Risk behavior identification method and device based on fingerprint mouse

Abstract

The invention provides a risk behavior identification method and device based on a fingerprint mouse. In some embodiments of the invention, a user fingerprint image and an access operation behavior are collected; identifying a person changing behavior according to a fingerprint comparison result of the user fingerprint image; identifying existing illegal risk behaviors according to the access operation behaviors; determining a total risk score according to each violation risk behavior; under the condition that the total risk score is greater than or equal to a set score threshold value, executing a risk warning operation; in the system use process, risk identification is automatically carried out based on fingerprint authentication and access operation behaviors, and the information security is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of artificial intelligence technology, and in particular to a risk behavior identification method and device based on fingerprint mouse. Background Art

[0002] Network system security means that the hardware, software and data in the network system are protected from damage, change or leakage due to accidental or malicious reasons, and the system runs continuously, reliably and normally without interruption of network services.

[0003] For various types of network office systems, subordinate departments can transmit, query and share various types of information in real time through network office systems. This networking method greatly improves the efficiency of network office work and strengthens communication and collaboration between different regions and different levels. The information content in the network office system is very important. How to ensure access and use of data under safe and legal conditions, as well as preventing personal privacy leaks and data security risks, is of great significance.

[0004] At present, there is a lack of an effective risk identification solution for network office systems, and the information security of network office systems is low. Summary of the invention

[0005] The present disclosure provides a risk behavior identification method and device based on a fingerprint mouse, so as to at least solve the problem of low existing information security.

[0006] The technical solution of the present disclosure is as follows: In one aspect of the present disclosure, a risk behavior identification method based on a fingerprint mouse is provided, comprising: The fingerprint collection module set on the fingerprint mouse is used to collect the user's fingerprint image, and the computer system is used to collect the user's access operation behavior; Identifying the user substitution behavior according to the fingerprint comparison result of the user's fingerprint image; Based on the access operation behavior, identify the existing risk of illegal behavior; Determine an overall risk score based on each of the risk behaviors described; When the total risk score is greater than or equal to the set score threshold, a risk warning operation is performed.

[0007] Optionally, the risk of violation behavior includes at least one of the following: injection attack, cross-site attack, malicious refresh and crawling data; the access operation behavior includes at least one of the following: access frequency, access behavior and access content; the identifying the risk of violation behavior according to the access operation behavior includes: If the access content successfully matches the set rule template, it is determined that the injection attack exists; Using regular expressions to detect malicious code in the accessed content; When the access frequency to the data interface is greater than the set frequency threshold, it is determined that there is a malicious refresh; The existence of the crawled data is determined based on non-browser access actions in the access log in the access content.

[0008] Optionally, determining a total risk score according to each of the risk violations includes: Count the number of occurrences of each type of risk violation behavior; Determine a score for each of the risk violations according to the number of times each of the risk violations occurs; The total risk score is determined according to the score of each of the risk violations and the weight of each of the risk violations.

[0009] Optionally, when the total risk score is greater than or equal to a set score threshold, performing a risk warning operation includes: When the total risk score is greater than or equal to the set score threshold, a warning message is generated and recorded in the warning database, and a pop-up window is displayed to display the warning message; and / or, The warning information is sent to a management device, where the warning information includes the risky violation behavior.

[0010] Optionally, the user fingerprint image includes: a first fingerprint image and a second fingerprint image, and the identifying the substitution behavior according to the fingerprint comparison result of the user fingerprint image includes: Performing fingerprint comparison according to the first fingerprint image and the second fingerprint image to obtain a fingerprint comparison result; wherein the first fingerprint image is an image collected by the fingerprint collection module during the process of logging into the target system, and the second fingerprint image is an image collected by the fingerprint collection module during the process of using the target system; According to the fingerprint comparison result, the substitution behavior is identified.

[0011] Optionally, performing fingerprint comparison according to the first fingerprint image and the second fingerprint image to obtain a fingerprint comparison result includes: Performing preprocessing operations on the first fingerprint image and the second fingerprint image respectively to obtain a preprocessed first fingerprint image and a preprocessed second fingerprint image; Performing an alignment operation on the preprocessed first fingerprint image and the preprocessed second fingerprint image respectively to obtain an aligned first fingerprint image and an aligned second fingerprint image; Performing feature extraction on the aligned first fingerprint image and the aligned second fingerprint image respectively to obtain a first texture feature and a first minutiae feature corresponding to the first fingerprint image and a second texture feature and a second minutiae feature corresponding to the second fingerprint image; splicing the first texture feature and the first detail point feature into a first feature vector, and splicing the second texture feature and the second detail point feature into a second feature vector; Fingerprint comparison is performed based on the first feature vector and the second feature vector to obtain the fingerprint comparison result.

[0012] Optionally, performing an alignment operation on the preprocessed first fingerprint image to obtain an aligned first fingerprint image includes: The preprocessed first fingerprint image is input into the positioning network for rotation and translation operations to obtain an aligned first fingerprint image.

[0013] Optionally, the extracting features of the aligned first fingerprint image to obtain first texture features and first minutiae features includes: Inputting the aligned first fingerprint image into a texture feature network to obtain the first texture feature; The aligned first fingerprint image is input into a texture feature network to obtain the first detail point feature.

[0014] Optionally, performing fingerprint comparison according to the first feature vector and the second feature vector to obtain the fingerprint comparison result includes: Calculating the similarity between the first feature vector and the second feature vector; When the similarity is greater than or equal to the similarity threshold, the fingerprint comparison result is determined to be fingerprint authentication passed.

[0015] Another aspect of the present disclosure further provides a risk behavior identification device based on a fingerprint mouse, comprising: The information collection module collects the user's fingerprint image using the fingerprint collection module set on the fingerprint mouse, and collects the user's access operation behavior using the computer system; A person-replacement recognition module, used to recognize person-replacement behavior based on a fingerprint comparison result of the user's fingerprint image; A violation identification module, used to identify existing violation risk behaviors according to the access operation behaviors; A risk determination module, used to determine a total risk score according to each of the risk violations; The warning execution module is used to execute a risk warning operation when the total risk score is greater than or equal to a set score threshold. The technical solution provided by the embodiments of the present disclosure brings at least the following beneficial effects: In some embodiments of the present disclosure, user fingerprint images and access operation behaviors are collected; based on the fingerprint comparison results of the user fingerprint images, the substitution behavior is identified; based on the access operation behaviors, the existing risk behaviors of violations are identified; based on each risk behavior of violations, the total risk score is determined; when the total risk score is greater than or equal to the set score threshold, a risk warning operation is performed; during the use of the system, the present disclosure automatically identifies risks based on fingerprint authentication and access operation behaviors to improve information security.

[0016] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings herein are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the description are used to explain the principles of the present disclosure, and do not constitute improper limitations on the present disclosure.

[0018] Figure 1 A flowchart of a risk behavior identification method based on a fingerprint mouse provided by an exemplary embodiment of the present disclosure; Figure 2 A schematic diagram of the structure of a risk behavior identification device based on a fingerprint mouse provided by an exemplary embodiment of the present disclosure; Figure 3 A schematic structural diagram of an electronic device provided by an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0019] In order to enable ordinary persons in the art to better understand the technical solutions of the present disclosure, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the accompanying drawings.

[0020] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure.

[0021] It should be noted that the user information involved in this disclosure includes but is not limited to: user device information and user personal information; the collection, storage, use, processing, transmission, provision and disclosure of user information in this disclosure comply with the relevant laws and regulations and do not violate public order and good morals.

[0022] In response to the above technical problems, in some embodiments of the present disclosure, user fingerprint images and access operation behaviors are collected; based on the fingerprint comparison results of the user fingerprint images, the substitution behavior is identified; based on the access operation behavior, the existing violation risk behaviors are identified; based on each violation risk behavior, the total risk score is determined; when the total risk score is greater than or equal to the set score threshold, a risk warning operation is performed; during the use of the system, the present disclosure automatically identifies risks based on fingerprint authentication and access operation behaviors to improve information security.

[0023] The technical solutions provided by various embodiments of the present disclosure are described in detail below in conjunction with the accompanying drawings.

[0024] Figure 1 The following is a flow chart of a risk behavior identification method based on a fingerprint mouse provided by an exemplary embodiment of the present disclosure. Figure 1 As shown, the method includes: S101: using a fingerprint collection module provided on the fingerprint mouse to collect a user's fingerprint image, and using a computer system to collect the user's access operation behavior; S102: Identify the user replacement behavior based on the fingerprint comparison result of the user's fingerprint image; S103: Identify existing risk violations based on access operation behaviors; S104: Determine a total risk score based on each violation risk behavior; S105: When the total risk score is greater than or equal to the set score threshold, a risk warning operation is performed.

[0025] In this embodiment, the execution subject of the above method is a terminal device. The types of terminal devices include but are not limited to: personal computers, notebooks, tablet computers, mobile phones and smart screens.

[0026] In this embodiment, user fingerprint images and access operation behaviors are collected; based on the fingerprint comparison results of the user fingerprint images, the substitution behavior is identified; based on the access operation behaviors, the existing risk behaviors of violations are identified; based on each risk behavior of violations, the total risk score is determined; when the total risk score is greater than or equal to the set score threshold, the risk warning operation is executed; during the use of the system, the present disclosure automatically identifies risks based on fingerprint authentication and access operation behaviors to improve information security.

[0027] It should be noted that the target system can be any type of network office system. The present disclosure does not limit the target system, and the target system can also be an official website or an enterprise content website.

[0028] Fingerprint mouse is a mouse product that combines fingerprint recognition technology and photoelectric positioning technology. It not only has all the functions of a traditional mouse, but also can realize security functions such as computer login and file encryption through fingerprint recognition. The fingerprint mouse uses a built-in fingerprint chip and live fingerprint recognition technology to authenticate the user when the mouse is touched, ensuring that only authorized users can access the computer or related files. The working principle of the fingerprint mouse is based on fingerprint recognition technology. When the user touches the mouse, the built-in sensor will receive a high-frequency alternating magnetic field, which will power the chip and identify the fingerprint information. The chip will compare the stored fingerprint information with the fingerprint information collected in real time, and perform corresponding operations after confirming the identity, such as computer login, file encryption, etc.

[0029] Access behavior mainly refers to the user's mouse operation behavior, such as mouse click, drag, double-click, right-click, scroll wheel sliding, scroll wheel clicking and other mouse events. Access content mainly refers to the function key click, content browsing, content input, and triggering of access behavior on the currently visited page.

[0030] An injection attack is when an attacker injects carefully constructed attack code into the place where the application receives user input in order to perform arbitrary operations, tamper with data, or obtain sensitive information. Injection attacks are one of the most common types of attacks in Web applications. Successful implementation of injection attacks will lead to risks in the confidentiality, integrity, and availability of the application.

[0031] Cross-site scripting (XSS) is a common network security vulnerability that attackers exploit to insert malicious scripts into the victim's web page to obtain sensitive user information, hijack sessions, or perform other malicious activities. The main principle of XSS attacks is to take advantage of the website's incorrect processing of user input, allowing malicious users to inject malicious scripts into the victim's web page. These scripts are executed in the user's browser, resulting in security risks.

[0032] Malicious refresh refers to the act of repeatedly refreshing a web page or application interface through automated tools or scripts to achieve some improper purpose. This behavior usually causes unnecessary load on the server, affects the access experience of normal users, and may even be used for fraud or other malicious activities.

[0033] ‌Data crawling‌ refers to the process of obtaining and extracting data from the Internet through automated programs. It is also called a web spider or web scraping, and is often used to collect, parse and store information from sources such as web pages, API interfaces, documents, etc. The application areas of data crawling include: ‌Web content acquisition‌, by crawling web page data, to achieve comprehensive data capture and analysis, for public opinion monitoring, news aggregation, search engines and other applications‌; data analysis and mining‌, by crawling data sources to obtain a large amount of data, perform data cleaning, processing and analysis, and discover patterns, trends and laws hidden in the data‌. Social media data collection‌, by crawling social media user information, posts and comments, etc., to conduct user portraits, public opinion analysis and social network analysis and other research‌.

[0034] In some embodiments of the present disclosure, a fingerprint acquisition module provided on a fingerprint mouse is used to acquire a user fingerprint image, wherein the user fingerprint image includes: a first fingerprint image and a second fingerprint image; a fingerprint comparison is performed based on the first fingerprint image and the second fingerprint image to obtain a fingerprint comparison result; and a substitution behavior is identified based on the fingerprint comparison result. The first fingerprint image is an image acquired by the fingerprint acquisition module during the process of logging into the target system, and the second fingerprint image is an image acquired by the fingerprint acquisition module during the process of using the target system. Wherein, if the fingerprint comparison result is that the fingerprint authentication is passed, it is determined that there is no substitution behavior; if the fingerprint comparison result is that the fingerprint authentication is not passed, it is determined that there is a substitution behavior.

[0035] It should be noted that the first fingerprint image can be the fingerprint image collected for the first time after the login verification is passed during the process of logging into the target system, and the second fingerprint image can be collected intermittently for a set time during the use of the target system, so as to continuously perform fingerprint authentication during the use of the target system and identify whether there is a problem of changing people using the system. The present disclosure uses a fingerprint mouse to perform fingerprint authentication on the target user to improve the security of network access. It should be noted that the present disclosure does not limit the set time and can be adjusted according to actual conditions. The set time is, for example, 10 seconds, 1 minute, etc.

[0036] In some embodiments of the present disclosure, fingerprint comparison is performed based on the first fingerprint image and the second fingerprint image to obtain a fingerprint comparison result. One achievable method is to perform preprocessing operations on the first fingerprint image and the second fingerprint image respectively to obtain a preprocessed first fingerprint image and a preprocessed second fingerprint image; perform alignment operations on the preprocessed first fingerprint image and the preprocessed second fingerprint image respectively to obtain an aligned first fingerprint image and an aligned second fingerprint image; perform feature extraction on the aligned first fingerprint image and the aligned second fingerprint image respectively to obtain a first texture feature and a first detail point feature corresponding to the first fingerprint image and a second texture feature and a second detail point feature corresponding to the second fingerprint image; splice the first texture feature and the first detail point feature into a first feature vector, and splice the second texture feature and the second detail point feature into a second feature vector; perform fingerprint comparison based on the first feature vector and the second feature vector to obtain a fingerprint comparison result.

[0037] In the above embodiment, the first fingerprint image is preprocessed to obtain the preprocessed first fingerprint image, wherein the first fingerprint image is preprocessed such as denoising and enhancement to improve the image quality.

[0038] In the above embodiment, the preprocessed first fingerprint image is aligned to obtain the aligned first fingerprint image. One achievable method is to input the preprocessed first fingerprint image into the positioning network for rotation and translation operations to obtain the aligned first fingerprint image. Similarly, the preprocessed second fingerprint image is input into the positioning network for rotation and translation operations to obtain the aligned second fingerprint image.

[0039] Before using the positioning network, you need to train the positioning network first. The training process is to collect sample fingerprint images and sample alignment fingerprint images corresponding to the sample fingerprint images, annotate the sample fingerprint images and sample alignment fingerprint images to form an annotated data set, and use the annotated data set to train the initial model to obtain a trained positioning network.

[0040] In the above embodiment, feature extraction is performed on the aligned first fingerprint image to obtain texture features and detail point features. One achievable method is to input the aligned first fingerprint image into a texture feature network to obtain a first texture feature; and input the aligned first fingerprint image into a texture feature network to obtain a first detail point feature. It should be noted that texture features mainly include overall features and local features; overall features refer to those features that can be directly observed with the naked eye, such as grain shape, pattern area, core point, triangle point and grain number. Grain shape is to divide fingerprints into ring, arch and spiral shapes according to the direction and distribution of the ridges. Local features include parameters such as the direction, curvature and position of the fingerprint grain lines. Detail point features refer to specific feature points used for fingerprint identification and comparison, including the end points, bifurcation points, termination points, divergence points, isolated points, ring points, short grains, etc. of the grain lines. These detail points provide unique confirmation information of fingerprints and are the key to distinguishing different fingerprints. The present disclosure uses texture feature networks and detail point feature networks for feature extraction to more comprehensively describe fingerprint information and improve feature expression capabilities. The types of texture feature networks and minutiae feature networks disclosed in the present invention are not limited. Similarly, the above method is used to extract features from the aligned second fingerprint image to obtain second texture features and second minutiae features, which will not be described in detail here.

[0041] In the above embodiment, the first texture feature and the first detail point feature are spliced ​​into a first feature vector. The first texture feature is vectorized to obtain a first vector; the first detail point feature is vectorized to obtain a second vector; the first vector and the second vector are directly spliced ​​to obtain a long feature vector, i.e., the first feature vector, which is convenient for subsequent data processing. Similarly, the second texture feature and the second detail point feature are spliced ​​into a second feature vector in the above manner.

[0042] In the above embodiment, a fingerprint comparison is performed based on the first feature vector and the second feature vector to obtain a fingerprint comparison result. One achievable method is to calculate the similarity between the first feature vector and the second feature vector; when the similarity is greater than or equal to a similarity threshold, the fingerprint comparison result is determined to be a fingerprint authentication pass; when the similarity is less than the similarity threshold, the fingerprint comparison result is determined to be a fingerprint authentication failure. It should be noted that the present disclosure does not limit the similarity threshold, and the similarity threshold can be adjusted according to actual conditions. The similarity threshold, for example, is 90, 95, etc.

[0043] In an exemplary embodiment, an encryption mechanism is used to encrypt, store and transmit fingerprint features to prevent fingerprint information leakage and protect user privacy.

[0044] In some embodiments of the present disclosure, during the process of a target user using a target system, the access operation behaviors of the target user are collected. It is realized to identify the illegal risk behaviors existing during the process of the user using the system. Among them, the access operation behaviors include, but are not limited to: user fingerprint information, user information, device information, user operation type, system name, function name, access address, access method, access content, access frequency, access parameters, access response code, access response content, and access time.

[0045] In some embodiments of the present disclosure, according to the access operation behaviors, the existing illegal risk behaviors are identified. Among them, the illegal risk behaviors of the present disclosure include at least one of the following: injection attack, cross-site attack, malicious refresh, and data crawling. The following will make a detailed description of the specific identification methods of the illegal risk behaviors respectively.

[0046] Risk behavior identification method 1: If the access content matches the set rule template successfully, it is determined that there is an injection attack. The user access content is pre-judged by using the pattern matching method. The behavior that the user access content contains SQL key element information, such as the access containing conditions such as CREATE, DELETE, MODIFY DATABASE, DATA TABLE, DATA INDEX, and the AND OR BETWEEN of related combined conditions. For example, injection_patterns = [ r"\b(select|insert|update|delete)\b", # Match common SQL keywords r"(\'|`).*?(\'|`)", # Match the content within the quotes, which may be the parameters injected in the parameterized query r"(;|--|\ / \*|\*\ / )", # Match special characters such as semicolons and comment symbols that may be used for SQL injection ], if an injection attack is identified, subsequent warning operations are performed.

[0047] Risk behavior identification method 2: Use regular expressions to detect malicious code in the access content. Cross-Site Scripting (XSS) is a common Web security vulnerability. Attackers steal user information or perform other malicious operations by injecting malicious scripts into web pages. Regular expressions are used for the user input content to detect potential malicious code in the input content. For example, xss_pattern = re.compile(r'<script|javascript:|on[a-zA-Z]+=|data:text / html;base64,') The rule is used to detect XSS attack behaviors, where, <script>标签及其内容；javascript:开头的URL；on[a-zA-Z]+=形式的DOM事件处理程序。data:text / html;base64，编码的HTML内容。

[0048] 风险行为识别方式三：在对数据接口的访问频率大于设定频率阈值的情况下，则确定存在恶意刷新。依靠较短时间窗口内捕获用户对同一个资源不断的访问行为。需要说明的是，本公开对设定频率阈值不作限定，设定频率阈值可以根据实际情况作出调整。设定频率阈值，可以为50次，100次，或者200次。例如，用户在10秒内对数据接口进行访问达100次以上，则可判定用户行为是一个恶意刷新行为。

[0049] 风险行为识别方式四：根据访问内容中的访问日志中的非浏览器的访问动作，确定存在爬取数据。主要针对终端用户使用不当手段获取数据的手段，判断这种行为主要依靠用户的访问日志，从日志中提取非浏览器的访问动作，并且以查询数据为主的访问行为，作为主要判断依据。

[0050] 在本公开的一些实施例中，根据每种违规风险行为，确定总风险得分。一种可实现的方式为，统计每种违规风险行为出现的次数；根据每种违规风险行为出现的次数，确定每种违规风险行为的得分；根据每种违规风险行为的得分与每种违规风险行为的权重，确定总风险得分。其中，统计设定周期内每种违规风险行为出现的次数，基于出现次数计算每种违规风险行为的得分；再基于每种违规风险行为的得分与每种违规风险行为的权重，计算总风险得分；本公开通过违规风险行为出现的次数和权重，计算总风险得分，总风险得分的确定更加合理以及准确。

[0051] 例如，统计一天之内注入攻击、跨站攻击、恶意刷新、爬取数据分别出现的次数；其中，注入攻击行为每出现一次增加1分；跨站攻击行为每出现一次增加1分；恶意刷新行为每出现一次增加1分；爬取数据行为每出现一次增加1分。根据每种违规风险行为的危害程度，分别为四种违规风险行为赋予相应的权重系数；其中，注入攻击行为对应的权重系数为9，跨站攻击行为对应的权重系数为2，恶意刷新行为对应的权重系数为1，爬取数据行为对应的权重系数为5。总风险得分的计算公式如下：注入攻击行为次数*9+跨站攻击行为次数*2+恶意刷新行为次数*1+爬取数据行为次数*5＝总风险得分。

[0052] 在本公开的一些实施例中，在总风险得分大于或者等于设定得分阈值的情况下，执行风险警示操作。其中，风险警示操作包括但不限于以下几种警示方式：风险警示方式一：在总风险得分大于或者等于设定得分阈值的情况下，生成警告信息记录至警告数据库，并弹窗显示警告信息。需要说明的是，本公开对设定得分阈值不作限定，设定得分阈值可以根据实际情况作出调整，设定得分阈值，例如，85分，90分等。本公开在总风险得分大于或者等于设定得分阈值的情况下，生成警告信息记录至警告数据库，以供后续查询警告信息记录进行维护工作；在目标用户所使用的用户终端弹窗显示警告信息，对目标用户起到警示作用。其中，本公开对警告信息的具体实现方式不作限定。

[0053] 风险警示方式二：向管理设备发送警告信息，警告信息包括违规风险行为。需要说明的是，在总风险得分大于或者等于设定得分阈值的情况下，向管理设备发送警告信息，以供管理用户查看警告信息进行后续风险处理操作。

[0054] 在本公开上述方法实施例中，采集用户指纹图像和访问操作行为；根据用户指纹图像的指纹比对结果，识别换人行为；根据访问操作行为，识别存在的违规风险行为；根据每种违规风险行为，确定总风险得分；在总风险得分大于或者等于设定得分阈值的情况下，执行风险警示操作；本公开在系统使用过程中，基于指纹认证及访问操作行为自动进行风险识别，提高信息安全性。

[0055] ‌图2为本公开示例性实施例提供的一种基于指纹鼠标的风险行为识别装置20的结构示意图。如图2所示，该基于指纹鼠标的风险行为识别装置20包括：信息采集模块21，换人识别模块22，违规识别模块23，风险确定模块24和警示执行模块25。

[0056] 信息采集模块21，利用指纹鼠标上设置的指纹采集模块采集用户指纹图像，利用计算机系统采集用户访问操作行为；换人识别模块22，用于根据用户指纹图像的指纹比对结果，识别换人行为；违规识别模块23，用于根据访问操作行为，识别存在的违规风险行为；风险确定模块24，用于根据每种违规风险行为，确定总风险得分；警示执行模块25，在总风险得分大于或者等于设定得分阈值的情况下，用于执行风险警示操作。

[0057] 可选地，违规风险行为包括以下至少一种：注入攻击、跨站攻击、恶意刷新和爬取数据；访问操作行为包括以下至少一种：访问频率、访问行为和访问内容；违规识别模块23在根据访问操作行为，识别存在的违规风险行为时，用于：在访问内容与设定规则模板匹配成功的情况下，则确定存在注入攻击；使用正则表达式检测访问内容中的恶意代码；在对数据接口的访问频率大于设定频率阈值的情况下，则确定存在恶意刷新；根据访问内容中的访问日志中的非浏览器的访问动作，确定存在爬取数据。

[0058] 可选地，风险确定模块24在根据每种违规风险行为，确定总风险得分时，用于：统计每种违规风险行为出现的次数；根据每种违规风险行为出现的次数，确定每种违规风险行为的得分；根据每种违规风险行为的得分与每种违规风险行为的权重，确定总风险得分。

[0059] 可选地，警示执行模块25在总风险得分大于或者等于设定得分阈值的情况下，执行风险警示操作时，用于：在总风险得分大于或者等于设定得分阈值的情况下，生成警告信息记录至警告数据库，并弹窗显示警告信息；和 / 或，向管理设备发送警告信息，警告信息包括违规风险行为。

[0060] 可选地，用户指纹图像包括：第一指纹图像和第二指纹图像，换人识别模块22在根据用户指纹图像的指纹比对结果，识别换人行为时，用于：根据第一指纹图像和第二指纹图像进行指纹比对，得到指纹比对结果；其中，第一指纹图像是在登录目标系统的过程中利用指纹采集模块采集到的图像，第二指纹图像是在使用目标系统的过程中利用指纹采集模块采集到的图像；根据指纹比对结果，识别换人行为。

[0061] 可选地，换人识别模块22在根据第一指纹图像和第二指纹图像进行指纹比对，得到指纹比对结果时，用于：对第一指纹图像和第二指纹图像分别进行预处理操作，得到预处理后的第一指纹图像和预处理后的第二指纹图像；对预处理后的第一指纹图像和预处理后的第二指纹图像分别进行对齐操作，得到对齐后的第一指纹图像和对齐后的第二指纹图像；对对齐后的第一指纹图像和对齐后的第二指纹图像分别进行特征提取，得到第一指纹图像对应的第一纹理特征和第一细节点特征以及第二指纹图像对应的第二纹理特征和第二细节点特征；将第一纹理特征和第一细节点特征拼接为第一特征向量，以及将第二纹理特征和第二细节点特征拼接为第二特征向量；根据第一特征向量和第二特征向量进行指纹比对，得到指纹比对结果。

[0062] 可选地，换人识别模块22在对预处理后的第一指纹图像进行对齐操作，得到对齐后的第一指纹图像时，用于：将预处理后的第一指纹图像输入定位网络中进行旋转和平移操作，得到对齐后的第一指纹图像。

[0063] 可选地，换人识别模块22在对对齐后的第一指纹图像进行特征提取，得到第一纹理特征和第一细节点特征时，用于：将对齐后的第一指纹图像输入纹理特征网络中，得到第一纹理特征；将对齐后的第一指纹图像输入纹理特征网络中，得到第一细节点特征。

[0064] 可选地，换人识别模块22在根据第一特征向量和第二特征向量进行指纹比对，得到指纹比对结果时，用于：计算第一特征向量和第二特征向量的相似度；在相似度大于或者等于相似度阈值的情况下，则确定指纹比对结果为指纹认证通过。

[0065] 关于上述实施例中的装置，其中各个模块执行操作的具体方式已经在有关该方法的实施例中进行了详细描述，此处将不做详细阐述说明。

[0066] 图3为本公开示例性实施例提供的一种电子设备的结构示意图。如图3所示，电子设备包括：存储器31和处理器32。另外，电子设备还包括电源组件33和通信组件34。

[0067] 存储器31，用于存储计算机程序，并可被配置为存储其它各种数据以支持在电子设备上的操作。这些数据的示例包括用于在电子设备上操作的任何应用程序或方法的指令。

[0068] 存储器31，可以由任何类型的易失性或非易失性存储设备或者它们的组合实现，如静态随机存取存储器（SRAM），电可擦除可编程只读存储器（EEPROM），可擦除可编程只读存储器（EPROM），可编程只读存储器（PROM），只读存储器（ROM），磁存储器，快闪存储器，磁盘或光盘。

[0069] 通信组件34，用于与其他设备进行数据传输。

[0070] 处理器32，可执行存储器31中存储的计算机指令，以用于：利用指纹鼠标上设置的指纹采集模块采集用户指纹图像，利用计算机系统采集用户访问操作行为；根据用户指纹图像的指纹比对结果，识别换人行为；根据访问操作行为，识别存在的违规风险行为；根据每种违规风险行为，确定总风险得分；在总风险得分大于或者等于设定得分阈值的情况下，执行风险警示操作。

[0071] 相应地，本公开实施例还提供一种存储有计算机程序的计算机可读存储介质。当计算机可读存储介质存储计算机程序，且计算机程序被一个或多个处理器执行时，致使一个或多个处理器执行图1方法实施例中的各步骤。

[0072] 相应地，本公开实施例还提供一种计算机程序产品，计算机程序产品包括计算机程序 / 指令，计算机程序 / 指令被处理器执行图1的方法实施例中的各步骤。

[0073] 上述图3中的通信组件被配置为便于通信组件所在设备和其他设备之间有线或无线方式的通信。通信组件所在设备可以接入基于通信标准的无线网络，如WiFi，2G、3G、4G / LTE、5G等移动通信网络，或它们的组合。在一个示例性实施例中，通信组件经由广播信道接收来自外部广播管理系统的广播信号或广播相关信息。在一个示例性实施例中，通信组件还包括近场通信（NFC）模块，以促进短程通信。例如，在NFC模块可基于射频识别（RFID）技术，红外数据协会（IrDA）技术，超宽带（UWB）技术，蓝牙（BT）技术和其他技术来实现。

[0074] 上述图3中的电源组件，为电源组件所在设备的各种组件提供电力。电源组件可以包括电源管理系统，一个或多个电源，及其他与为电源组件所在设备生成、管理和分配电力相关联的组件。

[0075] 上述电子设备还包括显示屏和音频组件。

[0076] 显示屏包括屏幕，其屏幕可以包括液晶显示屏（LCD）和触摸面板（TP）。如果屏幕包括触摸面板，屏幕可以被实现为触摸屏，以接收来自用户的输入信号。触摸面板包括一个或多个触摸传感器以感测触摸、滑动和触摸面板上的手势。触摸传感器可以不仅感测触摸或滑动动作的边界，而且还检测与触摸或滑动操作相关的持续时间和压力。

[0077] 音频组件，可被配置为输出和 / 或输入音频信号。例如，音频组件包括一个麦克风（MIC），当音频组件所在设备处于操作模式，如呼叫模式、记录模式和语音识别模式时，麦克风被配置为接收外部音频信号。所接收的音频信号可以被进一步存储在存储器或经由通信组件发送。在一些实施例中，音频组件还包括一个扬声器，用于输出音频信号。

[0078] 在本公开上述装置、设备、存储介质和计算机程序产品实施例中，采集用户指纹图像和访问操作行为；根据用户指纹图像的指纹比对结果，识别换人行为；根据访问操作行为，识别存在的违规风险行为；根据每种违规风险行为，确定总风险得分；在总风险得分大于或者等于设定得分阈值的情况下，执行风险警示操作；本公开在系统使用过程中，基于指纹认证及访问操作行为自动进行风险识别，提高信息安全性。

[0079] 本领域内的技术人员应明白，本公开的实施例可提供为方法、系统、或计算机程序产品。因此，本公开可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本公开可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质（包括但不限于磁盘存储器、CD-ROM、光学存储器等）上实施的计算机程序产品的形式。

[0080] 本公开是参照根据本公开实施例的方法、设备（系统）、和计算机程序产品的流程图和／或方框图来描述的。应理解可由计算机程序指令实现流程图和／或方框图中的每一流程和／或方框、以及流程图和／或方框图中的流程和／或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和／或方框图一个方框或多个方框中指定的功能的装置。

[0081] 这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和／或方框图一个方框或多个方框中指定的功能。

[0082] 这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和／或方框图一个方框或多个方框中指定的功能的步骤。

[0083] 在一个典型的配置中，计算设备包括一个或多个处理器 (CPU)、输入 / 输出接口、网络接口和内存。

[0084] 内存可能包括计算机可读介质中的非永久性存储器，随机存取存储器 (RAM) 和 / 或非易失性内存等形式，如只读存储器 (ROM) 或闪存(flash RAM)。内存是计算机可读介质的示例。

[0085] 计算机可读介质包括永久性和非永久性、可移动和非可移动媒体可以由任何方法或技术来实现信息存储。信息可以是计算机可读指令、数据结构、程序的模块或其他数据。计算机的存储介质的例子包括，但不限于相变内存 (PRAM)、静态随机存取存储器 (SRAM)、动态随机存取存储器 (DRAM)、其他类型的随机存取存储器 (RAM)、只读存储器 (ROM)、电可擦除可编程只读存储器 (EEPROM)、快闪记忆体或其他内存技术、只读光盘只读存储器(CD-ROM)、数字多功能光盘 (DVD) 或其他光学存储、磁盒式磁带，磁带磁磁盘存储或其他磁性存储设备或任何其他非传输介质，可用于存储可以被计算设备访问的信息。按照本文中的界定，计算机可读介质不包括暂存电脑可读媒体 (transitory media)，如调制的数据信号和载波。

[0086] 需要说明的是，在本文中，诸如"第一”和"第二”等之类的关系术语仅仅用来将一个实体或者操作与另一个实体或操作区分开来，而不一定要求或者暗示这些实体或操作之间存在任何这种实际的关系或者顺序。而且，术语"包括”、"包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者设备所固有的要素。在没有更多限制的情况下，由语句"包括一个……”限定的要素，并不排除在包括要素的过程、方法、物品或者设备中还存在另外的相同要素。

[0087] 以上仅是本公开的具体实施方式，使本领域技术人员能够理解或实现本公开。对这些实施例的多种修改对本领域的技术人员来说将是显而易见的，本文中所定义的一般原理可以在不脱离本公开的精神或范围的情况下，在其它实施例中实现。因此，本公开将不会被限制于本文的这些实施例，而是要符合与本文所公开的原理和新颖特点相一致的最宽的范围。< / script>

Claims

1. A risk behavior identification method based on fingerprint mouse, characterized in that: include: The fingerprint collection module set on the fingerprint mouse is used to collect the user's fingerprint image, and the computer system is used to collect the user's access operation behavior; Identifying the user substitution behavior according to the fingerprint comparison result of the user's fingerprint image; Based on the access operation behavior, identify the existing risk of illegal behavior; Determine an overall risk score based on each of the risk behaviors described; When the total risk score is greater than or equal to the set score threshold, a risk warning operation is performed.

2. The method according to claim 1, characterized in that The risk of violation includes at least one of the following: injection attack, cross-site attack, malicious refresh and crawling data; the access operation includes at least one of the following: access frequency, access behavior and access content; The step of identifying existing risk violations based on the access operation behavior includes: If the access content successfully matches the set rule template, it is determined that the injection attack exists; Using regular expressions to detect malicious code in the accessed content; When the access frequency to the data interface is greater than the set frequency threshold, it is determined that there is a malicious refresh; The existence of the crawled data is determined based on non-browser access actions in the access log in the access content.

3. The method according to claim 1, characterized in that According to each of the risk behaviors of violation, the total risk score is determined, including: Count the number of occurrences of each type of risk violation behavior; Determine a score for each of the risk violations according to the number of times each of the risk violations occurs; The total risk score is determined according to the score of each of the risk violations and the weight of each of the risk violations.

4. The method according to claim 1, characterized in that: When the total risk score is greater than or equal to the set score threshold, performing a risk warning operation includes: When the total risk score is greater than or equal to the set score threshold, a warning message is generated and recorded in the warning database, and a pop-up window is displayed to display the warning message; and / or, The warning information is sent to a management device, where the warning information includes the risky violation behavior.

5. The method according to claim 1, characterized in that The user fingerprint image includes: a first fingerprint image and a second fingerprint image, and the identifying the substitution behavior according to the fingerprint comparison result of the user fingerprint image includes: Performing fingerprint comparison according to the first fingerprint image and the second fingerprint image to obtain a fingerprint comparison result; wherein the first fingerprint image is an image collected by the fingerprint collection module during the process of logging into the target system, and the second fingerprint image is an image collected by the fingerprint collection module during the process of using the target system; According to the fingerprint comparison result, the substitution behavior is identified.

6. The method according to claim 5, characterized in that The performing fingerprint comparison according to the first fingerprint image and the second fingerprint image to obtain a fingerprint comparison result includes: Performing preprocessing operations on the first fingerprint image and the second fingerprint image respectively to obtain a preprocessed first fingerprint image and a preprocessed second fingerprint image; Performing an alignment operation on the preprocessed first fingerprint image and the preprocessed second fingerprint image respectively to obtain an aligned first fingerprint image and an aligned second fingerprint image; Performing feature extraction on the aligned first fingerprint image and the aligned second fingerprint image respectively to obtain a first texture feature and a first minutiae feature corresponding to the first fingerprint image and a second texture feature and a second minutiae feature corresponding to the second fingerprint image; splicing the first texture feature and the first detail point feature into a first feature vector, and splicing the second texture feature and the second detail point feature into a second feature vector; Fingerprint comparison is performed based on the first feature vector and the second feature vector to obtain the fingerprint comparison result.

7. The method according to claim 6, characterized in that The step of performing an alignment operation on the preprocessed first fingerprint image to obtain an aligned first fingerprint image includes: The preprocessed first fingerprint image is input into the positioning network for rotation and translation operations to obtain an aligned first fingerprint image.

8. The method according to claim 6, characterized in that The step of extracting features from the aligned first fingerprint image to obtain a first texture feature and a first minutiae feature includes: Inputting the aligned first fingerprint image into a texture feature network to obtain the first texture feature; The aligned first fingerprint image is input into a texture feature network to obtain the first detail point feature.

9. The method according to claim 6, characterized in that The fingerprint comparison is performed according to the first feature vector and the second feature vector to obtain the fingerprint comparison result, including: Calculating the similarity between the first feature vector and the second feature vector; When the similarity is greater than or equal to the similarity threshold, the fingerprint comparison result is determined to be fingerprint authentication passed.

10. A risk behavior identification device based on fingerprint mouse, characterized in that: include: The information collection module collects the user's fingerprint image using the fingerprint collection module set on the fingerprint mouse, and collects the user's access operation behavior using the computer system; A person-replacement recognition module, used to recognize person-replacement behavior based on a fingerprint comparison result of the user's fingerprint image; A violation identification module, used to identify existing violation risk behaviors according to the access operation behaviors; A risk determination module, used to determine a total risk score according to each of the risk violations; The warning execution module is used to execute a risk warning operation when the total risk score is greater than or equal to a set score threshold.

Images