WO2015032318A1 - Exceptional account determination method and device - Google Patents

Abstract

Provided are an exceptional account determination method and device. The exceptional account determination method comprises the steps of: detecting an IP address of login accounts, and counting the number of accounts logged in using the IP address; determining whether the number of accounts logged in using the IP address exceeds a threshold value or not; and if the number of accounts logged in using the IP address exceeds the threshold value, determining whether the accounts are exceptional accounts or not according to frequently used login locations, frequently used login time and frequently used services of the accounts logged in using the IP address. Also provided is an exceptional account determination device. According to the exceptional account determination method and device, whether login accounts are stolen or not is detected via the number of accounts logged in using the same IP address and exceptional operations of corresponding login accounts.

Description

Abnormal account determination method and device

The present application claims priority to Chinese Patent Application No. 201310396307.3, the entire disclosure of which is hereby incorporated by reference.

Technical field

The present invention relates to the field of the Internet, and in particular, to an abnormal account determination method and apparatus.

Background technique

In Internet services, most services require a user to provide a service password to access their own applications. At the same time, various hacking groups have also been created, which steal the user's service password in various ways to enter the user's application and illegally profit.

Now, for the handling of hacking, the operator generally receives the complaint of the user who has stolen the service password, and then performs a period of time processing on the user's account according to the complaint (to avoid malicious complaints), such as confirming the complaint is correct, and then Perform account recovery or re-apply application services. However, the above-mentioned processing is that the user himself complains about the account, which has a large delay, and may cause a large and irreparable loss to the user when the user complains.

Summary of the invention

The purpose of the embodiment of the present invention is to provide a method for determining an abnormal account, so as to solve the problem that the existing abnormal account is provided by the user itself, which has a large delay, and may cause a large Technical problems of irreparable damage.

The purpose of the embodiment of the present invention is to provide an abnormal account determining apparatus to solve the problem that the existing abnormal account is provided by the user itself, which has a large delay and may cause a large and irreparable loss to the user. Technical problem.

In one aspect, an abnormal account determination method is provided, which includes the steps of:

Detecting an IP (Internet Protocol) address of the login account, and counting the number of accounts logged in with the IP address;

Determining whether the number of the accounts logged in with the IP address exceeds a threshold;

If the number of accounts logged in by the IP address exceeds the threshold, it is determined whether the account is an abnormal account according to a common login location, a common login time, and a common service of the account that is logged in by the IP address.

In another aspect, an abnormal account determining apparatus is further provided, including:

a statistics module, configured to detect an IP address of the login account, and count the number of accounts logged in by the IP address;

An abnormality detecting module, configured to determine whether the number of accounts logged in by the IP address exceeds a threshold;

The abnormality determining module is configured to determine, according to the abnormality detecting module, that the number of accounts logged in by the IP address exceeds the threshold, according to a common login location, a common login time, and a common service of an account that is logged in by using the IP address, Whether the login account is an abnormal account.

In another aspect, a computer readable medium is provided for storing one or more computer programs, wherein the computer program includes computer system executable instructions having one or more memories; the instructions cause the computer system Execute the above abnormal account determination method.

Compared with the prior art, the abnormal account determining method and device of the present invention detects whether the login account is stolen by using the number of login accounts of the same IP address and the abnormal operation of the corresponding login account, and the existing abnormal account is solved by the user itself. The technical problem of providing large delays that may cause large, irreparable damage to the user.

DRAWINGS

1 is a schematic structural diagram of an abnormal account determining apparatus according to an embodiment of the present invention;

2 is a flowchart of a method for determining an abnormal account according to an embodiment of the present invention;

FIG. 3 is a schematic structural diagram of an abnormal account determining apparatus according to another embodiment of the present invention; FIG.

4 is a flowchart of a method for determining an abnormal account according to another embodiment of the present invention;

FIG. 5 is a schematic flowchart diagram of a specific embodiment of an abnormal account determining method according to the present invention;

FIG. 6 is a schematic diagram of a working environment structure of an electronic device in which the abnormal account determining method and the device are located in the present invention.

detailed description

The following description of the various embodiments is provided to illustrate the specific embodiments of the invention.

The terms "component," "module," "system," "interface," and the like, as used herein, are generally intended to refer to a computer-related entity: hardware, a combination of hardware and software, software, or software in execution. For example, a component can be, but is not limited to being, a process running on a processor, a processor, an object, an executable application, a thread of execution, a program, and/or a computer. By way of illustration, both an application running on a controller and the controller can be a component. One or more components may be within a process and/or thread of execution, And components can be located on one computer and/or distributed between two or more computers.

Moreover, the claimed subject matter can be implemented as a method, apparatus, or article of manufacture that uses standard programming and/or engineering techniques to produce software, firmware, hardware, or any combination thereof, to control a computer to implement the disclosed subject matter. The term "article of manufacture" as used herein is intended to encompass a computer program accessible from any computer-readable device, carrier, or media. Of course, those skilled in the art will recognize that many modifications can be made to the configuration without departing from the scope or spirit of the claimed subject matter.

Since the hacker steals the user password, he will try to log in to the user account, view the user's private information and use the user account for business consumption; and the hacker is likely to perform the above operations on multiple pirated accounts at the same time. Therefore, based on the user's behavior has a certain fixed law, it can be determined according to the IP aggregation status of the user login account that the user's account has been stolen, such as the login account of an IP address exceeds a threshold (ie, the login account of the IP address) If the number is abnormal, it can be determined that there is a large number of abnormal account operations on the IP address. The abnormal account operation may be caused by the hacker using the hacking software to frequently operate the stolen account. The abnormal account determining method and device of the present invention is based on the above principle, and can effectively provide an abnormal account to the operator and remind the user of the abnormal operation of the account.

Please refer to FIG. 1. FIG. 1 is a schematic structural diagram of a first preferred embodiment of an abnormal account determining apparatus according to the present invention. The abnormal account determining apparatus 10 of the preferred embodiment can be disposed in the electronic device. The abnormal account determining apparatus 10 of the preferred embodiment includes a statistic module 11, an abnormality detecting module 12, and an abnormality determining module 13. The statistic module 11 is configured to detect an IP address of the login account, and count the number of accounts logged in by the IP address; the abnormality detecting module 12 is configured to determine whether the number of accounts logged in by the IP address exceeds a threshold; the abnormality determining module 13 is used to The abnormality detecting module 12 determines whether the number of accounts logged in by the IP address exceeds a threshold, and determines whether the login account is an abnormal account according to a common login location, a common login time, and a common service of the account logged in by the IP address.

When the abnormal account determining apparatus 20 of the preferred embodiment is used, the first counting module 11 detects the IP addresses of all the login accounts, so that the number of accounts registered with the IP address can be counted. Then, the abnormality detecting module 12 detects whether the number of accounts registered with the IP address exceeds a threshold, and the threshold can be manually set. The threshold may be a multiple of the maximum number of accounts registered with the IP address; or a multiple of the average of the number of accounts registered with the IP address. For example, if the number of accounts logged in with an IP address suddenly increases to ten times the normal situation, the abnormality detecting module 12 generally considers that the number of accounts logged in with the IP address has exceeded the threshold. If the number of login accounts of the IP address does not exceed the threshold, the statistics module 11 continues to perform real-time statistics on the number of login accounts of each IP.

Then, if the abnormality detecting module 12 determines that the number of accounts logged in with the IP address exceeds the threshold, it is determined here that there may be an abnormal account operation on the IP address. The abnormality determining module 13 retrieves all login accounts registered on the IP address, common login locations of all login accounts, common login times, and common services; common login locations, common login times, and common services of the login account and the login account. The current login location, current login time, and current usage of the service are compared to determine if the login account is an abnormal account.

In one embodiment, if the number of login accounts registered on the IP address is A, where the common login location of the X login accounts is different from the current login location, the common login time of the Y login accounts is different from the current login time, Z. The common service of the login account is different from the current service. If X/A is greater than the first set value, Y/A is greater than the second set value, and Z/A is greater than the third set value, then the login is determined on the IP address. The accounts in the account that are not logged in through the common login location, not logged in at the usual login time, and unused common services are abnormal accounts. Here, the first set value, the second set value, and the third set value can be manually set, so that abnormal operations due to the user's own reasons or operator reasons can be excluded. Of course, the first set value, the second set value, and the third may not be set here. One or several of the set values, and the login account that does not log in through the common login location, does not log in at the usual login time, and does not use the common service is directly determined as an abnormal account.

Thus, the process of determining the abnormal account number of the abnormal account determining apparatus 10 of the preferred embodiment is completed.

The abnormal account determining apparatus of the preferred embodiment detects whether the login account is stolen by using the number of login accounts of the same IP address and the abnormal operation of the corresponding login account, and can provide the corresponding abnormal account to the user and the operator in time, thereby shortening the confirmation. The time of the abnormal account and the loss to the normal user.

Please refer to FIG. 1 and FIG. 2. FIG. 2 is a flowchart of a method for determining an abnormal account according to an embodiment of the present invention. The abnormal account determining method of this embodiment may be implemented by using the abnormal account determining device of the foregoing embodiment, and includes:

Step S201, detecting an IP address of the login account, and counting the number of accounts registered by the IP address;

Step S202, determining whether the number of accounts logged in by the IP address exceeds a threshold;

Step S203: Determine whether the account is an abnormal account according to a common login location, a common login time, and a common service of the account that is logged in by the IP address.

The abnormal account determination method of the preferred embodiment ends in step S203.

The specific flow of each step of the abnormal account determining method of the preferred embodiment will be described in detail below.

In step S201, the statistics module 11 detects the IP addresses of all the login accounts, so that the number of login accounts for each IP address can be counted, and then proceeds to step S202.

In step S202, the abnormality detecting module 12 detects whether the number of login accounts of each IP address exceeds a threshold, and the threshold can be manually set. The threshold may be a multiple of the maximum number of accounts logged in with the IP address; or a multiple of the average of the number of accounts logged in with the IP address. Such as the IP address of the account If the number does not exceed the threshold, the process returns to step S201, and the statistic module 11 continues to perform real-time statistics on the number of login accounts of each IP. Otherwise, step S203 is performed.

In step S203, if the abnormality detecting module 12 determines that the number of accounts logged in with the IP address exceeds the threshold, it is determined here that there may be an abnormal account operation on the IP address. The abnormality determining module 13 retrieves all accounts registered with the IP address, common login locations, common login times, and common services of the accounts; common login locations, common login times, and common services of the login account and the current current accounts. The login location, the current login time, and the currently used service are compared to determine whether the login account is an abnormal account.

In one embodiment, if the number of login accounts registered on the IP address is A, where the common login location of the X login accounts is different from the current login location, the common login time of the Y login accounts is different from the current login time, Z. The common service of the login account is different from the current service. If X/A is greater than the first set value, Y/A is greater than the second set value, and Z/A is greater than the third set value, then the login is determined on the IP address. The account number of the account that is not logged in through the common login location, not logged in at the usual login time, and unused common service is an abnormal account. Here, the first set value, the second set value, and the third set value can be manually set, so that abnormal operations due to the user's own reasons or operator reasons can be excluded. Of course, one or several of the first set value, the second set value, and the third set value may not be set here, but directly meet the failure to log in through the common login location, not log in at the common login time, and not used. The login account of the common service is determined to be an abnormal account.

This completes the process of determining the abnormal account number of the abnormal account determining method of the preferred embodiment.

The abnormal account determination method of the preferred embodiment detects whether the login account is stolen by using the number of login accounts of the same IP address and the abnormal operation of the corresponding login account, and can provide the corresponding abnormal account to the user and the operator in time, thereby shortening the confirmation. The time of the abnormal account and the reduction of the normal user loss.

Please refer to FIG. 3. FIG. 3 is a schematic structural diagram of an abnormal account determining apparatus according to another embodiment of the present invention. The abnormal account determining means 30 of the preferred embodiment can also be provided in the electronic device. Based on the first preferred embodiment, the abnormal account determining apparatus 30 of the preferred embodiment further includes a common login location determining module 35, a common login time determining module 36, a common service determining module 37, and an abnormal account determining module 38. The common login location determining module 35 is configured to use the most frequently used L login locations among all the login locations of the login account as the common login location of the login account, L is a positive integer greater than 1; the common login time determination module 36 is configured to log in the login account. The M login time period with the highest frequency in the login time period is used as the common login time of the login account, and M is a positive integer greater than 1. The common service determination module 37 is configured to use the N services with the highest frequency of use in the login account. For the common service of the login account, N is a positive integer greater than 1. The abnormal account determination module 38 is configured to perform an abnormal behavior detection on the login account confirmed as an abnormal account, and provide an abnormal account according to the detection result.

When the abnormal account determining apparatus 30 of the preferred embodiment is used, the first counting module 11 detects the IP addresses of all the login accounts, so that the number of accounts registered with the IP address can be counted. Then, the abnormality detecting module 12 detects whether the number of accounts registered with the IP address exceeds a threshold. If the number of accounts registered with the IP address does not exceed the threshold, the statistics module 11 continues to perform real-time statistics on the number of login accounts of each IP.

If the abnormality detecting module 12 determines that the number of accounts logged in by the IP address exceeds the threshold, the abnormality determining module 13 retrieves all the login accounts logged in with the IP address, and common login locations, common login times, and common services of all the login accounts; The common login location of the login account, the common login time, and the common service are compared with the current login location of the login account, the current login time, and the currently used service to determine whether the login account is an abnormal account. The specific determination process is as described above first For details, refer to the first preferred embodiment of the abnormal account determining device.

In the preferred embodiment, the common login location determining module 35 uses the L (such as 5) login locations with the highest frequency among all the login locations of the login account as the common login location of the login account, and L is a positive integer greater than 1. The common login time determining module 36 uses the M login time periods (such as 18:00 to 19:00, and 23 to 24 points) with the highest frequency in the login time period of the login account as the common login time of the login account, and M is greater than 1. The normal service determination module 37 uses the N service (such as a network phone) having the highest frequency of use in the service of the login account as a common service of the login account, and N is a positive integer greater than 1. Of course, the common login location, common login time, and common service settings can also be set by other statistical methods. The specific common login location, common login time, and common service setting method do not limit the protection scope of the abnormal account determination apparatus of the present invention.

After the abnormality determining module 13 determines the abnormal account, the abnormal account determining module 38 performs abnormal behavior detection on the login account confirmed as the abnormal account, and provides an abnormal account according to the detection result. The abnormal behavior detection here includes detecting whether the login account is reported, detecting whether the login account has sent a spam message, and detecting whether the login account has modified at least one of the passwords. Spam here includes advertising messages and pornographic messages. If the abnormal account determination module detects any of the abnormal behaviors described above, the abnormal account may be deemed to be provided to the corresponding operator for immediate processing (such as a title, etc.) to reduce the abnormal account to the user and the operator. loss.

The abnormal account determining apparatus of the preferred embodiment confirms the common login location, common login time, and common service of the abnormal account by using the common login location module, the common login time module, and the common service module on the basis of the first preferred embodiment. Makes detection of abnormal accounts faster. At the same time, the abnormal account detection by the abnormal account determination module further optimizes the provision of the abnormal account.

Please refer to FIG. 3 and FIG. 4. FIG. 4 is a schematic diagram of an abnormal account determination method according to another embodiment of the present invention. flow chart. The abnormal account number determining method in this embodiment may be implemented by using the abnormal account determining device according to another embodiment of the present invention, which includes:

Step S401, detecting an IP address of the login account, and counting the number of accounts registered by the IP address;

Step S402, determining whether the number of accounts logged in by the IP address exceeds a threshold;

Step S403, determining whether the login account is an abnormal account according to a common login location, a common login time, and a common service of the account that is logged in by the IP address;

Step S404, performing abnormal behavior detection on the login account for confirming the abnormal account, and providing an abnormal account according to the detection result.

The abnormal account determination method of the preferred embodiment ends in step S404.

The specific flow of each step of the abnormal account determining method of the preferred embodiment will be described in detail below.

In step S401, the statistics module 11 detects the IP addresses of all the login accounts, so that the number of login accounts for each IP address can be counted, and then proceeds to step S402.

In step S402, the abnormality detecting module 12 detects whether the number of login accounts of each IP address exceeds a threshold, and the threshold can be manually set. The threshold may be a multiple of the maximum number of accounts logged in with the IP address; or a multiple of the average of the number of accounts logged in with the IP address. If the number of login accounts of the IP address does not exceed the threshold, the process returns to step S401, and the statistics module continues to perform real-time statistics on the number of login accounts of each IP; otherwise, step S403 is performed.

In step S403, if the abnormality detecting module 12 determines that the number of accounts registered with the IP address exceeds the threshold, it is determined here that there may be an abnormal account operation on the IP address. The abnormality determining module 13 retrieves all accounts registered with the IP address, common login locations of all accounts, common login time, and common services; common login locations, common login times, and common services of the login account and the current current account Login location, current login time, and current usage comparisons to Determine if the login account is an abnormal account.

The common login location determining module 35 uses the highest frequency L (such as 5) login locations among all the login locations of the login account as the common login location of the login account, L is a positive integer greater than 1; the common login time determination module 36 will The M login time period (such as 18:00 to 19:00 and 23:00 to 24:00) with the highest frequency in the login time range of the login account is used as the common login time of the login account, and M is a positive integer greater than 1; The module 37 uses the N services (such as network telephones) with the highest frequency of use in the service of the login account as the common service of the login account, and N is a positive integer greater than 1. Of course, the common login location, common login time, and common service settings can also be set by other statistical methods. The specific common login location, common login time, and common service setting method do not limit the protection scope of the abnormal account determination apparatus of the present invention. Step S404 is then performed.

In step S404, after the abnormality determining module 13 determines the abnormal account, the abnormal account determining module 38 performs abnormal behavior detection on the login account confirmed as the abnormal account, and provides an abnormal account according to the detection result. The abnormal behavior detection here includes detecting whether the login account is reported, detecting whether the login account has sent a spam message, and detecting whether the login account has modified at least one of the passwords. Spam here includes advertising messages and pornographic messages. If the abnormal account determination module detects any of the abnormal behaviors described above, the abnormal account may be deemed to be provided to the corresponding operator for immediate processing (such as a title, etc.) to reduce the abnormal account to the user and the operator. loss.

On the basis of the first embodiment, the abnormal login account determining method of the preferred embodiment confirms the common login location, common login time, and common service of the abnormal account by using the common login location module, the common login time module, and the common service module. Detection of abnormal accounts is faster. At the same time, the abnormal account detection by the abnormal account determination module further optimizes the provision of the abnormal account.

The specific working principle of the abnormal account determining method of the present invention will be described in detail below with reference to FIG. Please refer to FIG. 5 is a schematic flowchart diagram of a specific embodiment of an abnormal account determining method according to the present invention.

After the user performs an abnormal operation (such as modifying a password or a transaction occurs), the abnormal account determining method according to the embodiment includes: recording the user operation behavior in real time 51; and performing analysis 52 on the user's operation behavior and operation time. The analysis 53 stores the user's common service in the common service determination module 54 and stores the user's common login time period in the common login time determination module 55.

When the user performs the login operation, the abnormal account determination method according to the embodiment includes: real-time recording 56 of the login operation of the user, and analyzing the login operation of the user, performing real-time statistics on the login IP address of the user 57 and the user The login location performs statistics 58, and the user's login location is stored in the common login location determination module 59.

When the statistic module counts the logged-in user of an IP address exceeding the threshold, the abnormality determining module 60 invokes the data of the common login time determining module 55, the common service determining module 54, and the common login location determining module 59, and the corresponding mathematical model to determine the abnormality. Account number, and determine the determined abnormal account to the corresponding operator or user.

Thus, the abnormal account determination method and the abnormal account determination process of the device of the present invention are completed.

The abnormal account determining method and device of the present invention detects whether the login account is stolen by the number of login accounts of the same IP address and the abnormal operation of the corresponding login account, and solves the problem that the existing abnormal account is provided by the user itself and has a large Delayed, technical problems that may cause large, irreparable damage to users.

Figure 6 and the following discussion provide a brief, general description of the operating environment of the electronic device in which the abnormal account determination device of the present invention is implemented. The working environment of Figure 6 is only one example of a suitable working environment and is not intended to suggest any limitation as to the scope of use or function of the working environment. Example electronic device 612 includes, but is not limited to, a personal computer, a server computer, a handheld or laptop device, a mobile device (such as a mobile phone, a personal digital assistant (PDA), a media player, etc.), a multi-processor system, a consumer Electronic devices, small computers, mainframe computers, distributed computing environments including any of the above systems or devices, and the like.

Although not required, embodiments are described in the general context in which "computer readable instructions" are executed by one or more electronic devices. Computer readable instructions may be distributed via computer readable media (discussed below). Computer readable instructions may be implemented as program modules, such as functions, objects, application programming interfaces (APIs), data structures, etc. that perform particular tasks or implement particular abstract data types. Typically, the functionality of the computer readable instructions can be combined or distributed at will in various environments.

FIG. 6 illustrates an example of an electronic device 612 that includes one or more embodiments of the abnormal account determination method and apparatus of the present invention. In one configuration, electronic device 612 includes at least one processing unit 616 and memory 618. Depending on the configuration and type of electronic device, memory 618 may be volatile (such as RAM), non-volatile (such as ROM, flash memory, etc.) or some combination of the two. This configuration is illustrated in Figure 1 by dashed line 614.

In other embodiments, electronic device 612 may include additional features and/or functionality. For example, device 612 may also include additional storage devices (eg, removable and/or non-removable) including, but not limited to, magnetic storage devices, optical storage devices, and the like. Such an additional storage device is illustrated by storage device 620 in FIG. In one embodiment, computer readable instructions for implementing one or more embodiments provided herein may be in storage device 620. Storage device 620 can also store other computer readable instructions for implementing an operating system, applications, and the like. Computer readable instructions may be loaded into memory 618 for execution by, for example, processing unit 616.

The term "computer readable medium" as used herein includes computer storage media. Computer storage Media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions or other data. Memory 618 and storage device 620 are examples of computer storage media. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical storage device, magnetic tape cassette, magnetic tape, magnetic disk storage device or other magnetic storage device, Or any other medium that can be used to store desired information and that can be accessed by electronic device 612. Any such computer storage media may be part of the electronic device 612.

Electronic device 612 may also include a communication connection 626 that allows electronic device 612 to communicate with other devices. Communication connection 626 may include, but is not limited to, a modem, a network interface card (NIC), an integrated network interface, a radio frequency transmitter/receiver, an infrared port, a USB connection, or other interface for connecting electronic device 612 to other electronic devices. Communication connection 626 can include a wired connection or a wireless connection. Communication connection 626 can transmit and/or receive communication media.

The term "computer readable medium" can include a communication medium. Communication media typically embodies computer readable instructions or other data in "modulated data signals" such as carrier waves or other transport mechanisms, and includes any information delivery media. The term "modulated data signal" can include a signal that one or more of the signal characteristics are set or changed in such a manner as to encode the information into the signal.

The electronic device 612 can include an input device 624 such as a keyboard, mouse, pen, voice input device, touch input device, infrared camera, video input device, and/or any other input device. Output device 622 may also be included in device 612, such as one or more displays, speakers, printers, and/or any other output device. Input device 624 and output device 622 can be connected to electronic device 612 via a wired connection, a wireless connection, or any combination thereof. In one embodiment, an input device or output device from another electronic device can be used as the input device 624 or output device of the electronic device 612. Prepare 622.

The components of electronic device 612 can be connected by various interconnects, such as a bus. Such interconnects may include Peripheral Component Interconnect (PCI) (such as Fast PCI), Universal Serial Bus (USB), Firewire (IEEE 1394), optical bus architecture, and the like. In another embodiment, the components of electronic device 612 can be interconnected by a network. For example, memory 618 may be comprised of multiple physical memory units that are interconnected by a network located in different physical locations.

Those skilled in the art will recognize that storage devices for storing computer readable instructions may be distributed across a network. For example, electronic device 630 accessible via network 628 can store computer readable instructions for implementing one or more embodiments of the present disclosure. The electronic device 612 can access the electronic device 630 and download a portion or all of the computer readable instructions for execution. Alternatively, electronic device 612 can download a plurality of computer readable instructions as needed, or some of the instructions can be executed at electronic device 612 and some of the instructions can be executed at electronic device 630.

Various operations of the embodiments are provided herein. In one embodiment, the one or more operations may constitute computer readable instructions stored on one or more computer readable media that, when executed by an electronic device, cause the computing device to perform the operations. The order in which some or all of the operations are described should not be construed as implying that the operations must be sequential. Those skilled in the art will appreciate alternative rankings that have the benefit of this specification. Moreover, it should be understood that not all operations must be present in every embodiment provided herein.

Moreover, the word "preferred" as used herein is intended to serve as an example, instance, or illustration. Any aspect or design described as "preferred" by the text is not necessarily to be construed as being more advantageous than other aspects or designs. Instead, the use of the word "preferred" is intended to present a concept in a specific manner. The term "or" as used in this application It is intended to mean an "or" rather than an excluded "or". That is, unless otherwise specified or clear from the context, "X employs A or B" means naturally including any one of the permutations. That is, if X uses A; X uses B; or X uses both A and B, then "X uses A or B" is satisfied in any of the foregoing examples.

Rather, the present invention has been shown and described with respect to the embodiments of the present invention. The present disclosure includes all such modifications and variations, and is only limited by the scope of the appended claims. With particular regard to various functions performed by the above-described components (e.g., elements, resources, etc.), the terms used to describe such components are intended to correspond to performing the specified functions of the components (e.g., they are functionally equivalent). Any component (unless otherwise indicated) is not equivalent in structure to the disclosed structure for performing the functions in the exemplary implementations of the present disclosure as shown herein. Moreover, although certain features of the present disclosure have been disclosed with respect to only one of several implementations, such features may be combined with one or more other implementations as may be desired and advantageous for a given or particular application. Other feature combinations. Furthermore, the terms "comprising," "having," "having," or "include" or "comprising" are used in the particular embodiments or claims, and such terms are intended to be encompassed in a manner similar to the term "comprising."

Each functional unit in the embodiment of the present invention may be integrated into one processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above integrated modules can be implemented in the form of hardware or in the form of software functional modules. The integrated modules, if implemented in the form of software functional modules and sold or used as stand-alone products, may also be stored in a computer readable storage medium. The above mentioned storage medium may be a read only memory, a magnetic disk or an optical disk or the like. Each of the above described devices or systems can perform the methods of the corresponding method embodiments.

In the above, the present invention has been disclosed in the above preferred embodiments, but the preferred embodiments are not intended to limit the present invention, and those skilled in the art can make various modifications without departing from the spirit and scope of the invention. The invention is modified and retouched, and the scope of the invention is defined by the scope defined by the claims.

Claims (13)

An abnormal account determination method, characterized in that the method comprises the steps of: Detecting an internet protocol address of the login account, and counting the number of accounts logged in with the internet protocol address; Determining whether the number of the accounts logged in with the Internet Protocol address exceeds a threshold; If the number of the accounts that are logged in by the Internet Protocol address exceeds the threshold, it is determined whether the account is an abnormal account according to a common login location, a common login time, and a common service of the account that is logged in by the Internet Protocol address. The abnormal account determination method according to claim 1, wherein the abnormal account is an account that is logged in with the Internet Protocol address, and is not logged in through a common login location, not logged in at a common login time, and not used. Business account number. The method for determining an abnormal account according to claim 2, wherein the step of determining whether the login account is an abnormal account comprises: If the number of login accounts of the Internet Protocol address exceeds the threshold, X account accounts of the Internet Protocol address are not logged in through a common login location, and Y accounts are in the login account of the Internet Protocol address. The login account of the Internet Protocol address has Z accounts that are not used for common services, and X/A is greater than the first set value, and Y/A is greater than the second set value, Z/A. If the value is greater than the third set value, where A is the number of login accounts of the Internet Protocol address, it is determined that the login account of the Internet Protocol address satisfies not logging in through the common login location, not logging in the common login time, and not using the commonly used login time. The login account of the service is the abnormal account. The abnormal account determination method according to claim 1, wherein the abnormal account determination method further comprises the steps of: The L most frequent login sites of all the login locations of the login account are used as common login sites of the login account, and L is a positive integer greater than 1. The M login time period with the highest frequency in the login time period of the login account is used as the common login time of the login account, and M is a positive integer greater than 1; The N service with the highest frequency of use in the service of the login account is used as a common service of the login account, and N is a positive integer greater than 1. The abnormal account determination method according to claim 1, wherein the abnormal account determination method further comprises the steps of: Performing abnormal behavior detection on the account identified as the abnormal account, and providing the abnormal account according to the detection result. The abnormal account determination method according to claim 5, wherein the abnormal behavior detection comprises detecting whether the login account is reported, detecting whether the login account has sent a spam message, and detecting whether the login account has been modified. At least one of the passwords. An abnormal account determining device, comprising: a statistics module, configured to detect an internet protocol address of the login account, and count the number of accounts registered by using the internet protocol address; An abnormality detecting module, configured to determine whether the number of accounts logged in by the Internet Protocol address exceeds a threshold; An abnormality determining module, configured to: if the abnormality detecting module determines that the number of accounts logged in by the Internet Protocol address exceeds the threshold, according to a common login location of an account with the Internet Protocol address Point, common login time, and common service, determine whether the account is an abnormal account. The abnormal account determining apparatus according to claim 7, wherein the abnormal account is a login account of the Internet Protocol address, and simultaneously fails to log in through a common login location, does not log in at a common login time, and does not use a common service. Account number. The abnormal account determining apparatus according to claim 8, wherein if the abnormality detecting module determines that the number of login accounts of the Internet Protocol address exceeds the threshold, the abnormality determining module determines the Internet Protocol address. There are X accounts in the login account that are not logged in through the common login location. Among the login accounts of the Internet Protocol address, there are Y accounts that are not logged in at the common login time. There are Z accounts in the login account of the Internet Protocol address. The common service is not used, and X/A is greater than the first set value, Y/A is greater than the second set value, and Z/A is greater than the third set value, where A is the number of login accounts of the Internet Protocol address, and Further determining that the login account of the Internet Protocol address satisfies the abnormal account that does not log in through the common login location, does not log in at the common login time, and does not use the common service. The abnormal account determining device according to claim 7, wherein the abnormal account determining device further comprises: a common login location determining module, configured to use the L most frequent login locations of all the login locations of the login account as the common login location of the login account, where L is a positive integer greater than one; a common login time determining module, configured to use M login time periods with the highest frequency in the login time period of the login account as the common login time of the login account, where M is a positive integer greater than 1; The common service determining module is configured to use the N service with the highest frequency of use in the service of the login account as a common service of the login account, where N is a positive integer greater than 1. The abnormal account determining device according to claim 7, wherein the abnormal account determining device further comprises: The abnormal account determining module is configured to perform abnormal behavior detection on the account confirmed as the abnormal account, and provide the abnormal account according to the detection result. The abnormal account determining apparatus according to claim 11, wherein the abnormal behavior detecting comprises detecting whether the login account is reported, detecting whether the login account has sent a spam message, and detecting whether the login account has been modified. At least one of the passwords. A computer readable medium storing one or more computer programs, wherein the computer program comprises computer system executable instructions having one or more memories; the instructions causing a computer system to perform according to claims 1-6 The abnormal account determination method described in any one of the above.

Images