Computer remote login identification system based on artificial intelligence

Abstract

The invention discloses a computer remote login recognition system based on artificial intelligence, relates to the technical field of remote login recognition, and breaks through the three limitations of a traditional scheme through underlying signal capture and multi-modal feature fusion: directly obtaining physical signals of input equipment, avoiding information loss caused by protocol packaging, and improving the recognition efficiency. Microcosmic anomalies of the high-simulation AI attack script are accurately recognized; a low-frequency hidden attack chain is captured in combination with a time sequence graph and a causal model, and the view limitation of single session detection is solved; the robustness of the model is enhanced through adversarial training, and the generalization ability of an unknown attack resisting technique is remarkably improved; meanwhile, the system design gives consideration to the user experience and compliance, the dynamic update of the device fingerprint avoids frequent strong authentication interference, and the federal learning architecture realizes the balance of security and privacy.

Claims

1. A computer remote login recognition system based on artificial intelligence, characterized in that: include, The data acquisition module is used to obtain raw input event data from the client's underlying driver layer in real time, including keyboard press signal waveforms, mouse movement trajectory coordinate sequences, and touch screen contact surface pressure distribution data. The data acquisition module includes an electromagnetic shielding layer to suppress the impact of external high-frequency interference on the input signal, with a signal-to-noise ratio of ≥60dB. A preprocessing module, connected to the data acquisition module, performs time domain normalization processing on the original input event data to generate a normalized operation flow containing millisecond-level timestamps; The multimodal analysis module receives the normalized operation stream and performs the following operations in parallel: a) Extracting semantic coherence features of operation instructions based on temporal convolutional networks; b) Using residual networks to capture physical-level micro-tremor characteristics of input devices; c) Construct cross-session behavior correlation features through temporal knowledge graph; The dynamic decision module generates a real-time risk value based on the output of the multimodal analysis module and triggers one of the following response strategies: session release, secondary authentication, or connection blocking.

2. A computer remote login recognition system based on artificial intelligence as claimed in claim 1, characterized in that: The keyboard press signal waveform is obtained through HID protocol analysis, including the press start time, peak pressure value and release decay curve; the mouse movement trajectory coordinate sequence is directly captured from the USB controller at a sampling rate of 1000Hz, including the X / Y axis displacement and micro switch trigger status; the touch screen contact surface pressure distribution data is collected through a capacitive matrix sensor, recording the contact area deformation gradient value.

3. A computer remote login recognition system based on artificial intelligence as claimed in claim 2, characterized in that: In the data acquisition module, at the client's underlying driver layer, by registering kernel-mode I / O callbacks, the keyboard press signals, mouse tracks, and touch screen pressure data are written into a zero-copy ring buffer, which is then read by a high-priority kernel thread in the form of f s ≥1000Hz rate is sent to user mode for processing, where f s represents the sampling frequency, and 1000 represents the kHz threshold. At the same time, the microswitch contact level signal is recorded, and its physical jitter characteristics are characterized by a second-order underdamped oscillation system model: Where δ(t) represents the contact offset, ζ represents the damping ratio, and ω k represents the natural angular frequency, and t represents time; Where ω κ It is determined by the contact spring stiffness and the mass of the moving piece and is expressed as: Among them, ω κ represents the natural angular frequency, κ represents the natural vibration mode, k represents the equivalent stiffness of the contact spring, and m represents the equivalent mass of the micro switch movable piece.

4. The computer remote login recognition system based on artificial intelligence as claimed in claim 1, characterized in that: The pre-processing module also includes a protocol abstraction layer for: Strip encapsulated data from RDP, SSH, and VNC protocols to extract raw input events; Extract metadata features from encrypted protocol data before decryption, including packet timing intervals and payload size distribution; The metadata features include the cipher suite arrangement order features in the client Hello message during the SSL / TLS handshake phase, and TCP window size adjustment frequency statistics.

5. The computer remote login recognition system based on artificial intelligence as claimed in claim 1, characterized in that: The physical-level micro-tremor feature extraction in the multimodal analysis module includes: A dual-channel one-dimensional convolutional neural network is used to process keyboard pressing waveforms and mouse trajectory sequences respectively; Performing spectrum analysis on the keyboard pressing waveform to extract fundamental frequency harmonic attenuation slope characteristics; Calculating the second-order derivative of the mouse trajectory sequence to generate a motion acceleration mutation point distribution map; The spectrum analysis covers the characteristic frequency band of biological tremor of 0-200 Hz, uses sliding window Fourier transform to extract the fundamental frequency and its third harmonic component, and calculates the harmonic energy attenuation ratio as a biological characteristic identifier.

6. The computer remote login recognition system based on artificial intelligence as claimed in claim 5, characterized in that: The method for constructing the temporal knowledge graph includes: Abstract discrete operation events into weighted <operation subject, operation type, operation object> triples; Introducing a time decay factor to dynamically adjust triple weights, with recent operational events being weighted higher than historical events. An incremental graph embedding algorithm is used to map the graph into a low-dimensional vector space; The time decay factor is updated according to the exponential decay law, with a half-life set to 72 hours, and the weight of historical events exceeding 3 half-lives is reset to zero.

7. The computer remote login recognition system based on artificial intelligence as claimed in claim 6, characterized in that: In the multimodal analysis module, the step of performing spectrum analysis on the keyboard pressing waveform to extract the fundamental frequency harmonic attenuation slope characteristics includes: Perform sliding window Fourier transform on the time-domain normalized keyboard pressing waveform x(t): where X n (f) represents the spectrum of the nth frame, f represents frequency with the unit of Hz, x(t) represents the keyboard pressure waveform, w(·) represents the Hamming window function, L represents the window length, P represents the frame shift, P < L with the unit of the number of sample points, n represents the frame number, and i represents the imaginary unit; Identify the fundamental frequency f1 and the third harmonic f3=3f1 in each frame spectrum, and extract the corresponding amplitude spectrum A1=|X n (f1)|、A3=|X n (f3)|, and calculate the harmonic attenuation slope: Where s represents the harmonic attenuation slope in dB / order, 20 is used to convert the amplitude ratio to decibels, A1 and A3 represent the fundamental frequency and third harmonic amplitudes respectively, and 3 represents the third harmonic order. The curvature radius calculation formula is introduced to supplement the geometric characteristics of mouse movement, and the count is converted into physical distance in combination with the mouse DPI parameter: Where R(t) represents the radius of curvature, v x (t),v y (t) represents the X / Y axis velocity component, a x (t),a y (t) represents the acceleration component of the X / Y axis, D represents the physical distance corresponding to each count, and is calculated as D = 1 / DPI, where DPI is the mouse resolution; The acceleration change rate threshold setting logic is: Define acceleration jump j(t) = da(t) / dt, a(t) represents the amplitude of the acceleration vector, j(t) represents the first-order derivative of the acceleration vector amplitude, and calculate its standard deviation σ within the sliding window j , and set the sensitivity coefficient β=3:J thr =βσ j , where J thr represents the acceleration change rate threshold, β represents the sensitivity coefficient, σ j represents the standard deviation of j(t), when |j(t)|>J thr When , it is marked as an acceleration mutation event.

8. The computer remote login recognition system based on artificial intelligence as claimed in claim 1, characterized in that: The dynamic decision module includes an adversarial training unit, and its training method includes: Generate adversarial operation sequence samples, including time domain perturbations that simulate human operations and semantically contradictory operation combinations; the time domain perturbations include inserting μs-level random delays into continuous operation events, and the delay amount follows a Poisson distribution; The adversarial samples are injected into the model training phase to force the decision model to learn the consistency features of the operation intention.

9. The computer remote login recognition system based on artificial intelligence as claimed in claim 8, characterized in that: It also includes a device fingerprint generation module, whose operations include: Generate an initial fingerprint vector based on the hardware clock offset of the input device; Encode the user's historical operation habit features into an updateable additional fingerprint vector; Dynamically fuse the initial fingerprint vector and the additional fingerprint vector through the gating mechanism to generate a composite device fingerprint; The hardware clock offset is calculated by comparing the cumulative deviation between the device's local clock and the NTP server's timestamp, with a sampling interval of 5 minutes, and generating an offset distribution histogram for 24 hours.

10. The computer remote login recognition system based on artificial intelligence as claimed in claim 9, characterized in that: The system uses a federated learning architecture to achieve privacy protection, including: Feature extraction and preliminary analysis are completed locally on the client, and only the 256-bit feature hash value is uploaded to the server; When the server aggregates multi-client model updates, it uses a differential privacy mechanism to add Gaussian noise.

Images