Multi-identity security verification system based on big data

Abstract

The invention relates to the technical field of identity security verification, and discloses a multi-identity security verification system based on big data. The system comprises a verification collection module, a feature construction module, a risk modeling module and a decision engine module, wherein the verification collection module obtains user multi-source biological features, behavior tracks and equipment environment data, and performs preprocessing to generate an initial feature set; the feature construction module extracts spatiotemporal behavior patterns and cross-device association features and fuses the spatiotemporal behavior patterns and the cross-device association features into a multi-dimensional The risk modeling module loads a pre-trained dynamic threat model, carries out real-time risk layering on the multi-dimensional feature matrix, and outputs a risk level identifier and an abnormal feature vector; and the decision engine module calls a corresponding verification strategy library, and generates a multi-factor verification instruction set in combination with the abnormal feature vector. The system realizes comprehensive verification of user identities through multi-source data integration, dynamic risk assessment and precise strategy matching, and adapts to various high-security demand scenes.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of identity security verification, in particular to a multi-identity security verification system based on big data. BACKGROUND

[0002] With the acceleration of digitalization, the dependence of various online services and offline scenes on identity verification is deepening. From financial transactions, government affairs to social platform registration, intelligent device login, identity verification of authenticity and security has become an important link to protect user rights and system stability. The current mainstream identity verification methods are mostly focused on single biometric verification or static information comparison, such as relying on single biometric data such as fingerprint recognition, face recognition for identity confirmation, or completing the verification process through the matching of identity card information and user filled information. However, such traditional verification methods gradually show obvious limitations when facing complex network environments and diversified security threats.

[0003] In terms of biometric verification, single feature data is vulnerable to forgery methods, such as printed face images and counterfeit fingerprint molds, which can bypass the security protection of traditional verification systems, leading to security risks such as user identity being impersonated and account funds being lost. At the same time, traditional verification methods only focus on the identity information submitted by the user at the moment, lacking comprehensive analysis of dynamic information such as user historical behavior trajectory and device usage environment, making the verification system unable to accurately identify abnormal operation behavior. For example, when a user account is logged in on a strange device in a strange place, the traditional verification system only confirms the identity based on the user's input password or biometric features, ignoring abnormal information such as login location and device model that do not conform to the user's regular usage habits, making it difficult to effectively prevent security incidents such as account theft and illegal transfers.

[0004] The risk assessment model of the existing identity verification system is mostly a static model, with fixed risk judgment criteria that cannot be adjusted in real time according to changes in network security threats. With the continuous upgrading of network attack methods, new malicious attack methods emerge in an endless stream, and the static risk model is difficult to quickly identify and respond to these emerging security threats, resulting in the security protection capability of the verification system gradually lagging behind the actual security needs. At the same time, the existing verification system lacks effective data fusion and feature extraction methods when processing multi-source data, and cannot organically integrate multi-dimensional information such as user biometric data, behavior trajectory data, and device environment data, making the generated feature information one-sided and difficult to fully reflect the user's real identity status and operation behavior risk, thereby affecting the accuracy and reliability of identity verification. The existence of these problems not only reduces the security protection level of the identity verification system, but also brings serious hidden dangers to the information security and property safety of users, therefore, a new type of identity security verification system that can integrate multi-source data, dynamically assess risks, and accurately identify identities is needed. SUMMARY

[0005] The present application aims to provide a multi-identity security verification system based on big data to solve the problems raised in the background art.

[0006] To achieve the above-mentioned purpose, the present application provides a multi-identity security verification system based on big data, which comprises:

[0007] A verification collection module acquires multi-source biological feature data, behavior trajectory data and device environment data of a user, and generates an initial feature set after preprocessing;

[0008] A feature construction module receives the initial feature set, extracts spatio-temporal behavior pattern features and cross-device correlation features, and fuses to generate a multi-dimensional feature matrix;

[0009] A risk modeling module loads a pre-trained dynamic threat model, inputs the multi-dimensional feature matrix into the dynamic threat model for real-time risk stratification, and outputs a risk level identifier and an abnormal feature vector;

[0010] A decision engine module calls a corresponding verification strategy library according to the risk level identifier, and generates a multi-factor verification instruction set in combination with the abnormal feature vector.

[0011] Preferably, the feature construction module performs the following operations:

[0012] Separate a biological feature subset, a behavior trajectory subset and a device environment subset from the initial feature set;

[0013] Perform spatio-temporal continuity analysis on the behavior trajectory subset to extract high-frequency access area sequence and operation interval features;

[0014] Perform cross-device correlation analysis on the device environment subset to generate a device group trustworthiness parameter;

[0015] Fuse the high-frequency access area sequence, operation interval features and device group trustworthiness parameter to construct the multi-dimensional feature matrix.

[0016] Preferably, the risk modeling module performs the following operations:

[0017] Load a pre-trained convolutional recurrent neural network model as the dynamic threat model;

[0018] Divide the multi-dimensional feature matrix into continuous feature segments according to time windows;

[0019] Perform spatio-temporal anomaly detection on each feature segment through the convolutional recurrent neural network model to output a segment risk probability;

[0020] aggregate all the segment risk probabilities and superimpose the device group credibility parameter to generate the risk level identifier and the anomaly feature vector.

[0021] Preferably, the decision engine module performs the following operations:

[0022] select a basic verification factor combination from a verification policy library according to the risk level identifier;

[0023] parse the spatio-temporal anomaly dimension in the anomaly feature vector and match an enhanced verification factor;

[0024] dynamically combine the basic verification factor and the enhanced verification factor to generate the multi-factor verification instruction set.

[0025] Preferably, the system further comprises:

[0026] a verification execution module receiving the multi-factor verification instruction set and scheduling a biometric terminal, a behavior verification engine and an environment sensing unit;

[0027] synchronously collecting real-time iris features, voiceprint features, operation behavior sequences and device environment parameters;

[0028] generating a real-time verification feature set and outputting a verification response code.

[0029] Preferably, the system further comprises:

[0030] a feedback learning module receiving the verification response code and the real-time verification feature set;

[0031] comparing the real-time verification feature set with a deviation parameter of the multi-dimensional feature matrix;

[0032] labeling a training sample of a dynamic threat model according to the deviation parameter and the verification response code;

[0033] generating a model update parameter set.

[0034] Preferably, the system further comprises:

[0035] a policy optimization module receiving the verification response code and the model update parameter set;

[0036] analyzing a verification response time delay and a misjudgment rate under different risk level identifiers;

[0037] adjusting a factor combination weight and a trigger threshold in the verification policy library;

[0038] outputting an optimized verification policy version number.

[0039] Preferably, the system further comprises:

[0040] a data reconstruction module configured to receive the real-time verification feature set and the optimized verification strategy version number;

[0041] cleaning redundant environmental parameters in the real-time verification feature set;

[0042] reorganizing the priority of the biological features according to the optimized verification strategy version number;

[0043] generating a compressed verification feature stream.

[0044] Preferably, the system further comprises:

[0045] a distributed storage module configured to receive the compressed verification feature stream and a model update parameter set;

[0046] dividing the encrypted feature partition and the model parameter partition;

[0047] establishing a cross-partition feature index chain and a parameter version mapping table;

[0048] generating a partition storage path identifier.

[0049] Preferably, the verification collection module is configured to perform the following operations:

[0050] loading historical verification features according to the partition storage path identifier;

[0051] fusing current device environmental data and historical behavior trajectory data;

[0052] filtering low-confidence biological features according to the optimized verification strategy version number;

[0053] outputting the updated initial feature set.

[0054] Compared with the prior art, the present application has the following advantages:

[0055] The verification collection module is configured to acquire multi-source biological feature data, behavior trajectory data and device environmental data of a user and preprocess to generate an initial feature set, breaking the limitation of traditional identity verification systems that rely on single data for identity confirmation. The collection and integration of multi-source data can comprehensively capture the identity-related information of the user from different dimensions. The biological feature data can be directly associated with the physiological characteristics of the user, the behavior trajectory data can reflect the long-term operation habits of the user, and the device environmental data can record the external environmental information when the user operates. The combination of these data makes the initial feature set contain more comprehensive user identity information, providing a multi-dimensional data basis for subsequent accurate identity verification and avoiding identity misjudgment problems caused by insufficient or one-sided single data.

[0056] After the feature construction module receives the initial feature set, it extracts spatio-temporal behavior pattern features and cross-device association features and fuses them to generate a multi-dimensional feature matrix. This process realizes the deep mining and effective integration of multi-source data. The extraction of spatio-temporal behavior pattern features can analyze the user's behavior rules from the two dimensions of time and space, such as the user's operation frequency at different time periods, the frequently occurring operation locations, etc. These features can clearly present the user's regular behavior habits. The extraction of cross-device association features can establish the operation association between different devices of the user, such as the model association of the user's commonly used devices, the consistency of operation behavior on different devices, etc. The fusion of these two types of features with other information in the initial feature set generates a multi-dimensional feature matrix that can more comprehensively and accurately depict the user's identity features and operation behavior features, enabling the system's cognition of the user's identity to no longer be limited to scattered data fragments, but to form a complete and three-dimensional user identity portrait, which is helpful for more accurately identifying whether the user's identity is abnormal in the subsequent process.

[0057] The risk modeling module loads a pre-trained dynamic threat model, inputs the multi-dimensional feature matrix into the model for real-time risk stratification, and outputs a risk level identifier and an abnormal feature vector, so that the risk assessment capability of the system has dynamic adaptability and real-time performance. The dynamic threat model can be continuously updated and optimized according to the changes of network security threats, and can identify new security threat patterns in a timely manner. Compared with traditional static risk models, it has more acute and timely perception of risks. The real-time risk stratification function can divide the user's operation into different risk levels according to the user's identity and operation behavior risks reflected by the multi-dimensional feature matrix, and the output abnormal feature vector can accurately locate the specific feature information of the existing risks, enabling the system to clearly understand the source of the risks and avoiding the security protection vulnerabilities caused by the lag or ambiguity of risk assessment in traditional systems. It can quickly respond to potential security threats and prevent the occurrence of security events such as identity impersonation and abnormal operation in advance.

[0058] The decision engine module calls a corresponding verification strategy library according to the risk level identification, and generates a multi-factor verification instruction set in combination with the abnormal feature vector, so as to realize the individualization and precision of the identity verification strategy. Different risk levels correspond to different verification strategies. For low-risk operations, a relatively simplified verification strategy can be called to improve the convenience of user operation while ensuring safety, and to avoid the problem of cumbersome operation caused by excessive verification for users; for high-risk operations, a more stringent multi-factor verification strategy is called, and the authenticity of the user identity is further confirmed through the combination of multiple verification means, so as to effectively prevent the security risks caused by high-risk operations. At the same time, the verification instruction set is generated in combination with the abnormal feature vector, and specific verification measures can be developed for specific abnormal features, for example, when the abnormal feature vector shows that the login device is a strange device, the verification instruction set can include device verification code verification, historical operation information verification and other multi-factor verification means, so that the verification process is more targeted, and the accuracy and safety of identity verification are greatly improved, which can effectively prevent various identity fraud, network attacks and other security risks, and can flexibly adjust the verification process according to the risk level on the premise of ensuring safety, improve user experience, and is suitable for financial, government, social and other scenes with high requirements for identity verification safety. BRIEF DESCRIPTION OF DRAWINGS

[0059] Figure 1 a timing diagram of the multi-identity security verification system based on big data described in the present application;

[0060] Figure 2 a flowchart for the feature construction module;

[0061] Figure 3 a flowchart for the risk modeling module;

[0062] Figure 4 a flowchart for the feedback learning module;

[0063] Figure 5 a flowchart for the strategy optimization module. DETAILED DESCRIPTION

[0064] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0065] Please refer to Figure 1 The present application provides a multi-identity security verification system based on big data, and the overall implementation scheme of the system is as follows.

[0066] The verification collection module obtains multi-source biometric data, behavior trajectory data and device environment data of the user; pre-processes the obtained data, including data cleaning, standardization and normalization operations, to eliminate noise and inconsistency; generates an initial feature set after pre-processing, which contains a structured data format for subsequent processing. After receiving the initial feature set, the feature construction module performs feature extraction operations, specifically including identifying and separating key feature elements from the data; extracting spatio-temporal behavior pattern features and cross-device association features through algorithms, wherein the spatio-temporal behavior pattern features reflect the timing rules of user activities, and the cross-device association features represent the interaction relationship between multiple devices; fusing the extracted features to generate a multi-dimensional feature matrix, which stores feature values in the form of a multi-dimensional array for efficient calculation. The risk modeling module loads a pre-trained dynamic threat model, which is trained based on historical data; inputs the multi-dimensional feature matrix into the dynamic threat model for real-time risk stratification processing, which involves calculating the risk weight of the feature matrix; outputs a risk level identifier and an abnormal feature vector, the risk level identifier uses digital coding to represent the risk level, and the abnormal feature vector identifies potential threat points. The decision engine module calls the corresponding verification strategy library according to the risk level identifier, and the verification strategy library stores verification rules in different risk scenarios; generates a multi-factor verification instruction set in combination with the abnormal feature vector, which contains a logical sequence of multiple verification factor combinations to guide subsequent verification operations. The above modules are connected through a system bus to realize synchronous transmission of data flow and control flow, ensuring the efficiency of the overall operation.

[0067] Embodiment 1: refer to Figure 2 The feature construction module receives the initial feature set transmitted by the verification collection module, which contains pre-processed multi-source biometric data, behavior trajectory data and device environment data. The initial feature set adopts a structured data format, including data fields, timestamps and source identifiers. After the module is started, it performs feature separation operations, dividing the initial feature set into three independent subsets according to data types: biometric feature subset, behavior trajectory subset and device environment subset. The biometric feature subset covers user fingerprint feature vectors, facial recognition feature points and voiceprint spectrum data, which are collected by biometric sensors and stored in numerical array form. The behavior trajectory subset contains user operation event sequences, interface interaction logs and geographic location history. The operation event sequence records the timestamps and types of actions such as key presses and clicks, the interface interaction log stores application switching and page browsing paths, and the geographic location history generates a sequence of latitude and longitude coordinates through GPS or network positioning data. The device environment subset includes device hardware identifiers, network connection parameters and system configuration information. Hardware identifiers such as device serial numbers and MAC addresses, network connection parameters including IP addresses, signal strengths and router identifiers, and system configuration information involving operating system versions and security patch states.

[0068] The spatiotemporal continuity analysis is performed on the subset of behavior trajectories, aiming to identify patterns and regularities in user behavior. The spatiotemporal continuity analysis employs a sliding window algorithm to process the behavior trajectory data, with a fixed time span, such as a sequence of operations within five consecutive minutes. The algorithm iterates through the sequence of operation events, detecting high-frequency operation patterns, such as repeated login attempts or frequent access to specific functions, generating an operation frequency distribution chart. Meanwhile, the historical geolocation data is analyzed to calculate the continuity and repeatability of the user's movement path, identifying common access areas such as home, workplace, and frequently visited public places, generating a region access frequency matrix. The operation interval feature is extracted from the sequence of operation events by calculating the time difference between adjacent operations, forming a time interval sequence that assesses the rhythm stability of user behavior. The high-frequency access region sequence is aggregated based on historical geolocation data, filtering out coordinate points that have been visited more than a threshold number of times within a specified time window, and sorting them in chronological order to form a sequence list. The spatiotemporal continuity analysis outputs include the high-frequency access region sequence and the operation interval feature, which are stored in the form of feature vectors for subsequent integration.

[0069] The cross-device association analysis is performed on the subset of device environment, aiming to establish logical relationships between devices and evaluate their credibility. The cross-device association analysis uses a graph theory algorithm to construct a device relationship network, with nodes representing device entities and edges representing interaction relationships between devices, such as the same user account login or network proximity. The algorithm analyzes device hardware identifiers and network connection parameters to identify device groups, such as multiple devices under the same local area network or a collection of devices sharing the same cloud account. The device group credibility parameter is calculated based on historical interaction data, considering factors such as interaction frequency between devices, interaction time consistency, and device type similarity. Interaction frequency is quantified by counting the number of data transmissions or session establishments between devices, interaction time consistency assesses the degree of overlap in device activity times, and device type similarity compares device hardware configurations and operating system versions. After calculation, the device group credibility parameter is generated, which is a numerical indicator ranging from 0 to 1, representing the reliability degree of the device group. The cross-device association analysis outputs the device group credibility parameter, which is integrated with other features.

[0070] A multidimensional feature matrix is ​​constructed by fusing high-frequency access region sequences, operation interval features, and device group credibility parameters. The fusion process employs feature vector concatenation technology to align features from different sources to a unified time dimension. High-frequency access region sequences are converted into numerical vectors, with each element representing the number of visits to a specific region within a time window. Operation interval features are converted into statistical vectors, including descriptive statistics such as mean, variance, and extreme values. Device group credibility parameters are directly incorporated into the matrix as scalar values. The concatenated features are normalized to eliminate dimensional differences; the normalization method uses min-max scaling to map feature values ​​to the 0-1 range. The multidimensional feature matrix is ​​constructed as a two-dimensional array, with rows representing time nodes and columns representing feature types. Each cell stores the normalized feature value. An additional metadata layer is added to the matrix to record the feature source, time range, and normalization parameters, ensuring data traceability. After generation, the multidimensional feature matrix is ​​transmitted to the risk modeling module via the system bus. Data compression technology is used during transmission to reduce bandwidth consumption, and the matrix data is temporarily stored in the system cache for subsequent processing.

[0071] Example 2: See Figure 3 The risk modeling module receives a multi-dimensional feature matrix from the feature construction module. This matrix contains high-frequency access region sequences organized by time series, operation interval features, and device group trust parameters. The module loads a pre-trained dynamic threat model, which employs a convolutional recurrent neural network architecture, containing a dual composite structure of convolutional and recurrent layers. The convolutional layers are configured with multiple feature detectors to identify spatial local patterns; the recurrent layers employ a gating mechanism to handle feature dependencies in the temporal dimension. Model parameters are trained using historical security event data and stored in a dedicated model repository. The loading process retrieves the latest model version from the repository and initializes the weight matrix and bias vector to the computation engine.

[0072] The multidimensional feature matrix is ​​divided into continuous feature segments over a fixed time span. The time span is set to a system preset value, and each segment contains feature data of equal duration. The segmentation operation is performed sequentially along the time axis, with the starting timestamp aligned to the first time node of the feature matrix. Each feature segment contains a complete temporal-spatial feature structure, preserving the region sequence, operation interval, and device reliability data dimensions from the original matrix. After segmentation, a segment sequence is generated, arranged in chronological order, with no data overlap between adjacent segments but maintaining temporal continuity. Each feature segment is encapsulated as an independent data structure, accompanied by a time range marker and segment sequence number.

[0073] The spatio-temporal anomaly detection is performed on each feature segment by a convolutional recurrent neural network model. The feature segment is first input into a convolutional layer, and the convolutional kernel slides and scans in the spatial dimension to extract local operation pattern features. The spatial feature detection focuses on the geographical location clustering in the high-frequency access region sequence and the distribution regularity of the operation interval features. The convolutional layer outputs a spatial feature map, which is transmitted to the recurrent layer for processing. The recurrent layer receives the spatial feature map and processes it step by step according to the time step. The gating mechanism controls the retention and forgetting of historical information, establishing long-term temporal dependencies. The recurrent layer analyzes the trend of operation behavior over time, detecting sudden changes in behavior rhythm or deviations in regional access rules. The spatio-temporal anomaly detection outputs a segment risk probability value, which is a floating-point number representing the degree of possibility of a security threat in the current segment. The processing of each feature segment is independent and parallel computing speeds up the detection speed.

[0074] The segment risk probability values of all feature segments are aggregated. The aggregation operation collects the probability sequence arranged in chronological order and calculates the overall risk level using a time-weighted algorithm. The time-weighted algorithm assigns a higher weight to recent segments, reflecting the time-sensitive nature of the risk state. The confidence parameter of the device group is superimposed on the aggregation result, and the confidence parameter serves as an adjustment factor in the calculation. A higher confidence parameter reduces the final risk value, while a lower confidence parameter amplifies the risk signal. A risk level identifier is generated, which is a discrete integer value, defining multiple risk levels through threshold division algorithm mapping the aggregation result. An anomaly feature vector is generated, which is a multidimensional array identifying the abnormal spatial positions and time nodes detected in the feature segments. The anomaly feature vector marks specific anomaly types, such as geographical location deviation, operation interval anomaly, or device association anomaly. The risk level identifier and anomaly feature vector are encapsulated into a data structure and transmitted to the decision engine module.

[0075] The decision engine module receives the risk level identifier and the anomaly feature vector. According to the risk level identifier, the verification strategy library is retrieved, which stores the basic verification factor combination configuration corresponding to different risk levels. The basic verification factor combination includes a preset set of verification elements, such as a combination of biometric verification types, behavior verification items, and minimum verification intensity requirements. The retrieval process indexes the strategy library entries through the risk level identifier and returns the corresponding basic factor combination parameter set.

[0076] The spatiotemporal anomaly dimension information in the anomaly feature vector is analyzed. The anomaly feature vector contains multiple anomaly detection flag bits, each of which is associated with a specific feature dimension and a time position. The analysis operation identifies the category attributes of the anomaly dimension, including three basic types of position movement anomaly, behavior rhythm anomaly, and device association anomaly. According to the anomaly category, the enhanced verification factor is matched, and the enhanced factor library stores the supplementary verification measures for specific anomaly types. The position movement anomaly is matched with the geographic position confirmation factor, the behavior rhythm anomaly is matched with the operation habit verification factor, and the device association anomaly is matched with the device fingerprint rechecking factor. The matching process generates a set of enhanced verification instruction parameters.

[0077] The basic verification factor and the enhanced verification factor are dynamically combined. The combination logic constructs a decision tree based on the risk level and the anomaly type: the basic factor combination constitutes the core verification framework; the enhanced factor is selectively superimposed according to the anomaly dimension; and multiple enhanced factors are combined when multiple anomalies exist. The combination process generates a factor execution sequence, which defines the trigger order and dependency relationship of different verification. Conflict detection is performed on the factor parameters to avoid repeated verification or resource competition, and the parameter threshold is adjusted if necessary. A multi-factor verification instruction set is generated, which adopts a structured data format to completely describe the verification type, execution order, parameter threshold, timeout setting, and anomaly handling rules. The instruction set is encoded into a machine-parsable format and transmitted to the verification execution module through the system interface. After the instruction set is generated, the operation log is updated to record the corresponding relationship between the risk level, the anomaly type, and the final verification strategy combination.

[0078] Embodiment 3: refer to Figure 4 The verification execution module receives the multi-factor verification instruction set from the decision engine module. The instruction set adopts a structured data format, which contains a list of verification factor types, an execution order sequence, parameter threshold settings, timeout control values, and anomaly handling rules. The module parses the instruction set and identifies the types of hardware resources scheduled therein, including biometric identification terminals, behavior verification engines, and environment perception units. According to the resource type, hardware scheduling instructions are generated and sent to the corresponding hardware controllers through the device control bus. The biometric identification terminal scheduling instruction activates the fingerprint sensor, iris camera, and microphone array, and configures their sampling frequency and resolution parameters. The behavior verification engine scheduling instruction initializes the keyboard log capturer, mouse track recorder, and application program interaction monitor, and sets the behavior pattern detection threshold. The environment perception unit scheduling instruction starts the GPS receiver, network probe, and device state monitor, and collects device location, network environment, and running state information. After all hardware resources are scheduled, the module enters a ready state and waits for a synchronization acquisition trigger signal.

[0079] Synchronous acquisition of real-time iris features, voiceprint features, operation behavior sequences and device environment parameters. The synchronization mechanism is realized based on a hardware clock signal, and the acquisition start timestamp is uniformly generated by the module and distributed to each hardware unit. Iris feature acquisition is performed by an infrared camera, which captures user iris texture images under near-infrared spectrum, and extracts iris encoding feature vectors through image processing algorithms. The vector contains more than 128 feature point data. Voiceprint feature acquisition is completed through a directional microphone array, which records user voice samples and applies acoustic models to analyze fundamental frequency, formant and spectral features to generate a voiceprint feature map. The operation behavior sequence acquisition records the keyboard key timing, mouse movement trajectory and interface element interaction sequence to form an operation event stream with millisecond-level timestamps. Device environment parameter acquisition includes device unique identifier, real-time GPS coordinates, network IP address, connection signal strength, battery status and running process list. All collected data are attached with a uniform timestamp identifier to ensure consistency in the time dimension. The acquisition process is completed within a preset timeout control window, and if the timeout trigger occurs, the acquisition is terminated and an abnormal flag is recorded.

[0080] Real-time verification feature set is generated and verification response code is output. The collected data is input into the feature fusion engine, which aligns each data stream by timestamp and constructs a multi-dimensional feature structure. The structure includes a biological feature partition storing iris vectors and voiceprint maps, a behavior feature partition storing operation event sequences, and an environment feature partition storing device parameter sets. The fusion process performs data standardization to eliminate differences in different sensor dimensions. The verification response code generation engine receives the fused feature set and performs state determination based on the pre-set rule library: compares the similarity of iris vectors and registered templates, evaluates the matching degree of voiceprint maps, detects the compliance of operation sequences, and verifies the consistency of device environment. The determination result is mapped to a digital state code, and the state code space definition includes four basic states: success, partial success, failure and timeout, each state contains a sub-state code to identify the specific failure reason. The real-time verification feature set and the verification response code are packaged into a response data packet and transmitted to the feedback learning module through a message queue.

[0081] The feedback learning module receives the verification response code and the real-time verification feature set. The module starts the feature comparison process and retrieves the multi-dimensional feature matrix cached by the risk modeling module as historical baseline data. The comparison operation first aligns the time window, and maps the real-time verification feature set to the corresponding time period of the historical matrix according to the time axis. The feature deviation calculation uses a multi-dimensional space distance algorithm, which is expressed as:

[0082]

[0083] where D represents the total feature deviation value, n is the total number of feature dimensions, x i is the i-th feature value in the real-time verification feature set, y i is the feature value of the corresponding dimension in the historical multi-dimensional feature matrix, and wi The weight coefficient represents the i-th dimensional feature. The weight coefficient is dynamically configured according to the feature type, and the biometric feature weight is higher than the environmental feature. The bias calculation is executed by feature category, and the output is the biometric feature bias, the behavior feature bias and the environmental feature bias component value.

[0084] The training sample of the dynamic threat model is labeled according to the bias parameter and the verification response code. The labeling engine receives the bias component value and sets the bias threshold rule: when the bias of a certain feature exceeds the threshold, mark this dimension as an abnormal sample point. The verification response code is parsed as a sample label confidence index, and the successful response code improves the label confidence, and the failed response code needs to be marked by manual review. The sample labeling result contains three core elements: time window identifier, abnormal feature dimension mark bitmap, and sample label value (0 represents normal / 1 represents abnormal). The labeled samples are sorted by time sequence to build an incremental training sample set.

[0085] The model update parameter set is generated. The incremental training sample set is input into the model update engine, and the engine loads the current version parameters of the dynamic threat model. Online learning algorithm is used to perform incremental training: forward propagation to calculate sample prediction value, backward propagation to calculate parameter gradient, and gradient descent algorithm to adjust convolution layer filter weight and recurrent layer cell state parameter. The training process uses small batch sample iteration, and the learning rate is dynamically decayed according to the sample quantity. The updated parameter set includes convolution kernel weight adjustment matrix, recurrent cell state update vector, output layer bias correction amount and model version metadata. The parameter set is stored in the distributed storage module after encryption, and is pushed to the parameter loader of the risk modeling module through the model management interface. The model loader automatically loads the updated parameters during the system low load period to complete the model hot update operation.

[0086] Embodiment 4: refer to Figure 5 The verification response code contains timestamp, risk level identifier, verification result state and subdivision state code. The model update parameter set records the convolution kernel weight adjustment amount, recurrent cell state correction value and bias item update amount of the dynamic threat model. The module starts the analysis engine and groups the historical verification records according to the risk level identifier. The statistical objects include two core indicators: verification response time delay and misjudgment rate. The response time delay is defined as the time difference from the verification instruction issuance to the response code generation, with the unit of milliseconds; the misjudgment rate is calculated as the proportion of false verification results (including illegal access false pass and legal access false rejection) to the total number of verification times. The analysis engine retrieves the verification log of the last week and aggregates the data according to the preset risk level interval. The following is a typical statistical table.

[0087] Table 1: Preset risk level interval aggregation data table.

[0088] Risk level identification Number of verifications Average response latency (ms) False positive rate 0 12540 320 0.012 1 8765 580 0.038 2 4321 1020 0.162 3 987 1560 0.251

[0089] Referring to Table 1, the factor combination weight and trigger threshold in the verification strategy library are adjusted. For risk level 0 (low risk), the analysis shows that the response time delay exceeds the expected baseline value. The optimization operation reduces the biometric verification intensity: the fingerprint verification weight is adjusted from 0.7 to 0.5, and the iris verification weight is adjusted from 0.8 to 0.6; the behavior verification factor weight is increased, and the operation habit matching weight is increased from 0.3 to 0.5. For risk level 2 (medium-high risk), the false rejection rate is significantly higher than the acceptable threshold. Increase multi-modal biological verification: the voiceprint verification weight is increased from 0.4 to 0.7, and the face liveness detection weight is increased from 0.5 to 0.8; at the same time, add device environment cross verification as a necessary factor. The trigger threshold adjustment involves the risk level conversion condition: the threshold for risk level 1 to 2 is lowered from the original probability value 0.35 to 0.28, and the threshold for risk level 2 to 3 is lowered from 0.65 to 0.55. After the threshold adjustment, some original level 1 events will be classified as level 2, and original level 2 events will be classified as level 3.

[0090] The output optimization verification strategy version number. The version number uses semantic coding rules, with the format "MAJOR.MINOR.PATCH". When the factor weight adjustment amplitude is less than 20%, the PATCH version is incremented; when the verification factor type is increased or decreased, the MINOR version is incremented; when the trigger threshold logic is changed, the MAJOR version is incremented. This optimization triggers the MINOR version upgrade, and the version number is updated from V2.3.5 to V2.4.0. The version number is written to the strategy library metadata table and is bound with the effective timestamp.

[0091] The data reconstruction module receives the real-time verification feature set and the optimization verification strategy version number V2.4.0. Clean up redundant environmental parameters in the real-time verification feature set: remove network signal strength fluctuation values (continuous sampling points with a standard deviation less than 0.1), filter device battery temperature data (monitoring sequences with a variation range less than ±2°C), and compress GPS positioning history (keep trajectory key points with a 100-meter accuracy threshold). The cleaning operation uses a sliding window variance detection algorithm, with a window size of 10 seconds and a variance threshold of 0.15.

[0092] Reorganize the biometric feature priority according to the optimization verification strategy version number V2.4.0. Query the factor weight configuration table of the V2.4.0 version of the strategy library: voiceprint feature weight 0.7 > face feature 0.65 > iris feature 0.6 > fingerprint feature 0.5. Based on this priority: the real-time verification feature set is re-ordered by biometric feature partition, and the voiceprint spectrum data is placed at the beginning of the feature array; in the feature storage structure, the face recognition feature vector is allocated 30% of the storage space, the iris feature is allocated 25%, and the fingerprint feature is allocated 20%. The reorganization process reconstructs the feature index mapping table to ensure that subsequent modules can access data according to the new priority.

[0093] The compressed verification feature stream is generated. The compression operation is performed in two stages: in the first stage, lossy compression is used to apply MFCC feature extraction to the voiceprint spectrum data, reducing the 128-dimensional spectrum vector to a 40-dimensional mel frequency cepstrum coefficient; in the second stage, lossless compression is used to apply the Zstandard algorithm to the reorganized feature set, setting the compression level to 10. The compressed feature stream is packaged as a binary data packet, with the version identifier V2.4.0 and timestamp metadata embedded in the header. A cyclic redundancy check code is appended to the end of the data packet, and the check polynomial uses the CRC-32 standard. The final output of the compressed verification feature stream is reduced to an average of 18%-22% of the original data volume, and is transmitted to the distributed storage module through the message middleware. The feature stream is accompanied by a metadata description file during transmission, which specifies the cleaning parameters, reorganization rules, and compression algorithm configuration items.

[0094] In embodiment 5, the distributed storage module receives the compressed verification feature stream from the data reconstruction module and the model update parameter set from the feedback learning module. The compressed verification feature stream contains the real-time verification data set after cleaning and reorganization, and is packaged in binary format with a version identifier. The model update parameter set records the dynamic threat model weight matrix correction, the state vector adjustment value, and the structure configuration change item. The module starts the storage allocation engine to divide the encrypted feature partition and the model parameter partition. The feature partition is used to store the compressed verification feature stream, and the allocation logic is based on the feature data type and timeliness: the biological feature subclass is allocated to the high-frequency access storage area, and the environmental parameter subclass is allocated to the low-frequency storage area. The parameter partition independently stores the model update parameter set, and is divided into convolution kernel storage segment, loop unit storage segment, and bias item storage segment according to the model architecture hierarchy. The physical locations of the partitions are distributed in different storage nodes, and the node selection uses the consistent hashing algorithm to map the data blocks. The encryption process is performed before data writing: the feature partition applies a hybrid encryption scheme to protect the feature stream content with symmetric encryption, and manages the symmetric key with asymmetric encryption; the parameter partition uses a hierarchical encryption mechanism, and the model weights and configuration information are protected with different keys.

[0095] A cross-partition feature index chain and a parameter version mapping table are established. The index chain covers the associated data in the feature partition: time-adjacent feature blocks establish a bidirectional linked list, and biological feature and environmental feature blocks establish cross-reference pointers. The index node contains feature type markers, time range identifiers, physical address pointers, and data check values. The parameter version mapping table maintains the association between the model parameters and the verification strategies: each model parameter version records the corresponding verification strategy version number, and the version number is bidirectionally traceable. The mapping table is stored in a key-value pair structure, with the model version hash value as the primary key and the strategy version metadata as the value. The index chain and the mapping table are persistently stored in a dedicated metadata storage engine and are cached in the in-memory database to accelerate access.

[0096] The partition storage path identifier is generated. The path identifier adopts a hierarchical coding structure: the first level identifies the storage node cluster, the second level identifies the partition type (feature / parameter), and the third level encodes the data version and timestamp. The feature partition path embeds the verification policy version identifier, and the parameter partition path contains the model architecture version mark. After the path identifier is generated, it is registered to the global naming service system to establish the mapping relationship between the path and the physical location. Finally, the path identifier set is output, including the feature partition main path, the parameter partition main path, and the corresponding backup path copy.

[0097] The verification collection module loads the historical verification features according to the partition storage path identifier. The loading process analyzes the path identifier structure: extracts the storage node cluster information to locate the physical storage location, identifies the partition type to filter the feature data, and reads the version identifier to match the time range. The feature retrieval is based on the time window parameter: the historical data of a certain period before the current time is obtained. Data decryption is performed immediately after reading: the symmetric key is obtained through a secure channel, and the decryption engine verifies the data integrity signature. The loaded historical verification features include multi-period biometric feature vectors, behavior trajectory sequences, and environmental parameter sets, which are organized into a historical feature cube according to the time axis.

[0098] The current device environment data and the historical behavior trajectory data are fused. The fusion operation is aligned in the time dimension: the current device environment data (including real-time device identifier, network status, and location coordinates) and the historical behavior trajectory (including operation event sequence, interface interaction log) are synchronized through timestamp interpolation. The spatial dimension fusion adopts a feature expansion mechanism: the historical behavior trajectory is supplemented with current device location data to generate an enhanced trajectory stream, and the current network parameter is expanded to the historical environment data set. The data conflict resolution strategy: when the historical trajectory deviates from the current location by more than a threshold value, the current data source is preferentially retained and the trajectory break point is marked. The fusion output is a spatiotemporally continuous feature set covering the evolution of device environment state and the transition of user behavior pattern.

[0099] Filter low-confidence biometric features according to the optimized verification policy version number. The filtering operation queries the policy library to obtain the version corresponding rule: load the confidence threshold table, which defines the minimum acceptable confidence score for different biometric feature types. The biometric feature confidence evaluation method: fingerprint features are scored according to ridge clarity, iris features are calculated based on texture contrast, and voiceprint features are graded according to signal-to-noise ratio. The filtering process scans the biometric feature data one by one: data points below the version threshold are marked as discarded; historical feature segments below the threshold for three consecutive periods are removed as a whole. The high-confidence biometric feature set is retained after filtering, with confidence score metadata.

[0100] The updated initial feature set is output. The feature set integrates the fused device environment data, historical behavior trajectory data, and filtered biometric feature data. The data structure is reorganized into a standardized format: the feature fields are arranged in a predetermined order, the timestamps are uniformly calibrated, and the null fields are filled with default parameters. The feature set is added with quality control labels: data integrity scores, confidence distribution values, and fusion processing logs. The final output is transmitted to the feature construction module through the system bus, and the transmission process uses a block verification mechanism to ensure data consistency. After the feature set is generated, the operation traceability record is updated, and the information of the verification strategy version, model version, and data loading path is associated to form a closed-loop processing chain.

[0101] It should be noted that the relational terms herein such as first and second and the like are used solely to distinguish one entity or action from another, without necessarily requiring or implying any such actual relationship or order between such entities or actions. Moreover, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus.

[0102] Although embodiments of the present application have been shown and described, it is to be understood that various modifications, substitutions, alternatives, and variations can be made in the embodiments without departing from the spirit and scope of the present application as defined by the appended claims and their equivalents.

Claims

1. A big data based multi-identity security verification system, characterized in that, Comprise: Verification collection module, obtain multi-source biological feature data, behavior trajectory data and device environment data of user, generate initial feature set after preprocessing; Feature construction module, receive the initial feature set, extract spatio-temporal behavior pattern features and cross-device association features, and fuse to generate a multi-dimensional feature matrix; Risk modeling module, load a pre-trained dynamic threat model, input the multi-dimensional feature matrix into the dynamic threat model for real-time risk stratification, output risk level identifier and abnormal feature vector; Decision engine module, according to the risk level identifier, call the corresponding verification strategy library, combine the abnormal feature vector to generate a multi-factor verification instruction set.

2. The big data based multiple identity security verification system according to claim 1, wherein, The feature construction module performs the following operations: Separate the biological feature subset, behavior trajectory subset and device environment subset from the initial feature set; Perform spatio-temporal continuity analysis on the behavior trajectory subset, extract high-frequency access area sequence and operation interval features; Perform cross-device association analysis on the device environment subset to generate device group trustworthiness parameters; Fuse the high-frequency access area sequence, operation interval features and device group trustworthiness parameters to construct the multi-dimensional feature matrix.

3. The big data based multiple identity security verification system according to claim 2, wherein, The risk modeling module performs the following operations: Load a pre-trained convolutional recurrent neural network model as the dynamic threat model; Divide the multi-dimensional feature matrix into continuous feature segments according to time window; Perform spatio-temporal anomaly detection on each feature segment through the convolutional recurrent neural network model, and output segment risk probability; Aggregate all segment risk probabilities and superimpose device group trustworthiness parameters to generate risk level identifier and abnormal feature vector.

4. The big data based multiple identity security verification system according to claim 3, wherein, The decision engine module performs the following operations: According to the risk level identifier, select the basic verification factor combination from the verification strategy library; Analyze the spatio-temporal anomaly dimensions in the abnormal feature vector, match the enhanced verification factors; Dynamically combine the basic verification factors and enhanced verification factors to generate the multi-factor verification instruction set.

5. The big data based multiple identity security verification system according to claim 4, wherein, Also include: Verification execution module, receive the multi-factor verification instruction set, dispatch biometric terminal, behavior verification engine and environment perception unit; Synchronously collect real-time iris features, voiceprint features, operation behavior sequence and device environment parameters; Generate real-time verification feature set and output verification response code.

6. The big data based multiple identity security verification system according to claim 5, wherein, Also include: Feedback learning module, receive the verification response code and real-time verification feature set; Compare the deviation parameters of the real-time verification feature set and the multi-dimensional feature matrix; According to the deviation parameters and verification response code, label the training samples of the dynamic threat model; Generate model update parameter set.

7. The big data based multiple identity security verification system according to claim 6, wherein, Also include: Strategy optimization module, receive the verification response code and model update parameter set; Analyze the verification response delay and misjudgment rate under different risk level identifiers; Adjust the factor combination weight and trigger threshold in the verification strategy library; Output the optimized verification strategy version number.

8. The big data based multiple identity security verification system according to claim 7, wherein, Also include: Data reconstruction module, receive the real-time verification feature set and optimized verification strategy version number; Clean up redundant environment parameters in the real-time verification feature set; Reorganize the biological feature priority according to the optimized verification strategy version number; Generate compressed verification feature stream.

9. The big data based multiple identity security verification system according to claim 8, wherein, Also include: A distributed storage module receives the compressed verification feature stream and the model update parameter set; The encrypted feature partition and the model parameter partition are divided; A cross-partition feature index chain and a parameter version mapping table are established; A partition storage path identifier is generated.

10. The big data based multiple identity security verification system according to claim 9, wherein, The verification collection module performs the following operations: Load historical verification features according to the partition storage path identifier; Fuse current device environment data and historical behavior trajectory data; Filter low-confidence biometric features according to the optimized verification strategy version number; Output the updated initial feature set.

Images