Human-machine identification method, system and equipment based on analysis of web access behaviors

Abstract

The invention relates to the technical field of man-machine identification, and provides a man-machine identification method, system and device based on analysis of web access behaviors, and the method comprises the steps: triggering and recording user interaction behavior data when a user accesses a web application system, encrypting the recorded user interaction behavior data, and obtaining backhaul encrypted data; acquiring backhaul encrypted data, decrypting the acquired backhaul encrypted data to obtain decrypted data, and performing feature extraction on the decrypted data to construct a user behavior set; and comparing the constructed user behavior set with a preset behavior rule, obtaining a user behavior score according to a comparison result, and judging a user identity according to the user behavior score. According to the man-machine identification method, system and equipment based on analysis of web access behaviors, various attack means can be better resisted, and the safety of man-machine identification is remarkably improved.

Description

Technical Field

[0001] The present invention relates to the technical field of human-machine identification, and in particular to a human-machine identification method, system and device based on analyzing web access behavior. Background Art

[0002] In the current Internet environment, malicious robots' attacks on Web applications have become a serious security threat. Attackers can easily obtain Web application vulnerabilities and user privacy data using scanners, crawlers and other tools. It is urgent to protect malicious machine traffic through human-machine recognition. The current mainstream human-machine recognition methods include image verification codes, text verification codes and device fingerprint recognition.

[0003] Image verification codes verify the authenticity of users by displaying image content such as text, numbers, and shapes that users need to recognize and input. In actual applications, using traditional computer vision technology or deep learning models, attackers can automatically crack simple image verification codes.

[0004] The text verification code verifies the authenticity of the user by sending a text message or email containing randomly generated numbers or letters to the user, requiring the user to enter them in the input box to verify their identity. In actual applications, the text verification code is usually distorted, disrupted, blurred, etc. to prevent recognition by automated tools, but this also makes the verification code difficult for users to read and understand, especially on mobile devices. Entering complex or ambiguous text verification codes may frustrate users and increase the time and difficulty for users to complete the verification process.

[0005] Device fingerprinting identifies and verifies the authenticity of user devices by collecting and analyzing device hardware and software features such as operating system version, browser type, and IP address. Device fingerprints are highly unique, but in actual applications, attackers can simulate and forge device fingerprints to bypass the recognition system. In some cases, device fingerprints may change due to hardware or software changes, resulting in misjudgment of legitimate users or allowing malicious users to pass verification.

[0006] Therefore, how to provide a safer, more efficient and accurate human-machine identification method has become a technical problem that needs to be solved urgently. Summary of the invention

[0007] In view of this, in order to overcome the deficiencies of the prior art, the present invention aims to provide a method, system and device for human-machine identification based on analyzing web access behavior.

[0008] According to a first aspect of the present invention, a method for human-machine identification based on analyzing web access behavior is provided, the method comprising: When a user accesses the web application system, the user interaction behavior data is triggered to be recorded, the recorded user interaction behavior data is encrypted, and the returned encrypted data is obtained; Collect the returned encrypted data, decrypt the collected returned encrypted data to obtain decrypted data, and construct a user behavior set by extracting features from the decrypted data; The constructed user behavior set is compared with the preset behavior rules, the user behavior score is obtained according to the comparison result, and the user identity is determined according to the user behavior score.

[0009] Preferably, in the human-machine identification method based on analyzing web access behavior of the present invention, when a user accesses a web application system, triggering recording of user interaction behavior data includes: When a user accesses a web application system through a web client, a first HTTP request is sent to the data forwarding module, and the data forwarding module forwards the first HTTP request to the web server after receiving the first HTTP request; After receiving the first HTTP request, the web server returns response data to the data forwarding module, and after receiving the response data, the data forwarding module forwards the response data and the web SDK to the web client; The web client loads and runs the received web SDK, triggering the data recording module to monitor the user's web interaction behavior and record the user interaction behavior data.

[0010] Preferably, in the human-machine identification method based on analyzing web access behavior of the present invention, the user interaction behavior data includes: mouse movement trajectory, click mode, scrolling event, window loading, window size change, keyboard input speed and input mode data.

[0011] Preferably, the present invention is based on a human-machine identification method for analyzing web access behavior, encrypts the recorded user interaction behavior data to obtain returned encrypted data, including: sending the recorded user interaction behavior data to an encryption module through a data recording module, and the encryption module encrypts the received user interaction behavior data to obtain returned encrypted data.

[0012] Preferably, in the human-machine identification method based on analyzing web access behavior, the present invention collects the returned encrypted data, decrypts the collected returned encrypted data to obtain decrypted data, and constructs a user behavior set by extracting features from the decrypted data, including: The data collection module collects the returned encrypted data from the encryption module through the data forwarding module, extracts the user interaction behavior encrypted data from the received returned encrypted data, and sends the extracted user interaction behavior encrypted data to the data decryption module; The data decryption module decrypts the received encrypted data of user interaction behavior, and sends the decrypted data to the behavior feature extraction module when the decryption is successful. The behavior feature extraction module extracts the key features in the user interaction behavior data from the received decrypted data, and constructs a user behavior set based on the extracted key features.

[0013] Preferably, in the human-machine identification method based on analyzing web access behavior, the present invention collects the returned encrypted data, decrypts the collected returned encrypted data to obtain decrypted data, and constructs a user behavior set by extracting features from the decrypted data, including: When decryption fails, the access is marked as pending and the access characteristics are recorded through the logging module; When building the user behavior set fails, the access is marked as a machine access and the access features are recorded through the logging module.

[0014] Preferably, in the human-machine identification method based on analyzing web access behavior, the present invention compares the constructed user behavior set with the preset behavior rules, and obtains the user behavior score according to the comparison result, including: the behavior feature extraction module sends the constructed user behavior set to the behavior analysis and comparison module, the behavior analysis and comparison module compares the received user behavior set with the preset behavior rules, and obtains the behavior score according to the comparison result.

[0015] Preferably, in the human-machine identification method based on analyzing web access behavior of the present invention, determining the user identity according to the user behavior score includes: The obtained behavior scores are sent to the decision-making module through the behavior analysis and comparison module; The decision module determines whether the user initiating the access is a machine based on the received behavior score; When it is determined that the user initiating the access is a machine, the access is marked as a machine access and the access characteristics are recorded through the log recording module.

[0016] According to a second aspect of the present invention, there is provided a human-machine identification system based on analyzing web access behavior, the system comprising a human-machine identification server, the human-machine identification server being used to: when a user accesses a web application system, trigger recording of user interaction behavior data, encrypt the recorded user interaction behavior data, and obtain returned encrypted data; collect returned encrypted data, decrypt the collected returned encrypted data to obtain decrypted data, and construct a user behavior set by extracting features from the decrypted data; compare the constructed user behavior set with preset behavior rules, obtain a user behavior score based on the comparison result, and determine the user identity based on the user behavior score.

[0017] According to a third aspect of the present invention, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in the first aspect of the present invention when executing the program.

[0018] The human-machine identification method, system and device based on analyzing web access behavior of the present invention extract and analyze user behavior features by monitoring and recording user web page interaction behavior data, and determine whether the access is a real user access or a machine access. In practical applications, the human-machine identification method and system based on analyzing web access behavior of this embodiment has the following beneficial technical effects: 1. By analyzing the user's behavior patterns in web applications, such as mouse movement, keyboard input, page browsing, etc., a behavioral feature model of each user can be established to identify the difference between normal users and robots, thereby achieving high-precision human-machine identification; 2. Different from traditional verification codes or manual identification methods, human-machine identification based on behavioral analysis does not require users to perform additional operations such as entering verification codes or answering questions. This non-perceptual identification method not only improves the user experience, but also enables risk assessment and identification without affecting user operations; 3. By monitoring and analyzing user behavior in real time, it is possible to respond quickly to risks that arise immediately; 4. Compared with traditional rule-based or static analysis methods, it can analyze and judge based on the user's real behavior patterns, with fewer false positives for normal users, reducing user experience problems caused by recognition errors and significantly reducing the false positive rate.

[0019] The human-machine identification method and system based on analyzing web access behavior in the embodiment of the present invention does not rely on a single static defense mechanism, but performs identification by comprehensively analyzing multiple aspects of user behavior. It can be used in WAF products to better resist various attack methods, avoid the shortcomings of traditional robot attacks that may attempt to bypass verification codes or other static defense measures, and significantly improve the security of human-machine identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0021] Figure 1 An exemplary diagram of a human-machine identification system based on analyzing web access behavior according to an embodiment of the present invention; Figure 2 A flowchart of a method for human-machine identification based on analyzing web access behavior according to an embodiment of the present invention; Figure 3 This is an example diagram of the technical principle of a human-machine identification method based on analyzing web access behavior according to an embodiment of the present invention; Figure 4 This is an example diagram of an execution of a human-machine identification method based on analyzing web access behavior according to an embodiment of the present invention; Figure 5 A schematic diagram of the structure of the device provided by the present invention. DETAILED DESCRIPTION

[0022] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0023] It should be noted that the following embodiments and features in the embodiments may be combined with each other in the absence of conflict; and, based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making any creative work are within the scope of protection of the present disclosure.

[0024] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein may be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present disclosure, it should be understood by those skilled in the art that an aspect described herein may be implemented independently of any other aspect, and two or more of these aspects may be combined in various ways. For example, any number of aspects described herein may be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein may be used to implement this device and / or practice this method.

[0025] Figure 1 FIG. 1 is an example diagram of a human-machine identification system based on analyzing web access behavior according to an embodiment of the present invention. Figure 1 As shown, the system may include a human-machine identification server 101, a communication network 102 and / or one or more human-machine identification clients 103. Figure 1 The example shown is a plurality of human-machine recognition clients 103 .

[0026] The human-machine identification server 101 can be any appropriate server for storing information, data, programs and / or any other suitable type of content. In some embodiments, the human-machine identification server 101 can perform appropriate functions. For example, in some embodiments, the human-machine identification server 101 can be used to perform human-machine identification based on analyzing web access behavior. As an optional example, in some embodiments, the human-machine identification server 101 can be used to: when a user accesses a web application system, trigger the recording of user interaction behavior data, encrypt the recorded user interaction behavior data, and obtain the returned encrypted data; collect the returned encrypted data, decrypt the collected returned encrypted data to obtain decrypted data, and construct a user behavior set by extracting features from the decrypted data; compare the constructed user behavior set with the preset behavior rules, obtain the user behavior score based on the comparison result, and determine the user identity based on the user behavior score.

[0027] As another example, in some embodiments, the human-machine recognition server 101 may send a human-machine recognition method based on analyzing web access behavior to the human-machine recognition client 103 for user use according to a request of the human-machine recognition client 103 .

[0028] As an optional example, in some embodiments, the human-machine identification client 103 is used to provide a visual identification interface, which is used to receive a user's selection input operation for performing human-machine identification based on analyzing web access behavior, and to, in response to the selection input operation, obtain from the human-machine identification server 101 an identification interface corresponding to the option selected by the selection input operation and display the identification interface, wherein the identification interface at least displays information on performing human-machine identification based on analyzing web access behavior and operation options for the information on performing human-machine identification based on analyzing web access behavior.

[0029] In some embodiments, the communication network 102 can be any suitable combination of one or more wired and / or wireless networks. For example, the communication network 102 can include any one or more of the following: the Internet, an intranet, a wide area network (WAN), a local area network (LAN), a wireless network, a digital subscriber line (DSL) network, a frame relay network, an asynchronous transfer mode (ATM) network, a virtual private network (VPN) and / or any other suitable communication network. The human-machine recognition client 103 can be connected to the communication network 102 via one or more communication links (e.g., communication link 104), and the communication network 102 can be linked to the human-machine recognition service end 101 via one or more communication links (e.g., communication link 105). The communication link can be any communication link suitable for transmitting data between the human-machine recognition client 103 and the human-machine recognition service end 101, such as a network link, a dial-up link, a wireless link, a hard-wired link, any other suitable communication link or any suitable combination of such links.

[0030] The human-machine identification client 103 may include any one or more clients that present an interface related to human-machine identification based on analyzing web access behavior in an appropriate form for use and operation by the user. In some embodiments, the human-machine identification client 103 may include any suitable type of device. For example, in some embodiments, the human-machine identification client 103 may include a mobile device, a tablet computer, a laptop computer, a desktop computer and / or any other suitable type of client device.

[0031] Although the captcha server 101 is illustrated as one device, in some embodiments, any appropriate number of devices may be used to perform the functions performed by the captcha server 101. For example, in some embodiments, multiple devices may be used to implement the functions performed by the captcha server 101. Alternatively, a cloud service may be used to implement the functions of the captcha server 101.

[0032] Based on the above system, an embodiment of the present application provides a method for human-machine identification based on analyzing web access behavior, which is described below through the following embodiments.

[0033] Figure 2 The present invention is a flowchart of a method for human-machine identification based on analyzing web access behavior according to an embodiment of the present invention. Figure 3 This is an example diagram of the technical principle of a human-machine identification method based on analyzing web access behavior according to an embodiment of the present invention. Figure 4 FIG. 1 is an example diagram of an implementation of a human-machine identification method based on analyzing web access behavior according to an embodiment of the present invention. Figure 2 , Figure 3 and Figure 4As shown, the human-machine identification method based on analyzing web access behavior of this embodiment can be executed on the human-machine identification server, and the human-machine identification method based on analyzing web access behavior includes the following steps: Step S201: When a user accesses a web application system, the user interaction behavior data is triggered to be recorded, the recorded user interaction behavior data is encrypted, and the returned encrypted data is obtained.

[0034] As an optional example, when a user accesses a web application system through a web client, the first HTTP request is sent to the data forwarding module, and the data forwarding module forwards the first HTTP request to the web server after receiving the first HTTP request; the web server returns response data to the data forwarding module after receiving the first HTTP request, and the data forwarding module forwards the response data and the web SDK to the web client after receiving the response data; the web client loads and runs the received web SDK, triggering the data recording module to monitor the user's web interaction behavior and record the user interaction behavior data. For example, the user interaction behavior data of this embodiment includes: mouse movement trajectory, click mode, scrolling event, window loading, window size change, keyboard input speed and input mode data. In actual applications, the user interaction behavior data may also include other types of interaction behavior data, which is not limited in this embodiment. In actual applications, this embodiment can monitor the user's web interaction behavior in real time, or it can monitor the user's web interaction behavior at a fixed time or at a set frequency.

[0035] As an optional example, in this embodiment, the data recording module sends the recorded user interaction behavior data to the encryption module, and the encryption module encrypts the received user interaction behavior data to obtain the returned encrypted data.

[0036] Step S202: Collect the returned encrypted data, decrypt the collected returned encrypted data to obtain decrypted data, and construct a user behavior set by extracting features from the decrypted data.

[0037] As an optional example, in this embodiment, the data collection module collects the returned encrypted data from the encryption module through the data forwarding module, extracts the user interaction behavior encrypted data from the received returned encrypted data, and sends the extracted user interaction behavior encrypted data to the data decryption module; the data decryption module decrypts the received user interaction behavior encrypted data, and sends the decrypted data to the behavior feature extraction module when the decryption is successful. The behavior feature extraction module extracts the key features in the user interaction behavior data from the received decrypted data, and constructs a user behavior set based on the extracted key features. In actual applications, by analyzing the user's behavior patterns in web applications, such as mouse movement, keyboard input, page browsing methods, etc., a behavior feature model for each user can be established. This model can be used to identify the difference between normal users and robots, thereby achieving high-precision human-machine recognition.

[0038] It should be noted that in this embodiment, when decryption fails, the log recording module marks the access as pending and records the access characteristics. In actual applications, a threshold for decryption failure can be set, and re-decryption is performed when decryption fails. When the number of re-decryption exceeds the set threshold for decryption failure, the log recording module marks the access as pending and records the access characteristics.

[0039] It should be noted that when the construction of the user behavior set fails, the access is marked as a machine access through the logging module and the access characteristics are recorded.

[0040] Step S203: Compare the constructed user behavior set with the preset behavior rules, obtain the user behavior score according to the comparison result, and determine the user identity according to the user behavior score.

[0041] As an optional example, in the method of this embodiment, the behavior feature extraction module sends the constructed user behavior set to the behavior analysis and comparison module, and the behavior analysis and comparison module compares the received user behavior set with the preset behavior rules and obtains the behavior score according to the comparison result. The behavior score obtained by the behavior analysis and comparison module is sent to the decision module; the decision module determines whether the user who initiated the access is a machine based on the received behavior score; when it is determined that the user who initiated the access is a machine rather than a real person, the log recording module marks the access as a machine access and records the access features.

[0042] The human-machine identification method and system based on analyzing web access behavior in the embodiment of the present invention extracts and analyzes user behavior features by monitoring and recording user web page interaction behavior data, and determines whether the access is a real user access or a machine access. In practical applications, the human-machine identification method and system based on analyzing web access behavior in this embodiment has the following beneficial technical effects: 1. By analyzing the user's behavior patterns in web applications, such as mouse movement, keyboard input, page browsing, etc., a behavioral feature model of each user can be established to identify the difference between normal users and robots, thereby achieving high-precision human-machine identification; 2. Different from traditional verification codes or manual identification methods, human-machine identification based on behavioral analysis does not require users to perform additional operations such as entering verification codes or answering questions. This non-perceptual identification method not only improves the user experience, but also enables risk assessment and identification without affecting user operations; 3. By monitoring and analyzing user behavior in real time, it is possible to respond quickly to risks that arise immediately; 4. Compared with traditional rule-based or static analysis methods, it can analyze and judge based on the user's real behavior patterns, with fewer false positives for normal users, reducing user experience problems caused by recognition errors and significantly reducing the false positive rate.

[0043] The human-machine identification method and system based on analyzing web access behavior in the embodiment of the present invention does not rely on a single static defense mechanism, but performs identification by comprehensively analyzing multiple aspects of user behavior. It can be used in WAF products to better resist various attack methods, avoid the shortcomings of traditional robot attacks that may attempt to bypass verification codes or other static defense measures, and significantly improve the security of human-machine identification.

[0044] like Figure 5 As shown, the present invention also provides a device, including a processor 310, a communication interface 320, a memory 330 for storing a computer program executable by the processor, and a communication bus 340. The processor 310, the communication interface 320, and the memory 330 communicate with each other through the communication bus 340. The processor 310 implements the above-mentioned human-machine identification method based on analyzing web access behavior by running the executable computer program.

[0045] Among them, the computer program in the memory 330 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0046] The system embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, i.e., they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected based on actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art may understand and implement it without creative effort.

[0047] Through the description of the above implementation modes, those skilled in the art can clearly understand that each implementation mode can be implemented by means of software plus a necessary general hardware platform, or of course by hardware. Based on such an understanding, the above technical solution can essentially or in other words be embodied in the form of a software product that contributes to the prior art. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment or some parts of the embodiment.

[0048] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A human-machine identification method based on analyzing web access behavior, characterized in that: The method comprises: When a user accesses the web application system, the user interaction behavior data is triggered to be recorded, the recorded user interaction behavior data is encrypted, and the returned encrypted data is obtained; Collect the returned encrypted data, decrypt the collected returned encrypted data to obtain decrypted data, and construct a user behavior set by extracting features from the decrypted data; The constructed user behavior set is compared with the preset behavior rules, the user behavior score is obtained according to the comparison result, and the user identity is determined according to the user behavior score.

2. The method for human-machine identification based on analyzing web access behavior according to claim 1 is characterized in that: When a user accesses a web application system, the user interaction behavior data is triggered and recorded, including: When a user accesses the web application system through a web client, a first HTTP request is sent to the data forwarding module, and the data forwarding module forwards the first HTTP request to the web server after receiving the first HTTP request; After receiving the first HTTP request, the web server returns response data to the data forwarding module, and after receiving the response data, the data forwarding module forwards the response data and the web SDK to the web client; The web client loads and runs the received web SDK, triggering the data recording module to monitor the user's web interaction behavior and record the user interaction behavior data.

3. The method for human-machine identification based on analyzing web access behavior according to claim 1 is characterized in that: User interaction behavior data includes: mouse movement trajectory, click mode, scrolling events, window loading, window size change, keyboard input speed and input mode data.

4. The method for human-machine identification based on analyzing web access behavior according to claim 1 is characterized in that: The recorded user interaction behavior data is encrypted to obtain the returned encrypted data, including: sending the recorded user interaction behavior data to the encryption module through the data recording module, and the encryption module encrypts the received user interaction behavior data to obtain the returned encrypted data.

5. The method for human-machine identification based on analyzing web access behavior according to claim 1 is characterized in that: Collect the returned encrypted data, decrypt the collected returned encrypted data to obtain the decrypted data, and construct the user behavior set by extracting features from the decrypted data, including: The data collection module collects the returned encrypted data from the encryption module through the data forwarding module, extracts the user interaction behavior encrypted data from the received returned encrypted data, and sends the extracted user interaction behavior encrypted data to the data decryption module; The data decryption module decrypts the received encrypted data of user interaction behavior, and sends the decrypted data to the behavior feature extraction module when the decryption is successful. The behavior feature extraction module extracts the key features in the user interaction behavior data from the received decrypted data, and constructs a user behavior set based on the extracted key features.

6. The method for human-machine identification based on analyzing web access behavior according to claim 1 is characterized in that: Collect the returned encrypted data, decrypt the collected returned encrypted data to obtain the decrypted data, and construct the user behavior set by extracting features from the decrypted data, including: When decryption fails, the access is marked as pending and the access characteristics are recorded through the logging module; When building the user behavior set fails, the access is marked as a machine access and the access features are recorded through the logging module.

7. The method for human-machine identification based on analyzing web access behavior according to claim 1 is characterized in that: The constructed user behavior set is compared with the preset behavior rules, and the user behavior score is obtained according to the comparison result, including: the behavior feature extraction module sends the constructed user behavior set to the behavior analysis and comparison module, the behavior analysis and comparison module compares the received user behavior set with the preset behavior rules, and obtains the behavior score according to the comparison result.

8. The method for human-machine identification based on analyzing web access behavior according to claim 1 is characterized in that: Determine user identity based on user behavior scores, including: The obtained behavior scores are sent to the decision-making module through the behavior analysis and comparison module; The decision module determines whether the user initiating the access is a machine based on the received behavior score; When it is determined that the user initiating the access is a machine, the access is marked as a machine access and the access characteristics are recorded through the log recording module.

9. A human-machine identification system based on analyzing web access behavior, characterized in that: The system includes a human-machine identification server, which is used to: when a user accesses a web application system, trigger the recording of user interaction behavior data, encrypt the recorded user interaction behavior data, and obtain the returned encrypted data; collect the returned encrypted data, decrypt the collected returned encrypted data to obtain the decrypted data, and construct a user behavior set by extracting features from the decrypted data; The constructed user behavior set is compared with the preset behavior rules, the user behavior score is obtained according to the comparison result, and the user identity is determined according to the user behavior score.

10. A computer device, characterized in that: The computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, and the processor implements the steps of the method according to any one of claims 1 to 8 when executing the program.

Images