CN111445210B - Account cleaning method and device, electronic equipment and storage medium - Google Patents

Abstract

Embodiments of the present invention provide an account cleaning method, device, electronic device and storage medium. In this method, the account information set to be managed and historical access record information are obtained; based on the historical access record information, it is determined whether there is early warning account information from the account information set to be managed; when early warning account information exists, the early warning account information is pushed send the early warning message to the preset client; receive a feedback message for the early warning message from the preset client, and process the early warning account information according to the feedback message. As a result, account managers are reminded and assisted to perform account cleanup operations without the need to perform full account cleanup operations.

Description

Account cleanup methods, devices, electronic devices and storage media

Technical field

The present invention relates to the field of Internet technology, and in particular to an account cleaning method, device, electronic equipment and storage medium.

Background technique

In recent years, out of concern for data security and controllability, some large entities (such as governments, large enterprises, schools, etc.) will build dedicated networks or company intranets.

In order to facilitate company employees to handle various matters, applications for different businesses (for example, office automation (Office Automation, OA), enterprise resource planning (ERP) and other system applications) will be configured in the network and provide employees with Assign the corresponding account. However, due to personnel resignations, transfers and other reasons, there will be a need to clean up useless accounts.

At present, account managers are mainly relied on to manage useless accounts. For example, department heads take the initiative to report personnel change information to apply for cleaning up the accounts of the changed personnel, or account managers regularly mobilize various departments to sort out useless accounts. However, this method of manual account management may lead to the problem of manual management negligence, which is not conducive to the security of the company's sensitive data.

In response to the above problems, there is currently no better solution in the industry.

Contents of the invention

Embodiments of the present invention provide an account cleaning method, device, electronic device and storage medium to solve the problem in the prior art that accounts in office networks require manual management, and realize intelligent screening and cleaning of account information.

Another aspect of the embodiment of the present invention provides an account cleaning method, which includes:

Obtain the account information set to be managed and historical access record information;

Based on the historical access record information, determine whether there is early warning account information from the account information set to be managed;

When the early warning account information exists, push an early warning message for the early warning account information to the default client;

Receive a feedback message for the early warning message from the preset client;

The early warning account information is processed according to the feedback message.

Further, based on the historical access record information, determine whether there is early warning account information from the account information set to be managed, specifically including:

Based on the historical access record information, obtain access feature information, where the access feature information includes access features in at least one dimension;

According to the access characteristic information, it is determined whether there is early warning account information from the account information set to be managed.

Further, the access characteristic information includes access characteristics in the access time dimension;

Correspondingly, according to the access characteristic information, determine whether there is early warning account information from the account information set to be managed, specifically including:

Determine the non-login duration of each account information based on the historical access time information of each account information in the account information set to be managed;

Compare the non-login duration of each account information with the warning time threshold to determine whether there is warning account information.

Further, the feedback message includes time correction information. Correspondingly, the account cleaning method also includes:

Determine the time threshold adjustment value based on the time correction information in each feedback message for the warning message within the preset time period;

Based on the time threshold adjustment value, the warning time threshold is adjusted, wherein the adjusted warning time threshold is applied in subsequent processing operations for the account information set to be managed.

Further, the feedback message includes confirmation information or denial information for the early warning message;

Correspondingly, the time threshold adjustment value is determined based on the time correction information in each feedback message of the warning message for the preset time period, specifically including:

Determine the corresponding time threshold reduction amount based on the time correction information in the feedback message including the confirmation information, or,

Determine the corresponding time threshold increment based on the time correction information in the feedback message including the denial information;

The time threshold adjustment value is determined based on the determined time threshold reduction or time threshold increase of each feedback message corresponding to the preset time period.

Further, the access characteristic information includes access characteristics under the access IP dimension;

Correspondingly, according to the access characteristic information, determine whether there is early warning account information from the account information set to be managed, specifically including:

Determine the number of consecutive external network visits for each account information based on the access IP information of each account information in the account information set to be managed;

Compare the number of consecutive external network visits of each account information with the number of warnings threshold to determine whether the warning account information exists.

Further, the access characteristic information includes access characteristics under the geographical dimension of access;

Correspondingly, according to the access characteristic information, determine whether there is early warning account information from the account information set to be managed, specifically including:

Compare the historical access geographical information of each account information in the account information set to be managed with the commonly used geographical information pre-bound to each account information to determine whether there is historical access geographical information in different places;

Based on the judgment results of the remote historical access geographical information, it is determined whether there is early warning account information.

Another aspect of the embodiment of the present invention provides an account cleaning device, including:

The access data acquisition unit is configured to acquire the account information set to be managed and historical access record information;

An early warning account determination unit is configured to determine whether there is early warning account information from the account information set to be managed based on the historical access record information;

An early warning message push unit is configured to push an early warning message for the early warning account information to a preset client when the early warning account information exists;

A feedback message receiving unit configured to receive a feedback message for the early warning message from the preset client;

The early warning account processing unit is configured to process the early warning account information according to the feedback message.

Another aspect of the embodiment of the present invention provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the above account cleaning method is implemented. step.

Another aspect of the embodiments of the present invention provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the above account cleaning method are implemented.

The account cleaning method, device, electronic device and storage medium provided by the embodiment of the present invention determine the early warning account information from the account information set of the network through the historical access record information of the network, and send the early warning account information to the preset client, and then Clear the warning account information based on the feedback from the default client. As a result, the early warning account information is automatically identified based on the historical access record information, thereby reminding and assisting account managers to perform account cleanup operations without the need for full account cleanup operations.

Description of the drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the drawings in the following description These are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without exerting creative efforts.

Figure 1 shows a schematic architectural diagram of an example of an environment suitable for applying the account cleanup method according to an embodiment of the present invention;

Figure 2 shows a flow chart of an example of an account cleaning method according to an embodiment of the present invention;

Figure 3 shows a flow chart of an example of determining early warning account information according to an embodiment of the present invention;

Figure 4 shows a flow chart of another example of an account cleaning method according to an embodiment of the present invention;

Figure 5 shows a flow chart of an example of an adjustment process for the warning time threshold according to an embodiment of the present invention;

Figure 6 shows a signal timing flow chart of an example of an account cleanup method according to an embodiment of the present invention;

Figure 7 shows a flow chart of another example of determining early warning account information according to an embodiment of the present invention;

Figure 8 shows a flow chart of another example of determining early warning account information according to an embodiment of the present invention;

Figure 9 shows a structural block diagram of an example of an account cleaning device according to an embodiment of the present invention;

Figure 10 shows a schematic structural diagram of an electronic device for account cleaning according to an embodiment of the present invention.

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments These are some embodiments of the present invention, rather than all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without making creative efforts fall within the scope of protection of the present invention.

As used herein, the term "includes" and variations thereof represent an open term meaning "including, but not limited to." The term "based on" means "based at least in part on." The terms "one embodiment" and "an embodiment" mean "at least one embodiment." The term "another embodiment" means "at least one other embodiment". The terms "first", "second", etc. may refer to different or the same object. Other definitions may be included below, whether explicit or implicit. The definition of a term is consistent throughout this specification unless the context clearly dictates otherwise.

Additionally, as used herein, the term "office network" may refer to a network deployed based on a private cloud architecture or a local area network architecture. There are a large number of intranet applications (such as OA and ERP system applications) in large entities. How to clean up the accounts of changed employees or resigned accounts to ensure the security of office network information is currently a major problem in the industry.

The account cleaning method and device according to the embodiment of the present invention will now be described with reference to the accompanying drawings.

Figure 1 shows a schematic architectural diagram of an example of an environment suitable for applying the account cleanup method according to the embodiment of the present invention.

As shown in Figure 1, in the environment 100, at least one client can send an access request to the office network server (for example, 151 and/or 152) through the office network 110 to request the office network server to provide corresponding content. Internet services, such as OA system application services or ERP system application services. Here, the client can be a terminal device such as a desktop computer 132, a notebook computer 136, and a mobile phone 134, and employees can use various applications configured in the office network through the client. In addition, the office network server may provide services for applications in the office network, such as office network servers serving OA system applications and ERP system applications. In an example of the embodiment of the present invention, the office network server includes at least one business application server. For example, 151 and 152 shown in Figure 1 may respectively be business application server terminals that specifically serve unique corresponding applications, for example, respectively. Server hosts dedicated to serving OA systems or ERP systems.

Further, the account cleaning device 140 can be deployed on any server that can communicate and interact with the office network server (for example, the account cleaning server), or the account cleaning device 140 can also be deployed on the office network server. In this way, the cleaning device 140 installed in the office network can determine whether there is account information that requires early warning by analyzing the historical access information to the office network server, and perform corresponding account retention operations or account cleaning based on the feedback message for the early warning account information. operations to protect information security in office networks.

FIG. 2 shows a flow chart of an example of an account cleaning method according to an embodiment of the present invention.

As shown in Figure 2, in step 210, the account information set to be managed and historical access record information are obtained.

It should be noted that the historical access record information may be record information generated based on all or part of the accounts in the above account information set accessing a preset network (such as an office network).

In addition, the account information set to be managed may be the registered account information of some or all employees in the office network. In an example of the embodiment of the present invention, at least one office system is configured in the office network, and the account information set to be managed is the account information set of at least one office system, for example, the account information registered in the OA system and the ERP system respectively. Set for cleaning. As a result, the account information of each different office system can be cleaned separately, realizing personalized account cleaning operations for each office system in the office network.

In step 220, based on the historical access record information, it is determined whether there is early warning account information from the account information set to be managed. Here, the historical access record information of the office network can reflect the access behavior of different account information to the office network, and then the corresponding access behavior can be analyzed to determine whether there is early warning account information. For example, you can analyze whether there is an account that has not been logged in for a long time, or abnormal usage of the account, etc., and use this to determine the warning account information. More details will be expanded below.

If the judgment result in step 220 indicates that there is warning account information, jump to step 230 . In addition, if the judgment result in step 220 indicates that there is no warning account information, jump to step 260 .

In step 230, push the warning message for the warning account information to the default client. Here, the warning message may be delivered in various message modes, such as email messages, short messages, application reminder messages, etc.

Specifically, the default client may refer to a default client used to receive and process the warning message. Based on the application scenario, the default client can be the client of the account manager, and the account manager can react to the alert account information according to the alert message, such as confirming that the employee corresponding to the alert account information has resigned or been transferred. Post. In addition, some other additional information may also exist in the feedback message and be used to implement corresponding functions. More details will be expanded below.

In step 240, a feedback message for the early warning message is received from a preset client.

In this step, the feedback message may carry deletion instruction information for the early warning message. Correspondingly, in this case, the early warning account information can be deleted and cleaned based on the feedback information.

In this step, the feedback information may include the latest account status of the early warning account information; accordingly, in this case, the early warning account information is processed according to the latest account status carried in the feedback message. If the latest account status is If the account status is logged in before the preset time period, the warning account information will be deleted and cleaned. If the latest account status is logged in within the preset time period, the warning account information will be retained.

In this step, the feedback message may include confirmation information or denial information for the warning message. Continuing with the above application scenario, when the account manager confirms the warning account information, there is confirmation information in the corresponding feedback message. Accordingly, in this case, the warning account information is deleted and cleaned. In addition, when the account manager denies the warning account information, there is denial information in the corresponding feedback message. Accordingly, in this case, the warning account information is retained.

In step 250, the early warning account information is processed according to the feedback message.

In this step, as mentioned above, the warning account information is deleted, retained, and other different processes are performed according to different situations reflected in the feedback message.

Through the embodiments of the present invention, early warning account information is identified from the account information set based on historical access record information, and account managers can be automatically reminded of account information that has potential security risks (for example, those who have resigned or have been transferred). Compared with manual screening, And clean up the early warning accounts to avoid manual management negligence. Improved data information security of the office network.

Based on the content of the above embodiment, in this embodiment, based on the historical access record information, it is determined whether there is early warning account information from the account information set to be managed, which specifically includes:

Based on the historical access record information, obtain access feature information, where the access feature information includes access features in at least one dimension;

According to the access characteristic information, it is determined whether there is early warning account information from the account information set to be managed.

In this embodiment, the access characteristic information includes access characteristics in at least one dimension. For example, it may be access characteristics in the time dimension, access characteristics in the IP dimension, and access characteristics in the geographical dimension. Among them, the access characteristics under the time dimension can be the non-login duration of each account information; the access characteristics under the IP dimension can be the number of consecutive external network visits for each account information; the access characteristics under the access geography dimension can be each Historical access geographic information of account information. Correspondingly, based on the access characteristics in at least one dimension, it is determined whether there is early warning account information from the account information set to be managed. For example: ① According to the access characteristics in the time dimension, determine whether there is early warning account information from the account information set to be managed; ② Based on the access characteristics under the IP dimension, determine whether there is early warning account information from the account information set to be managed. ; ③ According to the access characteristics under the geographical dimension of access, determine whether there is early warning account information from the account information to be managed; ④ According to the access characteristics under the time dimension and the access characteristics under the IP dimension, from the account information to be managed The information is concentrated to determine whether there is early warning account information; ⑤ According to the access characteristics in the time dimension and the access characteristics in the geographical dimension of access, it is determined from the account information to be managed whether there is early warning account information; ⑥ According to the access characteristics in the IP dimension and the access characteristics under the access geographical dimension, determine whether there is early warning account information from the account information to be managed; ⑦According to the access characteristics under the time dimension, the access characteristics under the IP dimension and the access characteristics under the access geographical dimension, from The account information to be managed is centrally determined to determine whether there is early warning account information.

Based on the content of the above embodiment, in this embodiment, the access characteristic information includes access characteristics in the access time dimension;

Correspondingly, according to the access characteristic information, determine whether there is early warning account information from the account information set to be managed, specifically including:

Determine the non-login duration of each account information based on the historical access time information of each account information in the account information set to be managed;

Compare the non-login duration of each account information with the warning time threshold to determine whether there is warning account information.

Figure 3 shows a flow chart of an example of determining early warning account information according to an embodiment of the present invention. As shown in Figure 3, in step 310, the non-login duration of each account information in the account information set to be managed is determined based on the historical access account information and the corresponding historical access time information in the historical access record information.

Specifically, the access time corresponding to the most recent access corresponding to each historical access account information in the historical access record information can be determined, and the non-login duration of each account information can be determined based on the access time corresponding to the most recent access.

In step 320, the non-login duration of each account information in the account information set to be managed is compared with the warning time threshold to determine whether there is warning account information. Specifically, when the non-login duration corresponding to an account information is greater than or equal to the warning time threshold, the account information can be determined to be warning account information; when the non-login duration corresponding to an account information is less than the warning time threshold, it can be Make sure that the account information is not the warning account information.

It should be noted that the warning time threshold can be preset (for example, 90 days), and can also be adjusted during the actual application operation, such as intelligent adjustment based on feedback messages. More details will be expanded below. .

Through the embodiments of the present invention, account information that has not been logged in for a long time can be screened out and determined as early warning account information, thereby realizing intelligent screening of account information of potential resigned employees or employees who have been transferred to other positions who have not logged in for a long time.

Based on the content of the above embodiment, in this embodiment, the feedback message includes time correction information. Correspondingly, the account cleaning method also includes:

Determine the time threshold adjustment value based on the time correction information in each feedback message for the warning message within the preset time period;

Based on the time threshold adjustment value, the warning time threshold is adjusted, wherein the adjusted warning time threshold is applied in subsequent processing operations for the account information set to be managed.

Figure 4 shows a flow chart of another example of an account cleaning method according to an embodiment of the present invention.

In step 410, the time threshold adjustment value is determined based on the time correction information in each feedback message for the warning message within the preset time period.

For example, when the account manager sends a feedback message through a preset client, in addition to replying with confirmation information or denial information for the warning message in the feedback message, he can also reply with time correction information in the feedback message. Correspondingly, The time threshold adjustment value is determined according to the time correction information in each feedback message for the warning message within the preset time period.

Based on the application scenario, the warning message was sent to the default client on "January 1, 2020". In other words, it reminded the account manager whether the corresponding warning should be issued on "January 1, 2020". Account information is cleared. At this time, the account manager can feedback message P "This account should be cleaned up, and the employee has resigned on December 11, 2019" or feedback message S "This account will not be cleaned up temporarily, and it can be extended to 2020 "January 11th."

In this embodiment, "the employee resigned on December 11, 2019" in the feedback message P is time correction information; similarly, "can be extended to January 11, 2020" in the feedback message S Also belongs to time correction information.

In this embodiment, the time threshold adjustment value is determined based on the time correction information in the feedback message for the early warning message, which can be understood as follows:

For example, for the feedback message P "This account should be cleaned up, and the employee has resigned on December 11, 2019", since the warning message was sent on January 1, 2020, and passed If the feedback message indicates that the employee resigned on December 11, 2019, the corresponding time threshold adjustment value can be determined to be -20 days (there is a 20-day difference between January 1, 2020, and December 11, 2019). In the same way, for the feedback message S that "the account will not be cleaned up for the time being and can be extended to January 11, 2020", since the warning message was sent on January 1, 2020, and it was known through this feedback message If it can be extended to January 11, 2020, then the corresponding time threshold adjustment value can be determined to be +10 days (the difference between January 11, 2020 and January 1, 2020 is 10 days).

In this embodiment, when determining the time threshold adjustment value based on the time correction information in the feedback message for the early warning message, you can find whether there are keywords such as "resignation" and "extension" based on keyword search. If so, extract the time information that is close to the "resignation" keyword or the information that has a time relationship with the "resignation" keyword. For example, for the sentence "The employee has resigned on December 11, 2019", " "December 11, 2019" is time information close to the keyword "resignation" or information that has a time relationship with the keyword "resignation". After obtaining this information, the difference between this information and the sending time of the warning message on January 1, 2020 can be obtained to obtain the time threshold adjustment value.

In step 420, the warning time threshold is adjusted based on the time threshold adjustment value, where the adjusted warning time threshold is applied in subsequent processing operations for the account information set to be managed.

In this step, the warning time threshold is adjusted upward or downward based on the time threshold adjustment value. For example, if the time threshold adjustment value is -20 days, the warning time threshold should be adjusted lower by 20 days; if the time threshold adjustment value is +10 days, the warning time threshold should be adjusted lower than the warning time threshold by 20 days. on the basis of 10 days.

Through the embodiments of the present invention, the time correction information in the feedback message can be used to intelligently adjust the warning time threshold, which can predict idle warning account information in a timely manner and avoid frequently disturbing the account managers, thus improving the efficiency of the office network. Data information security.

Based on the content of the above embodiment, in this embodiment, the feedback message includes confirmation information or denial information for the early warning message;

Correspondingly, the time threshold adjustment value is determined based on the time correction information in each feedback message of the warning message for the preset time period, specifically including:

Determine the corresponding time threshold reduction amount based on the time correction information in the feedback message including the confirmation information, or,

Determine the corresponding time threshold increment based on the time correction information in the feedback message including the denial information;

The time threshold adjustment value is determined based on the determined time threshold reduction or time threshold increase of each feedback message corresponding to the preset time period.

FIG. 5 shows a flowchart of an example of an adjustment process for a warning time threshold according to an embodiment of the present invention.

In step 510, the time threshold adjustment value is determined based on the time correction information in each feedback message for the warning message within the preset time period. For example, the preset time period may be one day. For example, the time threshold adjustment value may be determined based on the feedback messages of each warning message sent within a day, and then the warning time threshold may be adjusted based on the time threshold adjustment value. For example, increase or decrease the warning time threshold.

It should be noted that there are generally multiple warning messages and corresponding feedback messages sent in a preset time period, and among the multiple feedback messages, there may be feedback messages containing confirmation information, and there may also be feedback messages containing denial information. feedback message. In some implementations of the embodiments of the present invention, the time threshold adjustment value may be determined in the following manner: determining the corresponding time threshold reduction amount based on the time correction information in the feedback message including the acknowledgment information, and based on the time correction information including the denial information. The time correction information in the feedback message is used to determine the corresponding time threshold increment. Furthermore, the time threshold adjustment value may be determined based on the determined decrease amount and increase amount of the time threshold value of each feedback message corresponding to the preset time period.

For example, if the warning message is sent on May 10, and it is known from the feedback message that the employee resigned on May 5, it can be determined that the corresponding time threshold reduction amount T _{is reduced to} -5 days; in addition, If the warning message is sent on May 10, and it is known from the feedback message that the employee is taking leave until May 20, it can be determined that the corresponding time threshold increase T _{rises to} +10 days. Furthermore, the T _drop or T _rise corresponding to each feedback message can be counted, and the time threshold adjustment value can be determined comprehensively.

In step 520, the warning time threshold is adjusted based on the time threshold adjustment value. For example, increase or decrease the warning time threshold.

Through the embodiments of the present invention, the early warning time threshold is adjusted based on each feedback message received within a set time period, so that the early warning time threshold can be adjusted regularly to ensure high accuracy of the early warning time threshold.

Figure 6 shows a signal timing flow chart of an example of an account cleanup method according to an embodiment of the present invention.

As shown in Figure 6, it involves communication interactions between the account cleanup server 610, the account management client 620 (or, the default client) and the office network server 630.

In step 601, the office network server 630 sends the account information set to be managed and historical access record information to the account cleanup server 610.

In some implementations, the account cleanup server 610 can synchronize the account information sets of various systems in the office network (such as OA systems, ERP systems, etc.) in real time, and store them in the full account database A according to different systems. In addition, the account cleaning server 610 can also collect the login log information of all systems, analyze the log information, extract the account login information of each system (login system name, account number and login time), and store the data in separate tables according to different systems. In login information database B.

Next, in step 603, the account cleanup server 610 uses the warning time threshold to determine the warning account information in the account information set. For example, the non-login duration corresponding to each account information can be compared with the warning time threshold to identify the warning account information.

Continuing with the above implementation, the account cleanup server 610 can obtain the non-login duration T1 corresponding to each account by comparing the full account database A and the login information database B every day. For example, some accounts have not logged in for 60 days. In addition, the non-login duration T1 of each account information can be compared with the warning time threshold T. When an account with T1 >= T is found, the account information can be determined as warning account information.

Next, in step 605, the account cleanup server 610 sends an early warning message to the account management client 620.

For example, the client of the department or group leader of the account can be automatically reminded through email, and the warning message can prompt "This account has not been used for T time, can it be deleted?".

Next, in step 607, the account management client 620 sends a feedback message to the account cleanup server 610.

For example, on the one hand, when the person in charge replies via email that the employee can be deleted, the time of the employee's transfer will also be replied, and then the time difference T2 is determined based on the time of the employee's transfer and the sending time of the reminder email (such as the reminder email It was sent on May 20, and the employee resigned on May 10, then T2 = -10). On the other hand, when the person in charge replies via email that the deletion is not possible, he or she will also reply with a date to which the extension will be extended (for example, to May 30), and then the sending time of the reminder email will be based on May 30, the end date of the extended period. The time difference T3=10 is determined on May 10th.

It should be noted that the person in charge can be notified again on May 30, the end date of the extended period, whether the account can be deleted.

Next, in step 609, the account clearing server 610 determines whether to clear the warning account information based on the feedback message.

Specifically, on the one hand, when the feedback message contains confirmation information for the early warning message, the account cleanup server 610 can call the deletion account script to automatically delete the corresponding early warning account information. On the other hand, when the feedback message contains a denial message for the warning message, the account cleanup server 610 can retain the warning account information.

Preferably, in step 611, the warning time threshold is adjusted based on the feedback message.

Specifically, it can be determined whether each prediction of the early warning account information is successful or failed based on the confirmation message and denial message in the feedback message, and the T value can be intelligently and dynamically adjusted every day.

On the one hand, when the feedback message contains confirmation information for the warning message, it means that the prediction is successful. Therefore, when the prediction for account N1 is successful, assuming that the time threshold adjustment value corresponding to the account is -T2 _N1 , based on the time threshold Adjust the value, adjust the warning time threshold T so that it becomes: T-T2 _N1 ; similarly, when the prediction of account N2 is successful: adjust the warning time threshold to T-T2 _N2 ..., when the prediction of account Nn is successful Time: Adjust the warning time threshold TNn to T-T2 _Nn , where n is the number of all successfully predicted accounts.

On the other hand, when the feedback message contains denial information for the warning message, it means that the prediction has failed. Therefore, when the prediction for account M1 fails, assuming that the time threshold adjustment value corresponding to the account is +T3 _M1 , based on the time Threshold adjustment value, adjust the warning time threshold T so that it becomes: T+T3 _M1 ; similarly, when the prediction of account M2 fails: adjust the warning time threshold TM2 to T+T3 _M2 ..., When the prediction of account Mm fails: adjust the warning time threshold TMm to T+T3 _Mm , where m is the number of all failed prediction accounts.

Furthermore, combined with the revised TN1, TN2...TNn and TM1, TM2...TMm of the accounts participating in the prediction within a day, the adjusted warning time threshold is finally calculated based on the average prediction results of all accounts this time: T' = (TN1 +TN2+…TNn+TM1+TM2+…+TMm)/(n+m).

It should be noted that the adjusted (or updated) T value is used as the new warning time threshold. When scanning the account non-login time the next day, the new T value is used as the threshold for comparison. If the non-login time is greater than T When the value is reached, a corresponding warning message is issued.

Through the embodiments of the present invention, it is possible to allow account managers to confirm whether the accounts are valid in a targeted manner without fully confirming all accounts, thereby reducing the workload of account managers. In addition, by adjusting the warning time threshold through dynamic self-learning, invalid accounts can be deleted in time. In addition, after receiving the confirmation message from the person in charge, invalid accounts are automatically deleted without manual deletion, which improves the account cleaning experience.

Based on the content of the above embodiment, in this embodiment, the access characteristic information includes access characteristics under the access IP dimension;

Correspondingly, according to the access characteristic information, determine whether there is early warning account information from the account information set to be managed, specifically including:

Determine the number of consecutive external network visits for each account information based on the access IP information of each account information in the account information set to be managed;

Compare the number of consecutive external network visits of each account information with the number of warnings threshold to determine whether the warning account information exists.

Figure 7 shows a flow chart of another example of determining early warning account information according to an embodiment of the present invention. In the example of the embodiment of the present invention, the historical access record information includes historical access account information and corresponding access IP information.

As shown in Figure 7, in step 710, based on the historical access account information and the corresponding access IP information in the historical access record information, the number of consecutive external network accesses for each account information in the account information set to be managed is determined. Here, access IP information that is not in the IP segment of the office network can be defined as the external network IP. Correspondingly, the historical access behavior can be determined as the external network access behavior.

In step 720, the number of consecutive external network accesses of each account information in the account information set to be managed is compared with the warning number threshold to determine whether there is warning account information. Specifically, when the number of consecutive external network visits corresponding to an account information is greater than the warning number threshold, the account information can be determined to be warning account information; in addition, when the number of continuous external network visits corresponding to an account information is less than or equal to the warning number When the threshold is exceeded, it can be determined that the account information is not early warning account information.

Based on the application scenario, if it is determined based on the access IP information of an account that the number of consecutive external network visits of the account exceeds the warning threshold, such as 15 times, it can be suspected that the employee to whom the account belongs has resigned.

Through the embodiments of the present invention, the continuous access behavior of external network users is monitored, and account information is inferred and early-warned, thereby effectively preventing and controlling illegal logins to the company system by resigned employees, and improving the security of data information in the office network.

Based on the content of the above embodiment, in this embodiment, the access characteristic information includes access characteristics in the access geographic dimension;

Correspondingly, according to the access characteristic information, determine whether there is early warning account information from the account information set to be managed, specifically including:

Compare the historical access geographical information of each account information in the account information set to be managed with the commonly used geographical information pre-bound to each account information to determine whether there is historical access geographical information in different places;

Based on the judgment results of the remote historical access geographical information, it is determined whether there is early warning account information.

Figure 8 shows a flow chart of another example of determining early warning account information according to an embodiment of the present invention. In the example of the embodiment of the present invention, the historical access record information includes historical access account information and corresponding historical access geographical information, and each account information in the account information set to be managed is associated with the corresponding common geographical information. Here, commonly used geographical information can be used to reflect the location information of employees' frequently logged in account information. For example, Beijing is the commonly used geographical information of a certain account.

In step 810, the historical access geographical information in the historical access record information is compared with the common geographical information associated with the corresponding historical access account information to determine whether there is remote historical access geographical information.

In step 820, it is determined whether there is early warning account information based on the judgment results of historical access to geographical information in remote places. Specifically, when the historical access geographical information of an account information is different from the commonly used geographical information, it can be determined that there is remote historical access geographical information or remote access behavior for the account information. Furthermore, the account information can be determined as early warning account information.

In some preferred implementations of the embodiments of the present invention, on the one hand, when the feedback message contains confirmation information (for example, confirming that the account has been stolen), the account password can be automatically modified by calling a script, and the modified password will be notified by email. To the person who owns the account. On the other hand, when the feedback message contains denial information (for example, confirming that it is a normal remote login caused by an employee's business trip, etc.), there is no need to delete the account.

Through the embodiments of the present invention, when it is detected that the account information is logged in from another place, an early warning message is pushed to the corresponding person in charge to remind the account information to be cleaned up, which can effectively avoid the account information being stolen and ensure the office network. The security of data information in.

Figure 9 shows a structural block diagram of an example of an account cleaning device according to an embodiment of the present invention.

As shown in FIG. 9 , the account cleaning device 900 includes an access data acquisition unit 910 , an early warning account determination unit 920 , an early warning message pushing unit 930 , a feedback message receiving unit 940 and an early warning account processing unit 950 .

The access data acquisition unit 910 is configured to acquire the account information set to be managed and historical access record information.

The early warning account determination unit 920 is configured to determine whether there is early warning account information from the account information set to be managed based on the historical access record information.

The early warning message pushing unit 930 is configured to push an early warning message for the early warning account information to a preset client when the early warning account information exists.

The feedback message receiving unit 940 is configured to receive a feedback message for the early warning message from the preset client.

The early warning account processing unit 950 is configured to process the early warning account information according to the feedback message.

For more details and corresponding effects of the account cleaning device 900 according to the embodiment of the present invention, please refer to the description in the above method embodiment, and will not be described again here.

Figure 10 illustrates a schematic diagram of the physical structure of an electronic device. As shown in Figure 10, the electronic device may include: a processor (processor) 1010, a communication interface (Communication Interface) 1020, a memory (memory) 1030 and a communication bus 1040. Among them, the processor 1010, the communication interface 1020, and the memory 1030 complete communication with each other through the communication bus 1040. The processor 1010 can call logical instructions in the memory 1030 to perform the following method: obtain the account information set to be managed and the historical access record information; based on the historical access record information, determine whether there is an account information set to be managed from the account information set to be managed Early warning account information; when the early warning account information exists, push an early warning message for the early warning account information to a preset client; receive a feedback message for the early warning message from the preset client; according to the feedback message to process the warning account information.

In addition, the above-mentioned logical instructions in the memory 1030 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention essentially or the part that contributes to the existing technology or the part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program code. .

On the other hand, embodiments of the present invention also provide a non-transitory computer-readable storage medium on which a computer program is stored. The computer program is implemented when executed by a processor to perform the transmission method provided by the above embodiments, for example, including : Obtain the account information set to be managed and the historical access record information; based on the historical access record information, determine whether there is early warning account information from the account information set to be managed; when the early warning account information exists, push the The early warning message of the early warning account information is sent to a preset client; a feedback message for the early warning message is received from the preset client; and the early warning account information is processed according to the feedback message.

The device embodiments described above are only illustrative. The units described as separate components may or may not be physically separated. The components shown as units may or may not be physical units, that is, they may be located in One location, or it can be distributed across multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. Persons of ordinary skill in the art can understand and implement the method without any creative effort.

Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the part of the above technical solution that essentially contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM/RAM, magnetic disk, optical disk, etc., including a number of instructions to cause a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in various embodiments or certain parts of the embodiments.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention, but not to limit it; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that it can still be used Modifications are made to the technical solutions described in the foregoing embodiments, or equivalent substitutions are made to some of the technical features; however, these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims (7)

1. An account cleaning method, characterized by including: Obtain the account information set to be managed and historical access record information; Based on the historical access record information, determine whether there is early warning account information from the account information set to be managed; When the early warning account information exists, push an early warning message for the early warning account information to the default client; Receive a feedback message for the early warning message from the preset client; the feedback message includes time correction information and confirmation information or denial information for the early warning message; Process the early warning account information according to the feedback message; Based on the historical access record information, determine whether there is early warning account information from the account information set to be managed, specifically including: Based on the historical access record information, obtain access characteristic information, where the access characteristic information includes access characteristics in at least one dimension of access time, access IP, and access geography; According to the access feature information, determine whether there is early warning account information from the account information set to be managed; When the feedback message includes time correction information, correspondingly, the account cleaning method also includes: Determine the time threshold adjustment value based on the time correction information in each feedback message for the warning message within the preset time period; Based on the time threshold adjustment value, adjust the warning time threshold, wherein the adjusted warning time threshold is applied in subsequent processing operations for the account information set to be managed; When the feedback message includes confirmation information or denial information for the early warning message; Correspondingly, the time threshold adjustment value is determined based on the time correction information in each feedback message of the warning message for the preset time period, specifically including: Determine the corresponding time threshold reduction amount based on the time correction information in the feedback message including the confirmation information, or, Determine the corresponding time threshold increment based on the time correction information in the feedback message including the denial information; The time threshold adjustment value is determined based on the determined time threshold reduction or time threshold increase of each feedback message corresponding to the preset time period. 2. The account cleaning method according to claim 1, characterized in that the access characteristic information includes access characteristics in the access time dimension; Correspondingly, according to the access characteristic information, determine whether there is early warning account information from the account information set to be managed, specifically including: Determine the non-login duration of each account information based on the historical access time information of each account information in the account information set to be managed; Compare the non-login duration of each account information with the warning time threshold to determine whether there is warning account information. 3. The account cleaning method according to claim 1, characterized in that the access feature information includes access features under the access IP dimension; Correspondingly, according to the access characteristic information, determine whether there is early warning account information from the account information set to be managed, specifically including: Determine the number of consecutive external network visits for each account information based on the access IP information of each account information in the account information set to be managed; Compare the number of consecutive external network visits of each account information with the number of warnings threshold to determine whether the warning account information exists. 4. The account cleaning method according to claim 1, characterized in that the access feature information includes access features under the geographical dimension of access; Correspondingly, according to the access characteristic information, determine whether there is early warning account information from the account information set to be managed, specifically including: Compare the historical access geographical information of each account information in the account information set to be managed with the commonly used geographical information pre-bound to each account information to determine whether there is historical access geographical information in different places; Based on the judgment results of the remote historical access geographical information, it is determined whether there is early warning account information. 5. An account cleaning device, characterized by including: The access data acquisition unit is configured to acquire the account information set to be managed and historical access record information; An early warning account determination unit is configured to determine whether there is early warning account information from the account information set to be managed based on the historical access record information; An early warning message push unit is configured to push an early warning message for the early warning account information to a preset client when the early warning account information exists; A feedback message receiving unit configured to receive a feedback message for the early warning message from the preset client; the feedback message includes time correction information and confirmation information or denial information for the early warning message; An early warning account processing unit is configured to process the early warning account information according to the feedback message; The early warning account determination unit is configured as: Based on the historical access record information, obtain access characteristic information, where the access characteristic information includes access characteristics in at least one dimension of access time, access IP, and access geography; According to the access feature information, determine whether there is early warning account information from the account information set to be managed; When the feedback message includes time correction information, the account cleaning device further includes a time threshold adjustment unit configured as: Determine the time threshold adjustment value based on the time correction information in each feedback message for the warning message within the preset time period; Based on the time threshold adjustment value, adjust the warning time threshold, wherein the adjusted warning time threshold is applied in subsequent processing operations for the account information set to be managed; When the feedback message includes confirmation information or denial information for the warning message, the time threshold unit is configured to; Determine the corresponding time threshold reduction amount based on the time correction information in the feedback message including the confirmation information, or, Determine the corresponding time threshold increment based on the time correction information in the feedback message including the denial information; The time threshold adjustment value is determined based on the determined time threshold reduction or time threshold increase of each feedback message corresponding to the preset time period. 6. An electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that when the processor executes the program, it implements any one of claims 1 to 4 Follow the steps of the account cleanup method described in item 1. 7. A non-transitory computer-readable storage medium with a computer program stored thereon, characterized in that when the computer program is executed by a processor, the steps of the account cleaning method according to any one of claims 1 to 4 are implemented.