Dynamic identity risk assessment method and device based on behavior analysis

Abstract

The invention provides a dynamic identity risk assessment method and device based on behavior analysis, and the method comprises the steps: collecting the current behavior data of a current first user based on a plurality of preset data sources, obtaining a behavior baseline model, and carrying out the anomaly detection based on the behavior baseline model and the current behavior data, the method comprises the steps of obtaining an anomaly detection score corresponding to a first user, obtaining an equipment state analysis result and a network environment monitoring result, obtaining an information integration score based on the equipment state analysis result, the network environment monitoring result and the anomaly detection score, obtaining a dynamic score threshold, and performing response based on the information integration score and the dynamic score threshold. According to the method, the user behavior can be monitored in real time, the potential risk is dynamically evaluated and responded in time, and the risk of identity theft is reduced.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a method and device for dynamic identity risk assessment based on behavior analysis. Background Art

[0002] With the rapid development of Internet technology, identity theft incidents have occurred frequently, posing a huge threat to personal privacy and corporate information security, while traditional identity authentication methods have been unable to cope with complex network environments.

[0003] At present, the risk is reduced mainly by authenticating the user's identity and determining its legitimacy. Specifically, the account and password are used for authentication during the first login.

[0004] However, with current identity authentication methods, once an account password is leaked, personal identity may be stolen, resulting in the leakage of privacy or confidential information. Unauthorized third parties can easily impersonate legitimate users to perform operations, resulting in data leakage and violation of personal privacy. Therefore, the risk of identity theft is relatively high. Summary of the invention

[0005] In view of this, the purpose of the present application is to provide a dynamic identity risk assessment method and device based on behavior analysis, which comprehensively collects user behavior data through multiple data sources, and performs anomaly detection on the behavior data based on an established behavior baseline model to obtain an anomaly detection score, and integrates the device status analysis results, network environment monitoring results and anomaly detection scores to obtain information integration scores, and finally responds according to the information integration score and dynamic scoring threshold. It can monitor user behavior in real time, dynamically evaluate potential risks and respond in a timely manner, thereby reducing the risk of identity theft.

[0006] In a first aspect, an embodiment of the present application provides a dynamic identity risk assessment method based on behavior analysis, the method comprising:

[0007] Collecting current behavior data of the current first user based on preset multiple data sources;

[0008] Acquire a behavior baseline model, and perform anomaly detection based on the behavior baseline model and the current behavior data to obtain an anomaly detection score corresponding to the first user; wherein the behavior baseline model corresponds to multiple behavior patterns;

[0009] Obtaining device status analysis results and network environment monitoring results, and obtaining an information integration score based on the device status analysis results, the network environment monitoring results, and the anomaly detection score;

[0010] A dynamic scoring threshold is obtained, and a response is made based on the information integration score and the dynamic scoring threshold.

[0011] In a possible implementation, the acquiring of the behavior baseline model includes:

[0012] Collecting historical behavior data of the second user based on the multiple data sources;

[0013] Extracting features from the historical behavior data to obtain corresponding behavior features, and obtaining corresponding user behavior models based on the behavior features; wherein the behavior features are features that can accurately reflect user habits; and each behavior feature corresponds to a normal behavior pattern;

[0014] The user behavior model is trained based on a preset machine learning algorithm, and the user behavior model is tuned based on preset tuning parameters to obtain the behavior baseline model; wherein the behavior baseline model is a model with optimal performance in terms of high accuracy and generalization ability.

[0015] In a possible implementation, performing anomaly detection based on the behavior baseline model and the current behavior data to obtain an anomaly detection score corresponding to the first user includes:

[0016] Based on a preset anomaly detection algorithm and anomaly detection threshold, comparing the behavior baseline model with the current behavior data;

[0017] In response to identifying abnormal behavior exceeding the abnormal detection threshold in the current behavior data, determining an abnormal detection score corresponding to the first user based on the abnormal behavior; wherein the abnormal behavior characterizes abnormal activities that deviate from the normal behavior pattern corresponding to the behavior baseline model.

[0018] In a possible implementation, the obtaining of the device status analysis result and the network environment monitoring result includes:

[0019] Collecting device information of a device used by the first user, and building a corresponding device profile based on the device information;

[0020] Analyze the health status of the corresponding device based on the device portrait, identify abnormal devices, and obtain corresponding device status analysis results based on the abnormal devices; wherein the abnormal devices represent devices that have been tampered with or infected with malware;

[0021] The network environment information of the device is monitored, abnormal network behavior is identified, and corresponding network environment monitoring results are obtained based on the abnormal network behavior.

[0022] In a possible implementation, obtaining a dynamic scoring threshold includes:

[0023] For the first user, obtain a plurality of corresponding risk indicators, wherein each risk indicator supports quantification into a specific value;

[0024] Based on the contribution of each risk indicator to the risk of identity theft, a corresponding weight is assigned to each risk indicator; wherein the weight is set by expert experience; and the weight can be automatically optimized by the machine learning algorithm based on the historical behavior data;

[0025] Based on a preset threshold algorithm, all risk indicators and corresponding weights, a corresponding dynamic scoring threshold is determined; wherein the dynamic scoring threshold represents a score of the overall risk level.

[0026] In a possible implementation, the responding based on the information integration score and the dynamic scoring threshold includes:

[0027] Determining whether the information integration score exceeds the dynamic scoring threshold;

[0028] If so, a preset response strategy is triggered, and corresponding processing is performed based on the response strategy.

[0029] In a possible implementation, the performing corresponding processing based on the response strategy includes:

[0030] Determine different levels of response measures according to the preset identity risk level for the risk score and the response strategy; wherein the risk score of each identity risk level corresponds to a response measure;

[0031] The target identity risk level of the first user is determined based on the information integration score, a response measure of a corresponding level is determined based on the target identity risk level, and a response is performed based on the response measure.

[0032] In a second aspect, an embodiment of the present application further provides a dynamic identity risk assessment device based on behavior analysis, the device comprising:

[0033] A collection module, used for collecting current behavior data of the current first user based on a plurality of preset data sources;

[0034] a detection module, configured to obtain a behavior baseline model, and perform anomaly detection based on the behavior baseline model and the current behavior data to obtain an anomaly detection score corresponding to the first user; wherein the behavior baseline model corresponds to a plurality of behavior patterns;

[0035] An integration module, used to obtain the device status analysis results and the network environment monitoring results, and obtain an information integration score based on the device status analysis results, the network environment monitoring results and the anomaly detection score;

[0036] The response module is used to obtain a dynamic scoring threshold and respond based on the information integration score and the dynamic scoring threshold.

[0037] In a possible implementation manner, the detection module is specifically used to:

[0038] Collecting historical behavior data of the second user based on the multiple data sources;

[0039] Extracting features from the historical behavior data to obtain corresponding behavior features, and obtaining corresponding user behavior models based on the behavior features; wherein the behavior features are features that can accurately reflect user habits; and each behavior feature corresponds to a normal behavior pattern;

[0040] The user behavior model is trained based on a preset machine learning algorithm, and the user behavior model is tuned based on preset tuning parameters to obtain the behavior baseline model; wherein the behavior baseline model is a model with optimal performance in terms of high accuracy and generalization ability.

[0041] In a possible implementation manner, the detection module is specifically used to:

[0042] Based on a preset anomaly detection algorithm and anomaly detection threshold, comparing the behavior baseline model with the current behavior data;

[0043] In response to identifying abnormal behavior exceeding the abnormal detection threshold in the current behavior data, determining an abnormal detection score corresponding to the first user based on the abnormal behavior; wherein the abnormal behavior characterizes abnormal activity that deviates from the normal behavior pattern corresponding to the behavior baseline model.

[0044] In a possible implementation manner, the integration module is specifically used to:

[0045] The obtaining of the device status analysis results and the network environment monitoring results includes:

[0046] Collecting device information of a device used by the first user, and building a corresponding device profile based on the device information;

[0047] Analyze the health status of the corresponding device based on the device portrait, identify abnormal devices, and obtain corresponding device status analysis results based on the abnormal devices; wherein the abnormal devices represent devices that have been tampered with or infected with malware;

[0048] The network environment information of the device is monitored, abnormal network behavior is identified, and corresponding network environment monitoring results are obtained based on the abnormal network behavior.

[0049] In a possible implementation manner, the response module is specifically configured to:

[0050] For the first user, obtain a plurality of corresponding risk indicators, wherein each risk indicator supports quantification into a specific value;

[0051] Based on the contribution of each risk indicator to the risk of identity theft, a corresponding weight is assigned to each risk indicator; wherein the weight is set by expert experience; and the weight can be automatically optimized by the machine learning algorithm based on the historical behavior data;

[0052] Based on a preset threshold algorithm, all risk indicators and corresponding weights, a corresponding dynamic scoring threshold is determined; wherein the dynamic scoring threshold represents a score of the overall risk level.

[0053] In a possible implementation manner, the response module is specifically configured to:

[0054] Determining whether the information integration score exceeds the dynamic scoring threshold;

[0055] If so, a preset response strategy is triggered, and corresponding processing is performed based on the response strategy.

[0056] In a possible implementation manner, the response module is specifically configured to:

[0057] Determine different levels of response measures according to the preset identity risk level for the risk score and the response strategy; wherein the risk score of each identity risk level corresponds to a response measure;

[0058] The target identity risk level of the first user is determined based on the information integration score, a response measure of a corresponding level is determined based on the target identity risk level, and a response is performed based on the response measure.

[0059] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor, a storage medium and a bus, wherein the storage medium stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the storage medium through the bus, and the processor executes the machine-readable instructions to perform the steps of the dynamic identity risk assessment method based on behavior analysis as described in any one of the first aspects.

[0060] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the dynamic identity risk assessment method based on behavior analysis described in any one of the first aspects are executed.

[0061] The embodiment of the present application provides a dynamic identity risk assessment method and device based on behavior analysis, which collects the current behavior data of the current first user based on a preset multiple data sources, obtains a behavior baseline model, and performs anomaly detection based on the behavior baseline model and the current behavior data to obtain an anomaly detection score corresponding to the first user, obtains the device status analysis results and the network environment monitoring results, obtains an information integration score based on the device status analysis results, the network environment monitoring results and the anomaly detection score, obtains a dynamic scoring threshold, and responds based on the information integration score and the dynamic scoring threshold. The present application comprehensively collects user behavior data through multiple data sources, performs anomaly detection on the behavior data based on the established behavior baseline model to obtain an anomaly detection score, and integrates the device status analysis results, the network environment monitoring results and the anomaly detection score to obtain an information integration score, and finally responds according to the information integration score and the dynamic scoring threshold, which can monitor user behavior in real time, dynamically evaluate potential risks and respond in a timely manner, and reduce the risk of identity theft.

[0062] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0064] Figure 1 is a flow chart of a dynamic identity risk assessment method based on behavior analysis according to an embodiment of the present application;

[0065] Figure 2 is a schematic diagram of the dynamic identity risk assessment process;

[0066] Figure 3 is a flow chart of a dynamic identity risk assessment method based on behavior analysis according to another embodiment of the present application;

[0067] Figure 4 is a flow chart of a dynamic identity risk assessment method based on behavior analysis according to another embodiment of the present application;

[0068] Figure 5 is a structural diagram of a dynamic identity risk assessment device based on behavior analysis according to an embodiment of the present application;

[0069] Figure 6It is a schematic diagram of the structure of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0070] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of explanation and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in this application shows the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowchart can be implemented out of sequence, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart under the guidance of the content of the present application, or remove one or more operations from the flowchart.

[0071] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0072] It should be noted that the term "comprising" will be used in the embodiments of the present application to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.

[0073] Considering that with the rapid development of Internet technology, identity theft incidents have occurred frequently, posing a huge threat to personal privacy and corporate information security, and traditional identity authentication methods have been unable to cope with complex network environments.

[0074] At present, the risk is reduced mainly by authenticating the user's identity and determining its legitimacy. Specifically, the account and password are used for authentication during the first login.

[0075] However, with current identity authentication methods, once an account password is leaked, personal identity may be stolen, resulting in the leakage of privacy or confidential information. Unauthorized third parties can easily impersonate legitimate users to perform operations, resulting in data leakage and violation of personal privacy. Therefore, the risk of identity theft is relatively high.

[0076] To address this problem, the present application provides a dynamic identity risk assessment method and device based on behavioral analysis, which comprehensively collects user behavior data through multiple data sources, and performs anomaly detection on the behavior data based on an established behavioral baseline model to obtain an anomaly detection score, and integrates the device status analysis results, network environment monitoring results and the anomaly detection score to obtain an information integration score, and finally responds according to the information integration score and the dynamic scoring threshold. It can monitor user behavior in real time, dynamically evaluate potential risks and respond in a timely manner, thereby reducing the risk of identity theft.

[0077] Figure 1 is a flow chart of a dynamic identity risk assessment method based on behavior analysis according to an embodiment of the present application. Figure 1 As shown, the dynamic identity risk assessment method based on behavior analysis in the embodiment of the present application may specifically include:

[0078] S101. Collect current behavior data of a current first user based on preset multiple data sources.

[0079] S102: Acquire a behavior baseline model, and perform anomaly detection based on the behavior baseline model and current behavior data to obtain an anomaly detection score corresponding to the first user.

[0080] S103: Obtain device status analysis results and network environment monitoring results, and obtain an information integration score based on the device status analysis results, network environment monitoring results, and anomaly detection scores.

[0081] S104: Obtain a dynamic scoring threshold, and respond based on the information integration score and the dynamic scoring threshold.

[0082] In the above-mentioned dynamic identity risk assessment method based on behavior analysis, user behavior data is comprehensively collected through multiple data sources, and anomaly detection is performed on the behavior data based on the established behavior baseline model to obtain anomaly detection scores, and the device status analysis results, network environment monitoring results and anomaly detection scores are integrated to obtain information integration scores. Finally, a response is made based on the information integration score and the dynamic scoring threshold. It can monitor user behavior in real time, dynamically evaluate potential risks and respond in a timely manner, thereby reducing the risk of identity theft.

[0083] The above exemplary steps of the embodiment of the present application are described below with reference to specific examples:

[0084] S101, collecting current behavior data of a current first user based on preset multiple data sources.

[0085] In the embodiment of the present application, the data source is a pre-set data source for collecting user behavior data, and the data source includes but is not limited to API (Application Programming Interface) logs, user interface interaction records, database access records, etc. The first user is the user currently logged into the system, and the current behavior data is the current behavior data of the first user currently logged into the system. The behavior data includes but is not limited to login behavior, operating habits, access paths, and log records. The current behavior data of the current first user is collected based on the preset multiple data sources for subsequent processing. For example, Figure 2 As shown, obtain user behavior data.

[0086] Optionally, after collecting the behavioral data, the behavioral data may be preprocessed. The data preprocessing stage includes cleaning, deduplication, and formatting, so as to ensure the quality and consistency of the data for subsequent analysis.

[0087] As a result, user behavior data is collected comprehensively and accurately, including but not limited to login behavior, operating habits, access paths, log records, etc. These data are the basis for subsequent behavior analysis and risk assessment.

[0088] S102, obtaining a behavior baseline model, and performing anomaly detection based on the behavior baseline model and current behavior data to obtain an anomaly detection score corresponding to the first user.

[0089] In an embodiment of the present application, the behavior baseline model corresponds to multiple behavior patterns, and the anomaly detection score is the score of the anomaly detection of the current behavior data of the first user. The behavior baseline model is acquired, and anomaly detection is performed based on the behavior baseline model and the current behavior data collected in step S101 to obtain the anomaly detection score corresponding to the first user for subsequent processing.

[0090] Optionally, when obtaining the behavior baseline model, historical behavior data of the second user is collected based on multiple data sources; feature extraction is performed on the historical behavior data to obtain corresponding behavior features, and a corresponding user behavior model is obtained based on the behavior features; the user behavior model is trained based on a preset machine learning algorithm, and the user behavior model is tuned based on preset tuning parameters to obtain a behavior baseline model.

[0091] Among them, the second user is the user selected when creating the model, and the historical behavior data is the historical behavior data of the second user on the system. The historical behavior data within the set time of the second user can be selected, for example, the historical behavior data of the second user in one month is obtained; the behavioral characteristics at least include login time distribution, operation frequency, operation sequence, stay time, number of incorrect attempts, shortcut key usage, typing speed, and mouse movement speed; behavioral characteristics are characteristics that can accurately reflect user habits, and each behavioral characteristic corresponds to a normal behavior pattern, that is, the above-mentioned behavioral baseline model corresponds to multiple behavioral characteristics; machine learning algorithms include supervised learning and unsupervised learning algorithms; tuning parameters include but are not limited to cross-validation and grid search; the behavioral baseline model is a model with the best performance in terms of high accuracy and generalization ability.

[0092] It should be noted that the behavioral features selected in this application are meaningful behavioral features extracted from historical behavioral data. The selection of features is based on a deep understanding of user behavior patterns to ensure that the selected features can accurately reflect user habits. In addition, supervised learning or unsupervised learning algorithms are used to train the model, and after repeated training and verification, the accuracy and generalization ability are improved. At the same time, cross-validation, grid search and other technologies are used to tune parameters to ensure the optimal performance of the behavioral baseline model. In this way, model training and optimization are completed. For example, Figure 2 As shown, the historical user behavior of the second user, that is, historical behavior data, is collected and processed, the behavior characteristics are extracted, and the user behavior model is obtained through analysis. The user behavior model is trained and optimized to obtain the final behavior baseline model.

[0093] Optionally, before performing anomaly detection, the current behavior data needs to be processed in real time, that is, relying on an efficient data stream processing framework to receive and process the current behavior data in real time. Due to the high throughput and low latency characteristics of the system, the real-time nature of anomaly detection can be ensured.

[0094] Optionally, context information can be obtained; anomaly detection is performed based on the context information and current behavior data to obtain a corresponding anomaly detection score. The context information includes, but is not limited to, user historical behavior, geographic location, and device type. Specifically, anomaly detection can be performed in combination with context information such as user historical behavior, geographic location, and device type to enhance the accuracy of anomaly detection. For example, the behavior patterns of the same user on different devices may be different. The system supports distinguishing between normal variability and abnormal behavior, thereby distinguishing based on the context information of the device type, which can enhance the accuracy of anomaly detection.

[0095] It should be noted that, considering that user behavior may change over time, the model will be updated regularly to reflect the latest behavior patterns. In addition, model maintenance includes monitoring model performance, dealing with overfitting or underfitting problems, and introducing new features or algorithms in a timely manner, thereby achieving model updates and maintenance, improving model accuracy, and continuously maintaining efficient security protection capabilities.

[0096] Therefore, we use data mining and machine learning techniques to model the user's historical behavior data and form a user behavior pattern baseline, namely the behavior baseline model. Subsequently, by real-time monitoring of the difference between user behavior and the baseline pattern, we can accurately identify abnormal behavior patterns, which is a key step in identifying potential risks.

[0097] S103, obtaining device status analysis results and network environment monitoring results, and obtaining an information integration score based on the device status analysis results, the network environment monitoring results and the anomaly detection score.

[0098] In an embodiment of the present application, the device status analysis result is the result of analyzing the status of the device (for example, a mobile phone, a computer, etc.) used by the first user, the network environment monitoring result is the result of monitoring the network environment in which the first user is located, and the information integration score is the score obtained by integrating the device status analysis result, the network environment monitoring result and the anomaly detection score. The device status analysis result and the network environment monitoring result are acquired, and the information integration score is obtained based on the device status analysis result, the network environment monitoring result and the anomaly detection score obtained in step S102 for subsequent processing.

[0099] Optionally, when obtaining the device status analysis results and network environment monitoring results, collect device information of the device used by the first user, and build a corresponding device portrait based on the device information; analyze the health status of the corresponding device based on the device portrait, identify abnormal devices, and obtain corresponding device status analysis results based on the abnormal devices; monitor the network environment information of the device, identify abnormal network behavior, and obtain corresponding network environment monitoring results based on the abnormal network behavior.

[0100] Among them, device information includes but is not limited to device identifier, operating system version, hardware configuration, installed applications, connected external storage devices; device health status, namely whether the device has been tampered with or infected with malware, etc., and abnormal devices represent devices that have been tampered with or infected with malware; network environment information, namely information about the network environment in which the device is located, abnormal network behavior such as login attempts from unknown geographical locations or abnormally high data transmission rates. Network environment information includes but is not limited to IP address, network location, connection speed, network protocol, upload and download behavior.

[0101] Specifically, the device identifier, operating system version, hardware configuration, installed applications, connected external storage devices and other information of the first user are collected to build a device portrait, analyze the device health status, identify devices that have been tampered with or infected with malware, and obtain device status analysis results; monitor network environment information such as IP address, network location, connection speed, network protocol, upload and download behavior, identify abnormal network behavior, and obtain network environment monitoring results; for example, Figure 2 As shown, in the information integration stage, device status analysis and network environment monitoring are performed.

[0102] It should also be noted that the device status analysis results, network environment monitoring results and anomaly detection scores are integrated based on a preset integration method to obtain the corresponding information integration score. Among them, the integration method represents the weights corresponding to the device status analysis results, network environment monitoring results and anomaly detection scores, for example, the sum of the weighted products of the three is calculated to obtain the information integration score. Specifically, when integrating the device status analysis results, network environment monitoring results and anomaly detection scores, weighted average, integrated learning and other methods can be used to construct a comprehensive user authentication information matrix to achieve integration.

[0103] Therefore, in addition to user behavior data, this application also integrates multi-source trusted authentication information such as device status and network environment, that is, the integration of multi-source trusted authentication information can provide a more comprehensive basis for risk assessment and improve the accuracy and comprehensiveness of risk assessment.

[0104] S104, obtaining a dynamic scoring threshold, and responding based on the information integration score and the dynamic scoring threshold.

[0105] In the embodiment of the present application, the dynamic scoring threshold is a threshold of the dynamic scoring, and a response is performed based on the information integration score obtained in step S103 and the dynamic scoring threshold.

[0106] Optionally, when obtaining the dynamic scoring threshold, obtain multiple corresponding risk indicators for the first user; assign a corresponding weight to each risk indicator based on the contribution of each risk indicator to the risk of identity theft; and determine the corresponding dynamic scoring threshold based on a preset threshold algorithm, all risk indicators and corresponding weights.

[0107] Among them, risk indicators include but are not limited to the degree of abnormal behavior, device health index, and network risk level; each risk indicator supports quantification into a specific value; the weight is set through expert experience; the weight can be automatically optimized through the machine learning algorithm based on the historical behavior data; the dynamic scoring threshold represents the score of the overall risk level.

[0108] Specifically, a series of risk indicators are defined, each of which can be quantified into specific values ​​for easy calculation. Weights are reasonably allocated based on the contribution of each indicator to the risk of identity theft. The weights are set through expert experience and automatically optimized through machine learning based on historical behavioral data. A risk scoring algorithm is designed to comprehensively consider all risk indicators and output a score that represents the overall risk level, namely the dynamic scoring threshold. The risk scoring algorithm supports explainability to facilitate auditing and optimization.

[0109] Therefore, based on the results of user behavior analysis, namely the anomaly detection score and multi-source trusted authentication information, a comprehensive risk assessment system is constructed to determine the user's identity risk level through a quantitative assessment method. This system can comprehensively consider multiple factors and improve the accuracy and reliability of risk assessment.

[0110] The dynamic identity risk assessment method based on behavior analysis provided in the embodiment of the present application collects the current behavior data of the current first user based on a plurality of preset data sources, obtains a behavior baseline model, and performs anomaly detection based on the behavior baseline model and the current behavior data to obtain an anomaly detection score corresponding to the first user, obtains the device status analysis results and the network environment monitoring results, obtains an information integration score based on the device status analysis results, the network environment monitoring results and the anomaly detection score, obtains a dynamic scoring threshold, and responds based on the information integration score and the dynamic scoring threshold. The dynamic identity risk assessment method based on behavior analysis of the present application comprehensively collects user behavior data through a plurality of data sources, performs anomaly detection on the behavior data based on an established behavior baseline model to obtain an anomaly detection score, and integrates the device status analysis results, the network environment monitoring results and the anomaly detection score to obtain an information integration score, and finally responds based on the information integration score and the dynamic scoring threshold, which can monitor user behavior in real time, dynamically evaluate potential risks and respond in a timely manner, thereby reducing the risk of identity theft.

[0111] Further, such as Figure 3 As shown, the step S102 in the above embodiment of “performing anomaly detection based on the behavior baseline model and the current behavior data to obtain an anomaly detection score corresponding to the first user” may specifically include the following steps:

[0112] S301, based on a preset anomaly detection algorithm and anomaly detection threshold, the behavior baseline model is compared with the current behavior data.

[0113] In an embodiment of the present application, the anomaly detection algorithm is a pre-set anomaly detection algorithm, such as a statistical test (Z-Score), an isolation forest, a One-Class SVM, etc., and the anomaly detection threshold is a pre-set anomaly detection threshold, which can specifically be a threshold for behavioral characteristics, such as an operation frequency threshold, a residence time threshold, a number of error attempts threshold, etc. According to the anomaly detection algorithm and the anomaly detection threshold, the behavioral baseline model and the current behavioral data are compared for subsequent processing.

[0114] It should be noted that the anomaly detection threshold can be dynamically adjusted based on historical behavior data to adapt to seasonal changes in user behavior or slight changes in sudden behavior patterns to avoid false positives or negatives.

[0115] S302: In response to identifying an abnormal behavior exceeding an abnormal detection threshold in current behavior data, determine an abnormal detection score corresponding to the first user based on the abnormal behavior.

[0116] In an embodiment of the present application, abnormal behavior refers to behavior that exceeds the abnormal detection threshold in the current behavior data. Abnormal behavior characterizes abnormal activities that deviate from the normal behavior pattern corresponding to the behavioral baseline model, that is, abnormal behavior in the current behavior data of the current first user that deviates from the normal behavior pattern corresponding to the historical behavior data of the second user used in previous modeling. When abnormal behavior that exceeds the abnormal detection threshold is identified in the current behavior data, the abnormal detection score corresponding to the first user is determined based on these abnormal behaviors for subsequent processing.

[0117] Further, such as Figure 4 As shown, the “responding based on the information integration score and the dynamic scoring threshold” in step S104 in the above embodiment may specifically include the following steps:

[0118] S401, determining whether the information integration score exceeds a dynamic scoring threshold.

[0119] In the embodiment of the present application, it is determined whether the information integration score exceeds the dynamic scoring threshold, and corresponding processing is performed according to the determination result.

[0120] S402: If yes, trigger the preset response strategy and perform corresponding processing based on the response strategy.

[0121] In the embodiment of the present application, the response strategy is a preset security action, and the response strategy includes but is not limited to sending a warning notification, requiring secondary verification (adding a verification step), restricting account functions, and blocking an account. Based on the judgment result obtained in step S401, when it is determined that the information integration score exceeds the dynamic scoring threshold, it indicates that the risk of the first user is high (high risk score), and the preset response strategy needs to be triggered, and corresponding processing is performed based on the response strategy.

[0122] Optionally, when performing corresponding processing based on the response strategy, different levels of response measures are determined according to the preset identity risk level and response strategy for the risk score; the target identity risk level of the first user is determined based on the information integration score, the corresponding level of response measures is determined based on the target identity risk level, and a response is performed based on the response measures.

[0123] Among them, the identity risk level is the level of the risk score, for example, high, medium, and low; the response measures are the multiple levels divided by the response strategy, that is, the response measures of different degrees, and the risk score of each identity risk level corresponds to a response measure. For example, if the information integration score, that is, the level of the risk score, is high, medium, and low, then the corresponding response measures are also set to three levels, corresponding to high, medium, and low risk scores, respectively. For example, when the information integration score, that is, the level of the risk score, is high, the corresponding level of response measures is taken at this time. For example, a low risk score may only trigger a warning, while a high risk score may immediately block the account.

[0124] Specifically, the target identity risk level of the information integration score is determined according to the information integration score of the first user, and the corresponding level of response measures are determined according to the target identity risk level, and the response is performed based on the response measures. For example, when the target identity risk level of the information integration score of the first user is high, the corresponding level of response measures are determined to respond, such as Figure 2 As shown in the figure, after configuring the response level, intelligent automated response is performed.

[0125] Therefore, different degrees of response measures are triggered by the risk score, that is, the information integration score, to achieve a flexible response level. This dynamic response mechanism can flexibly respond to different risk levels and ensure the timeliness and effectiveness of security management.

[0126] It should be noted that although the automated response is quick and effective, the system also provides an interface for manual review, allowing the security team to intervene in complex or uncertain situations and conduct manual assessment and intervention, such as Figure 2 As shown, for example, when the security team manually reviews a high risk score, the account can be manually banned.

[0127] Furthermore, feedback information after the response is obtained, and the behavioral baseline model is adjusted based on the feedback information, and the response strategy is optimized. It should be noted that after each response, the system will collect feedback information, including user feedback, final judgment results of security events, etc., which are used to adjust the parameters of the behavioral baseline model, optimize the response strategy, and form a closed-loop learning mechanism.

[0128] Optionally, a warning threshold may be set based on the preset supported business and the risk tolerance of the first user, and a preset response strategy may be triggered in response to the information integration score exceeding the warning threshold. Specifically, a warning threshold for the risk score is set based on business support and risk tolerance. When the risk score exceeds the threshold, a corresponding response strategy may also be triggered, such as requiring secondary verification, limiting account functions, blocking an account, etc.

[0129] As a result, as user behavior patterns change and emerging threats emerge, behavioral baseline models and response strategies can be continuously optimized and adjusted to maintain efficient security protection capabilities.

[0130] In summary, the dynamic identity risk assessment method based on behavioral analysis of the present application, through the comprehensive collection of user behavior data, behavior pattern modeling and anomaly detection, integration of multi-source trusted authentication information, comprehensive risk assessment system, dynamic response mechanism and intelligent and adaptive capabilities and other core capabilities, can provide users with efficient and reliable identity security protection in a complex and changeable network environment. That is, while keeping the existing authentication strategy unchanged (in the form of account and password), it provides multiple guarantees for the system. The establishment of the user behavior baseline model relies on multi-dimensional, large-scale user behavior data, which cannot be copied and imitated. It cooperates with the intelligent response mechanism to protect users.

[0131] Figure 5 is a flow chart of a dynamic identity risk assessment device based on behavior analysis according to an embodiment of the present application, such as Figure 5 As shown, the dynamic identity risk assessment device 500 based on behavior analysis in the embodiment of the present application may specifically include:

[0132] The collection module 501 is used to collect the current behavior data of the current first user based on a plurality of preset data sources.

[0133] The detection module 502 is used to obtain a behavior baseline model, and perform anomaly detection based on the behavior baseline model and current behavior data to obtain an anomaly detection score corresponding to the first user; wherein the behavior baseline model corresponds to multiple behavior patterns.

[0134] The integration module 503 is used to obtain the device status analysis results and the network environment monitoring results, and obtain an information integration score based on the device status analysis results, the network environment monitoring results and the anomaly detection score.

[0135] The response module 504 is used to obtain the dynamic scoring threshold and respond based on the information integration score and the dynamic scoring threshold.

[0136] In a possible implementation, the detection module is specifically used to:

[0137] Collecting historical behavior data of the second user based on multiple data sources;

[0138] Extract features from historical behavior data to obtain corresponding behavior features, and obtain corresponding user behavior models based on the behavior features; behavior features are features that can accurately reflect user habits; each behavior feature corresponds to a normal behavior pattern;

[0139] The user behavior model is trained based on a preset machine learning algorithm, and is tuned based on preset tuning parameters to obtain a behavior baseline model; wherein the behavior baseline model is a model with optimal performance in terms of high accuracy and generalization ability.

[0140] In a possible implementation, the detection module is specifically used to:

[0141] Based on the preset anomaly detection algorithm and anomaly detection threshold, the behavior baseline model is compared with the current behavior data;

[0142] In response to identifying abnormal behavior exceeding an abnormal detection threshold in current behavior data, an abnormal detection score corresponding to the first user is determined based on the abnormal behavior; wherein the abnormal behavior characterizes abnormal activities that deviate from a normal behavior pattern corresponding to a behavior baseline model.

[0143] In a possible implementation, the integration module is specifically used to:

[0144] Obtain device status analysis results and network environment monitoring results, including:

[0145] Collect device information of a device used by the first user, and build a corresponding device profile based on the device information;

[0146] Analyze the health status of the corresponding device based on the device portrait, identify abnormal devices, and obtain corresponding device status analysis results based on the abnormal devices; wherein the abnormal devices represent devices that have been tampered with or infected with malware;

[0147] Monitor the network environment information of the device, identify abnormal network behavior, and obtain corresponding network environment monitoring results based on the abnormal network behavior.

[0148] In a possible implementation, the response module is specifically configured to:

[0149] For the first user, obtain a plurality of corresponding risk indicators, wherein each risk indicator supports quantification into a specific value;

[0150] Assign a corresponding weight to each risk indicator based on its contribution to the risk of identity theft; the weight is set based on expert experience; the weight can be automatically optimized through machine learning algorithms based on historical behavior data;

[0151] Based on the preset threshold algorithm, all risk indicators and corresponding weights, the corresponding dynamic scoring threshold is determined; wherein the dynamic scoring threshold represents the score of the overall risk level.

[0152] In a possible implementation, the response module is specifically configured to:

[0153] Determine whether the information integration score exceeds the dynamic scoring threshold;

[0154] If so, the preset response strategy is triggered and corresponding processing is performed based on the response strategy.

[0155] In a possible implementation, the response module is specifically configured to:

[0156] Determine different levels of response measures according to the preset identity risk level and response strategy for the risk score; wherein the risk score of each identity risk level corresponds to one response measure;

[0157] The target identity risk level of the first user is determined based on the information integration score, a response measure of a corresponding level is determined based on the target identity risk level, and a response is performed based on the response measure.

[0158] The dynamic identity risk assessment device based on behavior analysis provided in the embodiment of the present application collects the current behavior data of the current first user based on a preset multiple data sources, obtains a behavior baseline model, and performs anomaly detection based on the behavior baseline model and the current behavior data to obtain an anomaly detection score corresponding to the first user, obtains the device status analysis results and the network environment monitoring results, obtains an information integration score based on the device status analysis results, the network environment monitoring results and the anomaly detection score, obtains a dynamic scoring threshold, and responds based on the information integration score and the dynamic scoring threshold. The dynamic identity risk assessment device based on behavior analysis of the present application comprehensively collects user behavior data through multiple data sources, performs anomaly detection on the behavior data based on the established behavior baseline model to obtain an anomaly detection score, and integrates the device status analysis results, the network environment monitoring results and the anomaly detection score to obtain an information integration score, and finally responds according to the information integration score and the dynamic scoring threshold, which can monitor user behavior in real time, dynamically evaluate potential risks and respond in a timely manner, thereby reducing the risk of identity theft.

[0159] like Figure 6As shown, an electronic device 600 provided in an embodiment of the present application includes: a processor 601, a memory 602 and a bus, wherein the memory 602 stores machine-readable instructions executable by the processor 601. When the electronic device is running, the processor 601 communicates with the memory 602 through the bus, and the processor 601 executes the machine-readable instructions to perform the steps of the dynamic identity risk assessment method based on behavior analysis as described above.

[0160] Specifically, the above-mentioned memory 602 and processor 601 can be general-purpose memory and processor, which are not specifically limited here. When the processor 601 runs the computer program stored in the memory 602, the above-mentioned dynamic identity risk assessment method based on behavior analysis can be executed.

[0161] Corresponding to the above-mentioned dynamic identity risk assessment method based on behavior analysis, an embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned dynamic identity risk assessment method based on behavior analysis are executed.

[0162] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the system and device described above can refer to the corresponding process in the method embodiment, and will not be repeated in this application. In the several embodiments provided in this application, it should be understood that the disclosed system, device and method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0163] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0164] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0165] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the deployment method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks, or optical disks.

[0166] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A dynamic identity risk assessment method based on behavioral analysis, characterized in that: The method comprises: Collecting current behavior data of the current first user based on preset multiple data sources; Acquire a behavior baseline model, and perform anomaly detection based on the behavior baseline model and the current behavior data to obtain an anomaly detection score corresponding to the first user; wherein the behavior baseline model corresponds to multiple behavior patterns; Obtaining device status analysis results and network environment monitoring results, and obtaining an information integration score based on the device status analysis results, the network environment monitoring results, and the anomaly detection score; A dynamic scoring threshold is obtained, and a response is made based on the information integration score and the dynamic scoring threshold.

2. The method according to claim 1, characterized in that The acquisition of the behavior baseline model includes: Collecting historical behavior data of the second user based on the multiple data sources; Extracting features from the historical behavior data to obtain corresponding behavior features, and obtaining corresponding user behavior models based on the behavior features; wherein the behavior features are features that can accurately reflect user habits; and each behavior feature corresponds to a normal behavior pattern; The user behavior model is trained based on a preset machine learning algorithm, and the user behavior model is tuned based on preset tuning parameters to obtain the behavior baseline model; wherein the behavior baseline model is a model with optimal performance in terms of high accuracy and generalization ability.

3. The method according to claim 2, characterized in that The performing anomaly detection based on the behavior baseline model and the current behavior data to obtain an anomaly detection score corresponding to the first user includes: Based on a preset anomaly detection algorithm and anomaly detection threshold, comparing the behavior baseline model with the current behavior data; In response to identifying abnormal behavior exceeding the abnormal detection threshold in the current behavior data, determining an abnormal detection score corresponding to the first user based on the abnormal behavior; wherein the abnormal behavior characterizes abnormal activity that deviates from the normal behavior pattern corresponding to the behavior baseline model.

4. The method according to claim 3, characterized in that The obtaining of the device status analysis results and the network environment monitoring results includes: Collecting device information of a device used by the first user, and building a corresponding device profile based on the device information; Analyze the health status of the corresponding device based on the device portrait, identify abnormal devices, and obtain corresponding device status analysis results based on the abnormal devices; wherein the abnormal devices represent devices that have been tampered with or infected with malware; The network environment information of the device is monitored, abnormal network behavior is identified, and corresponding network environment monitoring results are obtained based on the abnormal network behavior.

5. The method according to claim 4, characterized in that The step of obtaining a dynamic scoring threshold comprises: For the first user, obtain a plurality of corresponding risk indicators, wherein each risk indicator supports quantification into a specific value; Based on the contribution of each risk indicator to the risk of identity theft, a corresponding weight is assigned to each risk indicator; wherein the weight is set by expert experience; and the weight can be automatically optimized by the machine learning algorithm based on the historical behavior data; Based on a preset threshold algorithm, all risk indicators and corresponding weights, a corresponding dynamic scoring threshold is determined; wherein the dynamic scoring threshold represents a score of the overall risk level.

6. The method according to claim 4, characterized in that The responding based on the information integration score and the dynamic scoring threshold comprises: Determining whether the information integration score exceeds the dynamic scoring threshold; If so, a preset response strategy is triggered, and corresponding processing is performed based on the response strategy.

7. The method according to claim 6, characterized in that The performing corresponding processing based on the response strategy includes: Determine different levels of response measures according to the preset identity risk level for the risk score and the response strategy; wherein the risk score of each identity risk level corresponds to a response measure; The target identity risk level of the first user is determined based on the information integration score, a response measure of a corresponding level is determined based on the target identity risk level, and a response is performed based on the response measure.

8. A dynamic identity risk assessment device based on behavior analysis, characterized in that: The device comprises: A collection module, used for collecting current behavior data of the current first user based on a plurality of preset data sources; a detection module, configured to obtain a behavior baseline model, and perform anomaly detection based on the behavior baseline model and the current behavior data to obtain an anomaly detection score corresponding to the first user; wherein the behavior baseline model corresponds to a plurality of behavior patterns; An integration module, used to obtain the device status analysis results and the network environment monitoring results, and obtain an information integration score based on the device status analysis results, the network environment monitoring results and the anomaly detection score; The response module is used to obtain a dynamic scoring threshold and respond based on the information integration score and the dynamic scoring threshold.

9. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate via the bus, and when the machine-readable instructions are executed by the processor, the steps of the dynamic identity risk assessment method based on behavior analysis are performed.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the dynamic identity risk assessment method based on behavior analysis as described in any one of claims 1 to 7 are executed.

Images