Attack detection method, electronic device, and computer-readable storage medium

Abstract

The present application provides an attack detection method, an electronic device and a computer-readable storage medium, wherein the method comprises: obtaining first-category data corresponding to an object to be tested, wherein the first-category data comprises: behavior-related data of the object to be tested, device-related data of a device used to detect the object to be tested and at least one of the object information of the object to be tested; performing attack risk detection on the object to be tested based on the first-category data; if the detection result indicates that the object to be tested does not have an attack risk, performing liveness detection on the object to be tested based on the acquired second-category data of the object to be tested and a corresponding liveness detection model; wherein the second-category data comprises image data of a specified part of the object to be tested.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to an attack detection method, an electronic device, and a computer-readable storage medium. Background Art

[0002] There are many potential hazards in the Internet environment. Therefore, in order to improve the security of services implemented on the Internet, identity authentication is usually required before providing services.

[0003] In the prior art, when authenticating a user, in order to improve the reliability of authentication, it is usually necessary to perform liveness detection on the user. However, current liveness detection is generally performed through models, which requires a relatively large amount of calculation, and the same liveness detection mode may not be able to meet the detection requirements of different detection environments. Therefore, there is an urgent need for a technical solution with higher reliability for authenticating users. Summary of the invention

[0004] The purpose of the present application is to provide an attack detection method, an electronic device and a computer-readable storage medium to improve the problem of low reliability of existing detection methods.

[0005] In a first aspect, the present invention provides an attack detection method, comprising: obtaining a first category of data corresponding to an object to be tested, the first category of data comprising: behavior-related data of the object to be tested, device-related data of a device used to detect the object to be tested, and at least one of object information of the object to be tested; performing attack risk detection on the object to be tested based on the first category of data; if the detection result indicates that the object to be tested does not have an attack risk, performing liveness detection on the object to be tested based on the acquired second category of data of the object to be tested and a corresponding liveness detection model; wherein the second category of data comprises image data of a specified part of the object to be tested.

[0006] In an optional embodiment, the obtaining of the first category data corresponding to the object to be tested includes: respectively collecting the first category data corresponding to the object to be tested in different detection stages; wherein the detection stage includes the image acquisition quality detection stage and the object information detection stage; the performing attack risk detection on the object to be tested based on the first category data includes: respectively performing attack risk detection on the object to be tested based on the first category data collected in each detection stage.

[0007] In an optional embodiment, the detection result includes a risk prediction score; the attack risk detection of the object to be tested based on the first category of data includes: judging whether the first category of data is abnormal according to the target rule; wherein the target rule includes at least one of the following rules: the first category of data is within the target numerical range or the first category of data contains the target field; if so, it is determined that the object to be tested has an attack risk; otherwise, the first category of data is detected using a risk prediction model to obtain a risk prediction score; wherein, when the risk prediction score is less than a first threshold, it indicates that the object to be tested does not have an attack risk.

[0008] In an optional embodiment, the detection result includes a risk prediction score; the liveness detection of the object to be tested based on the acquired second type of data of the object to be tested and the corresponding liveness detection model includes: if the risk prediction score is less than a second threshold, using a first liveness detection model to perform liveness detection on the object to be tested based on the second type of data, and the second threshold is less than the first threshold; if the risk prediction score is greater than the second threshold and less than the first threshold, using a second liveness detection model to perform liveness detection on the object to be tested based on the second type of data, the pass rate of the first liveness detection model is greater than the pass rate of the second liveness detection model, and the detection rate of the second liveness detection model is greater than the detection rate of the first liveness detection model.

[0009] In an optional embodiment, the first category of data includes behavior-related data of the object to be tested collected during the image acquisition quality detection phase; the behavior-related data includes at least one of equipment adjustment operation behavior data, image acquisition times, and time spent on image acquisition; judging whether the first category of data has an abnormality according to the target rule includes: judging whether the number of errors in equipment adjustment operations is greater than an abnormality times threshold based on the equipment adjustment operation behavior data, and if so, determining that the first category of data has an abnormality; or, judging whether the number of image acquisitions is greater than an image acquisition times threshold, and if so, determining that the first category of data has an abnormality; or, judging whether the time spent on image acquisition is greater than an image acquisition time threshold, and if so, determining that the first category of data has an abnormality.

[0010] In an optional embodiment, the first category of data includes object information of the object to be tested collected during the object information detection stage, and / or behavior information of the object to be tested collected during the object information detection stage, the object information including: account information of the object to be tested, the behavior information of the object to be tested including: at least one item of IP address verification information of the device used by the object to be tested; judging whether the first category of data has an abnormality according to the target rule includes: judging whether there is an abnormal field in the account information of the object to be tested, and if so, determining that the first category of data has an abnormality; or, judging whether the number of verifications initiated by the IP address within a first specified time period exceeds a verification number threshold based on the IP address verification information of the device used by the object to be tested, and if so, determining that the first category of data has an abnormality.

[0011] In an optional embodiment, the first category of data includes device-related data of the device used by the object to be detected collected during the object information detection phase, and the device-related data includes: at least one of device model data, operating system data and system permission data; the determining whether the first category of data has an abnormality according to the target rule includes: determining whether the device model data belongs to one in a risk device model set, and if so, determining that the first category of data has an abnormality; or, determining whether the operating system data belongs to one in a risk system version set, and if so, determining that the first category of data has an abnormality; or, determining whether the permissions of the device used by the object to be detected exceed the safe operating range based on the system permission data, and if so, determining that the first category of data has an abnormality; wherein the frequency of attacks initiated by devices corresponding to models in the risk device model set is greater than a first specified value.

[0012] In an optional embodiment, before performing liveness detection on the object to be tested based on the acquired second category data of the object to be tested and the corresponding liveness detection model, the method also includes: determining data-related information of the second category data; wherein the data-related information includes at least image size information and image copyright information; performing attack risk detection on the object to be tested according to a second target rule based on the data-related information; if the verification result indicates that there is no attack risk for the object to be tested, executing the step of performing liveness detection on the object to be tested based on the acquired second category data of the object to be tested and the corresponding liveness detection model.

[0013] In an optional embodiment, the attack risk detection is performed on the object to be tested based on the data-related information according to the second target rule, including: judging whether one or more image data in the second category of data are copied images based on the image copyright information; judging whether the size of one or more image data in the second category of data is within a set size limit range based on the image size information; if one or more image data in the second category of data are copied images, or the size of one or more image data in the second category of data is within a set size limit range, then the verification result representing the second category of data indicates that the object to be tested is subject to an attack risk.

[0014] In an optional embodiment, the set size is determined by: obtaining a verification data set, the verification data set including a plurality of real-person images and a plurality of attack images; determining size distribution data of the verification data set based on the size of each of the real-person images and the size of each of the attack images in the verification data set; determining the set size based on the size distribution data, wherein the number of attack images within a limited range of the set size is greater than the number of the real-person images.

[0015] In a second aspect, the present invention provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the method described in any one of the aforementioned embodiments.

[0016] In a third aspect, the present invention provides a computer-readable storage medium having a computer program or computer instructions stored thereon, which, when executed by a processor, implements the method described in any one of the aforementioned embodiments.

[0017] In a fourth aspect, the present invention provides a computer program product, comprising a computer program or computer instructions, which, when executed by a processor, implements the method described in any one of the aforementioned embodiments.

[0018] The beneficial effects of the embodiments of the present application include: before using the liveness detection model to perform liveness detection on the object to be tested, firstly perform attack risk detection on the object to be tested based on the first type of data such as the behavior-related data of the object to be tested, the device-related data of the device used, and the object information, and then perform liveness detection through the liveness detection model when the object to be tested does not have an attack risk through the first type of data detection. The accuracy of the detection result of the object to be tested can be improved by combining attack risk detection and liveness detection. At the same time, when the attack risk is detected through the first type of data, it is not necessary to perform liveness detection through the liveness detection model, so that the detection of the liveness detection model can be interrupted in time, the useless consumption of computing resources can be reduced, and the computing effectiveness can be improved. Furthermore, since the first type of data of the object to be tested is subjected to risk identification, it can be better detected whether there is a risk in the verification environment provided by the object to be tested. The detection process takes the risk of the environment into consideration. Therefore, the detection result of the attack detection method of the embodiment of the present application is more reliable. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 A block diagram of an electronic device provided in an embodiment of the present application;

[0021] Figure 2 A flowchart of an attack detection method provided in an embodiment of the present application;

[0022] Figure 3 An optional flow chart of step 230 of the attack detection method provided in an embodiment of the present application;

[0023] Figure 4 A partial flow chart of the attack detection method provided in the embodiment of the present application;

[0024] Figure 5 A flow chart for determining a set size in an attack detection method provided in an embodiment of the present application;

[0025] Figure 6 A schematic diagram of the size distribution of a validation data set in an example;

[0026] Figure 7 Another flow chart of the attack detection method provided in the embodiment of the present application;

[0027] Figure 8A schematic diagram of the functional modules of the attack detection device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0028] The technical solutions in the embodiments of the present application will be described below in conjunction with the accompanying drawings in the embodiments of the present application.

[0029] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0030] In recent years, research on computer vision, deep learning, machine learning, image processing, image recognition and other technologies based on artificial intelligence has made important progress. Artificial Intelligence (AI) is an emerging science and technology that studies and develops theories, methods, technologies and application systems for simulating and extending human intelligence. Artificial intelligence is a comprehensive discipline involving many types of technologies such as chips, big data, cloud computing, the Internet of Things, distributed storage, deep learning, machine learning, neural networks, etc. Computer vision, as an important branch of artificial intelligence, specifically allows machines to recognize the world. Computer vision technology usually includes face recognition, liveness detection, fingerprint recognition and anti-counterfeiting verification, biometric recognition, face detection, pedestrian detection, target detection, pedestrian recognition, image processing, image recognition, image semantic understanding, image retrieval, text recognition, video processing, video content recognition, 3D reconstruction, virtual reality, augmented reality, simultaneous positioning and map construction, computational photography, robot navigation and positioning and other technologies. With the research and progress of artificial intelligence technology, this technology has been applied in many fields, such as security control, urban management, traffic management, building management, park management, face access, face attendance, logistics management, warehouse management, robots, intelligent marketing, computational photography, mobile phone imaging, cloud services, smart homes, wearable devices, unmanned driving, automatic driving, smart medical care, face payment, face unlocking, fingerprint unlocking, identity verification, smart screen, smart TV, camera, mobile Internet, live broadcast, beauty, beauty, medical beauty, intelligent temperature measurement, etc. The image retrieval method in the embodiment of this application also belongs to the category of artificial intelligence technology.

[0031] Currently, many types of services can be implemented through Internet technology, such as financial transactions, communications, social services, etc. In order to ensure the safe implementation of these services, identity verification is usually required. In order to meet the identity verification needs of these services, various identity verification systems have also emerged.

[0032] The inventor has learned from research that the common identity verification systems currently on the market generally use a variety of visual recognition methods such as liveness detection of the subject to be tested based on the image of the subject to be tested, face comparison based on the image of the subject to be tested, etc. to determine whether the image of the subject to be tested who is using the service is the person himself. However, this visual recognition method can achieve detection related to the image of the subject to be tested, but it is difficult to know other possible attack behaviors of the subject to be tested.

[0033] Based on the above research, the present application provides an attack detection method, an electronic device and a computer-readable storage medium. The attack detection method not only performs liveness detection on the object to be detected, but also detects other peripheral data of the object to be detected to improve the reliability of attack behavior detection of the object to be detected.

[0034] To facilitate understanding of this embodiment, first, an electronic device that executes the attack detection method disclosed in the embodiment of the present application is introduced in detail.

[0035] like Figure 1 , which is a block diagram of an electronic device. The electronic device 100 may include a memory 111, a storage controller 112, a processor 113, a peripheral interface 114, an input and output unit 115, and a display unit 116. A person skilled in the art may understand that Figure 1 The structure shown is only for illustration and does not limit the structure of the electronic device 100. For example, the electronic device 100 may further include Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0036] The memory 111, storage controller 112, processor 113, peripheral interface 114, input / output unit 115 and display unit 116 are electrically connected to each other directly or indirectly to achieve data transmission or interaction. For example, these components can be electrically connected to each other via one or more communication buses or signal lines. The processor 113 is used to execute the executable module stored in the memory.

[0037] The memory 111 may be, but not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable read-only memory (EEPROM), etc. The memory 111 is used to store programs, and the processor 113 executes the program after receiving the execution instruction. The method executed by the electronic device 100 defined by the process disclosed in any embodiment of the present application can be applied to the processor 113, or implemented by the processor 113.

[0038] The processor 113 may be an integrated circuit chip with signal processing capability. The processor 113 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application may be implemented or executed. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0039] The peripheral interface 114 couples various input / output devices to the processor 113 and the memory 111. In some embodiments, the peripheral interface 114, the processor 113 and the memory controller 112 can be implemented in a single chip. In other embodiments, they can be implemented by separate chips.

[0040] The input and output unit 115 is used to provide input data to the user. The input and output unit 115 can be, but is not limited to, a mouse and a keyboard.

[0041] The display unit 116 provides an interactive interface (e.g., a user operation interface) between the electronic device 100 and the user or is used to display image data for the user's reference. In this embodiment, the display unit may be a liquid crystal display or a touch display. If it is a touch display, it may be a capacitive touch screen or a resistive touch screen that supports single-point and multi-point touch operations. Supporting single-point and multi-point touch operations means that the touch display can sense touch operations generated simultaneously from one or more positions on the touch display, and the sensed touch operations are handed over to the processor for calculation and processing.

[0042] Optionally, the electronic device 100 may further include a camera for capturing images or videos, and the captured images or frames in the videos may be used as images required in the attack detection method provided in the embodiments of the present application.

[0043] The electronic device 100 in this embodiment can be used to execute each step in each method provided in the embodiments of the present application. The implementation process of the attack detection method is described in detail below through several embodiments.

[0044] See also Figure 2 , is a flow chart of the attack detection method provided in the embodiment of the present application. The steps in the attack detection method in this embodiment can be represented by Figure 1 The electronic device shown is executed. Figure 2 As shown, the attack detection method of the embodiment of the present application may include the following steps: step 210, obtaining the first type of data corresponding to the object to be tested; step 230, performing attack risk detection on the object to be tested based on the first type of data, if the detection result indicates that the object to be tested does not have an attack risk, step 250 can be executed; step 250, performing liveness detection on the object to be tested based on the acquired second type of data of the object to be tested and the corresponding liveness detection model.

[0045] In some optional implementations, step 210 may be implemented in the following manner:

[0046] The first category of data mentioned above may include at least one of: behavior-related data of the object to be tested, device-related data of a device used to detect the object to be tested, and object information of the object to be tested.

[0047] Optionally, the first type of data corresponding to the object to be tested may be collected at different detection stages to obtain behavior-related data of the object to be tested, device-related data of a device used to detect the object to be tested, and object information of the object to be tested.

[0048] The detection stage includes an image acquisition quality detection stage and an object information detection stage.

[0049] Optionally, data may be collected during the image acquisition quality detection phase to obtain behavior-related data of the object to be tested.

[0050] Exemplarily, when collecting the object to be tested, if the collection environment does not meet the collection requirements, the electronic device can output a first prompt message to prompt the object to be tested to adjust the electronic device to make the collection environment meet the requirements. For example, the collection mode of the camera of the current electronic device can be a non-portrait model such as panoramic view and video, and the first prompt message can be a prompt message for adjusting the collection mode to prompt the object to be tested to adjust the collection mode to a portrait mode. For another example, the light in the collection environment of the current electronic device is dim, and the first prompt message can be a prompt message for adjusting the light to prompt the object to be tested to turn on the light or increase the brightness of the light. Therefore, after the electronic device outputs the first prompt message, the operation data of the object to be tested on the electronic device can be collected. The operation data may include mode adjustment data, light operation data, etc.

[0051] Exemplarily, when collecting data on the object to be measured, if the position of the object to be measured in front of the camera does not meet the requirements, the electronic device can output a second prompt message to prompt the object to be measured to adjust the shooting angle. For example, the second prompt message can be "please move to the left", or "please move the device to the right". For another example, the second prompt message can be "please step back to put the face into the specified frame", or "please move the device away to put the face into the specified frame". Therefore, after the electronic device outputs the second prompt message, the position change data presented by the object to be measured can be collected.

[0052] Optionally, data from the object information detection phase may be collected to obtain device-related data and object information used by the object to be detected.

[0053] The device-related data may include device model data, device brand, operating system data, system permission data, etc.

[0054] The attack detection method in this embodiment can be used in any scenario that requires identity authentication. For example, the attack detection method can be used in a network service. Before obtaining the network service, it is necessary to log in to the network service through an account. The account information, IP address, etc. used to log in to the network service can be obtained.

[0055] In some optional implementations, step 230 may be implemented in the following manner:

[0056] In this embodiment, attack risk detection can be performed on the object to be detected based on the first type of data collected in each detection stage.

[0057] Optionally, it is possible to determine whether the first category of data is abnormal by using a target rule. Exemplarily, each parameter in the first category of data may be compared with a parameter standard. If any parameter is not within its corresponding parameter standard, it may indicate that the object to be tested is at risk of attack. Exemplarily, each parameter in the first category of data may be compared with a parameter standard. If more than a specified number of parameters are not within their corresponding parameter standards, it may indicate that the object to be tested is abnormal. The specified number may be a value set as needed, for example, the specified number may be 2, 3, 4, etc.

[0058] The parameter standard can be a target value range or whether the target field is included.

[0059] Exemplarily, the behavior-related data in the first category of data may include: mode adjustment data, light operation data, and position change data; the target numerical range of the behavior-related data may include a target numerical range determined by a number threshold, for example, the target numerical range determined by the number threshold may be a range less than the number threshold. It is possible to determine whether the behavior data such as mode adjustment data, light operation data, and position change data are the same as the action indicated by the prompt message of the electronic device, and whether the number of times that the action indicated by the prompt message of the electronic device is different is within the target numerical range defined by the number threshold, so as to realize the attack risk detection of the object to be tested based on the behavior-related data of the object to be tested. For example, if the number of times that the action indicated by the prompt message of the electronic device is different is greater than the number threshold, it is determined that the detection result of the attack risk detection of the object to be tested is abnormal.

[0060] Exemplarily, the target numerical range of the device-related data may be a set device data set; if the device-related data is not in the set device data set, it may be determined that the device-related data of the object to be tested is abnormal. In one example, the device corresponding to any device data in the set device data set has not launched an attack within the second specified time period. Alternatively, in another example, the number of attacks launched by the device corresponding to any device data in the set device data set within the second specified time period is less than the first attack threshold. The second specified time period may be within one month, within two months, within ten days, etc.; the first attack threshold may be a smaller value, for example, the first attack threshold may be 2, 3, 4, etc.

[0061] Exemplarily, the device-related data in the first category of data may include: device model, device brand, and device operating system. The above-mentioned set device data set may include: a set device model subset, a set device brand subset, and a set device operating system subset. The device model data may be compared with the set device model subset, the device brand to be tested may be compared with the set device brand subset, and the device operating system may be compared with the set device operating system subset, so as to realize attack risk detection of the object to be tested based on the device-related data of the object to be tested.

[0062] Exemplarily, the device-related data in the first category of data may also include device system permissions. The parameter standard of the device system permissions may also be whether it is rooted. If the device system permissions of the device used by the object to be tested are rooted, it may indicate that there is an abnormality in the device system permissions.

[0063] In one example, if an electronic device of device model a in device brand A has launched an attack within a second specified time period, or the number of attacks launched within the second specified time period is greater than or equal to a first attack threshold, device brand A can be removed from the set device brand subset, and device model a can be removed from the set device model subset.

[0064] In this embodiment, the above-mentioned set device brand subset and set device model subset can be adaptively adjusted according to the real-time attack situation.

[0065] Exemplarily, the target numerical range of the object information may be a set object information set; if the object information is not in the set object information set, it may be determined that the object information is abnormal. In one example, a device that logs in to any object information in the set object information set has not launched an attack within a third specified time period. Alternatively, in another example, the number of attacks launched by a device that logs in to any object information in the set object information set within the third specified time period is less than a second attack threshold. The third specified time period may be within one month, two weeks, ten days, etc.; the second attack threshold may be a smaller value, for example, the attack threshold may be 2, 3, 4, 5, etc.

[0066] Exemplarily, the object information in the first category of data may include: account information and Internet Protocol (IP) address of the object to be tested. The above-mentioned set object information set may include a set account subset and a set IP address subset. The account information of the object to be tested may be compared with the set account subset, and the IP address may be compared with the set IP address subset to achieve attack risk detection of the object to be tested based on the object information of the object to be tested.

[0067] In one instance, if the IP address of the device logged in to the user account Ua is P1, and an attack has been launched within a third specified time period, or the number of attacks launched within the third specified time period is greater than or equal to the second attack threshold, the user account Ua can be removed from the set account subset, and the IP address P1 can be removed from the set IP address subset.

[0068] In this embodiment, the above-mentioned set account subset and set IP address set can be adaptively adjusted according to the real-time attack situation.

[0069] As the detection requirements change, the parameters included in the first category of data may be more or less. For example, the device-related data in the first category of data may also include: the price of the device on the market, the date of the device on the market, etc. The object information in the first category of data may also include: whether the IP address is a proxy, the number of times the IP address is used to initiate verification on the same day, the number of IP addresses used by the account information of the object to be tested on the same day, the number of times the account information of the object to be tested initiates verification within the fourth specified time period, etc. Some parameters in the first category of data may be selected for detection according to actual verification requirements.

[0070] Optionally, data features may be extracted from the first type of data, and the data features may be input into a risk prediction model for detection to determine whether the object to be detected has an attack risk.

[0071] Exemplarily, some parameters can be selected from multiple parameters in the first category of data, data features can be extracted based on the some parameters, and then the data features can be detected using a risk prediction model to determine whether the object to be tested has an attack risk. Among them, the some parameters can be parameters in the device-related data and object information of the object to be tested. For example, the some parameters may include: device operating system, device system permissions, device market price, device market launch date, account information of the object to be tested, the number of times an IP address is used to initiate verification on the same day, the number of IP addresses used by the account information of the object to be tested on the same day, and the number of times the account information of the object to be tested initiates verification within the fourth specified time period. One or more parameters.

[0072] Exemplarily, the risk prediction model may be a binary classification model, and the output result of the binary classification model may include two types of detection results: risk exists and risk does not exist.

[0073] Exemplarily, the binary classification model may be a model trained using behavior-related data, device-related data, object information, and other data.

[0074] Exemplarily, the risk prediction model may also be a probability estimation model, and the output result of the probability estimation model may include the probability of the existence of risk.

[0075] In some optional implementations, step 250 may be implemented in the following manner:

[0076] The second type of data mentioned above includes image data of a designated part of the object to be tested, which may be the face, fingerprint, pupil, etc. of the object to be tested.

[0077] Optionally, liveness detection may be performed on the object to be detected based on the second type of data of the object to be detected by using a liveness detection model.

[0078] The liveness detection model can be a neural network model, and the image data of the specified part can be input into the liveness detection model, and the liveness detection model can output the detection result. Exemplarily, the detection result can include multiple categories and the probabilities corresponding to each category. For example, the multiple categories can include real people and attack graphs. In one example, the output of the liveness detection model is: the probability of a real person is 80%, and the probability of an attack graph is 20%. In this example, it can be determined that the detection result is real person verification. In another example, the output of the liveness detection model is: the probability of a real person is 10%, and the probability of an attack graph is 90%. In this example, it can be determined that the detection result is an attack behavior.

[0079] In the above steps, before performing liveness detection on the object to be tested, the attack risk detection is first performed on other relevant information of the object to be tested, and liveness detection is performed when the detection shows that there is no attack risk. This can improve the accuracy of the detection result of the object to be tested, and can also interrupt the liveness detection in time when there is a risk of the object to be tested, reduce the useless consumption of computing resources, and improve the computing effectiveness. Furthermore, that is, when the attack risk detection of other relevant information shows that there is an attack risk, the subsequent detection can be interrupted in time to reduce the waste of computing resources.

[0080] In one embodiment, see Figure 3 As shown, the above-mentioned step 230 may include the following steps: step 231, judging whether there is an anomaly in the first category of data according to the target rule; if so, determining that the object to be tested has an attack risk; otherwise, executing step 232; step 232, using the risk prediction model to detect the first category of data to obtain a risk prediction score.

[0081] The target rule includes at least one of the following rules: the first type of data is within a target value range or the first type of data contains a target field.

[0082] The implementation of step 231 may refer to the above description on the use of the target rule in step 230, which will not be repeated here.

[0083] Among them, a higher risk prediction score can indicate that the detection result of the first type of data indicates that the probability of the object to be tested having an attack risk is higher, and a lower risk prediction score can indicate that the detection result of the first type of data indicates that the probability of the object to be tested having an attack risk is lower. Based on this, when the risk prediction score is less than the first threshold, it can be indicated that the object to be tested does not have an attack risk.

[0084] The first threshold value may be set as required, for example, the first threshold value may be 80%, 85%, 90%, etc.

[0085] The risk prediction model may be trained using a training data set. The training data set may be composed of historical data. The historical data may be data involved in a historical liveness detection environment.

[0086] Exemplarily, each piece of training data may include: device operating system, device system permissions, device market price, device market launch date, account information of the object to be tested, the number of times an IP address is used to initiate verification on that day, the number of IP addresses used by the account information of the object to be tested on that day, the number of times the account information of the object to be tested initiates verification within a fourth specified time period, and one or more of the following parameters.

[0087] In the above steps, the target rule can be used to determine whether the first type of data is abnormal. On the basis that the first type of data is not abnormal, the risk prediction model can be used to predict the risk. The double detection method can improve the accuracy of attack risk prediction. Furthermore, since the risk prediction model is used to predict on the basis that the first type of data is not abnormal, the use efficiency of computing resources can be improved and the waste of computing resources can be reduced.

[0088] Considering different scenarios, there are different requirements for liveness detection rates. For example, if the detection result of the first category of data indicates that the probability of the object to be tested having an attack risk is lower, then the risk of the object to be tested having an attack risk is also relatively low, and a liveness detection model with a higher pass rate can be used. For another example, if the detection result of the first category of data indicates that the probability of the object to be tested having an attack risk is higher, but it is not higher than the set first threshold, then the risk of the object to be tested having an attack risk is also relatively medium, and a liveness detection model with a lower pass rate can be used. Based on this, step 250 may include: if the risk prediction score is less than the second threshold, using the first liveness detection model to perform liveness detection on the object to be tested based on the second category of data; if the risk prediction score is greater than the second threshold and less than the first threshold, using the second liveness detection model to perform liveness detection on the object to be tested based on the second category of data.

[0089] Among them, the second threshold may be smaller than the first threshold, the pass rate of the first liveness detection model is greater than the pass rate of the second liveness detection model, and the detection rate of the second liveness detection model is greater than the detection rate of the first liveness detection model.

[0090] Optionally, the first liveness detection model and the second liveness detection model may be models trained using the same neural network, except that the first liveness detection model and the second liveness detection model have different exit criteria for training. For example, during the training of the first liveness detection model, the exit criterion for training may be that the error is less than a first error threshold, and during the training of the second liveness detection model, the exit criterion for training may be that the error is less than a second error threshold. The first error threshold is greater than the second error threshold.

[0091] Optionally, the first liveness detection model and the second liveness detection model may be models trained using different neural networks, wherein the neural network used by the second liveness detection model is more complex and has more structural levels than the neural network used by the first liveness detection model.

[0092] Of course, more liveness detection models can be configured for different usage scenarios to match different risk prediction scores. For example, three, four, five, or more liveness detection models can be pre-set, and different liveness detection models can be configured for different risk prediction scores.

[0093] Through the above method, multiple liveness detection models are pre-configured. When there are different attack risk probabilities for the objects to be tested, liveness detection models with different pass rates can be selected to match a more suitable liveness detection model and use computing resources reasonably. While improving the accuracy of attack detection, it can also reduce the waste of computing resources.

[0094] In one embodiment, the first type of data includes behavior-related data of the object to be tested collected during the image acquisition quality detection phase; the behavior-related data includes at least one of the following data: device adjustment operation behavior data, image acquisition times, and time spent on image acquisition. Step 231 may include: judging whether the number of errors in device adjustment operation is greater than an abnormal number threshold based on the device adjustment operation behavior data, and if so, determining that the first type of data is abnormal; or judging whether the number of image acquisitions is greater than an image acquisition times threshold, and if so, determining that the first type of data is abnormal; or judging whether the time spent on image acquisition is greater than an image acquisition time threshold, and if so, determining that the first type of data is abnormal.

[0095] Exemplarily, the device adjustment operation may be an adjustment operation performed according to a prompt message output by the electronic device. If the device adjustment operation is different from the operation indicated by the prompt message output by the electronic device, it indicates that there is an error in the device adjustment operation.

[0096] For example, if the electronic device prompts to brighten the lights, but the device adjustment operation received is a dimming operation, or other non-light adjustment operation, it can be determined that there is an error in the device adjustment operation.

[0097] For another example, the electronic device prompts to put a portrait into a specified frame, but the received operation results in less portrait content in the specified frame, then it can be determined that there is an error in the device adjustment operation.

[0098] The above-mentioned abnormal number threshold can be set as needed. For example, the abnormal number threshold can be 5, 8, 10, etc.

[0099] Exemplarily, the number of times of collecting images may represent the number of times of collecting images of the object to be detected during the attack detection behavior.

[0100] The image acquisition times threshold can be set as needed. For example, the image quality acquired by the camera of some electronic devices is relatively poor, and the image acquisition times threshold can be set to a larger value, for example, the image acquisition times threshold can be set to 6, 7, 8, etc. For another example, the image quality acquired by the camera of some electronic devices is relatively good, and the image acquisition times threshold can be set to a smaller value, for example, the image acquisition times threshold can be set to 3, 4, 5, etc.

[0101] The above-mentioned image acquisition time threshold can be set to different values ​​according to different user habits. For example, some users usually take a long time to take pictures, for example, usually it only takes 3 minutes, 4 minutes, etc., then the image acquisition time threshold corresponding to such users can be set to a longer threshold, for example, 5 minutes, 6 minutes, 7 minutes, etc. For another example, some users usually take a short time to take pictures, for example, usually it only takes 5 seconds, 10 seconds, etc., then the image acquisition time threshold corresponding to such users can be set to a longer threshold, for example, 1 minute, 2 minutes, 90 seconds, etc.

[0102] In one embodiment, the first category of data includes object information of the object to be tested collected during the object information detection phase, and / or behavior information of the object to be tested collected during the object information detection phase, the object information includes: account information of the object to be tested, and the behavior information of the object to be tested includes: at least one item of IP address verification information of the device used by the object to be tested. Step 231 may include: determining whether there is an abnormal field in the account information of the object to be tested, and if so, determining that the first category of data is abnormal; or, based on the IP address verification information of the device used by the object to be tested, determining whether the number of verifications initiated by the IP address within the first specified time period exceeds the verification number threshold, and if so, determining that the first category of data is abnormal.

[0103] Exemplarily, the abnormal field may be a field that does not appear in the account information. For example, the account information may be an ID card number, and the abnormal field may be a field that is not included in the address field. For example, the characters at the address character position in the account information of the object to be tested cannot represent any geographical location.

[0104] Exemplarily, the abnormal field may be a blacklist field that has been marked. For example, if the user account is a mobile phone number, the abnormal field may be a field that often appears in the mobile phone number marked as blacklisted.

[0105] The first specified time period may be within one hour, within one day, within two days, or the like.

[0106] The verification times threshold can be set as needed, for example, the verification times threshold can be 5, 10, 15, etc.

[0107] In one embodiment, the first category of data includes device-related data of the device used by the object to be detected collected during the object to be detected information detection phase, and the device-related data includes: at least one of device model data, operating system data, and system permission data. Step 231 may include: determining whether the device model data belongs to one of the risk device model sets, and if so, determining that the first category of data is abnormal; or, determining whether the operating system data belongs to one of the risk system version sets, and if so, determining that the first category of data is abnormal; or, determining whether the permissions of the device used by the object to be detected exceed the safe operation range based on the system permission data, and if so, determining that the first category of data is abnormal.

[0108] Among them, the frequency of attacks launched by devices corresponding to models in the risk device model set is greater than the first specified value. If the operating system of a device is an operating system in the risk system version set, the frequency of attacks launched by the device is greater than the first specified value.

[0109] The system permission data may include whether the device used by the object to be tested includes root permission. The safe operation range may indicate the permission range of the device that is not rooted.

[0110] The risky device model set may be determined based on historical verification data, and the devices of the device models in the risky device model set have all launched multiple attacks.

[0111] Optionally, the device models in the risky device model set may also be adjusted as needed. For example, if a device of a certain device model has not launched an attack within a period of time, the device model may be removed from the risky device model set.

[0112] In order to reduce the probability of invalid liveness detection, the second type of data can be tested for attack risks before liveness detection. Figure 4 As shown, before step 250, the attack detection method may also include: step 241, determining data-related information of the second category of data; step 242, performing attack risk detection on the object to be tested according to the second target rule based on the data-related information; if the verification result indicates that the object to be tested does not have an attack risk, execute step 250.

[0113] The data-related information includes at least image size information and image copyright information.

[0114] Optionally, step 242 may include: determining whether one or more image data in the second category of data are copied images based on the image copyright information; and determining whether the size of one or more image data in the second category of data is within a set size limit range based on the image size information.

[0115] If one or more image data in the second category of data is a duplicate image, or the size of one or more image data in the second category of data is within a set size limit range, the verification result representing the second category of data indicates that the object to be tested has an attack risk.

[0116] Exemplarily, the copyright field is carried in the image copyright information, which can indicate whether one or more image data in the second category of data are copied images.

[0117] For example, if the difference between the width of an image data in the second category of data and the width of the set size is smaller than a threshold, and the difference between the height and the height of the set size is also smaller than a threshold, it can be indicated that the image data is within the limited range of the set size.

[0118] This embodiment is not limited to the order of step 241 and step 242 and step 230. For example, step 241 and step 242 may be performed after step 230. For another example, step 241 and step 242 may be performed before step 230.

[0119] In one embodiment, if Figure 5 As shown, the set size is determined by the following method: Step 310, obtaining a verification data set; Step 320, determining the size distribution data of the verification data set according to the size of each real-person image and the size of each attack image in the verification data set; Step 330, determining the set size according to the size distribution data.

[0120] The verification data set includes a plurality of real-person images and a plurality of attack images, and the number of attack images within the set size limit is greater than the number of the real-person images.

[0121] Optionally, the verification data set may be clustered in a clustering manner to classify the verification data set, and a type of image data including only attack graphs may be selected to determine the set processing.

[0122] Optionally, a coordinate system with the width and height of the image may be constructed, and each image in the verification data set may be projected into the coordinate system with the width and height of the image, and the set size may be determined based on the distribution in the coordinate system.

[0123] like Figure 6 As shown, a schematic diagram of the size distribution of a validation data set in an example is shown. Figure 6 Each point in the image can represent the size of an image data, where the ordinate of the point represents the width of the image represented by the point, and the abscissa of the point represents the height of the image represented by the point. The points in the area from the origin to the upper right corner include multiple attack images and multiple real-person images. The circle in the lower right corner can represent the size of multiple attack images, and you can select a size from the circle in the lower right corner as the set size.

[0124] Through the method in the embodiment of the present application, before performing liveness detection, the first category of data and the second category of data can be tested for attack risks. After the detection is passed, liveness detection with relatively larger computational complexity can be used, which can reduce the waste of computing resources and improve the detection accuracy.

[0125] Combine the following Figure 7 Introduce the exemplary full process of the attack detection method provided in the embodiment of the present application: Figure 7 In the example shown, the attack detection method can be divided into two parts, the first part is the risk perception part, and the second part is the liveness detection part.

[0126] In the risk perception part, data from the image acquisition quality detection phase and data from the object information detection phase can be collected respectively, and it can be determined whether the image acquisition phase and the object information detection phase meet the requirements respectively.

[0127] The data in the image acquisition quality detection phase may include: behavior-related data of the object to be tested. Whether the behavior-related data of the object to be tested meets the requirements can be referred to the relevant description in the previous embodiment, which will not be repeated here.

[0128] Among them, the data in the information detection phase of the object to be tested may include: object information of the object to be tested, behavior information of the object to be tested, etc.; the object information includes: account information of the object to be tested, and the behavior information of the object to be tested includes: IP address verification information of the device used by the object to be tested, etc.

[0129] Regarding whether the account information of the object to be tested and the IP address verification information of the device used by the object to be tested meet the requirements, please refer to the relevant description in the previous embodiment, which will not be repeated here.

[0130] If the data in the image acquisition quality detection phase or the data in the object information detection phase do not meet the requirements, the attack detection process is terminated and the result of failure of the detection is output.

[0131] If the data in the image acquisition quality detection phase and the data in the object information detection phase meet the requirements, part or all of the data in the image acquisition quality detection phase and the data in the object information detection phase can be input into the risk prediction model for risk prediction to obtain a risk prediction score. Among them, the higher the risk prediction score, the higher the probability that the object to be tested will launch an attack. If the risk prediction score is greater than the first threshold, the attack detection process can be terminated and the result of failure of the detection can be output. If the risk prediction score is not greater than the first threshold, the subsequent selection process of the liveness detection model can be entered.

[0132] In this embodiment, before performing risk detection on the data in the image acquisition quality detection stage and the data in the information detection stage of the object to be measured, or after performing risk detection on the data in the image acquisition quality detection stage and the data in the information detection stage of the object to be measured, or during the process of performing risk detection on the data in the image acquisition quality detection stage and the data in the information detection stage of the object to be measured, the image data detection of the object to be measured can be started to determine whether the image data of the object to be measured meets the requirements.

[0133] Among them, it can be determined whether the image data of the object to be tested meets the requirements from multiple dimensions such as image copyright information, image size information, etc. The determination method of the image data of the object to be tested can also refer to the relevant description in the previous embodiment, which will not be repeated here.

[0134] If the image data of the object to be tested does not meet the requirements, the attack detection process can be terminated and the result of failure of the detection can be output. If the image data of the object to be tested meets the requirements, the subsequent selection process of the liveness detection model can be entered.

[0135] Exemplarily, a selection can be made based on the risk prediction score. If the risk prediction score is not greater than the second threshold, it may indicate that the probability of the object to be tested launching an attack is relatively small, and the first liveness detection model with a high pass rate can be selected for liveness detection; if the risk prediction score is greater than the second threshold, it may indicate that the probability of the object to be tested launching an attack is relatively high, and the second liveness detection model with a high detection rate can be selected for liveness detection.

[0136] Through the above implementation, before the liveness detection model is used to perform liveness detection on the object to be detected, it can be determined whether the various data meet the requirements. If not, the subsequent detection process can be interrupted in time, which can save computing resources and improve the detection rate. In addition, on the basis of detecting that the various data of the object to be detected meet the requirements, a liveness detection model with a high pass rate can be used to improve the pass rate of attack detection. By controlling the detection rate and pass rate in multiple dimensions, it is possible to reduce the waste of computing resources while maintaining the detection accuracy.

[0137] Based on the same application concept, an attack detection device corresponding to the attack detection method is also provided in the embodiment of the present application. Since the principle of solving the problem by the device in the embodiment of the present application is similar to that in the aforementioned attack detection method embodiment, the implementation of the device in this embodiment can refer to the description in the embodiment of the aforementioned method, and the repeated parts will not be repeated.

[0138] See also Figure 8, is a functional module diagram of the attack detection device provided in the embodiment of the present application. Each module in the attack detection device in this embodiment is used to execute each step in the above method embodiment. The attack detection device includes: a first acquisition module 410, a first detection module 420 and a second detection module 430; wherein the contents of each module are as follows: the first acquisition module 410 is used to obtain the first type of data corresponding to the object to be tested, and the first type of data includes: behavior-related data of the object to be tested, device-related data of the device used to detect the object to be tested, and at least one of the object information of the object to be tested; the first detection module 420 is used to perform attack risk detection on the object to be tested based on the first type of data; the second detection module 430 is used to perform liveness detection on the object to be tested based on the acquired second type of data of the object to be tested and the corresponding liveness detection model if the detection result indicates that the object to be tested does not have an attack risk; wherein the second type of data includes image data of a specified part of the object to be tested.

[0139] In one possible implementation, the first acquisition module 410 is used to collect the first type of data corresponding to the object to be tested in different detection stages; wherein the detection stage includes the image acquisition quality detection stage and the object information detection stage; the first detection module 420 is used to perform attack risk detection on the object to be tested based on the first type of data collected in each detection stage.

[0140] In one possible implementation, the detection result includes a risk prediction score; a first detection module 420 is used to determine whether the first category data has an abnormality according to a target rule; wherein the target rule includes at least one of the following rules: the first category data is within a target numerical range or the first category data contains a target field; if so, it is determined that the object to be tested has an attack risk; otherwise, the first category data is detected using a risk prediction model to obtain a risk prediction score; wherein, when the risk prediction score is less than a first threshold, it indicates that the object to be tested has no attack risk.

[0141] In one possible implementation, the detection result includes a risk prediction score; a second detection module 430 is used to use a first liveness detection model to perform liveness detection on the object to be detected based on the second type of data if the risk prediction score is less than a second threshold, and the second threshold is less than the first threshold; if the risk prediction score is greater than the second threshold and less than the first threshold, use a second liveness detection model to perform liveness detection on the object to be detected based on the second type of data, the pass rate of the first liveness detection model is greater than the pass rate of the second liveness detection model, and the detection rate of the second liveness detection model is greater than the detection rate of the first liveness detection model.

[0142] In one possible implementation, the first category of data includes behavior-related data of the object to be tested collected during the image acquisition quality detection phase; the behavior-related data includes at least one of equipment adjustment operation behavior data, image acquisition times, and time spent on image acquisition data; the first detection module 420 is used to determine whether the number of errors in the equipment adjustment operation is greater than an abnormal number threshold based on the equipment adjustment operation behavior data, and if so, determine that the first category of data has an abnormality; or, determine whether the number of image acquisitions is greater than an image acquisition times threshold, and if so, determine that the first category of data has an abnormality; or, determine whether the time spent on image acquisition is greater than an image acquisition time threshold, and if so, determine that the first category of data has an abnormality.

[0143] In one possible implementation, the first category of data includes object information of the object to be detected collected during the object information detection stage, and / or behavior information of the object to be detected collected during the object information detection stage, the object information including: account information of the object to be detected, the behavior information of the object to be detected including: at least one item of IP address verification information of the device used by the object to be detected; the first detection module 420 is used to determine whether the number of verifications initiated by the IP address within a first specified time period exceeds a verification number threshold based on the IP address verification information of the device used by the object to be detected, and if so, determine that the first category of data is abnormal.

[0144] In one possible implementation, the first category of data includes device-related data of the device used by the object to be detected collected during the object information detection phase, and the device-related data includes: at least one of device model data, operating system data and system permission data; a first detection module 420 is used to determine whether the device model data belongs to one of the risk device models in the risk device model set, and if so, it is determined that the first category of data is abnormal; or, to determine whether the operating system data belongs to one of the risk system version set, and if so, it is determined that the first category of data is abnormal; or, based on the system permission data, it is determined whether the permissions of the device used by the object to be detected exceed the safe operating range, and if so, it is determined that the first category of data is abnormal; wherein the frequency of attacks initiated by the device corresponding to the model in the risk device model set is greater than the first specified value.

[0145] In one possible implementation, the attack detection device may further include: a determination module, used to determine data-related information of the second category of data; wherein the data-related information includes at least image size information and image copyright information; a third detection module, used to perform attack risk detection on the object to be tested according to the second target rule based on the data-related information; if the verification result indicates that the object to be tested does not have an attack risk, the above-mentioned second detection module 430 is run.

[0146] In one possible implementation, the third detection module is used to determine whether one or more image data in the second category of data are copied images based on the image copyright information; and, based on the image size information, determine whether the size of one or more image data in the second category of data is within a set size limit range; if one or more image data in the second category of data is a copied image, and the size of one or more image data in the second category of data is within a set size limit range, then the verification result representing the second category of data indicates that the object to be tested is at risk of attack.

[0147] In one possible implementation, the set size is determined by: obtaining a verification data set, the verification data set including a plurality of real-person images and a plurality of attack images; determining size distribution data of the verification data set based on the size of each real-person image and the size of each attack image in the verification data set; determining the set size based on the size distribution data, wherein the number of attack images within a limited range of the set size is greater than the number of the real-person images.

[0148] In addition, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the attack detection method described in the above method embodiment are executed.

[0149] The computer program product of the attack detection method provided in the embodiment of the present application includes a computer-readable storage medium storing program code, and the instructions included in the program code can be used to execute the steps of the attack detection method described in the above method embodiment. For details, please refer to the above method embodiment, which will not be repeated here.

[0150] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0151] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0152] If the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a disk or an optical disk. It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprises" or any other variation thereof are intended to cover non-exclusive inclusion, so that a process, method, article or apparatus that includes a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or apparatus. In the absence of more restrictions, the elements defined by the sentence "includes..." do not exclude the presence of other identical elements in the process, method, article or apparatus that includes the elements.

[0153] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application. It should be noted that similar numbers and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0154] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. An attack detection method, characterized in that: include: Acquire first type of data corresponding to the object to be tested, the first type of data comprising: at least one of behavior-related data of the object to be tested, device-related data of a device used by the object to be tested, and object information of the object to be tested; Performing attack risk detection on the object to be tested based on the first type of data; If the detection result indicates that the object to be detected does not have an attack risk, performing a liveness detection on the object to be detected based on the acquired second type of data of the object to be detected and a corresponding liveness detection model; wherein the second type of data includes image data of a specified part of the object to be detected; The test results include a risk prediction score; The performing liveness detection on the object to be detected based on the acquired second type of data of the object to be detected and a corresponding liveness detection model includes: If the risk prediction score is less than a second threshold, a first liveness detection model is used to perform liveness detection on the object to be detected based on the second type of data, and the second threshold is less than the first threshold; wherein the risk prediction score is less than the first threshold, indicating that the object to be detected does not have an attack risk; If the risk prediction score is greater than the second threshold and less than the first threshold, a second liveness detection model is used to perform liveness detection on the object to be tested based on the second type of data, the pass rate of the first liveness detection model is greater than the pass rate of the second liveness detection model, and the detection rate of the second liveness detection model is greater than the detection rate of the first liveness detection model.

2. The method according to claim 1, characterized in that The obtaining of the first type of data corresponding to the object to be tested includes: The first type of data corresponding to the object to be tested is collected respectively in different detection stages; wherein the detection stage includes an image acquisition quality detection stage and an object to be tested information detection stage; The performing attack risk detection on the object to be detected based on the first type of data includes: Attack risk detection is performed on the object to be detected based on the first type of data collected in each detection stage.

3. The method according to claim 1 or 2, characterized in that: The detection result includes a risk prediction score; the attack risk detection of the object to be detected based on the first type of data includes: Determine whether the first category of data is abnormal according to a target rule; wherein the target rule includes at least one of the following rules: the first category of data is within a target value range or the first category of data contains a target field; If so, it is determined that the object to be tested has an attack risk; otherwise, the first type of data is detected using a risk prediction model to obtain a risk prediction score; wherein, when the risk prediction score is greater than a first threshold, it indicates that the object to be tested has an attack risk.

4. The method according to claim 3, characterized in that The first type of data includes behavior-related data of the object to be tested collected during the image acquisition quality detection phase; the behavior-related data includes at least one of equipment adjustment operation behavior data, image acquisition times, and image acquisition time data; The determining whether the first type of data is abnormal according to the target rule includes: Based on the device adjustment operation behavior data, determine whether the number of errors in the device adjustment operation is greater than the abnormal number threshold, and if so, determine that the first type of data is abnormal; or, Determine whether the number of image acquisitions is greater than a threshold value of the number of image acquisitions, and if so, determine that the first type of data is abnormal; or It is determined whether the time taken to collect the image is greater than a threshold of the time taken to collect the image. If so, it is determined that the first type of data is abnormal.

5. The method according to claim 3, characterized in that: The first type of data includes object information of the object to be tested collected during the object information detection phase, and / or behavior information of the object to be tested collected during the object information detection phase, wherein the object information includes: account information of the object to be tested, and the behavior information of the object to be tested includes: at least one item of IP address verification information of a device used by the object to be tested; The determining whether the first type of data is abnormal according to the target rule includes: Determine whether there is an abnormal field in the account information of the object to be tested, and if so, determine that the first type of data is abnormal; or Based on the IP address verification information of the device used by the object to be tested, it is determined whether the number of verifications initiated by the IP address within a first specified time period exceeds a verification number threshold. If so, it is determined that the first type of data is abnormal.

6. The method according to claim 3, characterized in that The first type of data includes device-related data of the device used by the object to be tested collected during the object to be tested information detection phase, and the device-related data includes: at least one of device model data, operating system data, and system permission data; The determining whether the first type of data is abnormal according to the target rule includes: Determine whether the device model data belongs to one of the risky device model sets, and if so, determine that the first type of data is abnormal; or Determine whether the operating system data belongs to one of the risk system version sets, and if so, determine that the first type of data is abnormal; or Based on the system authority data, determine whether the authority of the device used by the object to be tested exceeds the safe operation range, and if so, determine that the first type of data is abnormal; The frequency of attacks initiated by devices corresponding to the models in the risky device model set is greater than a first specified value.

7. The method according to claim 1 or 2, characterized in that: Before performing liveness detection on the object to be detected based on the acquired second type of data of the object to be detected and the corresponding liveness detection model, the method further includes: Determine data-related information of the second category of data; wherein the data-related information includes at least image size information and image copyright information; Performing attack risk detection on the object to be detected according to a second target rule based on the data related information; If the verification result indicates that the object to be detected does not have an attack risk, the step of performing liveness detection on the object to be detected based on the acquired second type of data of the object to be detected and the corresponding liveness detection model is executed.

8. The method according to claim 7, characterized in that The performing attack risk detection on the object to be detected according to the second target rule based on the data-related information includes: determining whether one or more image data in the second category of data are duplicate images based on the image copyright information; Determining whether the size of one or more image data in the second type of data is within a set size limit range based on the image size information; If one or more image data in the second category of data is a duplicate image, or the size of one or more image data in the second category of data is within a set size limit range, the verification result representing the second category of data indicates that the object to be tested has an attack risk.

9. The method according to claim 8, characterized in that The set size is determined by: Obtain a verification data set, wherein the verification data set includes multiple real-person images and multiple attack images; Determining size distribution data of the verification data set according to the size of each of the real-person images and the size of each of the attack images in the verification data set; The set size is determined according to the size distribution data, wherein the number of attack images within a limited range of the set size is greater than the number of real-person images.

10. An electronic device comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the method according to any one of claims 1 to 9.

11. A computer-readable storage medium having a computer program or a computer instruction stored thereon, characterized in that: When the computer program or computer instruction is executed by a processor, the method according to any one of claims 1 to 9 is implemented.

12. A computer program product, comprising a computer program or computer instructions, characterized in that When the computer program or computer instruction is executed by a processor, the method according to any one of claims 1 to 9 is implemented.

Images