CN116112258A - Login authentication method, login authentication device, electronic equipment and computer readable storage medium - Google Patents

Abstract

This application belongs to the field of communication technology, and discloses a login authentication method, device, electronic equipment, and computer-readable storage medium. The method includes: acquiring login information of a login requesting user; determining a login detection model set corresponding to a login account in the login information ;The login detection model is obtained based on the confrontation model training; the login detection model is used to detect the login anomaly based on the login information, and the abnormal value is obtained; the login authentication process is set corresponding to the abnormal value, and the login request user is authenticated; different abnormal values The login restrictions and time-consuming of the corresponding login authentication process are different. In this way, login restrictions and time-consuming costs can be reduced.

Description

Method, device, electronic device, and computer-readable storage medium for login authentication

technical field

The present application relates to the technical field of communications, and in particular, to a login authentication method, device, electronic equipment, and computer-readable storage medium.

Background technique

In some access scenarios with high security requirements, multi-factor login authentication is usually used for login authentication. Wherein, the multi-factor authentication mode refers to combining multiple authentication modes for login authentication, so as to improve the security of login authentication. For example, a bastion host is a dedicated host for operation and maintenance personnel to access core assets. All network and server resource access to assets must be performed through the bastion host. In order to improve the security of asset access, multi-factor login authentication is usually used to authenticate login request users.

However, using this method, although the security is guaranteed, there are many restrictions on login, and it will consume a lot of time and cost.

Contents of the invention

The purpose of the embodiments of the present application is to provide a login authentication method, device, electronic device, and computer-readable storage medium, so as to reduce login restrictions and time-consuming costs.

On the one hand, a method for login authentication is provided, including:

Obtain the login information of the login requesting user;

Determine the login detection model corresponding to the login account in the login information; the login detection model is obtained based on the training of the confrontation model;

Use the login detection model to detect login anomalies based on login information and obtain abnormal values;

Use the login authentication process set corresponding to the abnormal value to perform login authentication on the login requesting user; the login authentication process corresponding to different abnormal values has different login restrictions and time-consuming.

In one embodiment, before using the login authentication process set corresponding to the abnormal value, before performing login authentication on the login requesting user, the method further includes:

Divide all outliers to obtain multiple outlier intervals;

Based on multiple authentication methods, configure multiple login authentication processes; the login authentication process includes at least one authentication method;

Establish an association between the outlier interval and the login authentication process.

In an implementation manner, the login detection model is obtained through training through the following steps:

Obtain training data sets corresponding to multiple login accounts;

Based on the training data sets corresponding to each login account, the initial login detection model is trained separately to obtain the trained login detection model corresponding to each login account; the initial login detection model is obtained based on the confrontation model training.

In one embodiment, obtaining training data sets corresponding to multiple login accounts respectively includes:

Obtain multiple login success information and multiple login failure information;

Analyze each login success information and each login failure information separately, and obtain multiple login information and corresponding login results; the login results include login success and login failure;

According to the login result and the login account, the login information of successful login is divided, and the positive sample set corresponding to each login account is obtained; the positive sample set includes multiple login information and corresponding login results;

According to the login result and the login account, the login information of the login failure is divided, and the negative sample set corresponding to each login account is obtained; the negative sample set includes multiple login information and corresponding login results;

According to the positive sample sets corresponding to the respective login accounts and the negative sample sets corresponding to the respective login accounts, the training data sets corresponding to the respective login accounts are obtained.

In one embodiment, the method also includes:

Perform oversampling and/or add noise to negative samples in each negative sample set to obtain updated negative sample sets.

On the one hand, a device for login authentication is provided, including:

An acquisition unit, configured to acquire the login information of the login requesting user;

The determination unit is used to determine the login detection model corresponding to the login account in the login information; the login detection model is obtained based on the confrontation model training;

The detection unit is configured to use a login detection model to perform login anomaly detection based on login information to obtain an abnormal value;

The authentication unit is configured to use the login authentication process set corresponding to the abnormal value to perform login authentication on the login requesting user; the login restriction and time-consuming of the login authentication process corresponding to different abnormal values are different.

In one embodiment, the authentication unit is also used for:

Divide all outliers to obtain multiple outlier intervals;

Based on multiple authentication methods, configure multiple login authentication processes; the login authentication process includes at least one authentication method;

Establish an association between the outlier interval and the login authentication process.

In one embodiment, the determining unit is also used for:

Use the following steps to train the login detection model:

Obtain training data sets corresponding to multiple login accounts;

Based on the training data sets corresponding to each login account, the initial login detection model is trained separately to obtain the trained login detection model corresponding to each login account; the initial login detection model is obtained based on the confrontation model training.

In one embodiment, the determining unit is also used for:

Obtain multiple login success information and multiple login failure information;

Analyze each login success information and each login failure information separately, and obtain multiple login information and corresponding login results; the login results include login success and login failure;

According to the login result and the login account, the login information of successful login is divided, and the positive sample set corresponding to each login account is obtained; the positive sample set includes multiple login information and corresponding login results;

According to the login result and the login account, the login information of the login failure is divided, and the negative sample set corresponding to each login account is obtained; the negative sample set includes multiple login information and corresponding login results;

According to the positive sample sets corresponding to the respective login accounts and the negative sample sets corresponding to the respective login accounts, the training data sets corresponding to the respective login accounts are obtained.

In one embodiment, the determining unit is also used for:

Perform oversampling and/or add noise to negative samples in each negative sample set to obtain updated negative sample sets.

In one aspect, an electronic device is provided, including a processor and a memory, the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, various optional login authentication methods such as any of the above-mentioned ones are executed. Implement the steps of the method provided in the manner.

In one aspect, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the method provided in any of the above-mentioned optional implementation manners of login authentication are executed.

In one aspect, a computer program product is provided. When the computer program product runs on a computer, the computer executes the steps of the method provided in any of the above-mentioned optional implementation manners of login authentication.

In the login authentication method, device, electronic device, and computer-readable storage medium provided in the embodiments of the present application, the login information of the login requesting user is obtained; the login detection model corresponding to the login account in the login information is determined; the login detection model is based on Obtained by adversarial model training; use the login detection model to detect login anomalies based on login information, and obtain abnormal values; use the login authentication process set corresponding to the abnormal value to perform login authentication on the login requesting user; the login authentication process corresponding to different abnormal values Login restrictions and time-consuming vary. In this way, login restrictions and time-consuming costs can be reduced.

Additional features and advantages of the application will be set forth in the description which follows, and, in part, will be obvious from the description, or may be learned by practice of the application. The objectives and other advantages of the application may be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings.

Description of drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the accompanying drawings that need to be used in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present application, so It should not be regarded as a limitation on the scope, and those skilled in the art can also obtain other related drawings according to these drawings without creative work.

FIG. 1 is a flow chart of a method for model training provided by an embodiment of the present application;

FIG. 2 is a flow chart of a method for login authentication provided by an embodiment of the present application;

FIG. 3 is a structural block diagram of a device for login authentication provided by an embodiment of the present application;

FIG. 4 is a schematic structural diagram of an electronic device provided by an embodiment of the present application.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the present application with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, not all of them. The components of the embodiments of the application generally described and illustrated in the figures herein may be arranged and designed in a variety of different configurations. Accordingly, the following detailed description of the embodiments of the application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of the application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative efforts belong to the scope of protection of the present application.

Firstly, some terms involved in the embodiments of the present application will be described to facilitate the understanding of those skilled in the art.

Terminal equipment: Can be a mobile terminal, stationary terminal or portable terminal, such as a mobile handset, station, unit, device, multimedia computer, multimedia tablet, Internet node, communicator, desktop computer, laptop computer, notebook computer, netbook computer, Tablet computers, personal communication system devices, personal navigation devices, personal digital assistants, audio/video players, digital cameras/camcorders, pointing devices, television receivers, radio broadcast receivers, e-book devices, gaming devices, or any combination thereof, Includes accessories and peripherals for these devices or any combination thereof. It is also foreseeable that the terminal device can support any type of user-oriented interface (such as a wearable device) or the like.

Server: It can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or it can provide cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, Cloud servers for basic cloud computing services such as middleware services, domain name services, security services, and big data and artificial intelligence platforms.

In order to reduce login restrictions and time-consuming costs during login authentication, embodiments of the present application provide a login authentication method, device, electronic device, and computer-readable storage medium.

In the embodiment of this application, the method of model training and the method of login authentication are included. Model training is carried out through the method of model training first, and the login detection models corresponding to the trained login accounts are obtained. Then, when performing login authentication, the login detection model is used. The authentication method is to perform login detection and login authentication based on the login detection model corresponding to the login account of the login requesting user.

In the embodiment of the present application, the execution subject of the above-mentioned login authentication method may be an electronic device (such as a bastion host) used for login authentication, and the execution subject of the above-mentioned model training method may be the same as the execution subject of the above-mentioned login authentication method The device may also be other electronic devices (eg, server). An electronic device may be a server or a terminal device.

The above-mentioned model training method is described below in conjunction with FIG. 1. Referring to FIG. 1, it is a flow chart of a model training method provided in the embodiment of the present application. The specific implementation process of the method is as follows:

Step 100: Obtain training data sets respectively corresponding to multiple login accounts.

Step 101: Based on the training data sets corresponding to each login account, train the initial login detection model respectively to obtain the trained login detection model corresponding to each login account; the initial login detection model is obtained based on the adversarial model training.

In order to realize the collection of training data, the realization process of step 100 may include:

S1001: Obtain multiple login success information and multiple login failure information.

In one embodiment, the electronic device used for login authentication can be called a login authentication device. After multiple users log in to the login authentication device through multiple login accounts and use it for a period of time, they can log in from the log of the login authentication device. From the information, multiple login success messages and multiple login failure messages are extracted.

S1002: Analyze each piece of login success information and each piece of login failure information respectively to obtain a plurality of login information and corresponding login results; the login results include login success and login failure.

In one embodiment, text analysis is performed on each successful login information, and digital feature vector encoding is performed on the analyzed information to obtain the login information and its corresponding login result (ie, successful login). Each login failure information is analyzed in text, and the analyzed information is encoded with a digital feature vector to obtain the login information and its corresponding login result (ie, login failure).

Wherein, the analysis information of the successful login information may at least include the login account, the login Internet Protocol (Internet Protocol, IP) and the login frequency. Optionally, the parsing information of the successful login information may also include but not limited to at least one of the following: login time, login and logout time, and online duration.

Wherein, the analysis information of the login failure information may at least include a login account, a login IP, and a login frequency. Optionally, the parsing information of the basic login failure information may also include but not limited to at least one of the following: login time and login error information.

S1003: According to the login result and the login account, divide the login information that has successfully logged in, and obtain the positive sample set corresponding to each login account; the positive sample set includes multiple login information and corresponding login results.

In this way, each login information that has been successfully logged in can be used as a positive sample to obtain a set of positive samples for model training.

S1004: According to the login result and the login account, divide each login information that fails to log in, and obtain a negative sample set corresponding to each login account; the negative sample set includes a plurality of login information and corresponding login results.

In this way, each failed login information can be used as a negative sample to obtain a set of negative samples for model training.

Furthermore, since login failure events are usually sporadic events, the number of login failure events is usually much smaller than the number of login success events. Therefore, the number of negative samples can also be increased in the following ways:

Perform oversampling and/or add noise to negative samples in each negative sample set to obtain updated negative sample sets.

Among them, oversampling refers to repeated sampling of negative samples to increase the number of negative samples. Adding noise refers to randomly changing part of the information in the negative samples to obtain new negative samples, thereby increasing the number of negative samples.

Optionally, oversampling and/or adding noise may be implemented manually or automatically, which is not limited here.

In this way, the balance of the number of negative samples and positive samples can be maintained, so that the numbers of the two are relatively close, which in turn can make the performance of the model obtained by subsequent training better and the detection more accurate.

S1005: Obtain a training data set corresponding to each login account according to the positive sample set corresponding to each login account and the negative sample set corresponding to each login account.

In this way, a training data set for model training can be obtained.

As an example, after logging in and accessing the bastion host through multiple login accounts for a period of time, the login log in the bastion host is obtained, and the login success information and login failure information respectively corresponding to each login account are extracted from the login log. And, perform text analysis on each login success information to obtain each login information, generate a positive sample set, perform text analysis on each login failure information, obtain each login information, and generate a negative sample set. Further, each negative sample in the negative sample set is oversampled and noise is added to obtain a new negative sample set.

In order to obtain a trained login detection model, the implementation process of step 101 may include:

Based on the confrontation model, an initial login detection model is constructed, and for the target login account in each login account, the initial login detection model is trained based on the training data set of the target login account, and a trained login detection model corresponding to the target login account is obtained.

In one embodiment, the initial login detection model is trained based on the training data set of the target login account, and the detection accuracy and recall rate are determined according to the model output results, and the model parameters are adjusted according to the detection accuracy rate and recall rate , until a login detection model that meets the training conditions is obtained, so that a more comprehensive and better performance login detection model can be obtained through repeated training.

In this way, login detection models corresponding to different login accounts can be obtained, and in subsequent steps, the trained login detection models can be used for login authentication.

The method for login authentication is described below in conjunction with FIG. 2. Referring to FIG. 2, it is a flow chart of a method for login authentication provided by the embodiment of the present application. The specific implementation process of the method is as follows:

Step 200: Obtain the login information of the login requesting user.

In one embodiment, when it is determined that a login request message from a login requesting user is received, the login account number and login verification information (such as password and verification code, etc.) in the login request message are obtained, and according to the login verification information, it is determined that the verification is passed , get the login information of the user who requested the login.

Wherein, the login information may include the login account, login IP and login frequency of the login request. Optionally, the login time may also be included.

In this way, a preliminary login authentication can be performed first by means of account password authentication to obtain a login account.

Step 201: Determine the login detection model set corresponding to the login account in the login information; the login detection model is obtained based on adversarial model training.

In one embodiment, the login detection model set corresponding to the login account in the login information is selected from a plurality of trained login detection models.

Step 202: Use the login detection model to detect login anomalies based on the login information, and obtain abnormal values.

In one embodiment, the login information is input into the selected login detection model to obtain the output abnormal value.

It should be noted that the higher the outlier value, the greater the security risk of the login account, and the more stringent login authentication is required. On the contrary, the higher the security, the less complicated login authentication operations are required.

Step 203: Use the login authentication process set corresponding to the abnormal value to perform login authentication on the login requesting user; the login authentication process corresponding to different abnormal values has different login restrictions and time consumption.

In one embodiment, the abnormal value interval to which the abnormal value belongs is obtained, and the association relationship between the abnormal value interval and the login authentication process based on the pre-established relationship is obtained, and the login authentication corresponding to the abnormal value interval is obtained based on the association relationship. process, and based on the login authentication process, perform login authentication on the login requesting user.

Among them, based on the login authentication process, the login authentication of the login requesting user can be performed in any of the following ways:

Method 1: The login authentication device performs login authentication on the login requesting user based on the login authentication process.

Method 2: The login authentication device sends the login authentication process to the login access client of the login requesting user. The login access client performs login authentication on the login requesting user based on the received login authentication process.

Further, when establishing the above association relationship, the following steps may be adopted:

S2031: Divide all outliers to obtain multiple outlier intervals.

For example, the value range of the outlier can be 0-10, or 0-100.

S2032: Configure multiple login authentication processes based on multiple authentication modes; the login authentication process includes at least one authentication mode.

Among them, the authentication method may include but not limited to at least one of the following:

Account password authentication, Radius authentication, AD domain authentication, dynamic password (One Time Password, OTP) authentication, SMS authentication, certificate authentication, UKey authentication and face recognition.

In one embodiment, each authentication method is scored according to the degree of login restriction and time-consuming of each authentication method, and the authentication score of each authentication method is obtained. The more restrictive and time-consuming the login, the higher the authentication score, and vice versa, the lower the authentication score. Further, a login authentication process including at least one authentication method is generated according to the authentication scores of each authentication method. And, the process score corresponding to each login authentication process can be obtained according to the sum of the authentication scores of the authentication modes included in each login authentication process.

Wherein, the flow scores of each login authentication flow may be the same or different. That is, the same process score can correspond to one or more login authentication processes.

S2033: Establish an association relationship between the abnormal value interval and the login authentication process.

In one embodiment, corresponding process scores can be configured for each abnormal value interval, and the abnormal value interval and process score can be established according to the process score corresponding to each abnormal value interval and the login authentication process corresponding to each process score. The relationship between the value and the login authentication process.

It should be noted that since an abnormal value interval can correspond to one or more process scores, and the same process score can correspond to one or more login authentication processes, therefore, the same abnormal value interval can correspond to one or more login authentication processes.

It should be noted that the login restrictions and time-consuming of the login authentication process corresponding to different outliers are different. The larger the outlier value, the greater the corresponding process score, and the more login restrictions and time-consuming of the corresponding login authentication process. On the contrary, the smaller the corresponding process score, and the corresponding login restrictions and time-consuming of the login authentication process. less.

Further, if it is determined that the login is successful, the login success information may be obtained, and based on the login success information, the login detection model may be retrained to obtain an updated login detection model. If it is determined that the login fails, the login failure information is obtained, and based on the login failure information, the login detection model is retrained to obtain an updated login detection model, and a login failure alarm log is generated for management personnel (such as auditors) ) can be traced back.

In the embodiment of this application, different login detection models can be trained for failed login accounts, and the abnormal value of this login can be detected through the login detection model of the current login account, and the abnormal value can be selected to match. The authentication process performs login authentication, which can improve the accuracy of login anomaly detection, and dynamically adjust the login authentication process for login authentication according to the risk level of login anomalies, without adopting unified login restrictions and time-consuming The login authentication process performs all login authentication, which improves the flexibility of login authentication, reduces the cumbersome restrictions and time-consuming cost of login authentication, and improves the efficiency of login authentication.

Based on the same inventive concept, the embodiment of the present application also provides a device for login authentication. Since the problem-solving principle of the above-mentioned device and equipment is similar to a method for login authentication, the implementation of the above-mentioned device can refer to the implementation of the method. Repeated points will not be repeated.

As shown in Figure 3, it is a schematic structural diagram of a login authentication device provided in the embodiment of the present application, including:

An acquisition unit 301, configured to acquire login information of a login requesting user;

A determining unit 302, configured to determine a login detection model set corresponding to the login account in the login information; the login detection model is obtained based on confrontation model training;

The detection unit 303 is configured to use a login detection model to perform login anomaly detection based on login information to obtain an abnormal value;

The authentication unit 304 is configured to use the login authentication process set corresponding to the abnormal value to perform login authentication on the login requesting user; the login authentication process corresponding to different abnormal values has different login restrictions and time consumption.

In one embodiment, the authentication unit 304 is also used to:

Divide all outliers to obtain multiple outlier intervals;

Based on multiple authentication methods, configure multiple login authentication processes; the login authentication process includes at least one authentication method;

Establish an association between the outlier interval and the login authentication process.

In one implementation manner, the determining unit 302 is also used to:

Use the following steps to train the login detection model:

Obtain training data sets corresponding to multiple login accounts;

Based on the training data sets corresponding to each login account, the initial login detection model is trained separately to obtain the trained login detection model corresponding to each login account; the initial login detection model is obtained based on the confrontation model training.

In one implementation manner, the determining unit 302 is also used to:

Obtain multiple login success information and multiple login failure information;

Analyze each login success information and each login failure information separately, and obtain multiple login information and corresponding login results; the login results include login success and login failure;

According to the login result and the login account, the login information of successful login is divided, and the positive sample set corresponding to each login account is obtained; the positive sample set includes multiple login information and corresponding login results;

According to the login result and the login account, the login information of the login failure is divided, and the negative sample set corresponding to each login account is obtained; the negative sample set includes multiple login information and corresponding login results;

According to the positive sample sets corresponding to the respective login accounts and the negative sample sets corresponding to the respective login accounts, the training data sets corresponding to the respective login accounts are obtained.

In one implementation manner, the determining unit 302 is also used to:

Perform oversampling and/or add noise to negative samples in each negative sample set to obtain updated negative sample sets.

In the login authentication method, device, electronic device, and computer-readable storage medium provided in the embodiments of the present application, the login information of the login requesting user is obtained; the login detection model corresponding to the login account in the login information is determined; the login detection model is based on Obtained by adversarial model training; use the login detection model to detect login anomalies based on login information, and obtain abnormal values; use the login authentication process set corresponding to the abnormal value to perform login authentication on the login requesting user; the login authentication process corresponding to different abnormal values Login restrictions and time-consuming vary. In this way, login restrictions and time-consuming costs can be reduced.

FIG. 4 shows a schematic structural diagram of an electronic device 4000 . Referring to FIG. 4 , the electronic device 4000 includes: a processor 4010 and a memory 4020 , and optionally, a power supply 4030 , a display unit 4040 , and an input unit 4050 .

The processor 4010 is the control center of the electronic device 4000. It uses various interfaces and lines to connect various components, and executes various functions of the electronic device 4000 by running or executing software programs and/or data stored in the memory 4020. The device 4000 performs overall monitoring.

In the embodiment of the present application, when the processor 4010 invokes the computer program stored in the memory 4020, various steps in the foregoing embodiments are executed.

Optionally, the processor 4010 may include one or more processing units; preferably, the processor 4010 may integrate an application processor and a modem processor, wherein the application processor mainly processes operating systems, user interfaces, applications, etc., The modem processor primarily handles wireless communications. It can be understood that the foregoing modem processor may not be integrated into the processor 4010 . In some embodiments, the processor and memory can be implemented on a single chip, and in some embodiments, they can also be implemented on independent chips.

The memory 4020 can mainly include a program storage area and a data storage area, wherein the program storage area can store operating systems, various applications, etc.; the data storage area can store data created according to the use of the electronic device 4000 , etc. In addition, the memory 4020 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid-state storage devices.

The electronic device 4000 also includes a power supply 4030 (such as a battery) for supplying power to various components. The power supply can be logically connected to the processor 4010 through the power management system, so that functions such as charging, discharging, and power consumption can be managed through the power management system.

The display unit 4040 can be used to display information input by the user or provided to the user and various menus of the electronic device 4000, etc., and in the embodiment of the present invention, it is mainly used to display the display interface of each application in the electronic device 4000 and the display interface. Objects such as text and pictures. The display unit 4040 may include a display panel 4041 . The display panel 4041 may be configured in the form of a liquid crystal display (Liquid Crystal Display, LCD), an organic light-emitting diode (Organic Light-Emitting Diode, OLED), and the like.

The input unit 4050 can be used to receive information such as numbers or characters input by the user. The input unit 4050 may include a touch panel 4051 and other input devices 4052 . Wherein, the touch panel 4051, also referred to as a touch screen, can collect touch operations of the user on or near it (for example, the user uses any suitable object or accessory such as a finger, a touch pen, etc. on the touch panel 4051 or on the touch panel 4051 nearby operations).

Specifically, the touch panel 4051 can detect the user's touch operation, detect the signals brought by the touch operation, convert these signals into contact coordinates, send them to the processor 4010, and receive and execute the commands sent by the processor 4010 . In addition, the touch panel 4051 can be implemented in various types such as resistive, capacitive, infrared, and surface acoustic wave. Other input devices 4052 may include, but are not limited to, one or more of physical keyboards, function keys (such as volume control buttons, power-on/off buttons, etc.), trackballs, mice, joysticks, and the like.

Of course, the touch panel 4051 can cover the display panel 4041. When the touch panel 4051 detects a touch operation on or near it, it sends it to the processor 4010 to determine the type of the touch event. A corresponding visual output is provided on the display panel 4041 . Although in FIG. 4, the touch panel 4051 and the display panel 4041 are used as two independent components to realize the input and output functions of the electronic device 4000, in some embodiments, the touch panel 4051 and the display panel 4041 can be The input and output functions of the electronic device 4000 are realized by integration.

The electronic device 4000 may also include one or more sensors, such as a pressure sensor, an acceleration of gravity sensor, a proximity light sensor, and the like. Of course, according to the needs of specific applications, the above-mentioned electronic device 4000 may also include other components such as a camera. Since these components are not the key components used in the embodiment of this application, they are not shown in FIG. 4 and will not be described in detail .

Those skilled in the art can understand that FIG. 4 is only an example of the electronic device, and does not constitute a limitation to the electronic device. It may include more or less components than those shown in the figure, or combine certain components, or different components.

In the embodiment of the present application, a computer-readable storage medium stores a computer program on it, and when the computer program is executed by a processor, the communication device can execute the steps in the foregoing embodiments.

For the convenience of description, the above parts are divided into modules (or units) according to their functions and described separately. Of course, the functions of each module (or unit) can be implemented in one or more pieces of software or hardware when implementing the present application.

Those skilled in the art should understand that the embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present application is described with reference to flowcharts and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present application. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and a combination of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing equipment produce a An apparatus for realizing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions The device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby The instructions provide steps for implementing the functions specified in the flow chart or blocks of the flowchart and/or the block or blocks of the block diagrams.

While preferred embodiments of the present application have been described, additional changes and modifications to these embodiments can be made by those skilled in the art once the basic inventive concept is appreciated. Therefore, the appended claims are intended to be construed to cover the preferred embodiment and all changes and modifications which fall within the scope of the application.

Obviously, those skilled in the art can make various changes and modifications to the application without departing from the spirit and scope of the application. In this way, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalent technologies, the present application is also intended to include these modifications and variations.

Claims (12)

1. A method of login authentication, comprising:

acquiring login information of a login request user;

determining a login detection model correspondingly set by a login account in the login information; the login detection model is obtained based on countermeasure model training;

adopting the login detection model, and carrying out login abnormality detection based on the login information to obtain an abnormal value;

adopting a login authentication flow set corresponding to the abnormal value to perform login authentication on the login request user; the login restriction and time consumption of the login authentication flow corresponding to different outliers are different.

2. The method of claim 1, wherein prior to performing login authentication for the login-requesting user using the login authentication procedure set in correspondence with the outlier, the method further comprises:

dividing all abnormal values to obtain a plurality of abnormal value intervals;

configuring a plurality of login authentication flows based on a plurality of authentication modes; the login authentication flow comprises at least one authentication mode;

and establishing an association relation between the abnormal value interval and the login authentication flow.

3. The method of claim 1, wherein the login detection model is trained using the steps of:

acquiring training data sets respectively corresponding to a plurality of login accounts;

training the login detection initial model based on training data sets corresponding to the login account numbers respectively, and obtaining trained login detection models corresponding to the login account numbers respectively; the login detection initial model is obtained based on challenge model training.

4. The method of claim 3, wherein the obtaining training data sets respectively corresponding to the plurality of login accounts comprises:

acquiring a plurality of login success information and a plurality of login failure information;

analyzing each login success information and each login failure information respectively to obtain a plurality of login information and a corresponding login result; the login result comprises login success and login failure;

dividing each login information which is successfully logged in according to login results and login accounts to obtain positive sample sets respectively corresponding to each login account; the positive sample set comprises a plurality of login information and corresponding login results;

dividing each piece of login information failing to login according to login results and login accounts to obtain negative sample sets corresponding to each login account respectively; the negative sample set comprises a plurality of login information and corresponding login results;

and obtaining training data sets corresponding to the login accounts respectively according to the positive sample sets corresponding to the login accounts respectively and the negative sample sets corresponding to the login accounts respectively.

5. The method of claim 4, wherein the method further comprises:

and (3) carrying out oversampling and/or noise adding on the negative samples in each negative sample set to obtain each updated negative sample set.

6. A device for login authentication, comprising:

the acquisition unit is used for acquiring login information of a login request user;

the determining unit is used for determining a login detection model correspondingly set by a login account in the login information; the login detection model is obtained based on countermeasure model training;

the detection unit is used for detecting login abnormality based on the login information by adopting the login detection model to obtain an abnormal value;

an authentication unit, configured to perform login authentication on the login request user by using a login authentication procedure set corresponding to the abnormal value; the login restriction and time consumption of the login authentication flow corresponding to different outliers are different.

7. The apparatus of claim 6, wherein the authentication unit is further to:

dividing all abnormal values to obtain a plurality of abnormal value intervals;

configuring a plurality of login authentication flows based on a plurality of authentication modes; the login authentication flow comprises at least one authentication mode;

and establishing an association relation between the abnormal value interval and the login authentication flow.

8. The apparatus of claim 6, wherein the determining unit is further to:

the login detection model is obtained through training by the following steps:

acquiring training data sets respectively corresponding to a plurality of login accounts;

training the login detection initial model based on training data sets corresponding to the login account numbers respectively, and obtaining trained login detection models corresponding to the login account numbers respectively; the login detection initial model is obtained based on challenge model training.

9. The apparatus of claim 8, wherein the determining unit is further to:

acquiring a plurality of login success information and a plurality of login failure information;

analyzing each login success information and each login failure information respectively to obtain a plurality of login information and a corresponding login result; the login result comprises login success and login failure;

dividing each login information which is successfully logged in according to login results and login accounts to obtain positive sample sets respectively corresponding to each login account; the positive sample set comprises a plurality of login information and corresponding login results;

dividing each piece of login information failing to login according to login results and login accounts to obtain negative sample sets corresponding to each login account respectively; the negative sample set comprises a plurality of login information and corresponding login results;

and obtaining training data sets corresponding to the login accounts respectively according to the positive sample sets corresponding to the login accounts respectively and the negative sample sets corresponding to the login accounts respectively.

10. The apparatus of claim 9, wherein the determining unit is further to:

and (3) carrying out oversampling and/or noise adding on the negative samples in each negative sample set to obtain each updated negative sample set.

11. An electronic device comprising a processor and a memory storing computer readable instructions that, when executed by the processor, perform the method of any of claims 1-5.

12. A computer readable storage medium, on which a computer program is stored, characterized in that the computer program, when being executed by a processor, performs the method according to any of claims 1-5.

Images