A authentication analysis system and method based on big data artificial intelligence

Abstract

The present invention relates to the field of authentication analysis technology, specifically to an authentication analysis system and method based on big data artificial intelligence. The system includes: a data acquisition module, which collects user behavior data, cleans and formats the data, generates data cleaning results, uses the data cleaning results to create a fully connected graph, and generates a graph construction result. In the present invention, the cleaned data is converted into a fully connected graph form through graph construction technology, so that the implicit relationship between the data can be made explicit, which is convenient for further feature extraction. In the feature analysis stage, by extracting the similarity matrix and calculating its Laplace eigenvector, the inherent structure of the data is revealed, enriching the input features of subsequent clustering and anomaly detection. The behavior clustering module can effectively group data points, identify user groups with similar behavior patterns, and improve the accuracy of behavior analysis and prediction.

Description

Technical Field

[0001] The present invention relates to the field of authentication analysis technology, and in particular to an authentication analysis system and method based on big data artificial intelligence. Background Art

[0002] The authentication analysis system is a comprehensive technical system designed to verify the identity of users and predict their behavior patterns by analyzing and processing user behavior data. Its main purpose is to improve the accuracy and efficiency of security authentication, and it is often used to improve the security of online services such as banking, e-commerce, and social media.

[0003] However, existing technologies mainly rely on simple behavioral pattern recognition or threshold judgment in authentication analysis. This method is often incapable of handling complex data environments. Especially in situations where the amount of data is large and the behavioral patterns are changeable, it is difficult to fully explore the complex relationships in the data, resulting in poor adaptability to emerging behavioral patterns. In addition, existing technologies often lack structured representation in the data preprocessing stage, fail to form a comprehensive understanding of the data, and limit the depth of subsequent analysis. Therefore, improvements are needed. Summary of the invention

[0004] The purpose of the present invention is to solve the shortcomings of the prior art and to propose an authentication analysis system and method based on big data artificial intelligence.

[0005] In order to achieve the above purpose, the present invention adopts the following technical solution: an authentication analysis system based on big data artificial intelligence includes:

[0006] A data collection module collects user behavior data, cleans and formats the data, generates data cleaning results, creates a fully connected graph using the data cleaning results, and generates a graph construction result;

[0007] A feature analysis module extracts a similarity matrix from the graph construction result, calculates the eigenvectors of the Laplace matrix, generates a eigenvector set, analyzes the eigenvectors of the eigenvector set, reveals the intrinsic structure of the data, and generates a structure analysis result;

[0008] A behavior clustering module, which uses the feature vectors in the structure analysis results to perform clustering of data points, divides the data points into multiple groups, generates clustering grouping results, analyzes the behavior patterns of the clustering grouping results, and generates behavior pattern analysis results;

[0009] The anomaly detection module identifies the scale group or individual with abnormal behavior pattern from the behavior pattern analysis result, marks them, and generates an abnormal mark.

[0010] Preferably, the steps of obtaining the data cleaning results are:

[0011] Collect user behavior data from application usage records, browser history, and user interaction logs, identify and remove errors or incomplete records in the data, and obtain user behavior data that has been preliminarily screened;

[0012] Based on the preliminarily screened user behavior data, unify the timestamp format and encoding method of the data, standardize the field names, and obtain formatted user behavior data;

[0013] According to the formatted user behavior data, duplicate entries in the data set are removed, outliers in the data are corrected, and integrity checks are performed to obtain data cleaning results.

[0014] Preferably, the steps of obtaining the graph construction result are:

[0015] Extracting data instances of each user behavior from the data cleaning results, using the data instances as nodes, analyzing and recording the interaction frequency and intensity between every two nodes, using them as edge weights, and constructing a preliminary connectivity graph between nodes;

[0016] Based on the preliminary connected graph, traverse each node, make each node connected to all other nodes at least once, and obtain a fully connected graph intermediate result;

[0017] According to the fully connected graph intermediate result, non-essential edges are identified and deleted, and direct and indirect connections between nodes are optimized to obtain an optimized graph construction result.

[0018] Preferably, the steps of acquiring the feature vector set are:

[0019] Extracting similarities between nodes from the graph construction result, and constructing a similarity matrix according to the connection strength and the number of paths between the nodes;

[0020] Based on the similarity matrix, the Laplace matrix is ​​calculated, and the calculation formula is:

[0021]

[0022] in, is a diagonal matrix, each diagonal element is the degree of the node, is the adjacency matrix representing the connections between nodes, is the Laplace matrix;

[0023] Based on the Laplace matrix, the eigenvector is solved by numerical decomposition to obtain an eigenvector set.

[0024] Preferably, the steps of obtaining the structure analysis results are:

[0025] Selecting feature vectors from the feature vector set to obtain a main feature vector set;

[0026] Based on the main feature vector set, the principal component score of the data is calculated using the following formula:

[0027]

[0028] in, For the The first feature vector elements, For the The standard deviation of a variable, For the The value of a variable, is the principal component score, n is the total number of elements in the eigenvector;

[0029] According to the principal component score, the contribution and internal connection of each variable in the main eigenvector set are analyzed to obtain a structural analysis result.

[0030] Preferably, the steps of obtaining the clustering grouping results are:

[0031] Extracting feature vectors from the structural analysis results to obtain a feature vector set;

[0032] Based on the feature vector set, the data points are grouped by calculating the weighted square error sum, and the calculation formula is:

[0033]

[0034] in, Indicates The weighted sum of squared errors of clusters, It belongs to clustered data points, It is The center point of the cluster, It is a data point The standard deviation of It is a data point The weight of For the The total number of data points in the clusters;

[0035] According to the weighted square error sum of each cluster, the cluster assignment of the data points is determined to form the cluster grouping result.

[0036] Preferably, the steps of obtaining the behavior pattern analysis result are:

[0037] Extracting a set of data points of each group from the clustering grouping results, and analyzing the behavioral characteristics of the data points;

[0038] Based on the behavior characteristics, the behavior consistency index is calculated, and the calculation formula is:

[0039]

[0040] in, Indicates The behavioral consistency index of the group, It is In the group The behavior value of the data point, It is The average behavior of the group, It is The data point in The standard deviation in the groups, For the The total number of data points in the group;

[0041] According to the behavior consistency index, the uniformity of the behavior pattern of each group is evaluated, the behavior dynamics of the data are analyzed, and the behavior pattern analysis results are obtained.

[0042] Preferably, the steps of obtaining the abnormal mark are:

[0043] Analyze the behavioral consistency of each group from the behavioral pattern analysis results, and identify groups or individuals that deviate from the average behavioral pattern by comparing the uniformity index of each group with the group average level, and record them as a preliminary abnormal list;

[0044] Based on the preliminary abnormal list, the behavioral data of each group or individual and the behavioral dynamics within the group are analyzed, and the abnormal behavior patterns are verified and abnormal marking is performed through behavioral trend analysis and behavioral deviation calculation.

[0045] The present invention provides an authentication analysis method based on big data artificial intelligence, comprising the following steps:

[0046] Collect user behavior data, clean the data, and then build a fully connected graph through the data. The nodes in the graph represent individual users, and the edges reflect the interactions between users, generating the graph construction results.

[0047] Based on the graph construction result, extract the similarity matrix in the graph construction result, calculate the Laplace matrix of the similarity matrix, and solve the eigenvector set from the Laplace matrix; analyze the obtained eigenvector set to generate the structure analysis result;

[0048] The data points are clustered using the feature vectors in the structural analysis results, and the data points are divided into multiple groups based on the similarity of the feature vectors; the behavior patterns of the clustered data groups are analyzed to determine the behavior characteristics of each group and generate behavior pattern analysis results; the behavior pattern analysis results are checked to mark the scale groups or individuals with abnormal behavior patterns to form abnormal marking results.

[0049] Compared with the prior art, the advantages and positive effects of the present invention are:

[0050] In the present invention, the cleaned data is converted into a fully connected graph through graph construction technology, so that the implicit relationship between the data can be made explicit, which is convenient for further feature extraction. In the feature analysis stage, by extracting the similarity matrix and calculating its Laplace eigenvector, the inherent structure of the data is revealed, enriching the input features of subsequent clustering and anomaly detection. The behavior clustering module can effectively group data points, identify user groups with similar behavior patterns, and improve the accuracy of behavior analysis and prediction. The anomaly detection module analyzes the clustering results, marks individuals or groups with abnormal behavior, reduces the false alarm rate, and ensures the efficiency of operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 It is a system flow chart of the present invention. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0053] See also Figure 1 The present invention provides a technical solution: an authentication analysis system based on big data artificial intelligence includes:

[0054] The data collection module collects user behavior data, cleans and formats the data, generates data cleaning results, uses the data cleaning results to create a fully connected graph, and generates graph construction results;

[0055] The feature analysis module extracts the similarity matrix from the graph construction results, calculates the eigenvectors of the Laplace matrix, generates a set of eigenvectors, analyzes the eigenvectors of the set of eigenvectors, reveals the intrinsic structure of the data, and generates structural analysis results;

[0056] The behavior clustering module uses the feature vectors in the structure analysis results to perform clustering of data points, divide the data points into multiple groups, generate clustering grouping results, analyze the behavior patterns of the clustering grouping results, and generate behavior pattern analysis results;

[0057] The anomaly detection module identifies the scale groups or individuals with abnormal behavior patterns from the behavior pattern analysis results, marks them, and generates anomaly tags.

[0058] The steps to obtain data cleaning results are:

[0059] Collect user behavior data from application usage records, browser history, and user interaction logs, identify and remove errors or incomplete records in the data, and obtain user behavior data that has been preliminarily screened;

[0060] Based on the preliminarily screened user behavior data, the timestamp format and encoding method of the data are unified, and the field names are standardized to obtain formatted user behavior data;

[0061] According to the formatted user behavior data, duplicate entries in the data set are removed, outliers in the data are corrected, and integrity checks are performed to obtain data cleaning results.

[0062] Specifically, user behavior data is collected from application usage records, browser history, and user interaction logs. First, data items related to timestamps, event types, and user identifiers are filtered, and each record is checked for validity using custom data validation rules, such as excluding records with inconsistent timestamps or missing user identifiers. Parallel processing is performed on each data source to improve processing efficiency. These steps ensure that only complete and accurate records are retained, and finally a user behavior data set that has been preliminarily screened is formed.

[0063] Based on the preliminarily screened user behavior data, the timestamps in all data records are formatted according to the preset time format standard (such as ISO8601). Then, the case and naming inconsistencies of field names in various data sources are unified. For example, all fields marked with "Email" and "email" are unified as "email". At the same time, the data is encoded and converted to ensure that all text data uses the UTF-8 encoding format. Through these operations, the consistency and readability of the data are improved, forming formatted user behavior data.

[0064] Based on the formatted user behavior data, duplicate data entries are identified and deleted through defined rules. For example, if two pieces of data are exactly the same in user ID and timestamp, they are considered duplicates. Then, the numerical distribution of each field is analyzed through statistical methods. For data points that obviously deviate from the normal range, such as records in which the age field exceeds a reasonable range, outlier correction is performed. Finally, an integrity check is performed to ensure that each record is complete and intact, thus forming a data cleaning result.

[0065] The steps to obtain the graph construction results are:

[0066] Extract data instances of each user behavior from the data cleaning results, use the data instances as nodes, analyze and record the interaction frequency and intensity between every two nodes, use this as the edge weight, and build a preliminary connectivity graph between nodes;

[0067] Based on the preliminary connectivity graph, traverse each node and make each node connected to all other nodes at least once to obtain a fully connected graph intermediate result;

[0068] According to the intermediate result of the fully connected graph, unnecessary edges are identified and deleted, and the direct and indirect connections between nodes are optimized to obtain the optimized graph construction result.

[0069] Specifically, using the user behavior data instances extracted from the data cleaning results, we first create an independent node for each data instance. These nodes represent various user behaviors such as page browsing, product purchases, or social interactions. Then, we analyze the relationships between user behaviors, such as the frequency of browsing the same page or participating in forum discussions together. We use the frequency and strength of these behavioral relationships to set the edges in the graph. The weight of each edge is determined by the interaction frequency and strength of the corresponding behaviors between users. For example, if two users frequently leave messages and interact on the same product, the weight of the connecting edge between them will be higher. Finally, we construct a preliminary connectivity graph based on these weights.

[0070] After obtaining the preliminary connected graph, the DFS algorithm in graph theory is used to traverse each node in the graph. This process ensures that each node in the graph is connected to all other nodes through at least some path, thus forming a fully connected graph. When executing DFS, start from a randomly selected unvisited node and explore nodes as deep as possible until all nodes have been visited. During this process, every time a new node is visited, all nodes connected to it are checked. If an unvisited node is found, the visit continues to be deeper until all nodes are traversed. This method ensures that there is at least one path between any two nodes, thereby obtaining an intermediate result of a graph with a complete structure and strong connectivity.

[0071] Based on the intermediate result of the fully connected graph, the graph is optimized to improve its efficiency and practicality. First, all the edges in the graph are analyzed to identify those with weak or infrequent connections and consider their impact on the overall network structure. These edges often represent accidental or low-relevance user interactions, such as occasional co-visits to pages or one-off product reviews. Then, these edges are evaluated one by one for their necessity, and non-core or low-impact connections are deleted to reduce the complexity of the network and increase processing speed. Through this optimization, only those node connections with high relevance and frequent interactions are retained in the graph.

[0072] The steps to obtain the feature vector set are:

[0073] Extract the similarity between nodes from the graph construction results, and construct a similarity matrix based on the connection strength and the number of paths between nodes;

[0074] Based on the similarity matrix, the Laplace matrix is ​​calculated using the following formula:

[0075]

[0076] in, is a diagonal matrix, each diagonal element is the degree of the node, is the adjacency matrix representing the connections between nodes, is the Laplace matrix;

[0077] Based on the Laplace matrix, the eigenvector is solved by numerical decomposition to obtain the eigenvector set.

[0078] Specifically, in the formula, is a diagonal matrix, each diagonal element is the degree of the node, is the adjacency matrix representing the connections between nodes, is the Laplace matrix.

[0079] The calculation process first requires obtaining the adjacency matrix and the diagonal matrix . Adjacency Matrix Elements in represents the connection strength between node i and node j. If there is no direct connection between i and j, then . The angle matrix Elements in is the connectivity of node i, that is, the sum of all connection strengths of node i. Through data monitoring, if the connection strength between nodes i and j is 1, and node i is connected to 5 nodes, then , . Calculation: A graph containing 3 nodes and an adjacency matrix for:

[0080]

[0081] Angle Matrix for:

[0082]

[0083] According to the formula Compute the Laplacian matrix :

[0084]

[0085] This result shows that the Laplacian matrix reveals the structure of the graph and its eigenvectors can be used to identify community structures in the graph or perform other forms of graph analysis.

[0086] From the graph construction results, the similarity between nodes is extracted by evaluating the direct connection strength between each pair of nodes and the number of indirect connection paths through other nodes. For example, the number of direct interactions between nodes A and B is monitored to be 5 times, while the number of indirect interactions through an intermediate node C is 10 times. Such direct and indirect interactions are summarized to evaluate the overall connection strength between A and B. At the same time, there may be only indirect interactions between nodes A and D, through two different intermediate nodes E and F, with 3 and 2 interactions respectively. These interaction numbers are used to calculate the similarity between nodes. Through such calculations, a matrix reflecting the similarity relationship between nodes can be constructed, which illustrates the interaction pattern and connection density between nodes in the network.

[0087] Solving the eigenvector based on the numerical decomposition of the Laplace matrix involves decomposing the Laplace matrix into its eigenvalues ​​and corresponding eigenvectors. These eigenvectors represent the topological structure characteristics of the graph. For example, if three eigenvectors with eigenvalues ​​of 0, 3, and 3 are obtained from the calculation of the aforementioned Laplace matrix, then the eigenvector with eigenvalue 0 usually indicates the number of connected components in the graph, while the eigenvectors corresponding to other non-zero eigenvalues ​​reveal the possible community structure or clustered distribution pattern between nodes in the graph. These eigenvector sets provide a basis for further network analysis.

[0088] The steps to obtain the structural analysis results are:

[0089] Select eigenvectors from the eigenvector set to obtain a main eigenvector set;

[0090] Based on the main feature vector set, the principal component score of the data is calculated using the following formula:

[0091]

[0092] in, For the The first feature vector elements, For the The standard deviation of a variable, For the The value of a variable, is the principal component score, n is the total number of elements in the eigenvector;

[0093] According to the principal component scores, the contribution and internal connections of each variable in the main eigenvector set are analyzed to obtain the structural analysis results.

[0094] Specifically, in the process of extracting key feature vectors from the feature vector set, the distribution characteristics and possible outliers of the data are identified. Next, the feature vectors that have the greatest impact on the overall data set are screened out using the Z score or IQR (interquartile range). For example, using the Z score method, feature vectors with an absolute score greater than 2 are marked as key, which means that they are far from the average level and show greater variability. Such screening criteria are based on the standard deviation of the data, ensuring that only truly significant features are selected.

[0095] The benefit of the formula is that by combining the normalization of the eigenvectors and the absolute value of the variables, it can enhance the sensitivity to data outliers while maintaining the original structural properties of the data; Representative The first feature vector elements, which are computed from the data covariance matrix via eigendecomposition, Representative The standard deviation of a variable is obtained by the dispersion of each variable in the statistical data. For the The actual observed values ​​of a variable are usually taken from the original data in the dataset. is the total number of elements in the feature vector, which is equal to the number of variables in the dataset;

[0096] Computational process: A data set, where 2, then:

[0097]

[0098]

[0099] The results show that the principal component scores reflect the key structure and pattern strength of the data. If the score is higher than the average plus two standard deviations, it indicates that the vector has important representation in the data set.

[0100] After the principal component scores are calculated, further data analysis is to evaluate the correlation between variables and the contribution of each variable to the data structure by comparing the principal component scores. Using these scores, linear relationships between variables can be observed by drawing scatter plots and calculating correlation coefficients. In addition, factor analysis can be used to test whether variables may belong to a combination of fewer unobserved latent variables. At the same time, safety thresholds can be set, such as the mean of the score plus or minus twice the standard deviation, to identify variables that have a significant impact on the data structure.

[0101] The steps to obtain clustering grouping results are:

[0102] Extract feature vectors from the structural analysis results to obtain a feature vector set;

[0103] Based on the feature vector set, the data points are grouped by calculating the weighted sum of squared errors, which is calculated as follows:

[0104]

[0105] in, Indicates The weighted sum of squared errors of clusters, It belongs to clustered data points, It is The center point of the cluster, It is a data point The standard deviation of It is a data point The weight of For the The total number of data points in the clusters;

[0106] According to the weighted square error sum of each cluster, the cluster assignment of the data points is determined to form the cluster grouping result.

[0107] Specifically, the formula is beneficial in that by considering the weight and standard deviation of data points, the flexibility and accuracy of cluster analysis are increased, and it can better adapt to various data distribution situations; It belongs to clustered data points, It is The center point of each cluster is used to measure the centroid of the cluster. It is a data point The standard deviation indicates the degree of dispersion of the data. It is a data point The weight reflects the importance of each data point in the cluster. For the The total number of data points in the clusters;

[0108] Computational process: A data set, where The value is [1,2,3], the cluster center 2, standard deviation is 1, weight If both are 1, then:

[0109]

[0110] This result indicates that the data points in this cluster are less dispersed around its center, indicating that the cluster is relatively tight.

[0111] The process of determining the cluster assignment of a data point based on the weighted sum of squared errors for each cluster requires first calculating the sum of squared errors for each cluster and then comparing the sum of squared errors for all clusters. Value, select The smallest cluster is taken as the optimal cluster. After clustering is completed, data points are redistributed or maintained in the current state according to the quality of the clustering until a stable clustering grouping result is found.

[0112] The steps to obtain the behavior pattern analysis results are:

[0113] Extract a set of data points for each group from the clustering grouping results and analyze the behavioral characteristics of the data points;

[0114] Based on the behavioral characteristics, the behavioral consistency index is calculated using the following formula:

[0115]

[0116] in, Indicates The behavioral consistency index of the group, It is In the group The behavior value of the data point, It is The average behavior of the group, It is The data point in The standard deviation in the groups, For the The total number of data points in the group;

[0117] According to the behavioral consistency index, the uniformity of the behavioral pattern of each group is evaluated, the behavioral dynamics of the data are analyzed, and the behavioral pattern analysis results are obtained.

[0118] Specifically, in the cluster grouping result analysis, we first identify the set of data points within each group, which includes extracting the member data records of each group, and then specifically analyzing the behavioral characteristics of each data point, such as the frequency statistics of the activity type and the average calculation of the duration. These statistics are obtained by parsing the behavior logs of the data points, and the behavior logs of each data point record the detailed time and type of its activities. Through these behavior records, the number of occurrences and average duration of each activity are calculated, thereby preliminarily describing the behavior patterns of each group.

[0119] The benefit of the formula is that it not only enhances the sensitivity to differences in group behavior through cubic and standard deviation adjustments, but also improves the ability to identify abnormal behavior through weighted averaging. Specifically, the consistency of behavior in each group is measured by the deviation of the data point from the group average behavior, where the deviation is normalized by the standard deviation and cubiced to amplify the difference, which is suitable for discovering individual behaviors that are significantly different from group behavior. It is In the group The behavior value of each data point is usually obtained through behavior observation and data recording. It is The behavior average of a group is calculated by averaging the behavior of all data points in the group. It is The data point in The standard deviation within the groups is used to measure the variability of behavior. For the The total number of data points in a group is obtained by counting the number of members in the group;

[0120] Calculation process: There is a group containing 5 data points. The behavioral values ​​of these data points are 10, 8, 6, 8, 9, the behavioral mean of the group is 8, and the standard deviation of each data point is 1.5.

[0121] First, calculate the deviation of each data point's behavior from the group mean, divide by the standard deviation, and cube it:

[0122] First data point: ;

[0123] Second data point: ;

[0124] The third data point: ;

[0125] Fourth data point: ;

[0126] Fifth data point: ;

[0127] Add all the above results together to get the total: ;

[0128] Divide the sum by the total number of data points (5 data points): ;

[0129] Finally, subtract this ratio from 1 to get the behavioral consistency index:

[0130]

[0131] This calculation result It indicates that the behavioral consistency within the group is low, because this value is close to 0, indicating that there are large differences in behavior between the members of the group.

[0132] The behavioral consistency index obtained by calculation can accurately quantify the behavioral uniformity of members within each group. This quantification method not only reveals the uniformity of behavioral patterns within the group, but also helps identify those members whose behavioral patterns are significantly different from the group average behavior.

[0133] The steps to obtain the exception mark are:

[0134] Analyze the behavioral consistency of each group from the behavioral pattern analysis results, and identify groups or individuals that deviate from the average behavioral pattern by comparing the uniformity index of each group with the group average level, and record them as a preliminary abnormal list;

[0135] Based on the preliminary abnormal list, analyze the behavioral data of each group or individual and the behavioral dynamics within the group, verify the abnormal behavior pattern through behavioral trend analysis and behavioral deviation calculation, and mark the abnormalities.

[0136] Specifically, the uniformity index of each group obtained from the behavior pattern analysis is first evaluated. During the calculation process, the behavior data of each group member is compared with the behavior average of the group. The standard deviation is used as a tool to measure the deviation to determine whether the deviation exceeds the set safety threshold (for example, more than two standard deviations from the average are considered abnormal). This approach facilitates the accurate identification of individuals or groups whose behavior patterns deviate significantly from the group average and include them in the preliminary abnormal list. The analysis calculates the deviation between each data point and the group behavior average and accumulates it to ensure that all potential abnormal behaviors can be fully identified;

[0137] Based on the preliminary anomaly list, compare short-term behavioral changes with long-term behavioral patterns. Focus on individuals or groups that show abnormal frequency and intensity of behavior, and measure the consistency and variability of these behaviors through trend line analysis and variance analysis. Identify the exact degree of behavioral deviation and compare historical behavioral data to determine whether there is a true anomaly.

[0138] The present invention provides an authentication analysis method based on big data artificial intelligence, comprising the following steps:

[0139] Collect user behavior data, clean the data, and then build a fully connected graph through the data. The nodes in the graph represent individual users, and the edges reflect the interactions between users, generating the graph construction results.

[0140] Based on the graph construction result, extract the similarity matrix in the graph construction result, calculate the Laplace matrix of the similarity matrix, and solve the eigenvector set from the Laplace matrix; analyze the obtained eigenvector set to generate the structure analysis result;

[0141] The data points are clustered using the feature vectors in the structural analysis results, and the data points are divided into multiple groups based on the similarity of the feature vectors; the behavior patterns of the clustered data groups are analyzed to determine the behavior characteristics of each group and generate behavior pattern analysis results; the behavior pattern analysis results are checked to mark the scale groups or individuals with abnormal behavior patterns to form abnormal marking results.

Claims

1. An authentication analysis system based on big data artificial intelligence, characterized in that: The system comprises: A data collection module collects user behavior data, cleans and formats the data, generates data cleaning results, creates a fully connected graph using the data cleaning results, and generates a graph construction result; A feature analysis module extracts a similarity matrix from the graph construction result, calculates the eigenvectors of the Laplace matrix, generates a eigenvector set, analyzes the eigenvector set, reveals the intrinsic structure of the data, and generates a structure analysis result; A behavior clustering module, which uses the feature vectors in the structure analysis results to perform clustering of data points, divides the data points into multiple groups, generates clustering grouping results, analyzes the behavior patterns of the clustering grouping results, and generates behavior pattern analysis results; An anomaly detection module, which identifies a group or individual with an abnormal behavior pattern from the behavior pattern analysis result, marks them, and generates an abnormal mark; The steps for obtaining the structure analysis results are: Selecting feature vectors from the feature vector set to obtain a main feature vector set; Based on the main feature vector set, the principal component score of the data is calculated using the following formula: in, For the The eigenvector elements, For the The standard deviation of the elements, For the The value of the element, is the principal component score, n is the total number of elements in the eigenvector; According to the principal component score, the contribution and internal connection of each element in the main feature vector set are analyzed to obtain a structural analysis result.

2. The authentication analysis system based on big data artificial intelligence according to claim 1 is characterized in that: The steps for obtaining the data cleaning results are: Collect user behavior data from application usage records, browser history, and user interaction logs, identify and remove errors or incomplete records in the data, and obtain user behavior data that has been preliminarily screened; Based on the preliminarily screened user behavior data, unify the timestamp format and encoding method of the data, standardize the field names, and obtain formatted user behavior data; According to the formatted user behavior data, duplicate entries in the data set are removed, outliers in the data are corrected, and integrity checks are performed to obtain data cleaning results.

3. The authentication analysis system based on big data artificial intelligence according to claim 1 is characterized in that: The steps for obtaining the graph construction result are: Extracting data instances of each user behavior from the data cleaning results, using the data instances as nodes, analyzing and recording the interaction frequency and intensity between every two nodes, using them as edge weights, and constructing a preliminary connectivity graph between nodes; Based on the preliminary connected graph, traverse each node, make each node connected to all other nodes at least once, and obtain a fully connected graph intermediate result; According to the fully connected graph intermediate result, non-essential edges are identified and deleted, and direct and indirect connections between nodes are optimized to obtain an optimized graph construction result.

4. The authentication analysis system based on big data artificial intelligence according to claim 1 is characterized in that: The steps of obtaining the feature vector set are: Extracting similarities between nodes from the graph construction result, and constructing a similarity matrix according to the connection strength and the number of paths between the nodes; Based on the similarity matrix, the Laplace matrix is ​​calculated, and the calculation formula is: in, is a diagonal matrix, each diagonal element is the degree of the node, is the adjacency matrix, which represents the connection between nodes. is the Laplace matrix; Based on the Laplace matrix, the eigenvector is solved by numerical decomposition to obtain an eigenvector set.

5. The authentication analysis system based on big data artificial intelligence according to claim 1 is characterized in that: The steps for obtaining the clustering grouping results are: Extracting feature vectors from the structural analysis results to obtain a feature vector set; Based on the feature vector set, the data points are grouped by calculating the weighted square error sum, and the calculation formula is: in, Indicates The weighted sum of squared errors of clusters, It belongs to clustered data points, It is The center point of the cluster, It is a data point The standard deviation of It is a data point The weight of For the The total number of data points in the clusters; According to the weighted square error sum of each cluster, the cluster assignment of the data points is determined to form the cluster grouping result.

6. The authentication analysis system based on big data artificial intelligence according to claim 1 is characterized in that: The steps for obtaining the behavior pattern analysis result are: Extracting a set of data points of each group from the clustering grouping results, and analyzing the behavioral characteristics of the data points; Based on the behavior characteristics, the behavior consistency index is calculated, and the calculation formula is: in, Indicates The behavioral consistency index of the group, It is In the group The behavior value of the data point, It is The average behavior of the group, It is The data point in The standard deviation in the groups, For the The total number of data points in the group; According to the behavior consistency index, the uniformity of the behavior pattern of each group is evaluated, the behavior dynamics of the data are analyzed, and the behavior pattern analysis results are obtained.

7. The authentication analysis system based on big data artificial intelligence according to claim 1 is characterized in that: The steps for obtaining the abnormal mark are: Analyze the behavioral consistency of each group from the behavioral pattern analysis results, and identify groups or individuals that deviate from the average behavioral pattern by comparing the uniformity index of each group with the group average level, and record them as a preliminary abnormal list; Based on the preliminary abnormal list, the behavioral data of each group or individual and the behavioral dynamics within the group are analyzed, and the abnormal behavior patterns are verified and abnormal marking is performed through behavioral trend analysis and behavioral deviation calculation.

8. An authentication analysis method based on big data artificial intelligence, characterized in that: The authentication analysis system based on big data artificial intelligence according to any one of claims 1 to 7 is implemented, comprising the following steps: Collect user behavior data, clean the data, and then build a fully connected graph through the data. The nodes in the graph represent individual users, and the edges reflect the interactions between users, generating the graph construction results. Based on the graph construction result, extract the similarity matrix in the graph construction result, calculate the Laplace matrix of the similarity matrix, and solve the eigenvector set from the Laplace matrix; analyze the obtained eigenvector set to generate the structure analysis result; The data points are clustered using the feature vectors in the structural analysis results, and the data points are divided into multiple groups based on the similarity of the feature vectors; the behavior patterns of the clustered data groups are analyzed to determine the behavior characteristics of each group and generate behavior pattern analysis results; the behavior pattern analysis results are checked to mark the scale groups or individuals with abnormal behavior patterns to form abnormal marking results.

Images