Authentication method based on real name authentication

Abstract

An authentication method based on real name authentication comprises the following steps: S1, collecting user behavior data from a plurality of data sources through an API (Application Program Interface) data interface, and classifying and preprocessing the collected data; s2, classifying the user behavior characteristics according to a normal user behavior mode established by the user behavior model; s3, extracting behavior characteristics of the user, comparing the extracted behavior characteristics with an existing user behavior mode, performing authenticity evaluation, and determining a user risk level according to an evaluation result; and S4, continuously detecting the data security condition, regularly evaluating the performance of the encryption algorithm, regularly updating the user behavior model according to the evaluation result and the security requirement, and continuously optimizing the encryption algorithm and the authentication process. The authentication accuracy can be improved, the data security is enhanced, the user experience is improved, and dynamic security requirements are met.

Description

Technical Field

[0001] The present invention relates to the field of authentication, and in particular to an authentication method based on real-name authentication. Background Art

[0002] In today's digital age, network security and user identity authentication have become crucial issues. With the popularization of the Internet and the continuous emergence of various online services, ensuring the authenticity of user identities and the security of data has become particularly critical.

[0003] Traditional real-name authentication methods often rely on user-submitted identity information, such as ID numbers and mobile phone numbers, to verify the user's identity by comparing it with official databases. However, this approach has limitations. Identity information can be forged or misused, resulting in inaccurate authentication results. Furthermore, the database itself can contain security vulnerabilities, allowing attackers to obtain user information. With the continuous registration of new users and changes in user behavior, traditional authentication methods struggle to adapt to dynamic security needs. Summary of the Invention

[0004] To solve the above problems, the present invention provides an authentication method based on real-name authentication, which can improve authentication accuracy, enhance data security, improve user experience and adapt to dynamic security requirements.

[0005] To achieve the above object, the technical solution adopted by the present invention is:

[0006] An authentication method based on real-name authentication, comprising the following steps:

[0007] S1: Collect user behavior data from multiple data sources through API data interfaces, and classify and preprocess the collected data;

[0008] S2: Classify user behavior characteristics according to the normal user behavior pattern established by the user behavior model;

[0009] S3: By extracting the user's behavioral characteristics and comparing them with existing user behavior patterns, authenticity assessment is performed and the user's risk level is determined based on the assessment results;

[0010] S4: Continuously monitor data security and regularly evaluate encryption algorithm performance. Based on the evaluation results and security requirements, regularly update user behavior models and continuously optimize encryption algorithms and authentication processes.

[0011] Furthermore, the data source includes: user login logs, operation records and interaction behavior data; the user behavior model includes a model that combines a deep learning algorithm and a decision tree algorithm.

[0012] Furthermore, the normal user behavior pattern established according to the user behavior model comprises the following steps:

[0013] S21: A distributed framework built based on Spark core components and the Hadoop Distributed File System. It uses HDFS for data storage, monitors the running status of Spark jobs, and converts pre-processed data into time series format.

[0014] S22: Divide the time series data into training, validation, and test sets. Based on the network structure and input and output design of the gated recurrent unit, randomly initialize the weights and biases of the gated recurrent unit using a normal distribution, and perform training iterations, validation, and adjustments.

[0015] S23: Extract features from user behavior data based on the trained gated recurrent unit, fuse the features extracted by the gated recurrent unit with the original features through weighted summation, and train, fuse, and optimize the CART algorithm.

[0016] Furthermore, the training iteration, verification and adjustment include the following steps:

[0017] S221: Divide the time series data of user behavior data in the training set into small batches, and select one batch of data each time to input into the gated recurrent unit for training;

[0018] S222: For each input batch, the gated recurrent unit performs forward propagation calculation according to its network structure to obtain an output result, compares the output result of the gated recurrent unit with the actual label value, calculates the loss function, and calculates the gradient of the loss function with respect to the weight and bias of the gated recurrent unit through the backpropagation algorithm based on the loss function;

[0019] S223: Update the weights and biases of the gated recurrent unit according to the gradient through the Adam optimization algorithm. During the training process, the model is regularly verified using the validation set. The hyperparameters of the model are adjusted based on the verification results, and L2 regularization is used to prevent overfitting.

[0020] Furthermore, the training, integration and optimization of the CART algorithm include the following steps:

[0021] S231: The output of the gated recurrent unit algorithm is used as an input feature vector for the CART algorithm, and the label of the user behavior category is used as the corresponding target variable. The user behavior category labels include: normal behavior, suspicious behavior, and abnormal behavior;

[0022] S232: For each feature, traverse all values ​​and find the best partition point so that the difference between the two subsets after partitioning on the target variable is maximized. For each feature and partition point, calculate the Gini index after partitioning. The feature and partition point with the smallest Gini index are used as the best partition for the current node.

[0023] S233: recursively repeating the feature selection and partitioning of step S232 on the divided subsets until a stopping condition is met. When the stopping condition is met, marking the current node as a leaf node and determining the category label of the leaf node;

[0024] S234: For a new input sample, starting from the root node of the decision tree, traverse downward step by step according to the feature value of the sample and the partitioning rules of the decision tree until reaching the leaf node, obtain the predicted category label, and evaluate the constructed decision tree through the test set.

[0025] Furthermore, the two subsets after the division have the largest difference in the target variable, including: measuring the difference in the target variable by using the Gini index, and the Gini index calculation formula is:

[0026] Where D is the dataset, K is the number of categories, and p k is the proportion of samples belonging to category k;

[0027] For the features and partition points, the Gini index after partition is calculated, including: feature x i And the partition point s, calculate the Gini index after partition:

[0028]

[0029] Where N is the total number of datasets, N left and N right are the number of samples in the left and right subsets after division, D left and D right are the left and right subsets respectively.

[0030] Furthermore, the method extracts the user's behavioral characteristics, compares them with existing user behavior patterns, performs authenticity assessment, and determines the user's risk level based on the assessment results; the method includes the following steps:

[0031] S31: Calculate the similarity between the user feature vector and the existing user feature vectors using the Euclidean distance, and select existing users with higher similarity to form a similar user group based on the similarity list;

[0032] S32: By calculating the mean difference, the user is compared with similar user groups in various behavioral characteristics to detect whether the new user has obvious abnormal behavior. Based on the analysis results of behavioral differences and abnormal behavior, the authenticity of the new user is comprehensively evaluated;

[0033] S33: Set different risk level standards based on business needs and security requirements, assign new users to corresponding risk levels based on their authenticity assessment scores or behavioral characteristics, and regularly adjust and optimize user behavior models.

[0034] Furthermore, the method of continuously monitoring data security and regularly evaluating encryption algorithm performance, and optimizing based on evaluation results and security requirements, includes the following steps:

[0035] S41: Real-time monitoring of abnormal behaviors and potential attacks in network traffic through intrusion detection systems and intrusion prevention systems;

[0036] S42: Determine an evaluation period based on the importance of the system and the sensitivity of the data, collect encryption algorithm performance data through the API data interface and system logs, and collect security event data of the system during the evaluation period, perform performance testing on the encryption algorithm using a test data set according to evaluation indicators, and analyze the performance test results. The evaluation indicators include: encryption speed, decryption speed, key generation speed, data expansion rate, and anti-attack resistance;

[0037] S43: Based on the evaluation results and the security requirements of the system, optimization is performed through the complementary algorithm model. The optimized complementary algorithm model is put into use, and the performance and security of the system are continuously monitored.

[0038] Furthermore, the optimization by the complementary algorithm model comprises the following steps:

[0039] S431: According to the stored original data set D={d1, d2, ..., d n}, where n is the number of data items, for each data item d i , calculate the hash value through the SHA-256 hash algorithm, generate a symmetric encryption key through the AES symmetric encryption algorithm, encrypt the original data set with the key, and store the encrypted data set and the hash value of each data item in a database or file system;

[0040] S432: Read the encrypted data set and the corresponding hash value from the storage medium, calculate the expected hash value without decryption, and compare the calculated hash value with the stored hash value. If the two are equal, it means that the data has not been tampered with during the storage process; otherwise, it means that the data has been tampered with. When the hash value comparison result shows that the data is intact, the encrypted data item is decrypted using the key of the symmetric encryption algorithm to obtain the original data item.

[0041] Furthermore, the hash value is calculated using the SHA-256 hash algorithm, including: preprocessing the input data by padding and length extension, setting eight initial hash values, dividing the preprocessed data into a number of 512-bit blocks, performing multiple iterative calculations on each block through logical operations and bit operations, and obtaining a final 256-bit hash value after iterative calculation of all blocks.

[0042] The beneficial effects of the present invention are:

[0043] 1. By analyzing user behavior patterns and building user behavior models, we can gain a more comprehensive understanding of users and reduce the limitations of relying solely on traditional identity authentication. For example, for newly registered users, we can more accurately assess their authenticity by comparing their behavior patterns with those of existing users, reducing the risk of fraudulent registrations and fraud. Processing time series data using a gated recurrent unit machine learning algorithm can capture the dynamic changes and long-term dependencies of user behavior, improving our understanding and prediction capabilities. Combined with a decision tree algorithm for classification and analysis, we can clearly define different behavior categories and risk levels, providing a concrete basis for authentication decisions.

[0044] 2. Continuously monitor data security and establish real-time monitoring systems and intrusion detection and prevention mechanisms to promptly detect and respond to security anomalies, such as unusual logins and data transmission. Through alert and response mechanisms, swift action can be taken to protect user data and system security. Regularly evaluate encryption algorithm performance and optimize based on the evaluation results and security requirements. Selecting a combination of hash algorithms and symmetric encryption algorithms can improve data encryption strength and attack resistance. Optimize key management to ensure key security and reliability, further enhancing data confidentiality, integrity, and availability.

[0045] 3. The SHA-256 hash algorithm generates a unique, fixed-length hash value for each data item. During data verification, by comparing the calculated new hash value with the stored hash value, data tampering can be quickly and accurately detected. Even slight changes in the data will result in significant differences in the hash value, ensuring high sensitivity to data tampering. Comparing hash values ​​immediately upon data read can identify potential integrity issues before the data is used, providing an opportunity to take timely corrective action. This prevents incorrect decisions or security breaches caused by the use of tampered data.

[0046] 4. Symmetric encryption algorithms, such as AES, encrypt data quickly and effectively, protecting data content from unauthorized access. Symmetric encryption algorithms typically offer high encryption and decryption speeds for storing and transmitting large amounts of data, ensuring efficient data processing. Additional protection for symmetric encryption keys, such as using the SHA-256 hashing algorithm to process and store hash values, can enhance key security. Decryption is only possible when the key's hash value matches, further preventing the risk of key theft or tampering. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 The present invention is a flowchart of an authentication method based on real-name authentication. DETAILED DESCRIPTION

[0048] See also Figure 1 As shown, the present invention relates to an authentication method based on real-name authentication, which includes the following steps:

[0049] S1: Collect user behavior data from multiple data sources through API data interfaces, and classify and preprocess the collected data;

[0050] S2: Classify user behavior characteristics according to the normal user behavior pattern established by the user behavior model;

[0051] S3: By extracting the user's behavioral characteristics and comparing them with existing user behavior patterns, authenticity assessment is performed and the user's risk level is determined based on the assessment results;

[0052] S4: Continuously monitor data security and regularly evaluate encryption algorithm performance. Based on the evaluation results and security requirements, regularly update user behavior models and continuously optimize encryption algorithms and authentication processes.

[0053] Specifically, the method involves collecting user behavior data from multiple data sources, classifying and preprocessing the collected data. Specifically, the collected data is initially organized and classified, and different types of behavior data are stored separately for subsequent processing. For example, login behavior data, operation behavior data, and interaction behavior data are stored in different data tables or datasets. During data preprocessing, the data is cleaned to remove noise and outliers, and standardized to make it suitable for algorithm processing.

[0054] The user behavior model is regularly updated, and the encryption algorithm and authentication process are continuously optimized. Specifically, an appropriate user behavior model update cycle is determined based on the system's user activity and data change rate. User behavior data, including new user registration information and login, operation, and interaction data of registered users, is continuously collected through an API data interface. The collected data is cleaned and preprocessed to remove outliers, noise, and duplicate data to ensure data quality and consistency. Representative features that reflect user behavior patterns and habits are extracted from the preprocessed user behavior data. These extracted features are then selected and redundant and irrelevant features are removed to improve model efficiency and accuracy. The updated user behavior data is used to update and train the existing user behavior model. Feature extraction is performed on the new data using a gated recurrent unit, and the extracted features are then fed into a decision tree algorithm for training. During the model update process, an incremental learning approach is employed to avoid retraining the entire model and improve update efficiency. The updated user behavior model is evaluated to ensure improved performance and accuracy, using evaluation metrics such as precision, recall, and F1 score to measure model performance. Based on the evaluation results, the model is adjusted and optimized, such as adjusting the model's hyperparameters, such as the learning rate, number of layers, number of neurons, etc., or improving feature extraction and selection methods to improve the performance of the model.

[0055] While continuously optimizing encryption algorithms and authentication processes, regularly analyze the security requirements of the system, consider factors such as the sensitivity of user data, potential security threats, and regulatory requirements, and determine the optimization direction of the encryption algorithm based on changes in security requirements. Perform performance testing and verification on the optimized encryption algorithm to ensure that it meets security requirements without significantly impacting system performance. Use actual user data and system environments for testing, simulating different usage scenarios and load conditions. After the encryption algorithm is optimized, continuously monitor the security status of the system and the performance of the encryption algorithm. Collect encryption- and security-related data through API data interfaces and system logs to promptly identify potential security issues and performance bottlenecks, ensuring that it always meets the security and performance requirements of the system. Collect user feedback on the authentication process, including experiences and issues with registration, login, and identity verification. Analyze user feedback, identify deficiencies in the authentication process, and determine the direction for optimization. Evaluate the existing authentication process, analyzing its efficiency, security, and user experience. Use process analysis tools and user testing methods to assess the performance of the authentication process. Based on the evaluation results, improve and optimize the authentication process. For example, simplify the registration and login process, reduce the number of user steps, strengthen the security of identity verification, adopt methods such as multi-factor authentication, or improve authentication efficiency to reduce user wait time. Timely introduce new technologies and methods to improve the performance and security of the authentication process. Continuously test and optimize the optimized authentication process to ensure it provides a good experience and security in different usage scenarios and user groups. Through A / B testing, user feedback collection, and other methods, continuously improve the authentication process and increase user satisfaction.

[0056] Furthermore, the data source includes: user login logs, operation records and interaction behavior data; the user behavior model includes a model that combines a deep learning algorithm and a decision tree algorithm.

[0057] Specifically, for specific data sources, such as recording the timestamp, IP address, and device information used for each user login; recording the user's operation sequence in the system, buttons clicked, pages browsed, etc.; and user interaction information with other users, such as messages sent, comments, etc.

[0058] The user behavior model is a combination of a gated recurrent unit and a decision tree algorithm, both of which play an important role in establishing the user behavior model. For the gated recurrent unit, user behavior typically exhibits time series characteristics. For example, a user's login time and operation sequence change over time. The gated recurrent unit can effectively process time series data, capturing the dynamic changes and long-term dependencies of user behavior in the temporal dimension. It also learns how user behavior patterns evolve over time, such as changes in user operating habits and cyclical changes in login frequency over different time periods. By learning from a large amount of user behavior data, the gated recurrent unit can automatically extract high-level feature representations that reflect the underlying patterns and trends of user behavior. These high-level features include the implicit state of user behavior and complex combinations of behavior patterns. Since user behavior may change over time, environmental factors, and other factors, the dynamic learning capability of the gated recurrent unit enables it to adapt to such changes and continuously update its understanding and modeling of user behavior. This helps improve the model's generalization ability, enabling it to better respond to new users and new behavior patterns.

[0059] For the decision tree algorithm, user behavior is classified and analyzed based on the features extracted by the gated recurrent unit and other original features. It can clearly divide different behavior categories and risk levels, providing a specific basis for authentication decisions. For example, user behavior can be divided into different categories such as normal behavior, suspicious behavior and abnormal behavior, so that different authentication measures can be taken. It has high interpretability. Through the tree structure and node division rules, it can intuitively display the key factors affecting the classification of user behavior, which helps developers and decision makers analyze the rationality of the model and the direction of improvement. Based on the classification results of the decision tree, corresponding authentication strategies are formulated. For example, for users with high-risk behavior, stricter identity verification or restricted permissions can be required, and for users with normal behavior, more convenient services can be provided.

[0060] Furthermore, the normal user behavior pattern established according to the user behavior model comprises the following steps:

[0061] S21: A distributed framework built based on Spark core components and the Hadoop Distributed File System. It uses HDFS for data storage, monitors the running status of Spark jobs, and converts pre-processed data into time series format.

[0062] S22: Divide the time series data into training, validation, and test sets. Based on the network structure and input and output design of the gated recurrent unit, randomly initialize the weights and biases of the gated recurrent unit using a normal distribution, and perform training iterations, validation, and adjustments.

[0063] S23: Extract features from user behavior data based on the trained gated recurrent unit, fuse the features extracted by the gated recurrent unit with the original features through weighted summation, and train, fuse, and optimize the CART algorithm.

[0064] Specifically, in step S21, configure the master node and slave nodes of Spark, store the collected data in HDFS, continuously write real-time data to HDFS, and submit the written Spark application to the Spark cluster for execution. Monitor the running status of the Spark job, including task progress, resource usage, and performance indicators. Perform optimization based on the monitoring results, including adjusting the parallelism, memory allocation, and data partitioning of the job to improve the efficiency and performance of the job. For data preprocessing, perform data cleaning to remove duplicate data, outliers, and erroneous data; perform data normalization for better model processing; perform feature engineering to extract and construct meaningful features based on business needs and understanding of user behavior. Arrange the preprocessed user behavior features in the order of time series. The input of each time step is a vector containing multiple feature values, such as login time, operation type, geographic location, etc.

[0065] In step S22, the data is divided into 70%, 15%, and 15% groups. The training set is used for model training, the validation set is used to adjust model parameters and evaluate model performance during training, and the test set is used to ultimately evaluate the model's generalization ability. The number of gated recurrent unit layers is determined based on the complexity of the data and computing resource constraints. For more complex user behavior data, a 2-3-layer gated recurrent unit structure is selected. The number of neurons in each layer of the gated recurrent unit is adjusted based on the data size and task requirements. For large data volumes and complex behavior patterns, the number of neurons can be increased appropriately to improve the model's expressiveness. The ReLU activation function is used to enhance the model's nonlinear expressiveness. In the input layer, preprocessed user behavior features are input into the gated recurrent unit in time series order. The input for each time step can be a vector containing multiple feature values, such as login time, operation type, and geographic location. The output layer's format is determined based on the specific task requirements. In classification tasks, the output layer is configured with multiple neurons corresponding to different behavior categories; in regression tasks, the output layer is configured with one or more neurons outputting continuous numerical values. Normal distribution is used for initialization to ensure that the parameters are within a reasonable range.

[0066] In step S23, feature extraction is performed to obtain high-level feature representations that reflect the underlying patterns and trends of user behavior. For example, the features extracted by the gated recurrent unit are fused with basic user information (such as age, gender, etc.) to improve model performance.

[0067] Furthermore, the training iteration, verification and adjustment include the following steps:

[0068] S221: Divide the time series data of user behavior data in the training set into small batches, and select one batch of data each time to input into the gated recurrent unit for training;

[0069] S222: For each input batch, the gated recurrent unit performs forward propagation calculation according to its network structure to obtain an output result, compares the output result of the gated recurrent unit with the actual label value, calculates the loss function, and calculates the gradient of the loss function with respect to the weight and bias of the gated recurrent unit through the backpropagation algorithm based on the loss function;

[0070] S223: Update the weights and biases of the gated recurrent unit according to the gradient through the Adam optimization algorithm. During the training process, the model is regularly verified using the validation set. The hyperparameters of the model are adjusted based on the verification results, and L2 regularization is used to prevent overfitting.

[0071] Specifically, in step S221, the selection of the batch size needs to take into account computing resources and data scale, and is generally 32, 64, or 128.

[0072] In step S222, the output result is a predicted value of the user behavior, such as the predicted next operation type, login time interval, etc. For calculating the loss function, a suitable function can be selected according to the task type, such as mean square error (MSE) for regression tasks and cross entropy loss for classification tasks.

[0073] In step S223, the weights and biases of the gated recurrent unit are updated according to the gradient using the Adam optimization algorithm to reduce the loss function. This process is repeated until the loss function converges or the preset number of training times is reached. The loss function and other evaluation indicators on the validation set are calculated, such as accuracy, recall, and F1 value. According to the validation results, the hyperparameters of the model are adjusted, such as learning rate, number of layers, number of neurons, batch size, etc. A grid search or random search hyperparameter optimization method is used to find the best hyperparameter combination. If the performance of the model on the validation set begins to decline, overfitting may have occurred, and L2 regularization is used to prevent overfitting.

[0074] Furthermore, the training, integration and optimization of the CART algorithm include the following steps:

[0075] S231: The output of the gated recurrent unit algorithm is used as an input feature vector for the CART algorithm, and the label of the user behavior category is used as the corresponding target variable. The user behavior category labels include: normal behavior, suspicious behavior, and abnormal behavior;

[0076] S232: For each feature, traverse all values ​​and find the best partition point so that the difference between the two subsets after partitioning on the target variable is maximized. For each feature and partition point, calculate the Gini index after partitioning. The feature and partition point with the smallest Gini index are used as the best partition for the current node.

[0077] S233: recursively repeating the feature selection and partitioning of step S232 on the divided subsets until a stopping condition is met. When the stopping condition is met, marking the current node as a leaf node and determining the category label of the leaf node;

[0078] S234: For a new input sample, starting from the root node of the decision tree, traverse downward step by step according to the feature value of the sample and the partitioning rules of the decision tree until reaching the leaf node, obtain the predicted category label, and evaluate the constructed decision tree through the test set.

[0079] Specifically, the gated recurrent unit is a neural network algorithm used to process sequence data, and the CART decision tree is an algorithm for prediction and classification based on branch judgment. Combining them is to comprehensively utilize the advantages of both to more accurately model and analyze user behavior.

[0080] In step S233, the stopping conditions include the number of samples in the node being less than a certain threshold, the Gini index being less than a certain threshold, or reaching a preset tree depth. Determining the category label of the leaf node may select the category with the largest number of samples in the node as the category prediction for the leaf node. In step S234, the evaluation metrics include precision, recall, F1 value, etc.

[0081] The two subsets after the division have the largest difference in the target variable, including: measuring the difference in the target variable by the Gini index, and the Gini index calculation formula is:

[0082] Where D is the dataset, K is the number of categories, and p k is the proportion of samples belonging to category k;

[0083] For the features and partition points, the Gini index after partition is calculated, including: feature x i And the partition point s, calculate the Gini index after partition:

[0084]

[0085] Where N is the total number of datasets, N left and N right are the number of samples in the left and right subsets after division, D left and D right are the left and right subsets respectively.

[0086] Furthermore, the method extracts the user's behavioral characteristics, compares them with existing user behavior patterns, performs authenticity assessment, and determines the user's risk level based on the assessment results; the method includes the following steps:

[0087] S31: Calculate the similarity between the user feature vector and the existing user feature vectors using the Euclidean distance, and select existing users with higher similarity to form a similar user group based on the similarity list;

[0088] S32: By calculating the mean difference, the user is compared with similar user groups in various behavioral characteristics to detect whether the new user has obvious abnormal behavior. Based on the analysis results of behavioral differences and abnormal behavior, the authenticity of the new user is comprehensively evaluated;

[0089] S33: Set different risk level standards based on business needs and security requirements, assign new users to corresponding risk levels based on their authenticity assessment scores or behavioral characteristics, and regularly adjust and optimize user behavior models.

[0090] Specifically, in step S31, similarity is calculated for each existing user's feature vector to obtain a similarity list. To determine similar user groups, a similarity threshold is set, and existing users with similarity greater than the threshold are included in the similar user group.

[0091] In step S32, the degree of variance is determined by calculating mean differences, such as by comparing the distribution of login time, operation frequency, and interactive behavior patterns. To detect whether a new user has obvious abnormal behavior, examples include unusually remote login locations, extremely high or low operation frequency, and mismatches between registration information and behavior compared to similar users. By setting rules for determining abnormal behavior, a determination is made based on the rules to determine whether the new user has abnormal behavior. To comprehensively assess the authenticity of the new user, different behavioral characteristics and abnormal behaviors are assigned different weights, and a weighted summation is used to generate an authenticity assessment score.

[0092] In step S33, different risk level standards are divided into three levels: low risk, medium risk, and high risk. The assessment score range or behavioral feature combination corresponding to each risk level is determined, and the new user is assigned to the corresponding risk level based on the authenticity assessment score or behavioral features. For high-risk users, stricter authentication measures are taken, such as requiring additional identity verification, manual review, etc.; for low-risk users, more convenient services are provided. Based on the user's authentication results and subsequent behavioral performance, timely feedback is provided to the user behavior model. If the new user is confirmed to be a real user and the behavior is stable, his or her behavioral data is incorporated into the existing user behavior model to continuously update and optimize the model. For users who are judged to be risky, their behavioral characteristics and authentication process are analyzed to identify possible problems and improvement directions. Regular optimization includes adjusting the parameters of the gate recurrent unit and decision tree algorithm, improving the feature extraction method, updating the risk level standard, etc. As new users continue to register and user behavior changes, the accuracy and adaptability of the model are continuously improved.

[0093] Furthermore, the method of continuously monitoring data security and regularly evaluating encryption algorithm performance, and optimizing based on evaluation results and security requirements, includes the following steps:

[0094] S41: Real-time monitoring of abnormal behaviors and potential attacks in network traffic through intrusion detection systems and intrusion prevention systems;

[0095] S42: Determine an evaluation period based on the importance of the system and the sensitivity of the data, collect encryption algorithm performance data through the API data interface and system logs, and collect security event data of the system during the evaluation period, perform performance testing on the encryption algorithm using a test data set according to evaluation indicators, and analyze the performance test results. The evaluation indicators include: encryption speed, decryption speed, key generation speed, data expansion rate, and anti-attack resistance;

[0096] S43: Based on the evaluation results and the security requirements of the system, optimization is performed through the complementary algorithm model. The optimized complementary algorithm model is put into use, and the performance and security of the system are continuously monitored.

[0097] Specifically, in step S41, the intrusion detection system and the intrusion prevention system are important technical means for ensuring network security. They analyze the data transmitted in the network, identify activities that do not conform to normal patterns or rules, and promptly detect and take corresponding measures to prevent network security threats for attack behaviors that have not been fully implemented but have signs of possible occurrence.

[0098] In step S42, an appropriate evaluation period is determined. For example, for systems with high security requirements, an evaluation is conducted monthly; for systems with general security requirements, an evaluation is conducted quarterly. Data related to the performance of the encryption algorithm is collected, including encryption and decryption time, key generation time, data transmission speed, CPU and memory usage, etc. Security event data includes the number of attack attempts and the number of successful attacks to evaluate the anti-attack capability of the encryption algorithm. The test data set should be representative, including data of different sizes and types to simulate the data conditions in the actual system. Automated testing tools can be used to perform performance testing, record test results, and analyze them. Analyze the performance test results and intuitively display the evaluation results through charts and statistical analysis methods. Consider the actual needs and security requirements of the system and determine which indicators are the most important. For example, for real-time data transmission systems, encryption speed and decryption speed may be key indicators; while for systems that store sensitive data, anti-attack capability may be more important.

[0099] Encryption speed measures how quickly an encryption algorithm encrypts data, typically expressed in data processed per second. Decryption speed measures how quickly an encryption algorithm decrypts encrypted data, also expressed in data processed per second. Key generation speed assesses how quickly an encryption algorithm generates keys. This metric is particularly important for systems that require frequent key changes. Data expansion rate refers to the ratio of the size of encrypted data to the size of the original data. A lower data expansion rate can reduce storage and transmission costs. Attack resistance evaluates an encryption algorithm's ability to resist various attacks, such as brute force cracking and side-channel attacks. This resistance can be assessed through simulated attack experiments.

[0100] In step S43, the optimization goal is determined based on the evaluation results and the system's security requirements. For example, if the encryption speed is slow, improving the encryption speed is the optimization goal; if the attack resistance is insufficient, strengthening the attack resistance of the encryption algorithm. Optimization strategies include adjusting the parameters of the encryption algorithm to improve performance, or utilizing hardware devices (such as dedicated encryption chips, graphics processors, etc.) to accelerate the execution of the encryption algorithm. Hardware acceleration can significantly increase encryption speed, especially for the encryption and decryption of large amounts of data. Alternatively, improvements can be made to the key generation, storage, distribution, and update processes to improve key security and management efficiency. For example, a key management system can be used to automate the key management process, regularly replace keys, and strengthen key storage security. Based on the selected optimization strategy, specific optimization measures are implemented, which may involve modifying the system code, adjusting configurations, and upgrading hardware. During the implementation of the optimization strategy, sufficient testing and verification should be carried out to ensure that the optimized system still meets security requirements and does not introduce new security vulnerabilities. After the optimized encryption algorithm is put into use, the system's performance and security will be continuously monitored. Data related to the encryption algorithm's performance and security will be collected through the API data interface and system logs. Regular evaluations will be conducted. Based on the monitoring and evaluation results, the optimization strategy will be adjusted in a timely manner to ensure that the encryption algorithm always meets the system's security and performance requirements.

[0101] Furthermore, the optimization by the complementary algorithm model comprises the following steps:

[0102] S431: According to the stored original data set D={d1, d2, ..., d n}, where n is the number of data items, for each data item d i , calculate the hash value through the SHA-256 hash algorithm, generate a symmetric encryption key through the AES symmetric encryption algorithm, encrypt the original data set with the key, and store the encrypted data set and the hash value of each data item in a database or file system;

[0103] S432: Read the encrypted data set and the corresponding hash value from the storage medium, calculate the expected hash value without decryption, and compare the calculated hash value with the stored hash value. If the two are equal, it means that the data has not been tampered with during the storage process; otherwise, it means that the data has been tampered with. When the hash value comparison result shows that the data is intact, the encrypted data item is decrypted using the key of the symmetric encryption algorithm to obtain the original data item.

[0104] Specifically, the SHA-256 hash algorithm is used to verify data integrity, and then the data is encrypted using a symmetric encryption algorithm. During the data verification process, the data's hash value is first calculated and compared with the stored hash value to ensure data integrity. The data is then decrypted using the symmetric encryption algorithm's key. This combination ensures data integrity and confidentiality during both storage and verification.

[0105] In step S431, the SHA-256 hash algorithm is a secure hash algorithm that converts input data of arbitrary length into a hash value of fixed length of 256 bits. For generating symmetric encryption keys, a random number generator is used to generate a key of sufficient length to ensure the security of the key. In step S432, the expected hash value is calculated without decryption. Here, it is assumed that the encryption process does not change the hash value properties of the data, that is, the hash value of the encrypted data is the same as the hash value of the original data. If it has not been tampered with, the data has integrity. The AES decryption process is the inverse of the encryption process, including the steps of round key addition, column obfuscation, row shifting, byte replacement, and initial round performed in reverse order.

[0106] Furthermore, the hash value is calculated using the SHA-256 hash algorithm, including: preprocessing the input data by padding and length extension, setting eight initial hash values, dividing the preprocessed data into a number of 512-bit blocks, performing multiple iterative calculations on each block through logical operations and bit operations, and obtaining a final 256-bit hash value after iterative calculation of all blocks.

[0107] Specifically, the input data is padded and length-extended to meet specific length requirements. The multiple iterative calculations performed on each block through logical and bitwise operations include: multiple calculation operations are performed on each independent block, and each such calculation operation (i.e., iteration) includes a series of logical operations (and, or, not, etc.) and bitwise operations (shift, bitwise and, bitwise or, etc.). The multiple iterative calculations are intended to gradually optimize or approximate the final result, while the logical and bitwise operations are specific calculation methods used to process and convert data.

[0108] The above embodiments are merely descriptions of preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Without departing from the design spirit of the present invention, various modifications and improvements made to the technical solutions of the present invention by ordinary engineering technicians in this field should fall within the scope of protection determined by the claims of the present invention.

Claims

1. An authentication method based on real-name authentication, characterized in that: The following steps are involved: S1: Collect user behavior data from multiple data sources through API data interfaces, and classify and preprocess the collected data; S2: Classify user behavior characteristics according to the normal user behavior pattern established by the user behavior model; S3: By extracting the user's behavioral characteristics and comparing them with existing user behavior patterns, authenticity assessment is performed and the user's risk level is determined based on the assessment results; S4: Continuously monitor data security and regularly evaluate encryption algorithm performance. Based on the evaluation results and security requirements, regularly update user behavior models and continuously optimize encryption algorithms and authentication processes.

2. The authentication method based on real-name authentication according to claim 1, characterized in that: The data source includes: user login logs, operation records and interaction behavior data; the user behavior model includes a model that combines a deep learning algorithm and a decision tree algorithm.

3. The authentication method based on real-name authentication according to claim 2, characterized in that: The normal user behavior pattern established according to the user behavior model comprises the following steps: S21: A distributed framework built based on Spark core components and the Hadoop Distributed File System. It uses HDFS for data storage, monitors the running status of Spark jobs, and converts pre-processed data into time series format. S22: Divide the time series data into training, validation, and test sets. Based on the network structure and input and output design of the gated recurrent unit, randomly initialize the weights and biases of the gated recurrent unit using a normal distribution, and perform training iterations, validation, and adjustments. S23: Extract features from user behavior data based on the trained gated recurrent unit, fuse the features extracted by the gated recurrent unit with the original features through weighted summation, and train, fuse, and optimize the CART algorithm.

4. The authentication method based on real-name authentication according to claim 3, characterized in that: The training iteration, verification and adjustment include the following steps: S221: Divide the time series data of user behavior data in the training set into small batches, and select one batch of data each time to input into the gated recurrent unit for training; S222: For each input batch, the gated recurrent unit performs forward propagation calculation according to its network structure to obtain an output result, compares the output result of the gated recurrent unit with the actual label value, calculates the loss function, and calculates the gradient of the loss function with respect to the weight and bias of the gated recurrent unit through the backpropagation algorithm based on the loss function; S223: Update the weights and biases of the gated recurrent unit according to the gradient through the Adam optimization algorithm. During the training process, the model is regularly verified using the validation set. The hyperparameters of the model are adjusted based on the verification results, and L2 regularization is used to prevent overfitting.

5. The authentication method based on real-name authentication according to claim 3, characterized in that: The training, integration and optimization of the CART algorithm include the following steps: S231: The output of the gated recurrent unit algorithm is used as an input feature vector for the CART algorithm, and the label of the user behavior category is used as the corresponding target variable. The user behavior category labels include: normal behavior, suspicious behavior, and abnormal behavior; S232: For each feature, traverse all values ​​and find the best partition point so that the difference between the two subsets after partitioning on the target variable is maximized. For each feature and partition point, calculate the Gini index after partitioning. The feature and partition point with the smallest Gini index are used as the best partition for the current node. S233: recursively repeating the feature selection and partitioning of step S232 on the divided subsets until a stopping condition is met. When the stopping condition is met, marking the current node as a leaf node and determining the category label of the leaf node; S234: For a new input sample, starting from the root node of the decision tree, traverse downward step by step according to the feature value of the sample and the partitioning rules of the decision tree until reaching the leaf node, obtain the predicted category label, and evaluate the constructed decision tree through the test set.

6. The authentication method based on real-name authentication according to claim 5, characterized in that: The two subsets after the division have the largest difference in the target variable, including: measuring the difference in the target variable by the Gini index, and the Gini index calculation formula is: Where D is the dataset, K is the number of categories, and p k is the proportion of samples belonging to category k; For the features and partition points, the Gini index after partition is calculated, including: feature x i And the partition point s, calculate the Gini index after partition: Where N is the total number of datasets, N left and N right are the number of samples in the left and right subsets after division, D left and D right are the left and right subsets respectively.

7. The authentication method based on real-name authentication according to claim 1, characterized in that: The method extracts the user's behavioral characteristics, compares them with existing user behavior patterns, performs authenticity assessment, and determines the user's risk level based on the assessment results; the method includes the following steps: S31: Calculate the similarity between the user feature vector and the existing user feature vectors using the Euclidean distance, and select existing users with higher similarity to form a similar user group based on the similarity list; S32: By calculating the mean difference, the user is compared with similar user groups in various behavioral characteristics to detect whether the new user has obvious abnormal behavior. Based on the analysis results of behavioral differences and abnormal behavior, the authenticity of the new user is comprehensively evaluated; S33: Set different risk level standards based on business needs and security requirements, assign new users to corresponding risk levels based on their authenticity assessment scores or behavioral characteristics, and regularly adjust and optimize user behavior models.

8. The authentication method based on real-name authentication according to claim 1, characterized in that: Continuously monitoring data security and regularly evaluating encryption algorithm performance, and optimizing based on evaluation results and security requirements, includes the following steps: S41: Real-time monitoring of abnormal behaviors and potential attacks in network traffic through intrusion detection systems and intrusion prevention systems; S42: Determine an evaluation period based on the importance of the system and the sensitivity of the data, collect encryption algorithm performance data through the API data interface and system logs, and collect security event data of the system during the evaluation period, perform performance testing on the encryption algorithm using a test data set according to evaluation indicators, and analyze the performance test results. The evaluation indicators include: encryption speed, decryption speed, key generation speed, data expansion rate, and anti-attack resistance; S43: Based on the evaluation results and the security requirements of the system, optimization is performed through the complementary algorithm model. The optimized complementary algorithm model is put into use, and the performance and security of the system are continuously monitored.

9. The authentication method based on real-name authentication according to claim 8, characterized in that: The optimization by the complementary algorithm model comprises the following steps: S431: According to the stored original data set D={d1, d2, ..., d n }, where n is the number of data items, for each data item d i , calculate the hash value through the SHA-256 hash algorithm, generate a symmetric encryption key through the AES symmetric encryption algorithm, encrypt the original data set with the key, and store the encrypted data set and the hash value of each data item in a database or file system; S432: Read the encrypted data set and the corresponding hash value from the storage medium, calculate the expected hash value without decryption, and compare the calculated hash value with the stored hash value. If the two are equal, it means that the data has not been tampered with during the storage process; otherwise, it means that the data has been tampered with. When the hash value comparison result shows that the data is intact, the encrypted data item is decrypted using the key of the symmetric encryption algorithm to obtain the original data item.

10. The authentication method based on real-name authentication according to claim 9, characterized in that: The hash value is calculated using the SHA-256 hash algorithm, including: preprocessing the input data by padding and length extension, setting eight initial hash values, dividing the preprocessed data into a plurality of 512-bit blocks, performing multiple iterative calculations on each block through logical operations and bit operations, and obtaining a final 256-bit hash value after iterative calculations of all blocks.

Images