login parameters used by each banned device in the banned device library under each device factor, when this embodiment detects that the login device needs to perform any account-related operation (such as registering or logging in to a user account), it will first find out the historical login parameters used by each banned device under each device factor when it is banned, and then for each device factor, calculate the historical login parameters used by each banned device under the device factor when it is banned. The frequency with which each historical login parameter appears continuously in the banned device library is taken as the repetition frequency of each historical login parameter of the banned device library under the device factor in this embodiment. If the repetition frequency of each historical login parameter under a certain device factor is relatively high, it means that the historical login parameters used by the banned device library under the device factor are relatively stable, so that the floating of the banned device library under the device factor is relatively low. Therefore, this embodiment can calculate the login floating degree of the banned device library under each device factor by comprehensively analyzing the repetition frequency of each historical login parameter used by the banned device library under each device factor.

Exemplarily, since information entropy can accurately measure the degree of order of information in a system, the more ordered the information in the system is, the lower the information entropy is, and the more chaotic the information in the system is, the higher the information entropy is. Therefore, as shown in FIG2B , this embodiment can use information entropy to represent the login floating degree of the banned device under each device factor. At this time, for each device factor, based on the repetition frequency of each historical login parameter of the banned device library under the device factor, the login floating degree of the banned device library under the device factor is calculated. This can specifically include: performing entropy operation on the repetition frequency of each historical login parameter of the banned device library under each device factor to obtain the login floating degree of the banned device library under the device factor.

Specifically, after finding out the historical login parameters used by the banned device library under each device factor and determining the repetition frequency of each historical login parameter used by the banned device library under each device factor, entropy calculation can be performed on the repetition frequency of each historical login parameter used by the banned device library under each device factor. The entropy calculation formula is: Among them, _xi is the i-th historical login parameter adopted by the banned device library under each device factor, and p( _xi ) is the frequency corresponding to the repetition frequency of the i-th historical login parameter of the banned device library under each device factor; then, the repetition frequency of each historical login parameter adopted by the banned device library under each device factor is subjected to entropy operation, and the result of the operation is taken as the login floating degree of the banned device library under the device factor; according to the above entropy operation process, the login floating degree of the banned device library under each device factor can be obtained.

S220, based on the login fluctuation of the banned device library under each device factor, determine the ban reference confidence of each device factor, and screen out the device factors whose ban reference confidence meets the specified ban detection specifications as reference device factors.

Optionally, after calculating the login float of the banned device library under each device factor, since the login float is inversely proportional to the reference value of the device factor for ban detection, this embodiment can determine the ban reference confidence of each device factor based on the degree of reverse influence of the login float of the banned device library under each device factor on the reference value of ban detection. The ban reference confidence can accurately characterize the degree of credibility of a certain device factor as a reference device factor for ban detection of login devices. At this time, in order to accurately screen the corresponding number of reference device factors, this embodiment will pre-set the corresponding specified ban detection specification, which can be the number of reference device factors, and then according to the ban reference confidence of each device factor, multiple device factors that meet the specified ban detection specification are screened out as the reference device factors in this embodiment. For example, the TopK algorithm can be used to screen out device factors with the top K ban reference confidences from all device factors as the corresponding reference device factors. In addition, in this embodiment, multiple device factors that meet the specified ban detection specifications under lower login fluctuations can also be used as reference device factors in this embodiment, without calculating the ban reference confidence of each device factor, thereby reducing the screening steps of reference device factors.

S230, for each banned device in the banned device library, based on the login parameters of the login device and the banned device under each reference device factor, calculate the ban similarity between the login device and the banned device.

Optionally, after screening out the corresponding reference device factors, for each banned device in the banned device library, the login parameters used under each reference device factor when the login device performs any account-related operation, as well as the login parameters used under each reference device factor when the banned device is banned, can be found out respectively. Then, the device characteristics of the login device and the banned device composed of the login parameters used under each reference device factor are determined respectively. Then, the similarity between the login parameters used by the login device and the banned device under each reference device factor is analyzed using the corresponding similarity algorithm. The login parameter similarity under each reference device factor is comprehensively analyzed to calculate the banning similarity between the login device and the banned device. At this time, by executing the above steps, the banning similarity between the login device and each banned device can be calculated respectively.

It should be noted that there is no limitation on the similarity algorithm adopted, and the ban similarity between the login device and each banned device in this embodiment can be calculated by using the inverse influence between the Jaccard distance and the similarity. The device distance between the login device and the banned device (that is, the difference between the login device and the banned device) is calculated by the Jaccard distance, which has an inverse influence relationship with the ban similarity. At this time, the larger the device distance between the login device and a banned device calculated by the Jaccard distance, the smaller the ban similarity between the login device and the banned device. For example, if the reference device factors are (serial, iid, uuid, eid, mac, aid), and the login parameters used by the login device under each reference device factor are A = (efd313432, a3bedbd, 4cc33ea, 78c5b4a, 01:01:01:01:01:01, e683acb), and the login parameters used by a banned device under each reference device factor are B = (ABCDFG, a3bedbd, 4cc33ea, 78c5b4a, 02:02:02:02:02:02, c4aabcd5673), then the ban similarity between the login device and the banned device can be At this time, |A∪B| is 9, |A∩B| is 3, so the device distance between the login device and the banned device is 2/3, and the corresponding ban similarity is 1/3.

S240: Using the maximum similarity among the blocking similarities between the login device and each banned device as the blocking score of the login device.

Optionally, if the login device is similar to any banned device in the banned device library, then it means that the login device needs to be banned. At this time, it is only necessary to determine whether the maximum similarity in the banning similarity between the login device and each banned device reaches a preset similarity threshold. If the maximum similarity in the banning similarity between the login device and each banned device is also lower than the preset similarity threshold, it means that the login device and each banned device are not similar. Therefore, in this embodiment, the maximum similarity in the banning similarity between the login device and each banned device can be used as the banned score of the login device. At this time, if the maximum similarity indicates that the login device is similar to a banned device, then it can be accurately determined that the login device needs to be banned, thereby improving the comprehensiveness of determining whether the login device needs to be banned by the banned score of the login device.

The technical solution provided in this embodiment calculates the login floating degree of the banned device library under each device factor through entropy operation, which can ensure the accuracy of the login floating degree under each device factor, and then screen out the device factors that meet the specified ban detection specifications based on the login floating degree of the banned device library under each device factor, as the reference device factors, to ensure the reliability of the reference device factors; subsequently, by analyzing the similarity of login parameters between the login device and each banned device in the banned device library under each reference device factor, the ban score of the login device is calculated, so as to accurately judge the possibility of whether the login device needs to be banned, and ensure the reliability of the login device for ban detection. There is no need to ban each login device that uses multiple software, or to cluster and ban the login devices. On the basis of ensuring that the login device performs any normal operation, the lag of ban detection is avoided, thereby improving the accuracy of the login device for ban detection and the timeliness of the ban.

Embodiment 3

Figure 3A is a flow chart of a method for detecting a ban on a login device provided in the third embodiment of the present invention, and Figure 3B is a schematic diagram of the principle of the dynamic update process of the login float under each device factor and the preset ban threshold referenced when judging whether to ban in the method provided in the third embodiment of the present invention. This embodiment is optimized on the basis of the above-mentioned embodiment. Specifically, as shown in Figure 3A, this embodiment mainly explains in detail the preset ban threshold referenced when judging whether to ban the login device based on the banned score of the login device, and the dynamic update process of the login float when the login float under each device factor changes due to changes in the banned device library.

Optionally, as shown in FIG3A , this embodiment may include the following steps:

S310: based on the registration floating degree of the banned device library under each device factor, select corresponding reference device factors from each device factor.

S320, calculating a banned score of the logged-in device based on the similarity of the login parameters of the logged-in device and each banned device in the banned device library under each reference device factor.

S330: Determine a corresponding preset blocking threshold based on the blocking accuracy rate and blocking recall rate of the target login device set that has completed the blocking detection.

Optionally, in order to ensure the accuracy of the ban detection of the login device, the present embodiment can dynamically update the corresponding preset ban threshold by analyzing the accuracy and recall rate of determining whether each login device needs to be banned by the ban detection method provided in the present embodiment. At this time, after performing ban detection on each login device, regardless of the ban detection result, the ban result of each login device determined whether it needs to be banned by the ban detection method provided in the present embodiment can be added to the corresponding target login device set. At this time, each login device in the target login device set has completed the ban detection. There are login devices that need to be banned, and there are login devices that do not need to be banned. Therefore, by determining the specific ban detection result and the actual ban result of each login device in the target login device set, the corresponding ban accuracy rate and ban recall rate can be continuously calculated during the ban detection process of the login device, and then the ban accuracy rate and the ban recall rate can be used as evaluation indicators of the preset ban threshold to dynamically update the corresponding preset ban threshold. At this time, the preset ban threshold can represent a scoring node that can accurately distinguish login devices that need to be banned.

Exemplarily, the calculation formula of the ban accuracy rate may be: Among them, TP is the number of login devices that need to be banned in the target login device set, and FP is the number of login devices that do not need to be banned in the target login device set. The calculation formula of the ban recall rate can be: Among them, FN is the number of login devices in the target login device set that are predicted to not need to be banned.

At this time, the banned score of the corresponding login device when the ban accuracy reaches the corresponding accuracy requirement and the ban recall rate reaches the corresponding recall requirement can be used as the current preset ban threshold. For example, the present embodiment has a higher requirement for the ban accuracy, but the ban recall rate requirement can reach a certain range. Therefore, among the multiple login devices when the ban recall rate under the target login device set reaches a certain recall range, the banned score of the login device with the highest ban accuracy can be used as the current preset ban threshold. At this time, the preset ban threshold can ensure the highest accuracy of ban detection on the basis of ensuring a relatively high ban recall.

S340: If the ban score of the login device exceeds a preset ban threshold, the login device is banned.

Optionally, after calculating the banned score of the login device, you can determine whether the login device needs to be banned by comparing the banned score of the login device with the preset banned threshold. If the banned score of the login device exceeds the preset banned threshold, it means that the login device is very likely to be banned. Therefore, the login device can be banned to prevent users from performing any account-related operations on the login device, thereby reducing the widespread dissemination of illegal content and improving the safety and health of normal users' browsing of information.

S350, adding the banned login device to the banned device library, and updating the login floating degree of the banned device library under each device factor.

Optionally, after banning the login device, the login device can be directly added to the banned device library as a banned device, so that the corresponding reference device factors can be accurately screened out based on the login floating degree of the banned device library under each device factor. At this time, due to the continuous ban detection of the login device, the banned device library will change dynamically, and the login floating degree of the banned device library under each device factor will also change dynamically. Therefore, when adding the banned login device to the banned device library, this embodiment also needs to adopt the same method as provided in the above embodiment for calculating the login floating degree of the banned device library under each device factor to recalculate the login floating degree of the banned device library under each device factor, so as to dynamically update the login floating degree under each device factor, thereby improving the screening accuracy of the reference device factor.

The technical solution provided in this embodiment can screen out corresponding reference device factors from all device factors based on the login float of the banned device library under each device factor, and then calculate the banned score of the login device by analyzing the login parameter similarity between the login device and each banned device in the banned device library under each reference device factor, so as to accurately judge whether the login device needs to be banned, and ensure the reliability of the login device for ban detection. There is no need to ban each login device that uses multiple software, or to cluster and ban login devices. On the basis of ensuring that the login device performs any normal operation, the lag of ban detection is avoided, thereby improving the accuracy and timeliness of ban detection for the login device. At the same time, with reference to the ban accuracy and ban recall rate under the target login device set that has completed the ban detection, the corresponding preset ban threshold is dynamically updated to further ensure the accuracy of the login device for ban detection, and at the same time, the banned login devices are continuously added to the banned device library, and the login float of the banned device library under each device factor is dynamically updated to further improve the screening accuracy of the reference device factor.

Embodiment 4

FIG4 is a schematic diagram of the structure of a blocking detection device for a login device provided in a fourth embodiment of the present invention. Specifically, as shown in FIG4 , the device may include:

A reference factor screening module 410 is used to screen corresponding reference device factors from each device factor based on the registration floating degree of the banned device library under each device factor;

The ban detection module 420 is used to calculate the ban score of the login device based on the similarity of the login parameters between the login device and each banned device in the banned device library under each reference device factor.

The technical solution provided by this embodiment is that the larger the login float of the banned device library under each device factor, the greater the possibility that the device factor has been tampered with, that is, the lower the reference value of the device factor for ban detection of the login device. Therefore, based on the login float of the banned device library under each device factor, the corresponding reference device factor can be screened out from all device factors, and then the ban score of the login device is calculated by analyzing the similarity of the login parameters between the login device and each banned device in the banned device library under each reference device factor, so as to accurately judge the possibility of whether the login device needs to be banned, ensure the reliability of the login device for ban detection, and do not need to ban each login device that uses multiple software, or cluster ban the login devices. On the basis of ensuring that the login device performs any normal operation, the lag of ban detection is avoided, thereby improving the accuracy of the login device for ban detection and the timeliness of the ban.

The ban detection device for a login device provided in this embodiment can be applied to the ban detection method for a login device provided in any of the above embodiments, and has corresponding functions and beneficial effects.

Embodiment 5

Figure 5 is a schematic diagram of the structure of a server provided in Embodiment 5 of the present invention. As shown in Figure 5, the server includes a processor 50, a storage device 51 and a communication device 52. The number of processors 50 in the server may be one or more, and Figure 5 takes one processor 50 as an example. The processor 50, storage device 51 and communication device 52 in the server may be connected via a bus or other means, and Figure 5 takes connection via a bus as an example.

A server provided in this embodiment can be used to execute the ban detection method for a login device provided in any of the above embodiments, and has corresponding functions and beneficial effects.

Embodiment 6

Embodiment 6 of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the method for detecting a login device being blocked in any of the above embodiments can be implemented. The method may specifically include:

Based on the registration fluctuation of the banned device library under each device factor, a corresponding reference device factor is selected from each of the device factors;

Based on the similarity of the login parameters between the login device and each banned device in the banned device library under each of the reference device factors, a banned score of the login device is calculated.

Of course, the storage medium containing computer executable instructions provided by an embodiment of the present invention is not limited to the method operations described above, and can also execute related operations in the ban detection method of the login device provided by any embodiment of the present invention.

Through the above description of the implementation methods, the technicians in the relevant field can clearly understand that the present invention can be implemented by means of software and necessary general hardware, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory (FLASH), hard disk or optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, server, or network device, etc.) to execute the methods described in each embodiment of the present invention.

It is worth noting that in the embodiment of the ban detection device of the above-mentioned login device, the various units and modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.

The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims (10)

1. A seal detection method for a login device, comprising:

screening out corresponding reference equipment factors from the equipment factors based on the login floating degree of the blocked equipment library under each equipment factor; the reference device factor is a device factor with login parameters not easy to tamper;

calculating a blocked score of the login device based on the similarity of login parameters of the login device and each blocked device in the blocked device library under each reference device factor;

The calculating the blocked score of the login device based on the similarity of login parameters of each blocked device in the login device and the blocked device library under the reference device factors comprises the following steps:

Calculating, for each blocked device in the blocked device library, a blocking similarity between the login device and the blocked device based on login parameters of the login device and the blocked device under the reference device factors;

Taking the maximum similarity in the blocking similarity between the login device and each blocked device as a blocked score of the login device;

the screening the corresponding reference device factors from the device factors based on the login floating degree of the blocked device library under each device factor comprises the following steps:

Determining the blocking reference confidence coefficient of each equipment factor based on the login floating degree of the blocked equipment library under each equipment factor, and screening out the equipment factors with the blocking reference confidence coefficient meeting the specified blocking detection specification as the reference equipment factors; the seal reference confidence is used for representing the credibility of a certain device factor serving as a reference device factor for seal detection of the login device.

2. The method of claim 1, wherein the blocking similarity is calculated using a reverse effect between a jaccard distance and similarity.

3. The method of claim 1, further comprising, prior to screening out corresponding reference device factors from the device factors based on a degree of login float of the blocked device library at each device factor:

and calculating the login floating degree of the blocked equipment library under the equipment factors based on the repeated frequency of each historical login parameter of the blocked equipment library under the equipment factors aiming at each equipment factor.

4. The method of claim 3, wherein calculating the degree of logging float of the blocked device library under the device factor based on the repetition frequency of each historical logging parameter of the blocked device library under the device factor comprises:

And performing entropy operation on the repeated frequency of each historical login parameter of the blocked equipment library under each equipment factor to obtain the login floating degree of the blocked equipment library under the equipment factor.

5. The method of any of claims 1-4, further comprising, after calculating the blocked score for the login device:

and if the blocked score of the login equipment exceeds a preset blocking threshold, blocking the login equipment.

6. The method of claim 5, further comprising, after blocking the login device:

Adding the login equipment with the completion of blocking into the blocked equipment library, and updating the login floating degree of the blocked equipment library under each equipment factor.

7. The method as recited in claim 5, further comprising:

And determining a corresponding preset blocking threshold based on the blocking accuracy and the blocking recall rate of the target login equipment set with the blocking detection completed.

8. A seal detection device for a login device, comprising:

The reference factor screening module is used for screening out corresponding reference equipment factors from the equipment factors based on the login floating degree of the blocked equipment library under each equipment factor; the reference device factor is a device factor with login parameters not easy to tamper;

The blocking detection module is used for calculating a blocked score of the login equipment based on the similarity of login parameters of the login equipment and each blocked equipment in the blocked equipment library under the factors of the reference equipment;

the seal detection module is specifically configured to:

Calculating, for each blocked device in the blocked device library, a blocking similarity between the login device and the blocked device based on login parameters of the login device and the blocked device under the reference device factors;

Taking the maximum similarity in the blocking similarity between the login device and each blocked device as a blocked score of the login device;

the reference factor screening module is specifically configured to:

Determining the blocking reference confidence coefficient of each equipment factor based on the login floating degree of the blocked equipment library under each equipment factor, and screening out the equipment factors with the blocking reference confidence coefficient meeting the specified blocking detection specification as the reference equipment factors; the seal reference confidence is used for representing the credibility of a certain device factor serving as a reference device factor for seal detection of the login device.

9. A server, the server comprising:

one or more processors;

a storage means for storing one or more programs;

When the one or more programs are executed by the one or more processors, the one or more processors are caused to implement the method of tamper detection of a login device according to any one of claims 1-7.

10. A computer-readable storage medium, on which a computer program is stored, characterized in that the program, when being executed by a processor, implements a method for detecting the disablement of a login device according to any one of claims 1 to 7.