CN114448645B - Web page access processing method, device, storage medium, and program product - Google Patents
Web page access processing method, device, storage medium, and program product Download PDFInfo
- Publication number
- CN114448645B CN114448645B CN202210233962.6A CN202210233962A CN114448645B CN 114448645 B CN114448645 B CN 114448645B CN 202210233962 A CN202210233962 A CN 202210233962A CN 114448645 B CN114448645 B CN 114448645B
- Authority
- CN
- China
- Prior art keywords
- login
- target
- data
- web page
- account
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3234—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Information Transfer Between Computers (AREA)
Abstract
The embodiment of the application provides a processing method, a processing device, a computer readable storage medium and a computer program product for web page access, and relates to the field of network security computing. The method comprises the steps of receiving a login request for a target account through a webpage, generating a login file for target equipment for initiating the login request, obtaining portrait data of the target account, obtaining feature data for trust test from the login file, and executing man-machine interaction verification operation to determine whether to respond to the login request when the target equipment is determined to be non-trusted equipment according to the portrait data and the feature data. The embodiment of the application improves the identification rate of the stealing behavior of the webpage access.
Description
Technical Field
The present application relates to the field of network security technologies, and in particular, to a method and apparatus for processing web page access, a computer apparatus, a computer readable storage medium, and a computer program product.
Background
With the development of internet services, the scale of users of a network service platform is greatly improved. In order to provide exclusive service for users and facilitate reservation of user data, many network service platforms adopt account registration. However, for some purposes, some theft of numbers is increasingly occurring. In order to prevent the theft phenomenon from damaging the benefits of users, the network service platform can adopt some means to identify the theft phenomenon of the user account, and the identification is generally realized by adopting a mode of identifying the login geographic position at present.
When solving the problem of theft, some theft comes from web page access. Many times, the login place of the theft behavior can be displayed or revealed to obtain the frequent login of the user, and corresponding theft illegal behaviors are carried out. Particularly on a live broadcast platform, after the user account is stolen, illegal and illegal actions such as robbery and yellow playing are utilized, so that the trouble is caused to the normal activities of the user on the network service platform, and the operation service of the normal webpage access of the network service platform is also greatly influenced.
Disclosure of Invention
The embodiment of the application provides a processing method, a processing device, a computer readable storage medium and a computer program product for web page access, which are used for solving the technical problem that the running service of the existing web page access is influenced by the theft phenomenon.
According to a first aspect of an embodiment of the present application, there is provided a processing method for web page access, including the steps of:
Receiving a login request initiated by a webpage aiming at a target account, and generating a login file aiming at target equipment initiating the login request;
Obtaining portrait data of the target account number, and obtaining feature data for trust test from the login file;
And when the target device is determined to be an untrusted device according to the portrait data and the feature data, performing a man-machine interaction verification operation to determine whether to respond to the login request.
In an optional embodiment of an aspect, the step of receiving a login request for a target account initiated by a web page and generating a login file for a target device that initiates the request includes:
And when the target account number is detected to be the first login of the target equipment, acquiring the target equipment ID, and adding a prefix to the target equipment ID to form a unique equipment ID of the target equipment.
In an alternative embodiment of an aspect, the characteristic data includes a first unique device ID;
The step of determining that the target device is an untrusted device according to the portrait data and the feature data includes:
And matching the first unique equipment ID with a second unique equipment ID of the historical login equipment of the image data, and if the matching is unsuccessful, determining that the target equipment is very login equipment and the very login equipment is non-trusted equipment.
In an optional embodiment of an aspect, the feature data further includes a login IP and a login time;
The step of determining that the target device is an untrusted device according to the portrait data and the feature data includes:
Acquiring the current login IP and login time of the target equipment, and respectively matching with a normally-logged-in place and a normally-logged-in time period in the portrait data of the corresponding target account;
obtaining the score of each characteristic data according to the matching result, and carrying out weighted average calculation on the scores of all the login characteristic data;
And when the result of the weighted average calculation does not meet a preset detection value, determining that the target equipment is non-trusted equipment.
In an optional embodiment of an aspect, the step of obtaining the portrait data of the target account number includes:
Collecting login files in a history preset time period, acquiring characteristic data of each history login request, and forming a history message queue;
And cleaning the data of the historical message queue to obtain the portrait data of the target account.
In an optional embodiment of an aspect, the step of cleaning, according to the history message queue, portrait data of the target account number includes:
The registration place and registration time of each historical registration are obtained from the image data to form a corresponding registration place-time distribution diagram, wherein the values of the registration place and the registration time of each registration are expressed by a numerical point in the place-time distribution diagram;
and determining the range of the normally-logged ground and the normally-logged time of the target account in the historical login based on the distribution condition of the numerical points in the place-time distribution diagram.
In an optional embodiment of an aspect, the processing method for web page access further includes:
acquiring a unique device ID of the untrusted device;
based on the unique equipment ID of the non-trusted equipment, obtaining an associated user account which is logged in by the non-trusted equipment;
Acquiring characteristic data of a corresponding historical login request of each associated user account to form a historical message queue;
confirming whether the last login place and/or login time of each associated user account corresponds to the normally login place and/or normally login time or not, wherein the associated user accounts are other user accounts logged in by the non-trusted device;
if not, the corresponding associated user account executes temporary disabling operation.
According to another aspect of an embodiment of the present application, there is provided a processing apparatus for web page access, including:
the login file generation module is used for receiving a login request for a target account initiated by a webpage and generating a login file for target equipment initiating the login request;
The equipment trust test module is used for acquiring portrait data of the target account number and acquiring characteristic data for trust test from the login file;
and the login request verification module is used for executing man-machine interaction verification operation to determine whether to respond to the login request when the target device is determined to be an untrusted device according to the portrait data and the feature data.
According to another aspect of an embodiment of the present application, there is provided a computer apparatus including a memory, a processor and a computer program stored on the memory, the processor executing the steps of the processing method of the computer program for web page access according to any one of the preceding claims.
According to another aspect of an embodiment of the present application, there is provided a computer readable storage medium having stored thereon a computer program, characterized in that the computer program, when executed by a processor, is adapted to perform the steps of the method for processing a web page access of any of the preceding claims.
According to another aspect of an embodiment of the present application, there is provided a computer program product comprising a computer program, characterized in that the computer program, when executed by a processor, is adapted to carry out the steps of the method for processing a web page access of any of the preceding claims.
The technical scheme provided by the embodiment of the application has the beneficial effects that:
According to the processing scheme for webpage access, when the server receives a login request sent by target equipment through a webpage and aiming at a target account, a corresponding login file is formed, and feature data are acquired from the login file. And determining whether the target device is an untrusted device according to the feature data and the portrait data of the target account number. When the target device is determined to be an untrusted device, determining whether to respond to the login request of the target device according to the result of the confirmation. Based on the technical scheme provided by the application, the technical problem that the identification means of the conventionally-logged-on account number cannot identify the conventionally-logged-on account number of the target account number by the identification means of the logged-on geographical location is solved, so that the identification rate of the webpage access account number is improved, the safety guarantee level of the user account number is facilitated, and the normal operation of the network service platform is ensured.
Drawings
In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings that are required to be used in the description of the embodiments of the present application will be briefly described below.
FIG. 1 is a flowchart illustrating a method for processing web page access according to an embodiment of the present disclosure;
Fig. 2 is a verification interface display diagram of a login request on a live platform according to an embodiment of the present disclosure;
FIG. 3 is a plot of log-in location versus time provided by an embodiment of the present disclosure;
FIG. 4 is a schematic diagram of a processing device for web page access according to an embodiment of the present disclosure;
FIG. 5 is a schematic diagram of another apparatus for processing web page access according to an embodiment of the present disclosure;
Fig. 6 is a schematic structural diagram of a computer device for processing web page access according to an embodiment of the present disclosure.
Detailed Description
Embodiments of the present application are described below with reference to the drawings in the present application. It should be understood that the embodiments described below with reference to the drawings are exemplary descriptions for explaining the technical solutions of the embodiments of the present application, and the technical solutions of the embodiments of the present application are not limited.
As used herein, the singular forms "a", "an", "the" and "the" are intended to include the plural forms as well, unless expressly stated otherwise, as understood by those skilled in the art. It should be further understood that the terms "comprises" and "comprising," when used in this specification, specify the presence of stated features, information, data, steps, operations, but do not preclude the presence of other features, information, data, steps, operations, elements, components, and/or groups thereof, that may be implemented as desired in the art. It will be understood that when an element is referred to as being "connected" or "coupled" to another element, it can be directly connected or coupled to the other element or intervening elements may be present. Further, "connected" or "coupled" as used herein may include wirelessly connected or wirelessly coupled. The term "and/or" as used herein indicates at least one of the items defined by the term, e.g. "a and/or B" indicates implementation as "a", or as "a and B".
For the purpose of making the objects, technical solutions and advantages of the present application more apparent, the embodiments of the present application will be described in further detail with reference to the accompanying drawings.
In order to realize better experience of network services, services of the existing network service platform are accessed by application programs, especially login access is performed by webpages, such as fixed places like residence or office places. However, with the background of the network service platform for the enhanced management of the user account, in order to achieve the illegal purpose, some number theft phenomena occur in the network service platform. The number theft phenomenon is usually to acquire user account numbers and user login information by means of collection or network grabbing and the like, and to use the acquired information to conduct illegal operation. Furthermore, in order to avoid the existing means for identifying the stolen number by using the login geographic position, the webpage access is performed according to the normally logged-on ground displayed or leaked when the user account is normally logged in, so that a new challenge is provided for identifying the stolen number phenomenon by the network service platform.
In the example that the user account of the current live webpage is stolen and utilized to conduct illegal actions, the thief can conduct the theft by collecting, grabbing or stealing the frequently logged on land of the user account, and then conduct the illegal actions of theft, such as theft brushing, yellow-playing, or sending bullet screen contents disturbing the live host in the live broadcasting room, etc.
Fig. 1 is a flowchart illustrating a processing method for web page access according to an embodiment of the present disclosure.
In order to solve the technical problems, the application provides a processing method for web page access.
Referring to fig. 1, the method comprises at least the steps of:
s110, receiving a login request for a target account initiated by a webpage, and generating a login file for target equipment initiating the login request;
S120, obtaining portrait data of the target account number, and obtaining feature data for trust test from the login file;
And S140, when the target device is determined to be an untrusted device according to the portrait data and the feature data, performing a man-machine interaction verification operation to determine whether to respond to the login request.
The embodiments corresponding to the steps S110 to S140 described above may occur between a server and a terminal device that currently sends a login request, where a communication connection is established between the server and the terminal device, so that data interaction can be implemented according to an instruction or a response instruction. In the embodiment corresponding to the above steps, the execution body is a server. The following is a detailed description of how the above steps are performed between the server and the terminal device.
The terminal equipment can utilize the user account number of a specific network service platform to send a login request instruction to the network service platform through the browser. In this embodiment, the user account is set as the target account, and the terminal device that issues the login request is the target device. In a subsequent process execution, it is determined for the target account number whether the target device is an untrusted device. The login request instruction may be input by controlling the terminal device, or may be input according to a login program setting of a user account that is obtained in advance and carries a target account.
And the target equipment sends a login request to the server according to the login request instruction. In this embodiment, the target device may input a login link of the network service platform through the browser according to the login request instruction, so that the browser interface jumps to a login page of the network service platform, and inputs account information of the target account into an account control of the login page, and sends a login request to the network service platform for the target account, so that the target device may enter a login page corresponding to a login website of the network service platform according to a response message fed back by the server.
After receiving the login request, the server acquires the target device ID according to the login request and generates a login file. Wherein the login file carries the target device ID.
In this embodiment, the server feeds back to the target device the login file of the target site from the network service platform. The target device extracts information such as cookie setting data which is established under the domain name of the input login link and comprises the target device ID from the received login file, and the target device defaults to carry cookies which are established under the domain name of the input login link in a login interface of the target device according to the cookie setting data. With the above embodiment, the cookie setting data includes a login address of the network service platform requested to login. Based on the target device ID and the cookie setting data carried in the login file, the target device can initiate the target device ID corresponding to the current login request of the target account again through the webpage, so that whether the target device is an untrusted device can be confirmed later.
The server feeds back a login file of a target site from the network service platform to the target device, and records feature data capable of judging whether the target device is an untrusted device in the login file. Based on the feature data, the server can perform trust testing on the target device for which the target account sends a login request.
The server obtains portrait data of the login history of the target account based on the history login record of the target account. The portrait data comprises a history record formed by at least one kind of data formed by the target account number at each historical login request and/or processing data obtained by further data processing on the history record. In addition, the portrait data may also represent attribute information of the target account number, historical login track, and other information. In a live platform, a geographical track, a time track and the like of a corresponding registered user which is a host user or a viewer user, a historical login of the user and the like can be obtained through a target account number.
And when the server determines that the target device is an untrusted device according to the portrait data and the feature data, further executing the verification operation of man-machine interaction. The specific verification operation can confirm whether to respond to the login request sent by the target device or not through the server based on the verification result obtained by the verification operation. If the target equipment is the non-trusted equipment according to the verification result, the login request sent by the target equipment at present is not responded, otherwise, the login request is responded, and the target equipment carries out login access aiming at the target account.
In this embodiment, the man-machine interaction verification operation may be that, according to a verification result of the non-trusted device, the server obtains a user number corresponding to the target account, sends verification information of a current login request to a terminal device using the user number, and determines whether to respond to the login request according to a detection result of whether the user confirms the verification information. If the operation of confirming the verification information is detected, the login request is responded when the verification information is correct, and if the operation of confirming the verification information or the error of the verification information is not detected, the login request is forbidden to be executed.
Fig. 2 is a verification interface display diagram of a login request on a live platform according to an embodiment of the present disclosure.
Referring to fig. 2, in the embodiment of the live broadcast platform, the above-mentioned man-machine interaction verification operation may be that, according to a login request, the server sends verification information to a terminal device of a user number registered by the target account, and pushes a submission control of the verification information to an operation interface of the target device that sends the login request. And determining whether to respond to the login request by detecting the matching condition of the verification information and the verification information of the terminal equipment sent to the user number in the set time.
According to the analysis, according to the processing method for web page access provided by the application, when the server receives a login request of target equipment for a target account through a web page, a corresponding login file is formed, and characteristic data is acquired from the login file. And determining whether the target device is an untrusted device according to the feature data and the portrait data of the target account number. When the target device is determined to be an untrusted device, determining whether to respond to the login request of the target device according to the result of the confirmation. Based on the technical scheme provided by the application, the technical problem that the identification means of the conventionally-logged-on account number cannot identify the conventionally-logged-on account number of the target account number by the identification means of the logged-on geographical location is solved, so that the identification rate of the webpage access account number is improved, the safety guarantee level of the user account number is facilitated, and the normal operation of the network service platform is ensured.
Based on the above-provided embodiments, the step of generating a login file for the target device that initiates the request in step S120 includes:
And when the target account number is detected to be the first login of the target equipment, acquiring the target equipment ID, and adding a prefix to the target equipment ID to form a unique equipment ID of the target equipment.
In this embodiment, the server acquires the target device ID from the login file carrying the target device. The server may determine, according to the target device ID, whether the target device is logged in for the first time of the target account from the historical login record of the target account corresponding to the login request. If yes, acquiring the target equipment ID, and adding a prefix to the target equipment ID to obtain the unique equipment ID of the target equipment aiming at the target account.
And the prefix may be added according to a preset setting. For example, according to the embodiment, the prefix is represented by 'w', the corresponding unique device ID is obtained as 'w_ 482599900584255488', and '482599900584255488' is the target device ID of the target device for the first login of the target account. Based on the prefix "w", it is possible to distinguish between ways of logging in other ways than by web page approach, such as application programs.
In this embodiment, the target device ID may generate a globally unique ID for the target device by a snowflake algorithm. And obtaining the current login time frame of the target equipment login target account number and contents such as equipment information of the target equipment by utilizing a snowflake algorithm, and forming the global unique ID according to a preset rule. In addition, the globally unique ID of the target device ID may be obtained by other methods such as database self-addition, UUID, etc.
The unique device ID obtained in the above embodiments may be used to detect whether the target device is an untrusted test. And the characteristic data includes a first unique device ID. And obtaining the login mode of the target account number for logging in the target device for the first time, login IP, device information of the target device and the like according to the first unique device ID. The login IP is an Internet protocol address which indicates that the terminal equipment can embody a login geographic position when sending a login request.
On the basis, the determining in the step S140 that the target device is an untrusted device according to the portrait data and the feature data includes:
And matching the first unique equipment ID with a second unique equipment ID of the historical login equipment of the image data, and if the matching is unsuccessful, determining that the target equipment is very login equipment and the very login equipment is non-trusted equipment.
The image data records the history login condition of the target account number, which comprises the terminal equipment ID and the history login IP of the history login, and can also comprise the statistical data of the history login condition, such as the occurrence frequency of the history login IP corresponding to each terminal equipment. And obtaining the normally logged-on land corresponding to the target account according to the statistical data of the occurrence frequency of the historical logged-on IP. If the login IP of the current login obtained by analyzing the first unique device ID is matched with the history login IP in the second unique device ID of the image data or the normally login obtained by counting the occurrence frequency of the history login IP. If the matching fails, the target device is confirmed to be a very-logged-on device, and the very-logged-on device is confirmed to be an untrusted device. In this embodiment, the frequent sign-on may be confirmed according to the frequency of occurrence of the second unique device ID of the corresponding target account, and the frequent sign-on may be represented by the login IP that issues the login request in the history login record.
Labeling the very boarding device may also be included before determining that the very boarding device is a non-trusted device. According to the annotation of the very registered device, the server directly confirms the corresponding target device as an untrusted device. Or when the target device is determined to be a very login device, according to the type of the logged-in webpage, confirming whether the current target device is a non-trust device. For example, the type of the logged-in webpage is a service page of a government service website, and the historical login corresponding to the portrait data of the target account may be in other government service websites or addresses. Therefore, the fact that the current login webpage is confirmed to be a service webpage of a government service network point, and the fact that the target account number changes different terminal devices to log in at different login times is normal is that the current target device is not used as non-trust device.
As for the feature data referred to in the above embodiment, login IP and login time may be further included.
On the basis, the step of determining that the target device is an untrusted device according to the portrait data and the feature data in step S140 includes:
Acquiring the current login IP and login time of the target equipment, and respectively matching with a normally-logged-in place and a normally-logged-in time period in the portrait data of the corresponding target account;
obtaining the score of each characteristic data according to the matching result, and carrying out weighted average calculation on the scores of all the login characteristic data;
And when the result of the weighted average calculation does not meet a preset detection value, determining that the target equipment is non-trusted equipment.
In this embodiment, the login IP and login time including the target device acquired by the current login of the target device are matched item by item with the normally registered ground and normally registered time in the image data of the corresponding target account. And scoring the feature data of each item according to the matching result.
For the content of the login IP in the feature data, a specific login position of the current login of the target device, such as a D street E room number in C area of B city of A province, can be embodied. Such as a score range of 0-10 points for that particular login location. If the specific login specific position of the current login is consistent with the specific position of the normally logged in image data, the score is highest and is 10 minutes.
If the specific login position of the current login is inconsistent with the specific position of the normally logged-on ground in the image data, setting a corresponding score proportion according to the geographic level corresponding to each piece of geographic information in the specific position. The specific login positions include 5 geographical levels, namely province, city, district, street and room number, wherein the levels are arranged from high to low according to the size of the corresponding geographical range, and the geographical levels from high to low are the province, city, district, street and room number. The higher the geographic level, the greater the proportion of the score that is occupied. In this example, the ratio of the scores of provinces, cities, regions, streets and house numbers is 4, 3, 2, 1, 0.
And if the specific login position of the current login is compared with the specific position of the normally logged in field in the image data, deducting the corresponding score according to different geographic levels to obtain the score corresponding to the specific login position of the current login. If the specific login specific position of the current login is the E1 room number of the D1 street in C1 area of B city of A province, the corresponding score is 7 points. According to the score, the specific login position of the current login of the target device can be embodied in the form of data, so that a data basis is more convenient to provide for trust testing.
In addition, for the content of the login IP in the feature data, a score value may be preset for each region on the map. Specifically, on the map with the regional score set, confirming that the login IP obtains the position corresponding to the current login address of the target device, and obtaining the score corresponding to the login IP of the current login of the target device.
For the content of the login time in the characteristic data, the login time of the target device is divided according to the similarity of the time periods corresponding to the general living habits of the user. And scoring the specific login time according to the similarity of living habits with the normally logged time.
For example, the target account number normally has a login time of 19:40PM, and according to a general living habit, the time is generally a period of time when people eat meal for learning and entertainment. For general lifestyle, the period of time for learning and entertaining after eating meal is generally 19-22 PM. If the specific login time of the target device is 21PM, the corresponding score can obtain the highest score 10. If the time range of the time period 19-22PM is exceeded, determining a corresponding score according to the specific login time of the target equipment and the time interval of the login time.
After each item of characteristic data of the current login of the target device is acquired, the weighted proportion of each item of characteristic data can be determined according to the type corresponding to the logged webpage.
And comparing the total score obtained by the weighted average with a preset detection value aiming at the type corresponding to the webpage, and determining the target equipment as the non-trusted equipment when the total score does not meet the preset detection value. The predetermined detection value may be a numerical value or may relate to a range of predetermined detection values.
In order to clearly explain how to determine whether the target device is an untrusted device, the embodiment of the live platform is extended to further explain the implementation of the scenario.
In the case where the web page is that of a live platform, the weighted proportion of login time may be higher than the weighted proportion of login IP, e.g., 6:4. The total score corresponding to the current login of the target device can be obtained according to the specific score corresponding to the current login time and the login IP of the target device, which are obtained by the specific example or other modes, and according to the weighted proportion of the types corresponding to the login webpage.
Furthermore, the embodiment of the live broadcast platform is prolonged, and the weighted proportion of the characteristic data can also be according to the type of the live broadcast room and/or the live broadcast history data. For example, the type of live room a is domestic travel, the target account is a anchor account, and since the anchor typically needs to switch between different live scenes, in this embodiment, the login time is much higher than the weighted proportion of login IP.
If the target account is a viewer account, acquiring historical login information according to the portrait data, and determining a geographical position range corresponding to the login IP according to the historical login information, wherein the geographical position range corresponding to the login IP of the viewer account is basically in an office area or an address of a residence of the viewer account, namely the historical login address is relatively stable. For this case, the weighted proportion of the login IP of the target device may be adjusted up to be higher than the login time, so that the total score corresponding to the current login of the target device may more easily determine whether the target device is a non-trusted device.
If the type of the live broadcasting room B is knowledge sharing and the target account is a anchor account, the historical login IP obtained by the obtained portrait information of the anchor account is usually stabilized in one place, and the weighted proportion of the login IP is far higher than the login time. When the login IP can be matched with the historical login IP, the corresponding score of the entries related to the login IP is low, and the final total score cannot meet the preset detection value, so that the server can more easily determine that the target device is a non-trusted device.
In the above embodiment, the image data is obtained by the operation of obtaining the image data of the target account in step S120, and the operation may further include:
collecting login files in a history preset time period, acquiring the characteristic data of each login request, and forming a history message queue;
And cleaning the data of the historical message queue to obtain the portrait data of the target account.
In the server, each time a login request for the target account is received, a corresponding login file is generated, and feature data is acquired from the generated login file. For the collected characteristic data, the characteristic data can be stored in terms to form a historical message queue in a historical preset time period based on the target account.
The sub-items of the collected feature data include at least the sub-items of the statistics required for the image data to be formed, so that statistics are formed for the sub-items of the statistics required for the image data in the history message queue.
After the historical message queue is obtained, according to the statistical requirement of the sub-item content of the portrait data of the target account or the preset of the sub-item statistics, the data cleaning is carried out on the feature data which are corresponding to each login and do not meet the preset sub-item content. The historical message queue can also be deleted entirely after failing to collect the characteristic data corresponding to the preset item content, so that the waste of data operation resources caused by the increase of data volume in the subsequent trust test is avoided.
For the steps, according to the historical message queue, the data cleaning to obtain the portrait data of the target account number may further include:
The login place and login time of each historical login are obtained from the historical message queue to form a login place-time distribution diagram, wherein the values of the login place and login time of each login are represented by a numerical point in the place-time distribution diagram;
and determining the range of the normally-logged places and the normally-logged times of the target account in the historical login based on the density degree of the numerical points in the place-time distribution diagram.
FIG. 3 is a plot of log-in location versus time provided by an embodiment of the present disclosure.
Referring to fig. 3, in the present embodiment, the log-in time score and the log-in place score are used as the horizontal axis and the vertical axis of the log-in place-time distribution map, respectively, and the values of the scores obtained for the log-in place and the log-in time of the feature data corresponding to each history log-in are recorded as dots on the log-in place-time distribution map, thereby obtaining a log-in image with respect to the target account.
In a login image in a place-time distribution diagram, a range of a normally registered place and a normally registered time of a target account in a history registration is determined based on distribution of a plurality of data points indicating scores of a login place and a login time corresponding to the history registration.
The distribution condition may include a density of data points, or at least one of closed loop embodiments formed by connecting lines or connecting lines of a plurality of data points. And, a concentrated area of a plurality of data points can be obtained according to the distribution. And directly acquiring the corresponding normally-logged-on and normally-logged-on time of the target account in the historical login by using a centralized area embodied by a plurality of data points of the place-time distribution diagram. If the login IP and the login time corresponding to the current login are in the range of the normally logged on and the normally logged on time reflected on the location-time distribution diagram, the target device of the current login target account is trusted device, otherwise, the target device is non-trusted device.
As shown in fig. 3, a closed loop H formed by a plurality of data points intensively distributed in a certain area of the distribution chart is used as a basis for the corresponding normally-logged-on and normally-logged-on time of the target account in the history log-in. In this embodiment, the geometric center point is obtained from the closed loop H, and the login location and the login time corresponding to the data point corresponding to the history closest to the geometric center point are used as the normally logged in and normally logged out time.
In the implementation, if the target device is determined to be an untrusted device, a unique device ID of the untrusted device is obtained.
Based on the unique device ID of the non-trusted device, the processing method for web page access provided by the application further comprises the following steps:
based on the unique equipment ID of the non-trusted equipment, obtaining an associated user account which is logged in by the non-trusted equipment;
Acquiring characteristic data of a corresponding historical login request of each associated user account to form a historical message queue;
confirming whether the last login place and/or login time of each associated user account corresponds to the normally login place and/or normally login time or not, wherein the associated user accounts are other user accounts logged in by the non-trusted device;
if not, the corresponding associated user account executes temporary disabling operation.
In this embodiment, according to the unique device ID of the untrusted device, other user accounts involved in the history login record of the untrusted device are obtained, where the record of the other user accounts is obtained from a login file generated by the target device sending a login request. In this embodiment, the other user account is defined as the associated user account in the case where the target device is an untrusted device.
Each time the associated user account logs in the target device, a piece of characteristic data is generated, and a corresponding historical message queue is formed aiming at the characteristic data generated by one associated user account. Each historical message queue includes a login location and/or a login time generated to login to the target device for the same associated user account.
And acquiring whether the corresponding target account number corresponds to the latest login place and/or login time of the target device or not from the historical message queue, and judging whether the login place and/or login time is the login place and/or login time which can be represented by the portrait data of the target account number or not.
If not, confirming that the associated user account is an untrusted account, executing temporary disabling operation on the associated user account, and confirming the target device as an untrusted device.
In the above process, the types of the webpages logged in by the related user account can be combined to determine the sub-item content of the image data statistics. For example, if the web page is a web service web page of a government network site, the weighted proportion corresponding to the login location is smaller, and even the login location is not considered, and at this time, the login time is mainly used as one of the main considerations of the image data, so as to perform a trust test on the associated user account. If the login time exceeds the normal government service time, the associated user account can be directly confirmed to be an untrusted account, and the target device is confirmed to be an untrusted device.
Fig. 4 is a schematic structural diagram of a processing device for web page access according to an embodiment of the present disclosure.
An embodiment of the present application provides a processing apparatus for web page access, as shown in fig. 4, the processing apparatus 200 for web page access may include:
a login file generating module 210, configured to receive a login request for a target account initiated through a web page, and generate a login file for a target device that initiates the login request;
The device trust test module 220 is configured to obtain portrait data of the target account, and obtain feature data for performing trust test from the login file;
A login request verification module 230, configured to perform a man-machine interaction verification operation to determine whether to respond to the login request when it is determined that the target device is an untrusted device according to the portrait data and the feature data.
The processing device 200 for web page access in this embodiment may execute the processing method for web page access shown in the above embodiment of the present application, and its implementation principle is similar, and will not be described herein.
According to the processing device 200 for web page access provided by the application, when the server receives a login request of target equipment for a target account through a web page, a corresponding login file is formed, and characteristic data is acquired from the login file. And determining whether the target device is an untrusted device according to the feature data and the portrait data of the target account number. When the target device is determined to be an untrusted device, determining whether to respond to the login request of the target device according to the result of the confirmation. Based on the technical scheme provided by the application, the technical problem that the identification means of the conventionally-logged-on account number cannot identify the conventionally-logged-on account number of the target account number by the identification means of the logged-on geographical location is solved, so that the identification rate of the webpage access account number is improved, the safety guarantee level of the user account number is facilitated, and the normal operation of the network service platform is ensured.
The login file generating module 210 is further configured to detect that the target account number is the target device ID obtained when the target device logs in for the first time, and add a prefix to the target device ID to form a unique device ID of the target device.
The feature data includes a first unique device ID, a login request verification module 230, and is further configured to match the first unique device ID with a second unique device ID of a historical login device of the image data, and if the matching is unsuccessful, the target device is a very login device, and determine that the very login device is a non-trusted device.
The feature data further comprises a login IP and login time, and the login request verification module 230 is further configured to obtain a current login IP and login time of the target device, and match with a normally-logged-on location and a normally-logged-on time period in the portrait data of the corresponding target account respectively;
obtaining the score of each characteristic data according to the matching result, and carrying out weighted average calculation on the scores of all the login characteristic data;
And when the result of the weighted average calculation does not meet a preset detection value, determining that the target equipment is non-trusted equipment.
The device trust test module 220 is configured to collect login files in a preset historical time period, obtain feature data of each historical login request, and form a historical message queue;
And cleaning the data of the historical message queue to obtain the portrait data of the target account.
The device trust test module 220 is further configured to obtain a login location and a login time of each historical login from the image data, and form a corresponding login location-time distribution diagram, where values of the login location and the login time of each login are represented by a numerical point in the location-time distribution diagram;
and determining the range of the normally-logged ground and the normally-logged time of the target account in the historical login based on the distribution condition of the numerical points in the place-time distribution diagram.
Fig. 5 is a schematic structural diagram of another processing device for web page access according to an embodiment of the present disclosure.
As shown in fig. 5, the apparatus of this embodiment further includes an account trust test module 240 for associating the user account.
An account trust testing module 240, configured to obtain a unique device ID of the untrusted device;
based on the unique equipment ID of the non-trusted equipment, obtaining an associated user account which is logged in by the non-trusted equipment;
Acquiring characteristic data of a corresponding historical login request of each associated user account to form a historical message queue;
confirming whether the last login place and/or login time of each associated user account corresponds to the normally login place and/or normally login time or not, wherein the associated user accounts are other user accounts logged in by the non-trusted device;
if not, the corresponding associated user account executes temporary disabling operation.
Corresponding description of another apparatus and method:
the device of the embodiment of the present application may perform the method provided by the embodiment of the present application, and its implementation principle is similar, and actions performed by each module in the device of the embodiment of the present application correspond to steps in the method of the embodiment of the present application, and detailed functional descriptions of each module of the device may be referred to the descriptions in the corresponding methods shown in the foregoing, which are not repeated herein.
The embodiment of the application provides a computer device, which comprises a memory, a processor and a computer program stored on the memory, wherein the processor executes the computer program to realize the steps of a processing method for webpage access. And determining whether the target device is an untrusted device according to the feature data and the portrait data of the target account number. When the target device is determined to be an untrusted device, determining whether to respond to the login request of the target device according to the result of the confirmation. Based on the technical scheme provided by the application, the technical problem that the identification means of the conventionally-logged-on account number cannot identify the conventionally-logged-on account number of the target account number by the identification means of the logged-on geographical location is solved, so that the identification rate of the webpage access account number is improved, the safety guarantee level of the user account number is facilitated, and the normal operation of the network service platform is ensured.
In an alternative embodiment, a computer apparatus is provided, as shown in FIG. 6, the computer apparatus 4000 shown in FIG. 6 comprising a processor 4001 and a memory 4003. Wherein the processor 4001 is coupled to the memory 4003, such as via a bus 4002. Optionally, the computer device 4000 may further include a transceiver 4004, the transceiver 4004 may be used for data interaction between the computer device and other computer devices, such as transmission of data and/or reception of data, etc. It should be noted that, in practical applications, the transceiver 4004 is not limited to one, and the structure of the computer apparatus 4000 is not limited to the embodiment of the present application.
The Processor 4001 may be a CPU (Central Processing Unit ), general purpose Processor, DSP (DIGITAL SIGNAL Processor, data signal Processor), ASIC (Application SPECIFIC INTEGRATED Circuit), FPGA (Field Programmable GATE ARRAY ) or other programmable logic device, transistor logic device, hardware component, or any combination thereof. Which may implement or perform the various exemplary logic blocks, modules and circuits described in connection with this disclosure. The processor 4001 may also be a combination that implements computing functionality, e.g., comprising one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.
Bus 4002 may include a path to transfer information between the aforementioned components. Bus 4002 may be a PCI (PERIPHERAL COMPONENT INTERCONNECT, peripheral component interconnect standard) bus or an EISA (Extended Industry Standard Architecture ) bus, or the like. The bus 4002 can be divided into an address bus, a data bus, a control bus, and the like. For ease of illustration, only one thick line is shown in fig. 6, but not only one bus or one type of bus.
Memory 4003 may be, but is not limited to, ROM (Read Only Memory) or other type of static storage device that can store static information and instructions, RAM (Random Access Memory ) or other type of dynamic storage device that can store information and instructions, EEPROM (ELECTRICALLY ERASABLE PROGRAMMABLE READ ONLY MEMORY ), CD-ROM (Compact Disc Read Only Memory, compact disc Read Only Memory) or other optical disk storage, optical disk storage (including compact discs, laser discs, optical discs, digital versatile discs, blu-ray discs, etc.), magnetic disk storage media, other magnetic storage devices, or any other medium that can be used to carry or store a computer program and that can be Read by a computer.
The memory 4003 is used for storing a computer program for executing an embodiment of the present application, and is controlled to be executed by the processor 4001. The processor 4001 is configured to execute a computer program stored in the memory 4003 to realize the steps shown in the foregoing method embodiment.
The computer device includes, but is not limited to, a desktop computer device, a mobile computer or a portable mobile terminal such as a mobile phone, a tablet computer, etc.
The embodiment of the application provides a computer readable storage medium, and a computer program is stored on the computer readable storage medium, and when the computer program is executed by a processor, the steps and corresponding contents of the processing method embodiment of web page access can be realized.
The embodiment of the application also provides a computer program product, which comprises a computer program, wherein the computer program can realize the steps and the corresponding contents of the processing method embodiment of the webpage access when being executed by a processor.
It should be understood that, although various operation steps are indicated by arrows in the flowcharts of the embodiments of the present application, the order in which these steps are implemented is not limited to the order indicated by the arrows. In some implementations of embodiments of the application, the implementation steps in the flowcharts may be performed in other orders as desired, unless explicitly stated herein. Furthermore, some or all of the steps in the flowcharts may include multiple sub-steps or multiple stages based on the actual implementation scenario. Some or all of these sub-steps or phases may be performed at the same time, or each of these sub-steps or phases may be performed at different times, respectively. In the case of different execution time, the execution sequence of the sub-steps or stages can be flexibly configured according to the requirement, which is not limited by the embodiment of the present application.
The foregoing is merely an optional implementation manner of some of the implementation scenarios of the present application, and it should be noted that, for those skilled in the art, other similar implementation manners based on the technical ideas of the present application are adopted without departing from the technical ideas of the scheme of the present application, and the implementation manner is also within the protection scope of the embodiments of the present application.
Claims (11)
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210233962.6A CN114448645B (en) | 2022-03-10 | 2022-03-10 | Web page access processing method, device, storage medium, and program product |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210233962.6A CN114448645B (en) | 2022-03-10 | 2022-03-10 | Web page access processing method, device, storage medium, and program product |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN114448645A CN114448645A (en) | 2022-05-06 |
| CN114448645B true CN114448645B (en) | 2024-12-03 |
Family
ID=81359589
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210233962.6A Active CN114448645B (en) | 2022-03-10 | 2022-03-10 | Web page access processing method, device, storage medium, and program product |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114448645B (en) |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115361162B (en) * | 2022-07-06 | 2025-05-13 | 华盟科技咨询(深圳)有限公司 | System login method and related equipment |
| CN118413408B (en) * | 2024-07-04 | 2024-08-30 | 蒲惠智造科技股份有限公司 | Account abnormal login identification method and system |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109039987A (en) * | 2017-06-08 | 2018-12-18 | 北京京东尚科信息技术有限公司 | A kind of user account login method, device, electronic equipment and storage medium |
| CN110138791A (en) * | 2019-05-20 | 2019-08-16 | 四川长虹电器股份有限公司 | Web service account takeover method of real-time and system based on Flink |
Family Cites Families (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104581214B (en) * | 2015-01-28 | 2018-09-11 | 三星电子（中国）研发中心 | Multimedia content guard method based on ARM TrustZone systems and device |
| CN106330844B (en) * | 2015-07-02 | 2020-08-04 | 阿里巴巴集团控股有限公司 | A cross-terminal free login method and device |
| CN106549902B (en) * | 2015-09-16 | 2020-05-19 | 阿里巴巴集团控股有限公司 | Method and device for identifying suspicious users |
| CN111865885B (en) * | 2019-04-30 | 2022-07-01 | 中移(苏州)软件技术有限公司 | An access control method, apparatus, device and storage medium |
| US20210004807A1 (en) * | 2019-07-01 | 2021-01-07 | Raymond Anthony Joao | Apparatus and method for providing transaction security and/or account security |
-
2022
- 2022-03-10 CN CN202210233962.6A patent/CN114448645B/en active Active
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109039987A (en) * | 2017-06-08 | 2018-12-18 | 北京京东尚科信息技术有限公司 | A kind of user account login method, device, electronic equipment and storage medium |
| CN110138791A (en) * | 2019-05-20 | 2019-08-16 | 四川长虹电器股份有限公司 | Web service account takeover method of real-time and system based on Flink |
Also Published As
| Publication number | Publication date |
|---|---|
| CN114448645A (en) | 2022-05-06 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| KR102150742B1 (en) | Automatic fraudulent digital certificate detection | |
| US11165822B2 (en) | Identifying phishing websites using DOM characteristics | |
| US9578048B1 (en) | Identifying phishing websites using DOM characteristics | |
| JP6533871B2 (en) | System and method for controlling sign-on to web applications | |
| US10740411B2 (en) | Determining repeat website users via browser uniqueness tracking | |
| US20150135282A1 (en) | Methods and systems for secure internet access and services | |
| CN103701793B (en) | The recognition methods of server broiler chicken and device | |
| US20160285781A1 (en) | Data processing method, apparatus, client, server and system | |
| CN114448645B (en) | Web page access processing method, device, storage medium, and program product | |
| CN111404937B (en) | Method and device for detecting server vulnerability | |
| EP3817333B1 (en) | Method and system for processing requests in a consortium blockchain | |
| KR20180082504A (en) | Methods and equipment for application information risk management | |
| CN102984121A (en) | Access monitoring method and information processing apparatus | |
| CN105323210A (en) | Method, apparatus and cloud server for detecting website security | |
| KR102110642B1 (en) | Password protection question setting method and device | |
| US10154052B1 (en) | Tracer cookies to detect web session compromise by insiders | |
| US20150067772A1 (en) | Apparatus, method and computer-readable storage medium for providing notification of login from new device | |
| CN107241292B (en) | Vulnerability detection method and device | |
| US10225274B2 (en) | Clustering network addresses | |
| CN113497807A (en) | Method and device for detecting user login risk and computer readable storage medium | |
| CN109688099B (en) | Server-side database collision identification method, device, equipment and readable storage medium | |
| US7529181B2 (en) | Method and apparatus for adaptive monitoring and management of distributed systems | |
| CN114465816A (en) | Password spraying attack detection method, device, computer equipment and storage medium | |
| CN113117339A (en) | Data processing method, device, server and storage medium | |
| CN108133046B (en) | Data analysis method and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |