CN114465977B - Mailbox login abnormality detection method, device, equipment and storage medium - Google Patents

Abstract

The invention discloses a method, a device, equipment and a storage medium for detecting mailbox login abnormality, which comprise the following steps: acquiring all login records of a user mailbox, and establishing a trusted IP list and a standard user portrait according to a normal mail preset in the user mailbox; acquiring longitude and latitude of a region corresponding to each login record according to a preset geographic information base of the login IP; wherein each login record comprises a login IP and a login time; according to the login time, sequentially calculating the switching speed of longitude and latitude of the region corresponding to each two adjacent login records, and screening suspicious login records according to a preset speed threshold; and according to the trusted IP list and the standard user portrait, performing rejection operation on the suspicious login record, and taking the suspicious login record after the rejection operation as an abnormal record. The method and the device solve the technical problem of low login abnormality detection accuracy of login area switching in the prior art.

Description

A method, device, equipment and storage medium for detecting abnormal mailbox login

Technical Field

The present invention relates to the field of network information technology security, and in particular to a method, device, equipment and storage medium for detecting mailbox login anomalies.

Background technique

Unauthorized login detection of e-mail is an important application in the field of email security. E-mail is widely used, and the security of corporate email is more related to the interests of companies and enterprises. Most enterprises, government departments, scientific research institutions, etc. use corporate email to transmit, modify and approve official documents, and many highly confidential data are included in it. However, during the transmission process, e-mails need to be forwarded on different mail servers, which gives attackers an opportunity to take advantage of them. There are many ways to leak e-mail passwords, including but not limited to phishing emails (deceiving users to click on unknown links in emails to an illegal login page and stealing users' accounts and passwords), brute force cracking (using a large number of IPs to quickly try a large number of passwords of a large number of accounts, with a certain probability of cracking some email accounts with simple passwords), Trojans (installing Trojans on client machines through emails or other download methods and stealing user accounts and passwords), and database collision (users' accounts and passwords are shared by multiple websites, resulting in the backend of one website being compromised and the account password being stolen, and the same password can be used to log in to other systems or corresponding email systems). Since there are endless attack methods, we can only assume that some users have had their corresponding email account and password stolen due to some of the above reasons. Therefore, we need a way to determine whether the current logged-in user is the user himself or another unauthorized user.

At present, most of the security detection of email account login risk control is aimed at a specific leakage path. For example, the attacker's IP address is obtained through clustering and other methods, and the common login IP address of the suspicious email address is finally determined to identify the attacker. However, for attackers with a large number of suspected agents logging into stolen accounts from different IP addresses, or low-frequency continuous monitoring attacks against a small number of high-value accounts, the method based on the common login IP address may not be able to capture such abnormal logins. For brute force cracking, a certain threshold is set for trying a large number of different accounts and a large number of different passwords with the same IP address. For remote login risk control, two-factor authentication is required for logged-in users. However, for users who may use VPN and other agents, when switching corresponding geographical locations, or based on different IP geographical unknown information libraries, there is a certain probability of returning the wrong IP corresponding geographical location, which makes the login process complicated or even fails.

Therefore, there is an urgent need for a strategy to detect abnormal logins to corporate mailboxes to solve the problem in the prior art that users use proxies to cause login region switching, resulting in false alarms and inaccurate detection.

Summary of the invention

The present invention provides a method, device, equipment and storage medium for detecting abnormal login of a mailbox, so as to solve the technical problem of low accuracy of detecting abnormal login when switching login regions in the prior art.

In order to solve the above technical problems, an embodiment of the present invention provides a method for detecting abnormal mailbox login, comprising:

Obtain all login records of the user's mailbox, and establish a trusted IP list and standard user portrait based on the normal emails preset in the user's mailbox;

According to the preset geographic information database of the login IP, the longitude and latitude of the region corresponding to each login record are obtained; wherein each login record includes a login IP and a login time;

According to the login time, the switching speed of the longitude and latitude of the area corresponding to each two adjacent login records is calculated in sequence, and the suspicious login records are screened out according to a preset speed threshold;

The suspicious login records are eliminated according to the trusted IP list and the standard user portrait, and the suspicious login records after the elimination operation are regarded as abnormal records.

As a preferred solution, after removing the suspicious login records after the operation as abnormal records, the method further includes:

In response to the current user's mailbox login operation, generate a first login record, and determine whether the first login record is normal according to the trusted IP list and the standard user portrait;

If the first login record is normal, save the login record;

If the first login record is abnormal, two-factor authentication is triggered to enable the current user to confirm the login.

As a preferred solution, after generating a first login record in response to the current user's mailbox login operation, and judging whether the first login record is normal according to the trusted IP list and the standard user portrait, the method further includes:

The number of login records generated within a first preset time period is recorded, and if the number of the generated login records is greater than a preset first threshold, the mailbox of the current user is blocked.

As a preferred solution, after obtaining the longitude and latitude of the region corresponding to each login record according to the preset geographic information database of the login IP, the method further includes:

Obtaining all failed login records within a second preset time period, and classifying all failed login records according to a preset brute force cracking rule to obtain brute force cracking records and non-brute force cracking records;

If the brute force cracking record exceeds a preset second threshold, all login IPs in the brute force cracking record are marked as a brute force cracking IP list;

The exception record is updated according to the login record corresponding to the login IP that matches the brute force IP list.

As a preferred solution, all login records of the user mailbox are obtained, and a trusted IP list and a standard user profile are established according to normal emails preset in the user mailbox, specifically:

Obtain the number of unique senders corresponding to all preset normal email IPs in the user's mailbox, use the IP whose number of unique senders is greater than a third threshold as a trusted IP seed, and use the client IDs of all emails sent from the trusted IP as a trusted ID list; wherein each login record also includes a client ID;

According to the trusted IP seeds and the trusted ID list, each of the trusted IP seeds is taken as a vertex, and the weight of each vertex is the number of unique senders corresponding to each trusted IP seed, so as to construct a reputation transmission graph, iteratively grow and propagate the reputation transmission graph until the number of iterations reaches a preset value, obtain the weight of each vertex after the iteration, and obtain the trusted IP list according to the weight of each vertex after the iteration;

Based on the trusted IP list, a standard user profile is calculated.

As a preferred solution, the standard user profile is calculated based on the trusted IP, specifically:

Obtain all login records of the user's mailbox, and filter out login records that match the trusted IP list according to the trusted IP list;

Based on the login records that match the trusted IP list, a feature vector of the user is calculated as a standard user portrait.

As a preferred solution, according to the login time, the switching speed of the longitude and latitude of the area corresponding to each two adjacent login records is calculated in sequence, and suspicious login records are screened out according to a preset speed threshold, specifically:

According to the login time, all login records are sorted, and the switching speeds of the longitude and latitude of the areas corresponding to each two adjacent login records are calculated in turn, and according to a preset speed threshold, the two adjacent login records corresponding to the switching speed greater than the preset speed threshold are screened out as suspicious login records.

Accordingly, the present invention also provides a detection device for abnormal mailbox login, comprising: a list portrait module, a regional location module, a suspicious login module and an abnormal recording module;

The list portrait module is used to obtain all login records of the user mailbox and establish a trusted IP list and a standard user portrait based on the normal emails preset in the user mailbox;

The regional location module is used to obtain the longitude and latitude of the region corresponding to each login record according to the preset geographic information database of the login IP; wherein each login record includes a login IP and a login time;

The suspicious login module is used to calculate the switching speed of the longitude and latitude of the area corresponding to each two adjacent login records according to the login time, and filter out the suspicious login records according to a preset speed threshold;

The abnormal record module is used to remove the suspicious login records according to the trusted IP list and the standard user portrait, and use the suspicious login records after the removal operation as abnormal records.

Correspondingly, the present invention also provides a terminal device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor implements the method for detecting an abnormal mailbox login as described in any one of the above items when executing the computer program.

Correspondingly, the present invention also provides a computer-readable storage medium, which includes a stored computer program; wherein, when the computer program is running, it controls the device where the computer-readable storage medium is located to execute the method for detecting mailbox login anomalies as described in any of the above items.

Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

The technical solution of the present invention obtains all login records of the user's mailbox, and establishes a trusted IP list and a standard user portrait according to normal emails preset in the user's mailbox, so as to detect mailbox login anomalies based on the user's mailbox usage habits, thereby improving the accuracy of login anomaly detection, and calculating the switching speed of the longitude and latitude of the area corresponding to two adjacent login records, so as to screen out suspicious login records, thereby improving the screening accuracy of the two login records, and eliminating the suspicious login records according to the trusted IP list and the standard user portrait, thereby avoiding the false alarm of detection anomalies caused by switching the login area after using a proxy in the prior art, improving the user experience of using the mailbox and improving the accuracy of detecting mailbox login anomalies.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a flowchart of a method for detecting abnormal mailbox login provided by an embodiment of the present invention;

FIG2 is a diagram of IP reputation propagation in an initial state in a method for detecting abnormal mailbox login provided by an embodiment of the present invention;

FIG3 is a schematic diagram of reputation propagation of IP1 in a method for detecting abnormal mailbox login provided by an embodiment of the present invention;

FIG4 is a schematic diagram of reputation propagation of IP2 in a method for detecting abnormal mailbox login provided by an embodiment of the present invention;

FIG5 is a schematic diagram of reputation propagation of IP3 in a method for detecting abnormal mailbox login provided by an embodiment of the present invention;

FIG6 is a schematic diagram of the structure of a device for detecting abnormal mailbox login provided by an embodiment of the present invention.

Detailed ways

The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

Embodiment 1

Please refer to FIG. 1 , which is a method for detecting abnormal mailbox login provided by an embodiment of the present invention, comprising the following steps:

S101: Obtain all login records of the user mailbox, and establish a trusted IP list and a standard user portrait based on normal emails preset in the user mailbox.

Specifically, the number of unique senders corresponding to the IP addresses of all preset normal emails in the user's mailbox is obtained, and the IP addresses whose number of unique senders is greater than a third threshold are used as trusted IP seeds, and the client IDs of all emails sent from the trusted IP addresses are used as a trusted ID list; wherein each login record also includes a client ID; according to the trusted IP seeds and the trusted ID list, each of the trusted IP seeds is used as a vertex, and the weight of each vertex is the number of unique senders corresponding to each trusted IP seed, thereby constructing a reputation transmission graph, iteratively growing and propagating the reputation transmission graph until the number of iterations reaches a preset value, obtaining the weight of each vertex after the iteration, and obtaining the trusted IP list based on the weight of each vertex after the iteration; according to the trusted IP list, a standard user portrait is calculated.

It should be noted that the preset normal emails are emails in the outbox in which the recipient and the sender have had multiple exchanges of communication. Through the preset normal emails, it can be ensured that the IP when sending the normal email is the IP of the user himself, so as to ensure the generation of accurate and trustworthy trusted IP lists and user portraits. The number of unique senders corresponding to the IPs of all preset normal emails in the user's mailbox is obtained, and the IPs with a number of unique senders greater than the third threshold are used as trusted IP seeds. Preferably, in practice, for corporate mailboxes, it is generally found that most of these IPs are common export IPs of the company's office. Among them, the number of unique senders corresponding to the IP of normal emails can be understood as each normal email has an IP, and the number of unique senders corresponding to the same IP is counted.

In this embodiment, after obtaining the number of unique senders corresponding to the IPs of all normal emails in the user's mailbox, the IPs whose number of unique senders is greater than the third threshold are used as trusted IP seeds, and the IPs whose number of unique senders is too small are eliminated. The client IDs of all emails sent from the trusted IPs are used as trusted ID lists, and the trusted IP seeds are used as vertices. The weight of the vertices is the number of unique senders of the corresponding IP, that is, the reputation size, and the trusted ID list is the edge between each vertex to construct an initial reputation propagation graph. Subsequently, the reputation transmission graph is iteratively grown and propagated until the number of iterations reaches a preset value, and the weight of each vertex after the iteration is obtained, and the trusted IP list is obtained according to the weight of each vertex after the iteration.

As a preferred solution of this embodiment, please refer to Figure 2, which is a reputation propagation diagram in the initial state. In this preferred solution, a total of four IPs are obtained, namely IP1, IP2, IP3 and IP4, among which IP1 has 100 unique senders, an initial reputation of 100, a total of 100 trusted IDs, i.e., 100 edges, 7 edges connected to IP2, i.e., 7 common IDs with IP2, and 3 edges connected to IP3, i.e., 3 common IDs with IP3; IP2 has 10 unique senders, an initial reputation of 10, a total of 10 trusted IDs, i.e., 10 edges, 7 edges connected to IP1, and the remaining 3 edges are connected to other external IPs; IP3 has 0 unique senders, an initial reputation of 0, and only 3 edges connected to IP1; IP4 has no unique sender, an initial reputation of 0, and no common client with IP1, IP2 and IP3, so IP4 does not have reputation propagation. Reputation propagation is performed for IP1, IP2, and IP3 respectively. The size of the reputation propagated each time is propagated according to the ratio of the number of edge connections with each IP. The reputation propagation performed once for each IP is an iterative process. Preferably, please refer to Figure 3, which is a schematic diagram of reputation propagation from IP1 to IP2 and IP3. IP2 obtains 100*(7/100)=7 reputation from IP1, i.e., IP2's current reputation is 17, and IP3 obtains 100*(3/100)=3 reputation from IP1, i.e., IP3's current reputation is 3; please refer to Figure 4, which is a schematic diagram of reputation propagation from IP2 to IP1. IP1 obtains 17*(7/10)=11.9 reputation from IP2, i.e., IP1's current reputation is 111.9; please refer to Figure 5, which is a schematic diagram of reputation propagation from IP3 to IP1. IP1 obtains 3*(3/3)=3 reputation from IP3, i.e., IP1's current reputation is 114.9; in this preferred embodiment, all IPs complete a reputation propagation, i.e., an iterative process of reputation calculation is performed.

Preferably, the number of iterations reaches 4, the ranking of the reputation value of each IP is basically stable and converged, and the top 80% of the IPs with the largest reputation values are retained as a trusted IP list.

Through the reputation transfer process, the reputation value of a trusted IP can be propagated to other trusted IPs, including but not limited to situations where users change their IPs by using network proxies, etc., so that a relatively trusted IP list can be obtained. In order to avoid potential cheating processes such as subjective factors, only IPs with high reputation values after reputation propagation are retained, and IPs with lower reputations are eliminated. The retention ratio is determined based on actual needs.

Specifically, all login records of the user's mailbox are obtained, and according to the trusted IP list, the login records that meet the trusted IP list are screened out; according to the login records that meet the trusted IP list, the feature vector of the user is calculated as a standard user portrait.

It should be noted that the login record also includes the login time, login country, login city, C segment of the login IP and the login client ID. According to the login record that conforms to the trusted IP list, preferably, the user's feature vector is calculated through the item2vec method as a standard user portrait.

S102: According to the preset geographic information database of the login IP, the longitude and latitude of the area corresponding to each login record are obtained; wherein each login record includes a login IP and a login time.

As a preferred solution of this embodiment, after obtaining the longitude and latitude of the area corresponding to each login record according to the preset geographic information database of the login IP, it also includes: obtaining all login records of failed logins within a second preset time period, and classifying all the login records of failed logins according to the preset brute force cracking rules to obtain brute force cracking records and non-brute force cracking records; if the brute force cracking record exceeds a preset second threshold, marking all the login IPs in the brute force cracking record as a brute force cracking IP list; and updating the abnormal record according to the login record corresponding to the login IP that meets the brute force cracking IP list.

Preferably, the preset brute force cracking rules classify all login records of failed logins into four situations. The first situation a: hackers may use a small number of IPs to crack the same account with a large number of different passwords, and there will be a large number of failure records; the second situation b: hackers may use a small number of IPs to try to crack a large number of different accounts with the same password, and there will be a large number of failure records; the third situation c: hackers may use a small number of IPs to crack a large number of different accounts with a large number of different passwords, and there will be a large number of failure records; the fourth situation d: normal users may forget to change their email client passwords after changing their email passwords, resulting in a single IP trying the same account with the same password and some failure records. The preset brute force cracking rules classify a, b and c as brute force cracking records, and d as non-brute force cracking records. When the brute force cracking record a, b or c exceeds the second threshold, the IP corresponding to the brute force cracking record a, b or c is marked as a brute force cracking IP list, so that all login IPs are analyzed according to the brute force cracking IP list, and the login record of the IP corresponding to the brute force cracking IP list is used as a new abnormal record to update the abnormal record obtained in step S104.

S103: According to the login time, the switching speed of the longitude and latitude of the area corresponding to each two adjacent login records is calculated in sequence, and suspicious login records are screened out according to a preset speed threshold.

Specifically, all login records are sorted according to the login time, and the switching speeds of the longitude and latitude of the areas corresponding to each two adjacent login records are calculated in turn. According to a preset speed threshold, two adjacent login records corresponding to a switching speed greater than the preset speed threshold are screened out as suspicious login records.

It should be noted that the preset speed threshold is the maximum reasonable moving speed. Preferably, the speed threshold is 800 km/h, that is, the average speed of an airplane. If the switching speed of the longitude and latitude of the area corresponding to two adjacent login records is greater than the speed threshold, the two login records are regarded as suspicious login records. The switching speed of the longitude and latitude of the area corresponding to two adjacent login records is obtained by the ratio of the geographical difference between the longitude and latitude and the time difference between the two logins.

S104: According to the trusted IP list and the standard user portrait, the suspicious login records are eliminated, and the suspicious login records after the elimination operation are used as abnormal records.

As a preferred solution of this embodiment, after removing the suspicious login records after the operation as abnormal records, it also includes: generating a first login record in response to the current user's email login operation, and judging whether the first login record is normal based on the trusted IP list and the standard user portrait; if the first login record is normal, saving the login record; if the first login record is abnormal, triggering two-factor authentication to enable the current user to confirm the login.

It should be noted that in response to the current user's email login operation, the first login record generated is the login record of the current user's email login operation. During the login process, the first login record will be judged whether it is normal based on the current user's trusted IP list and standard user portrait; if it is abnormal, it will trigger two-factor authentication. The two-factor authentication methods include but are not limited to mobile phone verification code and telephone voice verification.

As a preferred scheme of this embodiment, after generating a first login record in response to the current user's email login operation and judging whether the first login record is normal based on the trusted IP list and the standard user portrait, it also includes: recording the number of login records generated within a first preset time period, and if the number of generated login records is greater than a preset first threshold, banning the current user's email.

It should be noted that after each login operation, the number of login records generated within the first preset time period will be recorded and detected. The first preset time period and the preset first threshold are determined according to actual needs. If the number of login records generated within the first preset time period is greater than the preset first threshold, that is, there are multiple login records within the first preset time period, the current user's mailbox will be blocked until the current user uses two-factor authentication to retrieve and modify the password and is allowed to use the mailbox.

The implementation of the present invention has the following effects:

The embodiment of the present invention obtains all login records of the user mailbox, establishes a trusted IP list and a standard user portrait according to normal emails preset in the user mailbox, and iteratively calculates the trusted IP list by means of a reputation propagation graph, thereby improving the accuracy and credibility of the trusted IP list, and realizing the detection of mailbox login anomalies based on the user's mailbox usage habits, thereby improving the accuracy of login anomaly detection, and calculating the switching speed of the longitude and latitude of the area corresponding to two adjacent login records, thereby screening out suspicious login records, and eliminating the suspicious login records, thereby improving the user experience of using the mailbox and improving the accuracy of mailbox login anomaly detection.

Embodiment 2

Correspondingly, please refer to FIG. 6 , which shows that the present invention also provides a device for detecting abnormal mailbox login, including: a list portrait module 201 , a regional location module 202 , a suspicious login module 203 and an abnormal record module 204 .

The list portrait module 201 is used to obtain all login records of the user mailbox, and establish a trusted IP list and a standard user portrait based on normal emails preset in the user mailbox.

As a preferred solution of this embodiment, the method of obtaining all login records of the user mailbox and establishing a trusted IP list and a standard user portrait according to normal emails preset in the user mailbox is specifically as follows:

Obtain the number of unique senders corresponding to the IP addresses of all preset normal emails in the user's mailbox, use the IP addresses whose number of unique senders is greater than a third threshold as trusted IP seeds, and use the client IDs of all emails sent from the trusted IP addresses as a trusted ID list; wherein each login record also includes a client ID; based on the trusted IP seeds and the trusted ID list, use each of the trusted IP seeds as a vertex, and the weight of each vertex is the number of unique senders corresponding to each trusted IP seed, thereby constructing a reputation transmission graph, iteratively grow and propagate the reputation transmission graph until the number of iterations reaches a preset value, obtain the weight of each vertex after the iteration, and obtain the trusted IP list based on the weight of each vertex after the iteration; based on the trusted IP list, calculate and obtain a standard user portrait.

As a preferred solution of this embodiment, the standard user portrait is calculated based on the trusted IP, specifically:

Obtain all login records of the user's mailbox, and filter out login records that match the trusted IP list based on the trusted IP list; calculate the user's feature vector based on the login records that match the trusted IP list as a standard user portrait.

The regional location module 202 is used to obtain the longitude and latitude of the region corresponding to each login record according to the preset geographic information library of the login IP; wherein each login record includes a login IP and a login time.

As a preferred solution of this embodiment, after obtaining the longitude and latitude of the region corresponding to each login record according to the preset geographic information database of the login IP, the method further includes:

Obtain all failed login records within a second preset time period, and classify all the failed login records according to the preset brute force cracking rules to obtain brute force cracking records and non-brute force cracking records; if the brute force cracking record exceeds a preset second threshold, mark all login IPs in the brute force cracking record as a brute force cracking IP list; update the exception record according to the login record corresponding to the login IP that meets the brute force cracking IP list.

The suspicious login module 203 is used to calculate the switching speed of the longitude and latitude of the area corresponding to each two adjacent login records according to the login time, and filter out suspicious login records according to a preset speed threshold.

As a preferred solution of this embodiment, the switching speed of the longitude and latitude of the area corresponding to each two adjacent login records is calculated in sequence according to the login time, and suspicious login records are screened out according to a preset speed threshold, specifically:

According to the login time, all login records are sorted, and the switching speeds of the longitude and latitude of the areas corresponding to each two adjacent login records are calculated in turn, and according to a preset speed threshold, the two adjacent login records corresponding to the switching speed greater than the preset speed threshold are screened out as suspicious login records.

The abnormal record module 204 is used to remove the suspicious login records according to the trusted IP list and the standard user portrait, and use the suspicious login records after the removal operation as abnormal records.

As a preferred solution of this embodiment, after removing the suspicious login records after the operation as abnormal records, the method further includes:

In response to the current user's email login operation, a first login record is generated, and whether the first login record is normal is determined based on the trusted IP list and the standard user portrait; if the first login record is normal, the login record is saved; if the first login record is abnormal, two-factor authentication is triggered to enable the current user to confirm the login.

As a preferred solution of this embodiment, after generating a first login record in response to the mailbox login operation of the current user, and judging whether the first login record is normal according to the trusted IP list and the standard user portrait, the method further includes:

The number of login records generated within a first preset time period is recorded, and if the number of the generated login records is greater than a preset first threshold, the mailbox of the current user is blocked.

Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

Implementing the above embodiments has the following effects:

The embodiment of the present invention obtains all login records of the user mailbox, establishes a trusted IP list and a standard user portrait according to normal emails preset in the user mailbox, and iteratively calculates the trusted IP list by means of a reputation propagation graph, thereby improving the accuracy and credibility of the trusted IP list, and realizing the detection of mailbox login anomalies based on the user's mailbox usage habits, thereby improving the accuracy of login anomaly detection, and calculating the switching speed of the longitude and latitude of the area corresponding to two adjacent login records, thereby screening out suspicious login records, eliminating the suspicious login records, and detecting the login operation of the current user, and triggering two-factor authentication only when a suspicious login record occurs, thereby avoiding the situation in the prior art where two-factor authentication is required for each login, thereby reducing the user experience.

Embodiment 3

An embodiment of the present invention also provides a terminal device, which includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and the processor implements the method for detecting mailbox login anomalies described in any of the above embodiments when executing the computer program.

Preferably, the computer program can be divided into one or more modules/units (such as computer program, computer program), and the one or more modules/units are stored in the memory and executed by the processor to complete the present invention. The one or more modules/units can be a series of computer program instruction segments that can complete specific functions, and the instruction segments are used to describe the execution process of the computer program in the terminal device.

The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor, or the processor may be any conventional processor. The processor is the control center of the terminal device, and various parts of the terminal device are connected using various interfaces and lines.

The memory mainly includes a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function, etc., and the data storage area can store related data, etc. In addition, the memory can be a high-speed random access memory, or a non-volatile memory, such as a plug-in hard disk, a smart memory card (SmartMedia Card, SMC), a secure digital (Secure Digital, SD) card, and a flash card (Flash Card), etc., or the memory can also be other volatile solid-state storage devices.

It should be noted that the above-mentioned terminal device may include, but is not limited to, a processor and a memory. Those skilled in the art will understand that the above-mentioned terminal device is merely an example and does not constitute a limitation on the terminal device. It may include more or fewer components, or a combination of certain components, or different components.

Embodiment 4

An embodiment of the present invention also provides a computer-readable storage medium, which includes a stored computer program; wherein, when the computer program is running, it controls the device where the computer-readable storage medium is located to execute the method for monitoring mailbox login anomalies described in any of the above embodiments.

The specific embodiments described above further illustrate the purpose, technical solutions and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. It is particularly pointed out that for those skilled in the art, any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of protection of the present invention.

Claims (9)

1. A method for detecting abnormal mailbox login, characterized by comprising: Obtain all login records of the user's mailbox, and establish a trusted IP list and a standard user portrait based on the normal emails preset in the user's mailbox; obtain the number of unique senders corresponding to the IPs of all preset normal emails in the user's mailbox, use the IPs whose number of unique senders is greater than a third threshold as trusted IP seeds, and use the client IDs of all emails sent from the trusted IPs as a trusted ID list; wherein each login record also contains a client ID; based on the trusted IP seeds and the trusted ID list, use each trusted IP seed as a vertex, and the weight of each vertex is the number of unique senders corresponding to each trusted IP seed, thereby constructing a reputation transmission graph, iteratively growing and propagating the reputation transmission graph until the number of iterations reaches a preset value, obtain the weight of each vertex after the iteration, and obtain the trusted IP list based on the weight of each vertex after the iteration; calculate the standard user portrait based on the trusted IP list; According to the preset geographic information database of the login IP, the longitude and latitude of the region corresponding to each login record are obtained; wherein each login record includes a login IP and a login time; According to the login time, the switching speed of the longitude and latitude of the area corresponding to each two adjacent login records is calculated in sequence, and the suspicious login records are screened out according to a preset speed threshold; The suspicious login records are eliminated according to the trusted IP list and the standard user portrait, and the suspicious login records after the elimination operation are regarded as abnormal records. 2. A method for detecting abnormal mailbox login according to claim 1, characterized in that after removing the suspicious login records after the operation as abnormal records, it also includes: In response to the current user's mailbox login operation, generate a first login record, and determine whether the first login record is normal according to the trusted IP list and the standard user portrait; If the first login record is normal, save the login record; If the first login record is abnormal, two-factor authentication is triggered to enable the current user to confirm the login. 3. A method for detecting an abnormal mailbox login as claimed in claim 2, characterized in that after generating a first login record in response to the mailbox login operation of the current user, and judging whether the first login record is normal according to the trusted IP list and the standard user portrait, it further comprises: The number of login records generated within a first preset time period is recorded, and if the number of the generated login records is greater than a preset first threshold, the mailbox of the current user is blocked. 4. A method for detecting abnormal mailbox login according to claim 1, characterized in that after obtaining the longitude and latitude of the area corresponding to each login record from the preset geographic information database according to the login IP, it also includes: Obtaining all failed login records within a second preset time period, and classifying all failed login records according to a preset brute force cracking rule to obtain brute force cracking records and non-brute force cracking records; If the brute force cracking record exceeds a preset second threshold, all login IPs in the brute force cracking record are marked as a brute force cracking IP list; The exception record is updated according to the login record corresponding to the login IP that matches the brute force IP list. 5. A method for detecting abnormal mailbox login according to claim 1, characterized in that the standard user portrait is calculated based on the trusted IP, specifically: Obtain all login records of the user's mailbox, and filter out login records that match the trusted IP list according to the trusted IP list; Based on the login records that match the trusted IP list, a feature vector of the user is calculated as a standard user portrait. 6. A method for detecting abnormal mailbox login according to claim 1, characterized in that the switching speed of the longitude and latitude of the area corresponding to each two adjacent login records is calculated in sequence according to the login time, and suspicious login records are screened out according to a preset speed threshold, specifically: According to the login time, all login records are sorted, and the switching speeds of the longitude and latitude of the areas corresponding to each two adjacent login records are calculated in turn, and according to a preset speed threshold, the two adjacent login records corresponding to the switching speed greater than the preset speed threshold are screened out as suspicious login records. 7. A detection device for abnormal mailbox login, characterized by comprising: a list portrait module, a regional location module, a suspicious login module and an abnormal record module; The list portrait module is used to obtain all login records of the user's mailbox, and establish a trusted IP list and a standard user portrait based on the normal emails preset in the user's mailbox; obtain the number of unique senders corresponding to the IPs of all preset normal emails in the user's mailbox, use the IPs whose number of unique senders is greater than a third threshold as trusted IP seeds, and use the client IDs of all emails sent from the trusted IPs as a trusted ID list; wherein each login record also contains a client ID; based on the trusted IP seeds and the trusted ID list, use each of the trusted IP seeds as a vertex, and the weight of each vertex is the number of unique senders corresponding to each trusted IP seed, thereby constructing a reputation transmission graph, iteratively growing and propagating the reputation transmission graph until the number of iterations reaches a preset value, obtain the weight of each vertex after the iteration, and obtain the trusted IP list based on the weight of each vertex after the iteration; calculate the standard user portrait based on the trusted IP list; The regional location module is used to obtain the longitude and latitude of the region corresponding to each login record according to the preset geographic information database of the login IP; wherein each login record includes a login IP and a login time; The suspicious login module is used to calculate the switching speed of the longitude and latitude of the area corresponding to each two adjacent login records according to the login time, and filter out the suspicious login records according to a preset speed threshold; The abnormal record module is used to remove the suspicious login records according to the trusted IP list and the standard user portrait, and use the suspicious login records after the removal operation as abnormal records. 8. A terminal device, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor implements the mailbox login anomaly detection method according to any one of claims 1 to 6 when executing the computer program. 9. A computer-readable storage medium, characterized in that the computer-readable storage medium includes a stored computer program; wherein, when the computer program is running, it controls the device where the computer-readable storage medium is located to execute the mailbox login anomaly detection method according to any one of claims 1 to 6.