A behavioral fingerprint digital feature extraction method, system, medium, and device

Abstract

The application discloses a behavior fingerprint digital feature extraction method, system, medium and equipment, and the method comprises the following steps: acquiring a behavior fingerprint sequence of a user and extracting digital feature information of the user, constructing a digital feature vector matrix for a to-be-matched user set and a known user set respectively, extracting a feature vector set of the user for the acquired behavior fingerprint sequence of the user, calculating the similarity distance between the digital feature vector of the known user and the digital feature vector of the to-be-matched user based on a similarity distance formula, and judging the identity of the user according to a preset matching strategy. The application expands the behavior fingerprint of the user, solves the problem of the sparsity of the behavior fingerprint of the user to a certain extent, and achieves the effect of improving the recognition accuracy.

Description

Technical Field

[0001] This invention relates to the field of user identification technology, specifically to a method, system, medium, and device for extracting behavioral fingerprint digital features. Background Technology

[0002] Currently, as human life becomes increasingly intertwined with various technological products, security has become a pressing issue, with identity verification technology being a crucial area. Common identity verification technologies primarily rely on biometric physiological characteristics, including fingerprints, facial recognition, and voiceprints. These authentication methods typically perform authentication at a specific point in time during program execution and require active biometric participation. Furthermore, with the continuous development of adversarial network technology, one-time authentication methods face greater challenges. In contrast, authentication methods based on user behavior fingerprints, such as online TV viewing, keystrokes, and web browsing, do not require active user participation, allowing the system to implicitly acquire user behavior. Moreover, they can continuously perform identity verification, serving as a supplement to existing identity verification technologies to enhance system security.

[0003] Currently, the basic approach to identity recognition based on user behavior fingerprints involves statistically analyzing the frequency of each behavior within the fingerprint to construct a digital feature vector for the user. The user's identity is then determined by calculating the similarity between the digital feature vectors of known and unknown users. However, behavioral fingerprints are often sparse. Some researchers have attempted to enhance recognition accuracy by concatenating several consecutive behaviors to form a new behavior, but this approach significantly increases the space and time required, resulting in a substantial waste of computational resources. Furthermore, existing identity recognition schemes still suffer from low recognition accuracy. Summary of the Invention

[0004] To overcome the defects and shortcomings of existing technologies, this invention provides a behavioral fingerprint digital feature extraction method that significantly reduces the types of extracted digital features while achieving better identity recognition results, thereby greatly reducing the recognition time and improving the accuracy of identity recognition based on similarity distance calculation.

[0005] The second objective of this invention is to provide a behavioral fingerprint digital feature extraction system;

[0006] A third objective of this invention is to provide a computer-readable storage medium;

[0007] A fourth objective of this invention is to provide a computing device.

[0008] To achieve the above objectives, the present invention adopts the following technical solution:

[0009] This invention provides a method for extracting digital features of behavioral fingerprints, comprising the following steps:

[0010] Obtain the user's behavioral fingerprint sequence and extract the user's digital feature information. Construct digital feature vector matrices for the user set to be matched and the known user set respectively. For the obtained user's behavioral fingerprint sequence, extract the user's feature vector set.

[0011] The similarity distance between the known user's digit feature vector and the user's digit feature vector to be matched is calculated based on the similarity distance formula.

[0012] The user's identity is determined based on a preset matching strategy.

[0013] As a preferred technical solution, the user's behavioral fingerprint sequence is derived from log records of various systems. A portion of the log records are extracted to form data, and a time point is selected. Based on the time point, the dataset is divided into a set of users to be matched and a set of known users.

[0014] As a preferred technical solution, the steps of obtaining the user's behavioral fingerprint sequence and extracting the user's digital feature information specifically include:

[0015] For the obtained behavioral fingerprint sequence S of user u u Extract the user's nth-order feature vector set.

[0016] Take the union of the n-order feature vector sets of all users, count the frequency of each digit feature vector in the union, and use this count to generate tuples. Each element in a tuple consists of a numerical feature vector and its frequency of occurrence in the tuple;

[0017] According to tuple* Sort the frequencies of each numerical feature vector in descending order to form a sorted tuple, denoted as *.

[0018] From sorted tuples* Extract the feature components of the set ratio into tuples

[0019] By fusing the n-order feature vector sets of all users, a behavioral frequency matrix including all users and their digital feature vectors is obtained.

[0020] As a preferred technical solution, the n-order feature vector set of the user is extracted based on the FaG method. The specific steps include:

[0021] Create a time sliding window n In the user u's behavioral fingerprint sequence S uSlide the slider to obtain the behavior state;

[0022] Constructing a directed graph in, Indicates the sliding window s n In the behavioral fingerprint sequence S of user u u The set of vertices contained within the window during the i-th slide, where e is a directed graph. edge set;

[0023] Extracting directed graphs Two-dimensional digital feature vectors;

[0024] Sliding window n In length l u Behavioral fingerprint sequence S u Swipe up to generate m graphs, which together form the nth-order feature map set for user u.

[0025] Obtain the feature vector set of user u from the first to the nth order. Specifically, it is expressed as follows:

[0026]

[0027] Where m = l - n + 1.

[0028] As a preferred technical solution, the similarity distance between the known user's digital feature vector and the user's digital feature vector to be matched is calculated based on the similarity distance formula, specifically including:

[0029] The formula for similarity distance is specifically expressed as follows:

[0030]

[0031]

[0032]

[0033]

[0034]

[0035]

[0036] Among them, u x Indicates the user to be matched, U y Indicates a known user. This represents the feature vector matrix of a known user. This represents a probability vector of the behavior of an unknown user. Let D(·||·) represent the probability matrix of the behavior of all known users, and let D(·||·) represent the KL divergence between the two eigenvectors.

[0037] As preferred technical solutions, the matching strategies include the maximum similarity matching strategy and the bipartite graph matching strategy.

[0038] As a preferred technical solution, the maximum similarity matching strategy is specifically expressed as follows:

[0039]

[0040] in, Indicates the predicted user identity, if This indicates that the predicted user identity matches their actual identity, and the prediction result is correct. ij U represents the similarity distance between two user feature vectors. y Represents a known set of users;

[0041] The bipartite graph matching strategy is specifically expressed as follows:

[0042]

[0043] The conditions are set as follows:

[0044] Among them, U x It is an unknown user set, and E represents the edge of the bipartite graph matching. This indicates the identity of users in the predicted set of unknown users.

[0045] To achieve the second objective mentioned above, the present invention adopts the following technical solution:

[0046] A behavioral fingerprint digital feature extraction system includes: a behavioral fingerprint sequence acquisition module, a digital feature information extraction module, a similarity distance calculation module, and a user judgment module;

[0047] The behavior fingerprint sequence acquisition module is used to acquire the user's behavior fingerprint sequence;

[0048] The digital feature information extraction module is used to extract the digital feature information of users, construct digital feature vector matrices for the set of users to be matched and the set of known users respectively, and extract the feature vector set of the user for the obtained behavioral fingerprint sequence of the user.

[0049] The similarity distance calculation module is used to calculate the similarity distance between the known user's digital feature vector and the user's digital feature vector to be matched based on the similarity distance formula;

[0050] The user identification module is used to determine the user's identity based on a preset matching strategy.

[0051] To achieve the third objective mentioned above, the present invention adopts the following technical solution:

[0052] A computer-readable storage medium includes a stored program that, when executed, implements the behavioral fingerprint digital feature extraction method described above.

[0053] To achieve the fourth objective mentioned above, the present invention adopts the following technical solution:

[0054] A computing device includes a processor and a memory for storing a processor-executable program, wherein when the processor executes the program stored in the memory, it implements the above-described behavioral fingerprint digital feature extraction method.

[0055] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0056] (1) This invention expands the user’s behavioral fingerprint by introducing an n-order feature vector, which solves the problem of sparsity of user behavioral fingerprint to a certain extent and achieves the effect of improving the recognition accuracy.

[0057] (2) The present invention maps one-dimensional behavioral fingerprints onto multiple two-dimensional graphics, which can better extract digital features from user behavioral fingerprints, thereby improving the accuracy of user identification.

[0058] (3) This invention transforms high-dimensional features into multiple two-dimensional features, so that all types of user features extracted are kept in two dimensions, thereby significantly reducing the types of digital features obtained, thereby reducing the size of the constructed digital feature vector matrix, thus shortening the time required to identify user identity, solving the problem of high-dimensional feature type explosion, and significantly reducing identification time.

[0059] (4) This invention improves the existing Jaccard distance and Jaccard containment distance and combines them with KL distance to solve the problem of low accuracy of existing similarity distance recognition and achieves the effect of improving recognition accuracy. Attached Figure Description

[0060] Figure 1 This is a flowchart illustrating the behavioral fingerprint digital feature extraction method of the present invention;

[0061] Figure 2 For the present invention FURE + Step-by-step diagram;

[0062] Figure 3 This is a schematic diagram of the FAG method of the present invention;

[0063] Figure 4 For the present invention FURE + Renderings;

[0064] Figure 5 This is a schematic diagram illustrating the LKL effect of the present invention;

[0065] Figure 6 For the present invention FURE + A schematic diagram showing the combined effect of LKL and LKL. Detailed Implementation

[0066] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0067] Example 1

[0068] like Figure 1 As shown, this embodiment provides a method for extracting behavioral fingerprint digital features, including the following steps:

[0069] S1: Obtain the user's behavioral fingerprint sequence and extract the user's digital feature information from it to form the user set U to be matched. x and the known user set U y Construct digital feature vector matrices respectively for the obtained behavioral fingerprint sequence S of user u. u ,like Figure 2 and combined Figure 4 As shown, using FURE + The method extracts the user's nth-order feature vector set. Mapping a one-dimensional behavioral fingerprint onto multiple two-dimensional graphs can better extract digital features from a user's behavioral fingerprint, thereby improving the accuracy of user identification.

[0070] In this embodiment, the behavioral fingerprint sequence is derived from log records of various systems. Taking network broadcast television playback records provided by a certain company as an example, it specifically includes: the original data contains the following fields: <userID, CurChannel, NextChannel, time, duration>. Records with a viewing duration of less than 5 seconds are removed, and the <userID, CurChannel, time> fields are extracted to form a new dataset. Here, userID is the anonymous user ID; in this implementation, the 1000 users with the most viewing records are selected, so the user IDs range from 1 to 1000. CurChannel is the channel currently being viewed by the user, with a total of 157 channels. Time is the time point in time when the user's viewing behavior occurred, in days, ranging from 0 to 31. A time point x is selected, and based on the value of x, the dataset is divided into a set of users to be matched, U. x and the known user set U y For example, when x is 16, the set of non-anonymous users U is from day 0 to day 16. y Days 17 to 31 are for anonymous users. x .

[0071] In this embodiment, the user's behavioral fingerprint sequence is obtained and the user's digital feature information is extracted to form a set of users U to be matched. x and the known user set U y Construct their nth-order eigenvector sets respectively Where n takes the value of 3, the specific steps include:

[0072] S11: For the obtained behavioral fingerprint sequence S of user u u ,like Figure 3 As shown, the FaG (Fingerprinting as Graph) method is used to extract the user's n-order feature vector set.

[0073] S12: Take the union of the n-order feature vector sets of all users, count the frequency of each numeric feature vector in the union, and use this to generate tuples. Each element in a tuple consists of a numerical feature vector and its frequency of occurrence in the tuple;

[0074] S13: Based on tuples* The frequencies of each numerical feature vector are sorted in descending order to form a sorted tuple, denoted as *.

[0075] S14: From * Based on a given ratio, extract the top-ranked features to form a tuple.

[0076] S15: Integrate the nth-order feature sets of all users into in Represents the union of the n-order feature vector sets of all users. Indicates user The set of n-order eigenvectors, U y Given a known set of users, we can construct a behavior frequency matrix containing all users and their numerical feature vectors.

[0077] In this embodiment, the FaG (Fingerprinting as Graph) method is used to extract the user's n-order feature vector set. Compared to the existing MISFUB (Multi-Item-Set Feature Fingerprint of User Behaviors), which concatenates n consecutive behaviors into a new feature, the FAG method proposed in this embodiment can stabilize the feature vector in two dimensions. This reduces the size of the acquired behavior frequency matrix while keeping the number of users N constant, thereby reducing the runtime when calculating the similarity distance between matrices. Specific steps include:

[0078] (1) Create a time sliding window s with a span of n. n Let the time sliding window s n In the behavioral fingerprint sequence S of user u u Slide on top;

[0079] (2) For sliding window s n In the i-th sliding motion, there are n behavioral states within the window. Based on these behaviors, a graph containing n vertices can be constructed. in Indicates the sliding window s n In the behavioral fingerprint sequence S of user u u The set of vertices contained within the window during the i-th sliding motion on the graph, where e is the vertex set of the graph. The edge set, for user u, whose behavioral state is unidirectional in the time dimension, thus forming a graph. It is a directed graph, meaning that there exists only one path from the graph located at s. n The vertex on the left to the position located at s n The directed edge of the right vertex;

[0080] In this embodiment, the sliding window s is first extracted. n The n actions in the graph constitute the graph. The vertices, and then based on the time window s in which each vertex is located. n Internal location construction diagram The edge, such as Figure 3 As shown, this embodiment can map a one-dimensional behavioral fingerprint onto a two-dimensional graph, which can better extract the digital features in the user's behavioral fingerprint.

[0081] (3) Figure All directed edges and their start and end points form a numerical feature vector to obtain the graph. The number of all numerical feature vectors in the dataset. Numerically, it is shown in equation (1):

[0082]

[0083] Where C represents combination, in this embodiment, from the figure The extracted digital feature vectors are two-dimensional digital vectors;

[0084] (4) Step (3) above is a single time window s n The method of graph construction and feature vector extraction, and with the sliding window s n In length l u Behavioral fingerprint sequence S u Swiping up will generate m graphs, where m = l - n + 1. These graphs form the nth-order feature map set of user u. At this point, the number of eigenvectors of user u at the nth order is As shown in equation (2):

[0085]

[0086] In this embodiment, it is necessary to set the time window s. n Each swipe on the behavioral fingerprint sequence constructs a graph and extracts the digital feature vector from the graph. The goal is to map the one-dimensional behavioral fingerprint sequence to multiple two-dimensional graphs, thereby better extracting the user's feature vector.

[0087] (5) Step (4) above is the nth-order feature vector of user u. The feature vector set of user u from the first to the nth order is obtained. Its formula is shown in equation (3):

[0088]

[0089] in, The number of eigenvectors contained As shown in equation (4):

[0090]

[0091] S2. Calculate the known user U based on the similarity distance formula.y Numerical features and users to be matched U x Similarity distance between numerical features;

[0092] Traditional methods often use similarity distance to measure the similarity between two vectors. When the distance between two vectors is close enough, they are considered to be the same vector. Therefore, in step S1, the behavior frequency matrices of known users and unknown users are obtained respectively. The identity of each user in an unknown user set can be confirmed by calculating the similarity distance between matrices;

[0093] Among existing similarity distances, the JKL distance, composed of the Jaccard and KL distances, boasts better recognition accuracy compared to other distances. However, the Jaccard distance does not perform well when the set size is asymmetrical. Therefore, this embodiment proposes an improvement to the Jaccard formula, introducing the LJC distance, and combines it with the KL distance to propose a new similarity distance, LKL, as follows. Figure 5 , Figure 6 As shown, the recognition accuracy results are obtained. This embodiment improves the existing Jaccard distance and Jaccard containment distance, and combines them with KL distance to solve the problem of low recognition accuracy of existing similarity distances, thereby improving the recognition accuracy.

[0094] In this embodiment, the similarity distance formula is specifically expressed as follows:

[0095]

[0096] Where ∈ is the correction coefficient, and its value is 10. -6 .

[0097] Formula (5) consists of two parts, one of which is LJC (Large Jaccard Containment), which is defined as shown in formula (6):

[0098]

[0099] Here, P and Q are two sets, and |P|∩|Q| represents the number of features shared between the two sets. In calculating the known user U... y Numerical features and users to be matched U x When calculating the similarity distance between digital features, the formula is shown in equation (7).

[0100]

[0101] in, Known user | U y|Eigenvector matrix.

[0102] The other part of formula (5) is the similarity distance KL. The basic form of KL is shown in formula (8). Generally speaking, the smaller the KL distance between two fingerprint features, the higher the similarity between the two fingerprints.

[0103]

[0104] in, as well as Representing unknown user u x The probability vector of behavior. Let be the probability matrix of the behavior of all known users. D(·||·) is the KL divergence between the two eigenvectors, where ... The definition is shown in equation (9):

[0105]

[0106] Therefore, formula (5) is used to calculate the known user U y Numerical features and users to be matched U x When calculating the similarity distance between numerical features, the LKL formula is shown in equation (10):

[0107]

[0108] S3. Determine the user's identity according to the matching strategy. The known user set U is calculated in step S2. y and unknown user set U x The similarity distance between users can be used to determine a user's identity based on different decision-making strategies.

[0109] In this embodiment, maximum similarity matching (NM) or complete bipartite graph matching strategy (GM) is used. Under normal conditions, GM has a better matching accuracy than NM.

[0110] The formula for calculating NM is shown in equation (11):

[0111]

[0112] in, Indicates the predicted user identity, if This indicates that the predicted user identity matches their actual identity, and the prediction result is correct; ij It is the similarity distance between two user feature vectors; U y This represents a known set of users.

[0113] The formula for calculating GM is shown in equation (12):

[0114]

[0115] Formula (11) can be used under any conditions, while formula (12) is only used when the condition is met. It can be used at any time, where U x It is an unknown user set, U y Given a known set of users, E represents the edges in the graph matching GM. Since GM identifies all users at once, it uses... This is used to represent the identity of users in the predicted set of unknown users.

[0116] Example 2

[0117] This embodiment provides a behavioral fingerprint digital feature extraction system, including: a behavioral fingerprint sequence acquisition module, a digital feature information extraction module, a similarity distance calculation module, and a user judgment module;

[0118] In this embodiment, the behavior fingerprint sequence acquisition module is used to acquire the user's behavior fingerprint sequence;

[0119] In this embodiment, the digital feature information extraction module is used to extract the digital feature information of users, construct digital feature vector matrices for the user set to be matched and the known user set respectively, and extract the feature vector set of the user for the obtained user's behavioral fingerprint sequence.

[0120] In this embodiment, the similarity distance calculation module is used to calculate the similarity distance between the known user's digital feature vector and the user's digital feature vector to be matched based on the similarity distance formula;

[0121] In this embodiment, the user identification module is used to determine the user's identity according to a preset matching strategy.

[0122] Example 3

[0123] This embodiment provides a computer-readable storage medium, which may be a ROM, RAM, disk, optical disk, or other storage medium. The storage medium stores one or more programs. When the programs are executed by a processor, they implement the behavioral fingerprint digital feature extraction method of Embodiment 1.

[0124] Example 4

[0125] This embodiment provides a computing device, which may be a desktop computer, laptop computer, smartphone, PDA handheld terminal, tablet computer or other terminal device. The computing device includes a processor and a memory. The memory stores one or more programs. When the processor executes the program stored in the memory, it implements the behavioral fingerprint digital feature extraction method of Embodiment 1.

[0126] The above embodiments are preferred embodiments of the present invention, but the embodiments of the present invention are not limited to the above embodiments. Any changes, modifications, substitutions, combinations, or simplifications made without departing from the spirit and principle of the present invention shall be considered equivalent substitutions and shall be included within the protection scope of the present invention.

Claims

1. A method for extracting digital features of behavioral fingerprints, characterized in that, Includes the following steps: Obtain the user's behavioral fingerprint sequence and extract the user's digital feature information. Construct digital feature vector matrices for the user set to be matched and the known user set respectively. For the obtained user's behavioral fingerprint sequence, extract the user's feature vector set. The specific steps for obtaining the user's behavioral fingerprint sequence and extracting the user's digital feature information include: For the obtained behavioral fingerprint sequence S of user u u Extract the user's nth-order feature vector set. Take the union of the n-order feature vector sets of all users, count the frequency of each digit feature vector in the union, and use this count to generate tuples. Each element in a tuple consists of a numerical feature vector and its frequency of occurrence in the tuple; According to tuples Sort the frequencies of each numerical feature vector in descending order to form a sorted tuple, denoted as . From sorted tuples Extract the feature components of the set ratio into tuples By fusing the n-order feature vector sets of all users, a behavioral frequency matrix including all users and their digital feature vectors is obtained. The similarity distance between the known user's digit feature vector and the user's digit feature vector to be matched is calculated based on the similarity distance formula. The user's identity is determined based on a preset matching strategy.

2. The behavioral fingerprint digital feature extraction method according to claim 1, characterized in that, The user's behavioral fingerprint sequence is derived from log records of various systems. A portion of the log records are extracted to form the data. A time point is selected, and the dataset is divided into a set of users to be matched and a set of known users based on the time point.

3. The behavioral fingerprint digital feature extraction method according to claim 1, characterized in that, The nth-order feature vector set of this user was extracted based on the FaG method. The specific steps include: Create a time sliding window n In the user u's behavioral fingerprint sequence S u Slide the slider to obtain the behavior state; Constructing a directed graph in, Indicates the sliding window s n In the behavioral fingerprint sequence S of user u u The set of vertices contained within the window during the i-th slide, where e is a directed graph. edge set; Extracting directed graphs Two-dimensional digital feature vectors; Sliding window n In length l u Behavioral fingerprint sequence S u Swipe up to generate m graphs, which together form the nth-order feature map set for user u. Obtain the feature vector set of user u from the first to the nth order. Specifically, it is expressed as follows: Where m = l - n + 1.

4. The behavioral fingerprint digital feature extraction method according to claim 1, characterized in that, The similarity distance between the known user's digit feature vector and the user's digit feature vector to be matched is calculated based on the similarity distance formula, specifically including: The formula for similarity distance is specifically expressed as follows: Among them, u x Indicates the user to be matched, U y Indicates a known user. This represents the feature vector matrix of a known user. This represents a probability vector of the behavior of an unknown user. Let D(·||·) represent the probability matrix of the behavior of all known users, and let D(·||·) represent the KL divergence between the two eigenvectors.

5. The behavioral fingerprint digital feature extraction method according to claim 1, characterized in that, Matching strategies include maximum similarity matching strategy and bipartite graph matching strategy.

6. The behavioral fingerprint digital feature extraction method according to claim 5, characterized in that, The maximum similarity matching strategy is specifically expressed as follows: in, Indicates the predicted user identity, if This indicates that the predicted user identity matches their actual identity, and the prediction result is correct. ij U represents the similarity distance between two user feature vectors. y Represents a known set of users; The bipartite graph matching strategy is specifically expressed as follows: The conditions are set as follows: Among them, U x It is an unknown user set, and E represents the edge of the bipartite graph matching. This indicates the identity of users in the predicted set of unknown users.

7. A behavioral fingerprint digital feature extraction system, characterized in that, The method for extracting digital features of behavioral fingerprints according to any one of claims 1-6 includes: a behavioral fingerprint sequence acquisition module, a digital feature information extraction module, a similarity distance calculation module, and a user judgment module; The behavior fingerprint sequence acquisition module is used to acquire the user's behavior fingerprint sequence; The digital feature information extraction module is used to extract the digital feature information of users, construct digital feature vector matrices for the set of users to be matched and the set of known users respectively, and extract the feature vector set of the user for the obtained behavioral fingerprint sequence of the user. The similarity distance calculation module is used to calculate the similarity distance between the known user's digital feature vector and the user's digital feature vector to be matched based on the similarity distance formula; The user identification module is used to determine the user's identity based on a preset matching strategy.

8. A computer-readable storage medium comprising a stored program, characterized in that, When the program is executed, it implements the behavioral fingerprint digital feature extraction method as described in any one of claims 1-6.

9. A computing device, comprising a processor and a memory for storing a processor-executable program, characterized in that, When the processor executes the program stored in the memory, it implements the behavioral fingerprint digital feature extraction method as described in any one of claims 1-6.

Images