Browser authentication method and system based on user behaviors

Abstract

The invention discloses a browser authentication method and system based on user behaviors, and the method comprises the steps: collecting the historical use information of a user, and constructing a data operation library of the user based on the historical use information; obtaining current use information of the browser, and determining an identification state of a current user based on the current use information and the data operation library; marking the operation behavior related to the privacy of the user as a confidential operation, and setting a confidential level according to the importance of the confidential operation on the privacy of the user; setting a security level for the confidential operation according to the recognition state, and setting a security verification problem corresponding to the security level according to the user identity information; and performing security verification on the operation information in the current use information in combination with the security verification problem and the confidential operation to obtain a verification result of the user. According to the method, the privacy of the original user can be better guaranteed, unauthorized access is effectively prevented, the security of the system is improved, the possibility of invasion of malicious attackers is effectively reduced, and the level of protecting the privacy of the user is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of identity authentication, and more specifically, to a browser authentication method and system based on user behavior. Background Art

[0002] With the development of the Internet, more and more services and applications need to authenticate users. The invention patent application with application number CN202410497901X discloses a client authentication method based on browser fusion. The invention preprocesses and extracts features from the collected user behavior data, calculates the user feature vector based on failed authentication attempts, determines whether the user's authentication is passed by the calculated deviation degree coefficient, predicts unknown authentication based on the authentication security assessment coefficient, assesses whether there is a risk in the user's authentication security, and divides the user's authentication security risk into different levels, thereby providing risk warnings to users and taking corresponding risk response strategies for users with different risk levels. When obtaining the user's identity, the invention calculates the deviation degree coefficient by selecting failed authentication attempts and assesses the risk level for authentication. If a malicious attacker maliciously steals the authentication information, the system may not be able to effectively prevent the intrusion of malicious attackers and effectively protect user privacy. Summary of the invention

[0003] The present invention provides a browser authentication method and system based on user behavior to solve the problem of how to authenticate the identity of the user.

[0004] In order to solve the above problem, according to one aspect of the present invention, a browser authentication method based on user behavior is provided, the method comprising:

[0005] Collecting historical usage information of users, and building a data operation library of users based on the historical usage information;

[0006] Obtaining current usage information of the browser, and determining the identification status of the current user based on the current usage information and the data operation library;

[0007] Mark operations related to user privacy as confidential operations, and set confidentiality levels based on the importance of confidential operations to user privacy;

[0008] Set a security level for confidentiality operations based on the identification status, and set security verification questions corresponding to the security level based on the user identity information;

[0009] Combining security verification issues with confidentiality operations, security verification is performed on the operation information in the current usage information to obtain the user's verification result.

[0010] Preferably, the step of constructing a user's data operation library based on the historical usage information includes:

[0011] The first key behavior feature is extracted based on the historical usage information, and a proportional coefficient corresponding to each first key behavior feature is set to build a user data operation library based on the first key behavior feature and the proportional coefficient; wherein the sum of the proportional coefficients corresponding to all first key behavior features is 1.

[0012] Preferably, the determining the identification status of the current user based on the current usage information and the data operation library comprises:

[0013] Extracting a second key behavior feature based on the current usage information, and comparing the second key behavior feature with the first key behavior feature, determining a proportional coefficient corresponding to the key behavior feature with successful comparison as a success proportional coefficient, and determining a proportional coefficient corresponding to the key behavior feature with failed comparison as a failure proportional coefficient;

[0014] Calculate the ratio of the sum of the success ratio coefficients to the sum of the failure ratio coefficients to determine the comparison coefficient;

[0015] The comparison coefficient is compared with a preset comparison coefficient threshold, and the recognition status of the current user is determined according to the comparison result.

[0016] Preferably, the step of comparing the comparison coefficient with a preset comparison coefficient threshold and determining the recognition status of the current user according to the comparison result comprises:

[0017] Determine whether the comparison coefficient satisfies a first comparison coefficient threshold value or more; if so, mark the recognition status of the current user as a compliant status; otherwise, determine whether the comparison coefficient satisfies a second preset comparison coefficient threshold value or more; if so, mark the recognition status of the current user as a sub-compliant status; otherwise, mark the recognition status of the current user as a non-compliant status.

[0018] Preferably, setting a security level for the confidentiality operation according to the identification status includes:

[0019] Extract the confidentiality level corresponding to the confidentiality operation; the confidentiality level includes three levels: A, B, and C;

[0020] The recognition level of the conforming state in the recognition state is marked as level 1, the recognition level of the sub-conforming state is marked as level 2, and the recognition level of the non-conforming state is marked as level 3;

[0021] A security level is obtained based on the identification level and the confidentiality level; the security levels include: A1, A2, A3, B1, B2, B3, C1, C2 and C3.

[0022] Preferably, the security verification questions corresponding to the security level are set according to the user identity information, including:

[0023] Extract user identity information; wherein the user identity information includes: user name, bound mobile phone number, bound personal information and account password;

[0024] The sub-data in the user identity information is evaluated to obtain an evaluation result, and the sub-data is arranged and combined according to the evaluation result and matched one-to-one with the security level to obtain a security verification answer, and a security verification question is set according to the security verification answer.

[0025] Preferably, evaluating the sub-data in the user identity information to obtain an evaluation result includes:

[0026] Extract sub-data from user identity information;

[0027] Count the occurrence frequency of each sub-data in the historical usage data, and mark the occurrence frequency of each sub-data as Pi, where i is the number of the sub-data;

[0028] By formula The entropy HXi of the sub-data numbered i is calculated, and the entropy of the sub-data is used as the evaluation result of the sub-data; wherein n is the number of sub-data.

[0029] Preferably, the step of arranging and combining the sub-data according to the evaluation results and making one-to-one correspondence with the security levels to obtain a security verification answer includes:

[0030] Extract the evaluation results and security levels of sub-data;

[0031] According to the size of the evaluation results, the sub-data are sorted from large to small, and sorted in pairs in order of size to obtain a double answer sequence. Each sub-data is combined to obtain a single answer sequence. The single answer sequence is combined with the double answer sequence to obtain an answer sequence. The answer sequence is matched with the security level in order of size to obtain an answer sequence corresponding to the security level. The answer sequence corresponding to the security level is marked as a security verification answer.

[0032] Preferably, the step of combining the security verification question with the confidentiality operation to perform security verification on the operation information in the current usage information to obtain the user's verification result includes:

[0033] Extracting operation information and confidentiality operations from current usage information;

[0034] Determine whether the operation information is the same as the confidential operation; if yes, provide corresponding identity verification questions according to the corresponding security level of the confidential operation, and the user needs to answer the identity verification questions; if no, do not provide identity verification questions, but continue to compare to obtain the user's identification status;

[0035] Setting an error count threshold; the error count threshold is a manually set number of allowed incorrect answers to identity verification questions;

[0036] Determine whether the user's answer to the identity verification question is correct; if yes, open the confidentiality operation permission for the current user; if no, increase the number of wrong answers by one;

[0037] When the number of incorrect responses of a user is equal to the error number threshold, the identity authentication question interface is closed, the current user is marked as an abnormal user, and the permission to use all confidential operations is closed.

[0038] According to another aspect of the present invention, there is provided a browser authentication system based on user behavior, the system comprising:

[0039] A data operation library construction unit, used to collect historical usage information of a user and construct a data operation library of the user based on the historical usage information;

[0040] an identification state determination unit, configured to obtain current usage information of the browser, and determine the identification state of the current user based on the current usage information and a data operation library;

[0041] A confidentiality level setting unit, used to mark an operation behavior related to user privacy as a confidentiality operation, and set a confidentiality level according to the importance of the confidentiality operation to the user privacy;

[0042] A verification question setting unit, used to set a security level for the confidentiality operation according to the identification state, and to set a security verification question corresponding to the security level according to the user identity information;

[0043] The verification unit is used to perform security verification on the operation information in the current usage information in combination with the security verification problem and the confidentiality operation to obtain the user's verification result.

[0044] Preferably, the data operation library construction unit constructs the user's data operation library based on the historical usage information, including:

[0045] The first key behavior feature is extracted based on the historical usage information, and a proportional coefficient corresponding to each first key behavior feature is set to build a user data operation library based on the first key behavior feature and the proportional coefficient; wherein the sum of the proportional coefficients corresponding to all first key behavior features is 1.

[0046] Preferably, the recognition state determining unit determines the recognition state of the current user based on the current usage information and the data operation library, including:

[0047] Extracting a second key behavior feature based on the current usage information, and comparing the second key behavior feature with the first key behavior feature, determining a proportional coefficient corresponding to the key behavior feature with successful comparison as a success proportional coefficient, and determining a proportional coefficient corresponding to the key behavior feature with failed comparison as a failure proportional coefficient;

[0048] Calculate the ratio of the sum of the success ratio coefficients to the sum of the failure ratio coefficients to determine the comparison coefficient;

[0049] The comparison coefficient is compared with a preset comparison coefficient threshold, and the recognition status of the current user is determined according to the comparison result.

[0050] Preferably, the recognition status determination unit compares the comparison coefficient with a preset comparison coefficient threshold, and determines the recognition status of the current user according to the comparison result, including:

[0051] Determine whether the comparison coefficient satisfies a first comparison coefficient threshold value or more; if so, mark the recognition status of the current user as a compliant status; otherwise, determine whether the comparison coefficient satisfies a second preset comparison coefficient threshold value or more; if so, mark the recognition status of the current user as a sub-compliant status; otherwise, mark the recognition status of the current user as a non-compliant status.

[0052] Preferably, the verification question setting unit sets a security level for the confidentiality operation according to the identification state, including:

[0053] Extract the confidentiality level corresponding to the confidentiality operation; the confidentiality level includes three levels: A, B, and C;

[0054] The recognition level of the conforming state in the recognition state is marked as level 1, the recognition level of the sub-conforming state is marked as level 2, and the recognition level of the non-conforming state is marked as level 3;

[0055] A security level is obtained based on the identification level and the confidentiality level; the security levels include: A1, A2, A3, B1, B2, B3, C1, C2 and C3.

[0056] Preferably, the verification question setting unit sets the security verification question corresponding to the security level according to the user identity information, including:

[0057] Extract user identity information; wherein the user identity information includes: user name, bound mobile phone number, bound personal information and account password;

[0058] The sub-data in the user identity information is evaluated to obtain an evaluation result, and the sub-data is arranged and combined according to the evaluation result and matched one-to-one with the security level to obtain a security verification answer, and a security verification question is set according to the security verification answer.

[0059] Preferably, the verification question setting unit evaluates the sub-data in the user identity information to obtain an evaluation result, including:

[0060] Extract sub-data from user identity information;

[0061] Count the occurrence frequency of each sub-data in the historical usage data, and mark the occurrence frequency of each sub-data as Pi, where i is the number of the sub-data;

[0062] By formula The entropy HXi of the sub-data numbered i is calculated, and the entropy of the sub-data is used as the evaluation result of the sub-data; wherein n is the number of sub-data.

[0063] Preferably, the verification question setting unit arranges and combines the sub-data according to the evaluation result and makes a one-to-one correspondence with the security level to obtain a security verification answer, including:

[0064] Extract the evaluation results and security levels of sub-data;

[0065] According to the size of the evaluation results, the sub-data are sorted from large to small, and sorted in pairs in order of size to obtain a double answer sequence. Each sub-data is combined to obtain a single answer sequence. The single answer sequence is combined with the double answer sequence to obtain an answer sequence. The answer sequence is matched with the security level in order of size to obtain an answer sequence corresponding to the security level. The answer sequence corresponding to the security level is marked as a security verification answer.

[0066] Preferably, the verification unit performs security verification on the operation information in the current usage information in combination with the security verification question and the confidentiality operation to obtain the user's verification result, including:

[0067] Extracting operation information and confidentiality operations from current usage information;

[0068] Determine whether the operation information is the same as the confidential operation; if yes, provide corresponding identity verification questions according to the corresponding security level of the confidential operation, and the user needs to answer the identity verification questions; if no, do not provide identity verification questions, but continue to compare to obtain the user's identification status;

[0069] Setting an error count threshold; the error count threshold is a manually set number of allowed incorrect answers to identity verification questions;

[0070] Determine whether the user's answer to the identity verification question is correct; if yes, open the confidentiality operation permission for the current user; if no, increase the number of wrong answers by one;

[0071] When the number of incorrect responses of a user is equal to the error number threshold, the identity authentication question interface is closed, the current user is marked as an abnormal user, and the permission to use all confidential operations is closed.

[0072] According to another aspect of the present invention, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any step of a browser authentication method based on user behavior.

[0073] According to another aspect of the present invention, the present invention provides an electronic device, including:

[0074] The computer-readable storage medium described above; and

[0075] One or more processors are used to execute the program in the computer-readable storage medium.

[0076] The present invention provides a browser authentication method and system based on user behavior, including: collecting historical usage information of users, and building a data operation library of users based on the historical usage information; obtaining current usage information of the browser, and determining the identification status of the current user based on the current usage information and the data operation library; marking operation behaviors related to user privacy as confidentiality operations, and setting confidentiality levels according to the importance of confidentiality operations to user privacy; setting security levels for confidentiality operations according to the identification status, and setting security verification questions corresponding to the security levels according to user identity information; and performing security verification on operation information in the current usage information in combination with security verification questions and confidentiality operations to obtain the user's verification result. The present invention can better protect the privacy of the original user, can effectively prevent unauthorized access, increase the security of the system, effectively reduce the possibility of malicious attackers intruding, and improve the level of protecting user privacy. BRIEF DESCRIPTION OF THE DRAWINGS

[0077] A more complete understanding of exemplary embodiments of the present invention may be obtained by referring to the following drawings:

[0078] Figure 1 is a flowchart of a browser authentication method 100 based on user behavior according to an embodiment of the present invention;

[0079] Figure 2 A flowchart of determining a user's identification status according to an embodiment of the present invention;

[0080] Figure 3 Schematic diagram of the structure of a browser authentication system 300 based on user behavior according to an embodiment of the present invention. DETAILED DESCRIPTION

[0081] Now, exemplary embodiments of the present invention are described with reference to the accompanying drawings. However, the present invention can be implemented in many different forms and is not limited to the embodiments described herein. These embodiments are provided to disclose the present invention in detail and completely and to fully convey the scope of the present invention to those skilled in the art. The terms used in the exemplary embodiments shown in the accompanying drawings are not intended to limit the present invention. In the accompanying drawings, the same units / elements are marked with the same reference numerals.

[0082] Unless otherwise specified, the terms (including technical terms) used herein have the commonly understood meanings to those skilled in the art. In addition, it is understood that the terms defined in commonly used dictionaries should be understood to have the same meanings as those in the context of the relevant fields, and should not be understood as idealized or overly formal meanings.

[0083] The purpose of the present invention is to provide a browser authentication method and system based on user behavior, by collecting the historical usage information and user identity information of the original user, and detecting and collecting the current usage information of the current user in real time; extracting key behavior features after preprocessing the historical usage information and constructing an operation database, setting proportional coefficients for the key behavior features respectively, comparing the current usage information with the operation database, obtaining a comparison coefficient according to the comparison result and the proportional coefficient, comparing the comparison coefficient with a preset comparison threshold, and obtaining the recognition state of the current user; marking the operation related to the user privacy in the browser as a confidential operation, and setting a corresponding confidentiality level, combining the recognition state with the security level corresponding to the confidentiality level, evaluating the sub-data in the user identity information, arranging and combining the sub-data according to the evaluation result, and corresponding to the security level to obtain a security verification answer and a corresponding security verification question, effectively reducing the possibility of intrusion by malicious attackers, improving the level of protecting user privacy, and solving the problem that the user privacy cannot be effectively protected in the prior art due to the relatively single identity authentication method when there is a malicious attack on the identity authentication information technology.

[0084] Figure 1 FIG. 1 is a flow chart of a browser authentication method 100 based on user behavior according to an embodiment of the present invention. Figure 1 As shown, the browser authentication method based on user behavior provided by the embodiment of the present invention can better protect the privacy of the original user, effectively prevent unauthorized access, increase the security of the system, effectively reduce the possibility of intrusion by malicious attackers, and improve the level of protection of user privacy. The browser authentication method based on user behavior provided by the embodiment of the present invention 100 starts from step 101. In step 101, historical usage information of the user is collected, and a data operation library of the user is constructed based on the historical usage information.

[0085] Preferably, the step of constructing a user's data operation library based on the historical usage information includes:

[0086] The first key behavior feature is extracted based on the historical usage information, and a proportional coefficient corresponding to each first key behavior feature is set to build a user data operation library based on the first key behavior feature and the proportional coefficient; wherein the sum of the proportional coefficients corresponding to all first key behavior features is 1.

[0087] In the present invention, it is necessary to collect the user's historical usage information and current usage information.

[0088] Exemplarily, an identity registration form is created on the registration interface, and the original user fills in the user identity information, including the user name, bound mobile phone number, bound personal information and account password when registering. After the original user completes and submits the form, the identity registration form is stored in the browser client; the user's historical usage information is recorded during the use of the browser, including historical browsing records and historical operation records; during the current use process, the current user's current usage information is monitored and recorded in real time, including the current browsing records and current operations.

[0089] After obtaining the historical usage information, the user's operation database is constructed according to the historical usage information. Specifically, constructing the operation database includes: extracting the historical usage information; the historical usage information includes historical browsing records and historical operation records; preprocessing the historical usage information to obtain historical usage data; constructing an initial operation library, extracting key behavior features from the historical usage data, and storing the key behavior features in the initial operation library to obtain the operation database.

[0090] Preferably, the historical usage information is preprocessed to obtain historical usage data, including: extracting the historical usage information; sequentially performing data cleaning, outlier detection and elimination, and data standardization on the historical usage information, converting the data into a unified format, and marking the preprocessed historical usage information as historical usage data.

[0091] Exemplarily, the extracted historical usage information is sequentially subjected to data cleaning, outlier detection and elimination, and data standardization processing, the data in the historical usage information is standardized into a unified format, and the pre-processed historical usage information is marked as historical usage data; an initial operation library is constructed to extract key behavioral features in the historical usage data, and the key behavioral features may include behavioral features such as search keywords, login time points, dwell time on different types of pages, and customary operation sequence; the key behavioral features are stored in the initial operation library to obtain an operation database. In this embodiment, four key behavioral features are extracted, namely, search keywords, login time points, dwell time on different types of pages, and customary operation sequence.

[0092] It should be noted that the key behavioral features in the operation database refer to several major categories of behavioral features, which can be specifically divided into many detailed behavioral features. For example, the habitual operation sequence can specifically include the order of clicking pages, typing speed, typing habits and frequently viewed pages, etc., and can be specifically set according to the original user's operating habits.

[0093] In step 102, current usage information of the browser is obtained, and the identification status of the current user is determined based on the current usage information and a data operation library.

[0094] Preferably, the determining the identification status of the current user based on the current usage information and the data operation library comprises:

[0095] Extracting a second key behavior feature based on the current usage information, and comparing the second key behavior feature with the first key behavior feature, determining a proportional coefficient corresponding to the key behavior feature with successful comparison as a success proportional coefficient, and determining a proportional coefficient corresponding to the key behavior feature with failed comparison as a failure proportional coefficient;

[0096] Calculate the ratio of the sum of the success ratio coefficients to the sum of the failure ratio coefficients to determine the comparison coefficient;

[0097] The comparison coefficient is compared with a preset comparison coefficient threshold, and the recognition status of the current user is determined according to the comparison result.

[0098] Preferably, the step of comparing the comparison coefficient with a preset comparison coefficient threshold and determining the recognition status of the current user according to the comparison result comprises:

[0099] Determine whether the comparison coefficient satisfies a first comparison coefficient threshold value or more; if so, mark the recognition status of the current user as a compliant status; otherwise, determine whether the comparison coefficient satisfies a second preset comparison coefficient threshold value or more; if so, mark the recognition status of the current user as a sub-compliant status; otherwise, mark the recognition status of the current user as a non-compliant status.

[0100] Combination Figure 2 As shown, in the present invention, current usage information is collected and compared with the operation database to obtain the identification status. Specifically, it includes:

[0101] A1: Extract the operation database and current usage information; assign a proportional coefficient to each key behavior feature in the operation database, add up all proportional coefficients to one, and compare the current usage information with the operation database one by one; mark the proportional coefficient corresponding to the key behavior feature that is successfully compared as the successful proportional coefficient, and mark the proportional coefficient corresponding to the key behavior feature that is not successfully compared as the failed proportional coefficient;

[0102] A2: marking the ratio of the sum of the success ratio coefficients to the sum of the failure ratio coefficients as a comparison coefficient; setting a comparison threshold; the comparison threshold is set according to the comparison coefficient for determining whether the user's behavior habits conform to the historical behavior habits; the comparison threshold includes a first preset comparison coefficient threshold and a second preset comparison coefficient threshold;

[0103] A3: Determine whether the comparison coefficient is greater than or equal to a first preset comparison coefficient threshold; if yes, mark the recognition status of the current user as a compliance status; if no, jump to A4;

[0104] A4: Determine whether the comparison coefficient is greater than or equal to a second preset comparison coefficient threshold; if yes, mark the recognition status of the current user as a sub-compliant state; if no, mark the recognition status of the current user as a non-compliant state.

[0105] Exemplarily, in the present invention, the proportional coefficient assigned to the search keyword is 0.2, the proportional coefficient of the login time point is 0.2, the proportional coefficient of the residence time of different types of pages is 0.2, and the proportional coefficient of the habitual operation sequence is 0.4; the current usage information is compared with the operation database, and the specific process of the comparison is to determine whether the sub-data in the current usage information is the same as the corresponding sub-data in the operation database, or the proportion of the corresponding sub-data in the operation database is larger. If the comparison result is the same or the proportion is larger, then the comparison can be considered successful; in this embodiment, the comparison result of the login time point and the habitual operation sequence is a successful comparison, and the comparison result of the search keyword and the residence time of different types of liquid levels is a failed comparison. Then the proportional coefficient of the login time point and the habitual operation sequence is the success proportional coefficient, and the proportional coefficient of the search keyword and the residence time of different types of liquid levels is the failure proportional coefficient.

[0106] The comparison coefficient obtained by the present invention is 2 / 3. This embodiment sets the first preset comparison coefficient threshold to 3 / 2, and the second comparison threshold to 1 / 4; judge whether the comparison coefficient is greater than or equal to the first preset comparison coefficient threshold. If the comparison coefficient is less than the first preset comparison coefficient threshold, then continue to judge whether the comparison coefficient is greater than or equal to the second preset comparison coefficient threshold. If the comparison coefficient is greater than the first preset comparison coefficient threshold, the current user's recognition status is marked as a sub-compliant state.

[0107] In step 103, the operation behavior related to the user privacy is marked as a confidentiality operation, and a confidentiality level is set according to the importance of the confidentiality operation to the user privacy.

[0108] In step 104, a security level is set for the confidentiality operation according to the identification status, and a security verification question corresponding to the security level is set according to the user identity information.

[0109] Preferably, setting a security level for the confidentiality operation according to the identification status includes:

[0110] Extract the confidentiality level corresponding to the confidentiality operation; the confidentiality level includes three levels: A, B, and C;

[0111] The recognition level of the conforming state in the recognition state is marked as level 1, the recognition level of the sub-conforming state is marked as level 2, and the recognition level of the non-conforming state is marked as level 3;

[0112] A security level is obtained based on the identification level and the confidentiality level; the security levels include: A1, A2, A3, B1, B2, B3, C1, C2 and C3.

[0113] Preferably, the security verification questions corresponding to the security level are set according to the user identity information, including:

[0114] Extract user identity information; wherein the user identity information includes: user name, bound mobile phone number, bound personal information and account password;

[0115] The sub-data in the user identity information is evaluated to obtain an evaluation result, and the sub-data is arranged and combined according to the evaluation result and matched one-to-one with the security level to obtain a security verification answer, and a security verification question is set according to the security verification answer.

[0116] Preferably, evaluating the sub-data in the user identity information to obtain an evaluation result includes:

[0117] Extract sub-data from user identity information;

[0118] Count the occurrence frequency of each sub-data in the historical usage data, and mark the occurrence frequency of each sub-data as Pi, where i is the number of the sub-data;

[0119] By formula The entropy HXi of the sub-data numbered i is calculated, and the entropy of the sub-data is used as the evaluation result of the sub-data; wherein n is the number of sub-data.

[0120] Preferably, the step of arranging and combining the sub-data according to the evaluation results and making one-to-one correspondence with the security levels to obtain a security verification answer includes:

[0121] Extract the evaluation results and security levels of sub-data;

[0122] According to the size of the evaluation results, the sub-data are sorted from large to small, and sorted in pairs in order of size to obtain a double answer sequence. Each sub-data is combined to obtain a single answer sequence. The single answer sequence is combined with the double answer sequence to obtain an answer sequence. The answer sequence is matched with the security level in order of size to obtain an answer sequence corresponding to the security level. The answer sequence corresponding to the security level is marked as a security verification answer.

[0123] In step 105, security verification is performed on the operation information in the current usage information in combination with the security verification question and the confidentiality operation to obtain the user's verification result.

[0124] Preferably, the step of combining the security verification question with the confidentiality operation to perform security verification on the operation information in the current usage information to obtain the user's verification result includes:

[0125] Extracting operation information and confidentiality operations from current usage information;

[0126] Determine whether the operation information is the same as the confidential operation; if yes, provide corresponding identity verification questions according to the corresponding security level of the confidential operation, and the user needs to answer the identity verification questions; if no, do not provide identity verification questions, but continue to compare to obtain the user's identification status;

[0127] Setting an error count threshold; the error count threshold is a manually set number of allowed incorrect answers to identity verification questions;

[0128] Determine whether the user's answer to the identity verification question is correct; if yes, open the confidentiality operation permission for the current user; if no, increase the number of wrong answers by one;

[0129] When the number of incorrect responses of a user is equal to the error number threshold, the identity authentication question interface is closed, the current user is marked as an abnormal user, and the permission to use all confidential operations is closed.

[0130] In the present invention, based on the security verification module, operation behaviors related to user privacy are marked as confidential operations, and the confidentiality level is set according to the importance of the confidentiality operation to the user privacy; the security level is set for the confidentiality operation according to the identification status; the security verification questions corresponding to the security level are set according to the user identity information; and the operation information in the current usage information is security verified in combination with the security verification questions and the confidentiality operation to obtain the user's verification result.

[0131] Among them, setting a security level for a confidentiality operation according to the identification status includes: extracting the confidentiality level corresponding to the identification status and the confidentiality operation; the confidentiality level includes three levels: A, B, and C; marking the identification level of the compliant state in the identification status as level 1, marking the identification level of the sub-compliant state as level 2, and marking the identification level of the non-compliant state as level 3; combining the identification level with the confidentiality level to obtain the security level; the security levels include A1, A2, A3, B1, B2, B3, C1, C2, and C3.

[0132] Among them, the security verification questions corresponding to the security level are set according to the user identity information, including:

[0133] Extract user identity information; the user identity information includes user name, bound mobile phone number, bound personal information and account password;

[0134] The sub-data in the user identity information is evaluated to obtain an evaluation result, and the sub-data is arranged and combined according to the evaluation result and matched one-to-one with the security level to obtain a security verification answer, and a security verification question is set according to the security verification answer.

[0135] The sub-data in the user identity information is evaluated to obtain an evaluation result, including:

[0136] Extract sub-data from user identity information;

[0137] Count the occurrence frequency of each sub-data in the historical usage data, and mark the occurrence frequency of each sub-data as Pi, where i is the number of the sub-data;

[0138] By formula The entropy HXi of the sub-data numbered i is calculated, and the entropy of the sub-data is used as the evaluation result of the sub-data.

[0139] Among them, according to the evaluation results, the sub-data are arranged and combined and matched one by one with the security level to obtain the security verification answer, including:

[0140] Extract the evaluation results and security levels of sub-data;

[0141] According to the size of the evaluation results, the sub-data are sorted from large to small, and sorted in pairs in order of size to obtain a double answer sequence. Each sub-data is combined to obtain a single answer sequence. The single answer sequence is combined with the double answer sequence to obtain an answer sequence. The answer sequence is matched with the security level in order of size to obtain an answer sequence corresponding to the security level. The answer sequence corresponding to the security level is marked as a security verification answer.

[0142] Among them, combining the security verification problem with the confidentiality operation to perform security verification on the operation information in the current usage information to obtain the user's verification result, including:

[0143] Extracting operation information and confidentiality operations from current usage information;

[0144] Determine whether the operation information is the same as the confidential operation; if yes, provide corresponding identity verification questions according to the corresponding security level of the confidential operation, and the user needs to answer the identity verification questions; if no, do not provide identity verification questions, but continue to compare to obtain the user's identification status;

[0145] Setting an error count threshold; the error count threshold is a manually set number of allowed incorrect answers to identity verification questions;

[0146] Determine whether the user's answer to the identity verification question is correct; if yes, open the confidentiality operation permission for the current user; if no, increase the number of wrong answers by one;

[0147] When the number of incorrect responses of a user is equal to the error number threshold, the identity authentication question interface is closed, the current user is marked as an abnormal user, and the permission to use all confidential operations is closed.

[0148] Exemplarily, the identification level of the compliant state in the identification status is marked as level 1, the identification level of the sub-compliant state is marked as level 2, and the identification level of the non-compliant state is marked as level 3; the confidentiality levels are A, B, and C respectively. Combining the confidentiality level and the identification level, a total of nine security levels are obtained, including A1, A2, A3, B1, B2, B3, C1, C2 and C3.

[0149] By counting the frequency of occurrence of sub-data in each user identity information in the historical usage data, we can get the frequency of user name as 15%, the number of user name is one, the frequency of bound mobile phone number is 30%, the number of bound mobile phone number is two, the frequency of bound personal information is 10%, the number of bound personal information is three, the frequency of account password is 45%, the number of account password is four, then through the formula The entropy of user name numbered 1 is calculated to be HX1=0.41, the entropy of mobile phone number numbered 2 is calculated to be HX2=0.52, the entropy of personal information numbered 3 is calculated to be HX3=0.33, and the entropy of account password numbered 4 is calculated to be HX4=0.67. The entropy of all sub-data is used as the evaluation result of the sub-data.

[0150] The sub-data are sorted according to the size of the entropy in the evaluation result, and four is greater than two, greater than one, greater than three. They are combined in pairs in the order of numbering, and the double answer sequences are four two, four one, four three, two one, two three and one three. The single answer sequence is four, two, one and three. The single answer sequence is combined with the double answer sequence to obtain the answer sequence. The answer sequence is matched with the security level in order of size to obtain the answer sequence corresponding to the security level. In this embodiment, the answer sequences corresponding to the security levels are A1 corresponding to four, A2 corresponding to two, A3 corresponding to one, B1 corresponding to three, B2 corresponding to four two, B3 corresponding to four one, C1 corresponding to four three, C2 corresponding to two one, and C3 corresponding to two three.

[0151] It should be noted that the number of security levels set in the present invention is limited, and more security levels can be obtained by setting more confidentiality levels. More combinations can also be made by sorting the sub-data, such as a three-answer sequence or more obtained by a three-by-three combination.

[0152] The security verification answers obtained are all set with corresponding security verification questions. For example, the corresponding number for A1 is four, and the answer to the security verification is the account number and password. Then the corresponding security verification is what is the account number and password, and so on. If it is a double-answer sequence, two corresponding security verification questions are set. For example, the corresponding number for B2 is four and two, and the answer to the security verification is the account number and password and the bound mobile phone number. Then the corresponding security verification questions are what is the account number and password and mobile phone number verification.

[0153] For different users, a more personalized security level can be obtained by combining the confidentiality level, reducing unnecessary verification steps while ensuring security and improving user experience. Customized security strategies can provide more personalized protection measures, making the system more personalized and user-friendly while ensuring security.

[0154] The operation information of the current user is detected in real time to determine whether the operation information is the same as the confidentiality operation. If it is determined that the current user is operating an A2-level confidentiality operation, the identity authentication interface is displayed to verify the bound mobile phone number. In this embodiment, the error number threshold is set to three times to determine whether the user's reply to the identity authentication question is correct. If the user's first reply to the identity authentication question is incorrect and the second reply to the identity authentication question is correct, and the number of incorrect replies is one, the user's identity authentication is passed and the A2-level confidentiality operation permission is opened.

[0155] In another embodiment, if the user responds incorrectly three times, the identity verification question interface is closed, the current user is marked as an abnormal user, and the user's access to all confidential operations is closed. The user must answer all security verification questions to unlock the abnormal user identity.

[0156] The present invention collects historical usage information, user identity information and current usage information, and extracts key behavior features in the historical usage information for constructing an operation database. Through an in-depth understanding of user behavior, it can better balance privacy protection and functional practicality, and use the operation database as a comparison template with the current operation information to make it more accurate to distinguish between the current user and the original user; the current usage information is compared with the operation database to obtain the identification status, and it is determined whether the current usage information conforms to the usage habits of the original user, which can effectively identify abnormal behavior and enhance the security of the system; the operation behavior related to the user's privacy is marked as a confidential operation, and a corresponding confidentiality level is set. The security level of the confidential operation for the current user is obtained by combining the identification status and the confidentiality level. Different security levels are set according to different users, which can better To protect the privacy information of users, customized security policies can provide more personalized protection measures according to the behavior patterns and privacy needs of different users. By providing users with appropriate security levels, unnecessary verification steps can be reduced while ensuring security, thereby improving user experience. Security verification questions corresponding to the security level are set according to user identity information, and the difficulty of security verification questions is dynamically adjusted according to user usage and security level. If the current user is performing confidential operations, a security verification interface will pop up to verify the user's identity through security verification questions. If the verification passes, the confidential operation permission will be opened. If the verification fails, the current user will be marked as an abnormal user, and all confidential operation permissions will be closed, which can better protect the privacy of the original user, effectively prevent unauthorized access, and increase the security of the system.

[0157] The present invention obtains the recognition status of the current user by comparing the current usage information with the operation database, assigns a proportional coefficient to the key behavior features in the operation database, obtains a comparison coefficient based on the comparison result, and compares the comparison coefficient with the set comparison threshold. This can make the recognition status obtained by comparison more accurate, reduce misjudgment, and improve recognition accuracy.

[0158] Figure 3 FIG. 3 is a schematic diagram of a browser authentication system 300 based on user behavior according to an embodiment of the present invention. Figure 3 As shown, the browser authentication system 300 based on user behavior provided by the embodiment of the present invention includes: a data operation library construction unit 301, an identification state determination unit 302, a confidentiality level setting unit 303, a verification question setting unit 304 and a verification unit 305.

[0159] Preferably, the data operation library construction unit 301 is used to collect historical usage information of the user and construct the data operation library of the user based on the historical usage information.

[0160] Preferably, the data operation library construction unit 301 constructs the user's data operation library based on the historical usage information, including:

[0161] The first key behavior feature is extracted based on the historical usage information, and a proportional coefficient corresponding to each first key behavior feature is set to build a user data operation library based on the first key behavior feature and the proportional coefficient; wherein the sum of the proportional coefficients corresponding to all first key behavior features is 1.

[0162] Preferably, the recognition state determining unit 302 is used to obtain current usage information of the browser, and determine the recognition state of the current user based on the current usage information and a data operation library.

[0163] Preferably, the recognition state determining unit 302 determines the recognition state of the current user based on the current usage information and the data operation library, including:

[0164] Extracting a second key behavior feature based on the current usage information, and comparing the second key behavior feature with the first key behavior feature, determining a proportional coefficient corresponding to the key behavior feature with successful comparison as a success proportional coefficient, and determining a proportional coefficient corresponding to the key behavior feature with failed comparison as a failure proportional coefficient;

[0165] Calculate the ratio of the sum of the success ratio coefficients to the sum of the failure ratio coefficients to determine the comparison coefficient;

[0166] The comparison coefficient is compared with a preset comparison coefficient threshold, and the recognition status of the current user is determined according to the comparison result.

[0167] Preferably, the recognition state determination unit 302 compares the comparison coefficient with a preset comparison coefficient threshold, and determines the recognition state of the current user according to the comparison result, including:

[0168] Determine whether the comparison coefficient satisfies a first comparison coefficient threshold value or more; if so, mark the recognition status of the current user as a compliant status; otherwise, determine whether the comparison coefficient satisfies a second preset comparison coefficient threshold value or more; if so, mark the recognition status of the current user as a sub-compliant status; otherwise, mark the recognition status of the current user as a non-compliant status.

[0169] Preferably, the confidentiality level setting unit 303 is used to mark the operation behavior related to the user privacy as a confidentiality operation, and set the confidentiality level according to the importance of the confidentiality operation to the user privacy.

[0170] Preferably, the verification question setting unit 304 is used to set a security level for the confidentiality operation according to the identification status, and to set a security verification question corresponding to the security level according to the user identity information.

[0171] Preferably, the verification question setting unit 304 sets a security level for the confidentiality operation according to the identification state, including:

[0172] Extract the confidentiality level corresponding to the confidentiality operation; the confidentiality level includes three levels: A, B, and C;

[0173] The recognition level of the conforming state in the recognition state is marked as level 1, the recognition level of the sub-conforming state is marked as level 2, and the recognition level of the non-conforming state is marked as level 3;

[0174] A security level is obtained based on the identification level and the confidentiality level; the security levels include: A1, A2, A3, B1, B2, B3, C1, C2 and C3.

[0175] Preferably, the verification question setting unit 304 sets the security verification question corresponding to the security level according to the user identity information, including:

[0176] Extract user identity information; wherein the user identity information includes: user name, bound mobile phone number, bound personal information and account password;

[0177] The sub-data in the user identity information is evaluated to obtain an evaluation result, and the sub-data is arranged and combined according to the evaluation result and matched one-to-one with the security level to obtain a security verification answer, and a security verification question is set according to the security verification answer.

[0178] Preferably, the verification question setting unit 304 evaluates the sub-data in the user identity information to obtain an evaluation result, including:

[0179] Extract sub-data from user identity information;

[0180] Count the occurrence frequency of each sub-data in the historical usage data, and mark the occurrence frequency of each sub-data as Pi, where i is the number of the sub-data;

[0181] By formula The entropy HXi of the sub-data numbered i is calculated, and the entropy of the sub-data is used as the evaluation result of the sub-data; wherein n is the number of sub-data.

[0182] Preferably, the verification question setting unit 304 arranges and combines the sub-data according to the evaluation result and makes a one-to-one correspondence with the security level to obtain a security verification answer, including:

[0183] Extract the evaluation results and security levels of sub-data;

[0184] According to the size of the evaluation results, the sub-data are sorted from large to small, and sorted in pairs in order of size to obtain a double answer sequence. Each sub-data is combined to obtain a single answer sequence. The single answer sequence is combined with the double answer sequence to obtain an answer sequence. The answer sequence is matched with the security level in order of size to obtain an answer sequence corresponding to the security level. The answer sequence corresponding to the security level is marked as a security verification answer.

[0185] Preferably, the verification unit 305 is used to perform security verification on the operation information in the current usage information in combination with the security verification question and the confidentiality operation to obtain the user's verification result.

[0186] Preferably, the verification unit 305 performs security verification on the operation information in the current usage information in combination with the security verification question and the confidentiality operation to obtain the user's verification result, including:

[0187] Extracting operation information and confidentiality operations from current usage information;

[0188] Determine whether the operation information is the same as the confidential operation; if yes, provide corresponding identity verification questions according to the corresponding security level of the confidential operation, and the user needs to answer the identity verification questions; if no, do not provide identity verification questions, but continue to compare to obtain the user's identification status;

[0189] Setting an error count threshold; the error count threshold is a manually set number of allowed incorrect answers to identity verification questions;

[0190] Determine whether the user's answer to the identity verification question is correct; if yes, open the confidentiality operation permission for the current user; if no, increase the number of wrong answers by one;

[0191] When the number of incorrect responses of a user is equal to the error number threshold, the identity authentication question interface is closed, the current user is marked as an abnormal user, and the permission to use all confidential operations is closed.

[0192] The browser authentication system 300 based on user behavior in the embodiment of the present invention corresponds to the browser authentication method 100 based on user behavior in another embodiment of the present invention, and will not be described in detail herein.

[0193] According to another aspect of the present invention, the present invention provides a computer-readable storage medium having a computer program stored thereon, which implements any step of a browser authentication method based on user behavior when executed by a processor.

[0194] According to another aspect of the present invention, the present invention provides an electronic device, including:

[0195] The computer-readable storage medium described above; and

[0196] One or more processors are used to execute the program in the computer-readable storage medium.

[0197] The invention has been described above with reference to a few embodiments. However, it is readily apparent to a person skilled in the art that other embodiments than the ones disclosed above are equally within the scope of the invention, as defined by the appended patent claims.

[0198] Generally, all terms used in the claims are to be interpreted according to their ordinary meaning in the technical field, unless explicitly defined otherwise therein. All references to "a / said / the [means, components, etc.]" are to be openly interpreted as at least one instance of said means, components, etc., unless explicitly stated otherwise. The steps of any method disclosed herein do not necessarily have to be performed in the exact order disclosed, unless explicitly stated otherwise.

[0199] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0200] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0201] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0202] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0203] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A browser authentication method based on user behavior, characterized in that: The method comprises: Collecting historical usage information of users, and building a data operation library of users based on the historical usage information; Obtaining current usage information of the browser, and determining the identification status of the current user based on the current usage information and the data operation library; Mark operations related to user privacy as confidential operations, and set confidentiality levels based on the importance of confidential operations to user privacy; Set a security level for confidentiality operations based on the identification status, and set security verification questions corresponding to the security level based on the user identity information; Combining security verification issues with confidentiality operations, security verification is performed on the operation information in the current usage information to obtain the user's verification result.

2. The method according to claim 1, characterized in that The step of constructing a user's data operation library based on the historical usage information includes: The first key behavior feature is extracted based on the historical usage information, and a proportional coefficient corresponding to each first key behavior feature is set to build a user data operation library based on the first key behavior feature and the proportional coefficient; wherein the sum of the proportional coefficients corresponding to all first key behavior features is 1.

3. The method according to claim 2, characterized in that The determining the identification status of the current user based on the current usage information and the data operation library includes: Extracting a second key behavior feature based on the current usage information, and comparing the second key behavior feature with the first key behavior feature, determining a proportional coefficient corresponding to the key behavior feature with successful comparison as a success proportional coefficient, and determining a proportional coefficient corresponding to the key behavior feature with failed comparison as a failure proportional coefficient; Calculate the ratio of the sum of the success ratio coefficients to the sum of the failure ratio coefficients to determine the comparison coefficient; The comparison coefficient is compared with a preset comparison coefficient threshold, and the recognition status of the current user is determined according to the comparison result.

4. The method according to claim 3, characterized in that The comparing the comparison coefficient with a preset comparison coefficient threshold, and determining the recognition status of the current user according to the comparison result, includes: Determine whether the comparison coefficient satisfies a first comparison coefficient threshold value or more; if so, mark the recognition status of the current user as a compliant status; otherwise, determine whether the comparison coefficient satisfies a second preset comparison coefficient threshold value or more; if so, mark the recognition status of the current user as a sub-compliant status; otherwise, mark the recognition status of the current user as a non-compliant status.

5. The method according to claim 1, characterized in that Set security levels for confidentiality operations based on identification status, including: Extract the confidentiality level corresponding to the confidentiality operation; the confidentiality level includes three levels: A, B, and C; The recognition level of the conforming state in the recognition state is marked as level 1, the recognition level of the sub-conforming state is marked as level 2, and the recognition level of the non-conforming state is marked as level 3; A security level is obtained based on the identification level and the confidentiality level; the security levels include: A1, A2, A3, B1, B2, B3, C1, C2 and C3.

6. The method according to claim 1, characterized in that The security verification questions corresponding to the security level are set according to the user identity information, including: Extract user identity information; wherein the user identity information includes: user name, bound mobile phone number, bound personal information and account password; The sub-data in the user identity information is evaluated to obtain an evaluation result, and the sub-data is arranged and combined according to the evaluation result and matched one-to-one with the security level to obtain a security verification answer, and a security verification question is set according to the security verification answer.

7. The method according to claim 6, characterized in that The step of evaluating the sub-data in the user identity information to obtain an evaluation result includes: Extract sub-data from user identity information; Count the occurrence frequency of each sub-data in the historical usage data, and mark the occurrence frequency of each sub-data as Pi, where i is the number of the sub-data; By formula The entropy HXi of the sub-data numbered i is calculated, and the entropy of the sub-data is used as the evaluation result of the sub-data; wherein n is the number of sub-data.

8. The method according to claim 6, characterized in that The sub-data are arranged and combined according to the evaluation results and matched one by one with the security levels to obtain a security verification answer, including: Extract the evaluation results and security level of sub-data; According to the size of the evaluation results, the sub-data are sorted from large to small, and sorted in pairs in order of size to obtain a double answer sequence. Each sub-data is combined to obtain a single answer sequence. The single answer sequence is combined with the double answer sequence to obtain an answer sequence. The answer sequence is matched with the security level in order of size to obtain an answer sequence corresponding to the security level. The answer sequence corresponding to the security level is marked as a security verification answer.

9. The method according to claim 1, characterized in that: The security verification of the operation information in the current usage information by combining the security verification problem with the confidentiality operation to obtain the user's verification result includes: Extracting operation information and confidentiality operations from current usage information; Determine whether the operation information is the same as the confidential operation; if yes, provide corresponding identity verification questions according to the corresponding security level of the confidential operation, and the user needs to answer the identity verification questions; if no, do not provide identity verification questions, but continue to compare to obtain the user's identification status; Setting an error count threshold; the error count threshold is a manually set number of allowed incorrect answers to identity verification questions; Determine whether the user's answer to the identity verification question is correct; if yes, open the confidentiality operation permission for the current user; if no, increase the number of wrong answers by one; When the number of incorrect responses of a user is equal to the error number threshold, the identity authentication question interface is closed, the current user is marked as an abnormal user, and the permission to use all confidential operations is closed.

10. A browser authentication system based on user behavior, characterized in that: The system comprises: A data operation library construction unit, used to collect historical usage information of a user and construct a data operation library of the user based on the historical usage information; an identification state determination unit, configured to obtain current usage information of the browser, and determine the identification state of the current user based on the current usage information and a data operation library; A confidentiality level setting unit, used to mark an operation behavior related to user privacy as a confidentiality operation, and set a confidentiality level according to the importance of the confidentiality operation to the user privacy; A verification question setting unit, used to set a security level for the confidentiality operation according to the identification state, and to set a security verification question corresponding to the security level according to the user identity information; The verification unit is used to perform security verification on the operation information in the current usage information in combination with the security verification problem and the confidentiality operation to obtain the user's verification result.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

12. An electronic device, characterized in that: include: The computer readable storage medium as claimed in claim 11; as well as One or more processors are used to execute the program in the computer-readable storage medium.

Images