Method and device for detecting injection attack

Abstract

The embodiment of the invention provides a method and device for detecting an injection attack. The method comprises the following steps: acquiring first feature data when the user equipment performs a first image acquisition process, the first feature data at least comprising sensor feature data corresponding to a target sensor in the user equipment, and the target sensor being used for sensing the motion of the user equipment; determining whether second feature data matched with the first feature data exists in a first feature library or not, wherein the second feature data corresponds to a second image acquisition process with the injection behavior; and determining whether an injection behavior exists in the first image acquisition process or not according to a determination result.

Description

Technical Field

[0001] The embodiments of the present specification belong to the field of computer technology, and more particularly, to a method and device for detecting injection attacks. Background Art

[0002] In eKYC (Electronic Know Your Customer) authentication, users need to use their devices to capture facial and ID videos. With the development of AIGC (Artificial Intelligence Generated Content) technology, it has become easier for criminals to forge facial or ID pictures.

[0003] A reasonable and reliable solution is needed to effectively detect injection attacks on image acquisition behaviors. Summary of the invention

[0004] The purpose of the present invention is to provide a solution for detecting injection attacks, which can effectively detect injection attacks on image acquisition behaviors.

[0005] The first aspect of the present specification provides a method for detecting an injection attack, comprising: obtaining first feature data when a user device performs a first image acquisition process, wherein the first feature data includes at least sensor feature data corresponding to a target sensor in the user device, and the target sensor is used to sense the movement of the user device; determining whether there is second feature data matching the first feature data in a first feature library, the second feature data corresponding to a second image acquisition process in which an injection behavior exists; and determining whether there is an injection behavior in the first image acquisition process based on the determination result.

[0006] The second aspect of the present specification provides an apparatus for detecting injection attacks, comprising: an acquisition unit, configured to acquire first feature data when a user device performs a first image acquisition process, wherein the first feature data at least includes sensor feature data corresponding to a target sensor in the user device, and the target sensor is used to sense the movement of the user device; a first determination unit, configured to determine whether there is second feature data matching the first feature data in a first feature library, the second feature data corresponding to a second image acquisition process in which an injection behavior exists; and a second determination unit, configured to determine whether there is an injection behavior in the first image acquisition process based on the determination result of the first determination unit.

[0007] A third aspect of the present specification provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method described in the first aspect.

[0008] A fourth aspect of the present specification provides a computing device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method described in the first aspect is implemented.

[0009] A fifth aspect of the present specification provides a computer program product, comprising a computer program / instruction, which, when executed by a processor, implements the steps of the method described in the first aspect.

[0010] The solution provided by the above-mentioned embodiment of this specification supports the construction of a first feature library for injection attack detection, which includes second feature data corresponding to the second image acquisition process in which the injection behavior exists, and the second feature data at least includes sensor feature data corresponding to the target sensor in the user device that performs the second image acquisition process, and the target sensor is used to sense the movement of the user device. In the injection attack detection stage, the first feature data when the user device performs the first image acquisition process can be obtained, which at least includes sensor feature data corresponding to the target sensor in the user device, and then it is determined whether there is second feature data matching the first feature data in the first feature library, and then according to the determination result, it is determined whether there is injection behavior in the first image acquisition process. Since the sensor feature data corresponding to the target sensor is related to the user behavior, it is not easy to forge, and the forging cost is high. Therefore, when criminals carry out batch injection attacks, such sensor feature data is generally limited. By using such sensor feature data for injection attack detection, effective injection attack detection of image acquisition behavior can be achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the technical solutions of the embodiments of this specification, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0012] Figure 1 It is a schematic diagram of the feature library construction process in the embodiment of this specification;

[0013] Figure 2 is another schematic diagram of the feature library construction process in the embodiment of this specification;

[0014] Figure 3 is a flow chart of a method for detecting injection attacks in an embodiment of this specification;

[0015] Figure 4 is another flow chart of the method for detecting injection attacks in an embodiment of this specification;

[0016] Figure 5 It is a structural diagram of a device for detecting injection attacks in an embodiment of this specification. DETAILED DESCRIPTION

[0017] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0018] As mentioned above, in eKYC verification, users need to use their devices to capture facial and ID videos. With the development of AIGC technology, it has become easier for criminals to forge facial or ID images.

[0019] The embodiments of this specification provide a solution for detecting injection attacks, which can effectively detect injection attacks on image acquisition behaviors. It should be noted that the scenarios to which this solution is applicable include but are not limited to electronic identity authentication scenarios. In addition, the solution can be divided into a feature library construction phase and an injection attack detection phase. In the feature library construction phase, one or more feature libraries can be constructed based on the feature data D1 corresponding to each of multiple image acquisition processes P1 in which injection behaviors exist. The construction of the one or more feature libraries can be performed by any device, platform or device cluster with computing and processing capabilities.

[0020] The feature data D1 at least includes sensor feature data corresponding to the target sensor in the user device that executes the corresponding image acquisition process P1, and the target sensor is used to sense the movement of the user device. The target sensor may include at least one of a linear accelerometer, an accelerometer, and a gyroscope. The sensor feature data may include at least one of device posture information and device motion data. The device posture information may include the absolute position (absolute) of the device in the global coordinate system, and the roll angle (Roll), pitch angle (Pitch) and yaw angle (Yaw) of the device. The device motion data may include three-axis acceleration values ​​excluding the influence of gravity, three-axis acceleration values ​​including the influence of gravity, the time interval of data sampling, the rotation rate on the three axes, and the timestamp, etc. Among them, the three axes here refer to the X axis, the Y axis and the Z axis. Further, the feature data D1 can be collected based on a plurality of preset feature categories, and the sensor feature data in the feature data D1 corresponds to the first feature category among the plurality of feature categories. The first feature category can be used to characterize sensor features related to the target sensor.

[0021] The image acquisition process P1 corresponding to the feature data D1, for example, may involve image acquisition of a person's face and a target certificate. For the sensor feature data in the feature data D1, its acquisition may start when the page for image acquisition of the person's face is pulled up, and end when the image acquisition of the person's face is completed. The acquisition frequency of the sensor feature data may be 25 times or 50 times per second, etc. It should be understood that the acquisition frequency can be configured according to actual needs and is not specifically limited here. The target certificate may include but is not limited to a certificate used to indicate the identity of the user. The feature data D1 may also include facial feature data corresponding to the person's face, certificate attribute feature data corresponding to the target certificate, GPS (Global Positioning System) information corresponding to the user device that executes the image acquisition process P1, and at least one of the device model information corresponding to the user device. Among them, the certificate attribute feature data may be structured data.

[0022] The above-mentioned multiple feature categories may also include at least one of a second feature category for characterizing facial features of a person, a third feature category for characterizing document attribute features, a fourth feature category for characterizing GPS, and a fifth feature category for characterizing a device model. As mentioned above, the facial feature data may correspond to the second feature category, the document attribute feature data may correspond to the third feature category, the GPS information may correspond to the fourth feature category, and the device model information may correspond to the fifth feature category. As an implementation method, the fourth feature category and the fifth feature category may be combined into a sixth feature category, and the sixth feature category is used to characterize GPS and device models. When the feature data D1 includes GPS information and device model information, the GPS information and device model information are composed into structured data corresponding to the sixth feature category in the feature data D1. It should be noted that, affected by the collection authority (such as the collection authority of GPS and / or device model, etc.), the various feature data included in the feature data D1 may correspond to some or all of the above-mentioned multiple feature categories.

[0023] The document attribute feature data may include at least one of the document position, angle feature, clarity value, brightness value, integrity value, and distance from the target document to the user device. The document position may include four corner point positions. The angle feature may include roll angle, pitch angle, and yaw angle.

[0024] The process of collecting the document attribute feature data may include, in the process of the user device collecting the image of the target document, in response to obtaining the image frame P1 collected by the user device, using the document detection model to perform document detection on the image frame P1 to obtain the detection result DR1, and then in response to the detection result DR1 indicating that the image frame P1 contains the document and includes the initial position of the document, extracting the document area from the image frame P1 based on the initial position, and generating the document image based on the document area, and then using the document attribute detection model to perform document attribute detection on the document image to obtain the detection result DR2, which includes multiple document attribute features, and then after determining that the document image quality is qualified based on the detection result DR2, at least part of the multiple document attribute features are combined into document attribute feature data. It should be pointed out that in the case where the detection result DR1 indicates that the image frame P1 does not contain the document, the user device can continue to collect the next image frame P2, so as to then perform document detection and other processing on the image frame P2.

[0025] The initial position of the certificate may include the initial four corner point positions. The certificate detection model and the certificate attribute detection model may both be implemented based on CNN (Convolutional Neural Network). The above-mentioned multiple certificate attribute features may include multiple items of certificate position, angle features, clarity value, brightness value, integrity value, and the distance from the target certificate to the user device. Furthermore, the above-mentioned multiple certificate attribute features may also include certificate category. In addition, in order to detect whether the quality of the certificate image is qualified, a certificate image quality review standard may be preset, so as to use the review standard to determine whether the quality of the certificate image is qualified based on the detection result DR2.

[0026] It should be noted that the process of collecting the attribute feature data of the certificate can be performed by the user device as described above, or by a server communicating with the user device, and is not specifically limited here. Other feature data in the feature data D1 can be collected by the user device. In addition, when it is determined based on the detection result DR2 that the quality of the certificate image is qualified, the user device can take a photo of the target certificate based on the determined result. When it is determined based on the detection result DR2 that the quality of the certificate image is unqualified, a prompt information indicating that the quality of the certificate image is unqualified can be provided to the user.

[0027] When building a feature library, Figure 1 As shown in , each feature data D1 is stored in the feature library FL. Figure 1It is a schematic diagram of the feature library construction process in the embodiment of this specification. Further, in order to facilitate the subsequent matching operation, for each feature data D1, the vector representation of the feature data D1 can be stored in the feature library FL, or the vector representation of each feature data in the feature data D1 can be stored in the feature library FL.

[0028] In the case of constructing multiple feature libraries, the multiple feature libraries all involve the first feature category as described above, and the feature categories involved in the multiple feature libraries are not completely the same. For each feature data D1, and the feature library in which the feature categories involved in the multiple feature libraries are subsets of the feature categories corresponding to the feature data D1, several feature data in the feature data D1 corresponding to the feature categories involved in the feature library can be stored in the feature library. Furthermore, in order to facilitate subsequent matching operations, the vector representation of the combination of the several feature data items can be stored in the feature library, or the vector representation of each of the several feature data items can be stored in the feature library.

[0029] Assume that the preset multiple feature categories are the first feature category, the third feature category, and the sixth feature category as mentioned above, and the multiple feature libraries to be constructed are feature library FL1, feature library FL2, and feature library FL3, wherein feature library FL1 involves the multiple feature categories, feature library FL2 involves the first feature category and the sixth feature category, and feature library FL3 involves the first feature category. For any feature data D1, if the feature data D1 includes sensor feature data corresponding to the first feature category, document attribute feature data corresponding to the third feature category, and GPS and device model information corresponding to the sixth feature category, then it can be as follows Figure 2 As shown in , each feature data in the feature data D1 is stored in the feature library FL1. Figure 2 FIG. 1 is another schematic diagram of the feature library construction process in the embodiment of this specification. Further, in order to expand the feature data in the feature library FL2 and / or the feature library FL3, it is also possible to Figure 2 As shown in , the sensor feature data and GPS, device model information in the feature data D1 are stored in the feature library FL2, and / or the sensor feature data in the feature data D1 are stored in the feature library FL3.

[0030] In one embodiment, for a feature library involving multiple feature categories in the above-mentioned multiple feature libraries, when the feature library stores vector representations of several items of feature data corresponding to the multiple feature categories in the feature data D1, in order to improve the matching accuracy of subsequent matching operations, the feature library can be configured with weight values ​​corresponding to each feature category involved to achieve segmented matching.

[0031] After constructing the feature library based on each feature data D1, in the injection attack detection phase, the following can be performed: Figure 3 The injection attack detection process shown in Figure 1. Figure 3 This is a flow chart of a method for detecting injection attacks in an embodiment of this specification. The method can be performed by any device with computing and processing capabilities (such as the user device in step S301 below, or a server communicating with the user device, etc.), platform or device cluster, and includes steps S301-S305 as shown below.

[0032] like Figure 3 As shown, in step S301, feature data D2 is obtained when the user device performs the image acquisition process P2, which at least includes sensor feature data corresponding to the target sensor in the user device, and the target sensor is used to sense the movement of the user device.

[0033] The feature data D2 can be obtained based on the multiple feature categories as described above, and the sensor feature data in the feature data D2 corresponds to the first feature category in the multiple feature categories. For the explanation of the image acquisition process P2 and the feature data D2, please refer to the relevant description of the image acquisition process P1 and the feature data D1 in the previous text, which will not be repeated here.

[0034] It should be noted that if only one feature library is built during the feature library construction phase, such as Figure 1 If the feature library FL shown in the figure is used, the feature library FL can be used as the first feature library, and then step S303 is performed. If multiple feature libraries are constructed in the feature library construction stage, a feature library in which each feature category involved is a subset of each feature category corresponding to the feature data D2 can be used as the first feature library, and then step S303 is performed. Furthermore, if there is a feature library in which each feature category involved is the same as each feature category corresponding to the feature data D2 among the multiple feature libraries, the feature library can be used as the first feature library. In addition, in order to facilitate the distinction between different feature data, each feature data in the first feature library is referred to as feature data D3 hereinafter.

[0035] In step S303, it is determined whether there is feature data D3 matching the feature data D2 in the first feature library, and the feature data D3 corresponds to the image acquisition process P1 in which the injection behavior occurs.

[0036] Specifically, in one embodiment, each feature data D3 in the first feature library can be matched with the feature data D2 in sequence until the feature data D3 matching the feature data D2 is determined, or it is determined that each feature data D3 does not match the feature data D2. In another embodiment, in order to effectively improve the matching efficiency, in the feature library construction stage, each feature data in each constructed feature library can be clustered to divide the feature data into multiple clusters; based on this, it can be determined whether there is a feature data D3 matching the feature data D2 in the feature data D3 as the center point of each cluster of the first feature library.

[0037] It should be noted that when the feature data D3 in the first feature library is matched with the feature data D2, as a matching operation mode, the similarity S1 between the feature data D3 and the feature data D2 can be determined, and when the similarity S1 reaches the similarity threshold, the feature data D3 is determined to match the feature data D2. Further, if the feature data D3 is a vector representation of a feature data D1 in the previous text, or a vector representation of a combination of several feature data in the feature data D1, the vector representation corresponding to the feature data D2 can be determined, and then the similarity S1 between the feature data D3 and the vector representation can be calculated.

[0038] In order to improve the matching accuracy, as another matching operation mode, when the feature data D3 includes multiple feature data (or multiple vector representations), multiple feature data of the same feature category as the feature data D3 can be determined in the feature data D2, and then the similarity S2 between the feature data D3 and the feature data (or vector representations) corresponding to the same feature category in the multiple feature data (or multiple vector representations corresponding to the multiple feature data) is determined, and then based on each similarity S2, the similarity S3 between the feature data D3 and the multiple feature data (or the multiple vector representations) is calculated, and when the similarity S3 reaches the similarity threshold, it is determined that the feature data D3 matches the multiple feature data (or the multiple vector representations). Wherein, when calculating the similarity S3, for example, the average value of each similarity S2 can be used as the similarity S3; or, when the first feature library is configured with weight values ​​corresponding to each feature category involved, each similarity S2 is weighted and summed based on the weight value to obtain the similarity S3.

[0039] When calculating the similarity S1 or the similarity S2 as described above, an existing similarity calculation algorithm may be used, such as a cosine similarity or a Jaccard similarity coefficient.

[0040] Next, in step S305, it is determined whether there is any injection behavior in the image acquisition process P2 according to the determination result.

[0041] Specifically, if the determination result of step S303 is yes, it can be determined that there is injection behavior in the image acquisition process P2. If the determination result of step S303 is no, if there are other feature libraries in the constructed feature libraries whose feature categories are subsets of the feature categories corresponding to the feature data D2, it can be determined whether there is injection behavior in the image acquisition process P2 by matching the feature data D2 with the feature data in the other feature library; if the other feature library does not exist in the constructed feature libraries, it can be determined that there is no injection behavior in the image acquisition process P2.

[0042] In one embodiment, in order to expand the feature data in the feature library and realize continuous updating of the feature library, when it is determined that there is injection behavior in the image acquisition process P2, when the feature data D2 and the feature data D3 matched therewith are not completely the same, the feature data D2 can be considered to be a new feature or a new variant of an existing feature, so that the feature data D2 can be stored in the first feature library. Furthermore, in order to ensure the validity of the feature data in the feature library, before the feature data D2 is stored in the first feature library, the audit information including the feature data D2 can be provided to the auditor. Based on this, after receiving the audit result returned by the auditor to indicate that the feature data D2 is to be added to the first feature library, the feature data D2 can be stored in the first feature library.

[0043] exist Figure 3 In the corresponding embodiment, feature data D2 can be obtained when the user device performs the image acquisition process P2, which at least includes sensor feature data corresponding to the target sensor in the user device, and the target sensor is used to sense the movement of the user device, and then determine whether there is feature data D3 matching the feature data D2 in the first feature library, and then determine whether there is injection behavior in the image acquisition process P2 based on the determination result. Since the sensor feature data corresponding to the target sensor is related to the user behavior, it is not easy to forge, and the cost of forging is high. Therefore, when criminals carry out batch injection attacks, such sensor feature data is generally limited. By using such sensor feature data for injection attack detection, effective injection attack detection of image acquisition behavior can be achieved.

[0044] In one embodiment, in the process of constructing multiple feature libraries as described above, for each feature data D1 as described above, and a feature library in which each feature category involved in the multiple feature libraries is a subset of each feature category corresponding to the feature data D1, when storing several feature data in the feature data D1 corresponding to each feature category involved in the feature library into the feature library, a data sequence composed of the several feature data, a vector representation of the data sequence, and any item in a vector representation sequence composed of the vector representations of each feature data in the data sequence can be specifically stored in the feature library.

[0045] Based on this, in the injection attack detection stage, feature data D2 can be obtained when the user device performs the image acquisition process P2, which at least includes sensor feature data corresponding to the target sensor in the user device, and the target sensor is used to sense the movement of the user device. Afterwards, a data sequence V1 containing the sensor feature data can be constructed based on the feature data D2. For example, for several feature libraries that have been constructed and each feature category involved is a subset of each feature category corresponding to the feature data D2, a feature library in the several feature libraries can be used as the first feature library. For the convenience of description, the data sequence in the first feature library is referred to as data sequence D3 below. When constructing the data sequence V1, several feature data items corresponding to each feature category involved in the first feature library in the feature data D2 can be used to form a data sequence V1 with the same structure as each data sequence D3 in the first feature library. Among them, the same structure can refer to consistency in dimensions and arrangement methods. Then, it can be determined whether there is a data sequence D3 matching the data sequence V1 in the first feature library. Then, based on the determination result, it can be determined whether there is an injection behavior in the image acquisition process P2.

[0046] Furthermore, before starting to construct the multiple feature libraries as described above, multiple data combination strategies corresponding to the multiple feature libraries can be configured, and each data combination strategy includes each feature category involved in the corresponding feature library. Thus, in the feature library construction stage, for each feature data D1 as described above, a data combination strategy in which each feature category included is a subset of each feature category corresponding to the feature data D1 can be determined from the preset multiple data combination strategies, and then the data combination strategy is used to construct a data sequence according to the feature data D1, such as generating a data sequence according to a number of feature data in the feature data D1 corresponding to each feature category included in the data combination strategy, and storing the data sequence in the feature library corresponding to the data combination strategy.

[0047] In practice, each feature data in the feature data D1 may include a timestamp, and the data combination strategy may indicate that the timestamps are sorted in ascending order. Based on this, the data sequence constructed using the data combination strategy may be a time series. When storing the time series in the feature library corresponding to the data combination strategy, in order to facilitate subsequent matching operations, for example, the Time2Vec encoding method may be used to convert the time series into a vector representation, and then the vector representation is stored in the feature library; or, each feature data in the time series is converted into a vector representation, respectively, to obtain a vector representation sequence, and the vector representation sequence is stored in the feature library.

[0048] Time2Vec is a special encoding method that aims to capture the periodicity and patterns of time series data, converting timestamps into vector representations that can capture the complexity of the time dimension. Unlike traditional time encodings such as sine and cosine functions, Time2Vec allows the model to decide how to best represent time information through learning. The layer of Time2Vec can be used as an embedding layer based on time series or as a preprocessing module alone. The formula for Time2Vec can be as shown in formula (1):

[0049]

[0050] Where k is the Time2Vec dimension; τ is the original time series feature; F is the periodic activation function; w and is a set of learnable parameters, i.e., the concept of weight coefficients in the embedding layer of Time2Vec. In the experiment, in order to enable the algorithm to capture the periodic behavior in the data, F is selected as a sine function. At the same time, the linear term (corresponding to the formula corresponding to i=0) represents the non-periodic process of time, which is used to capture the non-periodic pattern in the time input.

[0051] In the case where the above-mentioned multiple feature libraries correspond to multiple preset data combination strategies, when constructing the data sequence V1 according to the feature data D2, in one embodiment, a data combination strategy can be selected from the multiple data combination strategies, and each feature category included in the data combination strategy is a subset of each feature category corresponding to the feature data D2. Afterwards, the data sequence V1 is constructed according to the feature data D2 using the data combination strategy. In addition, the feature library corresponding to the data combination strategy is also used as the first feature library.

[0052] Considering that the more types of feature data involved in matching, the more accurate the matching result, in another embodiment, the following can be performed: Figure 4 Step S403 shown in FIG. 4 constructs a data sequence V1. Figure 4is another flow chart of the method for detecting injection attacks in an embodiment of the present specification. The method can be performed by any device with computing and processing capabilities (such as the user device in step S401 below, or a server communicating with the user device, etc.), platform or device cluster, and includes steps S401-S409 as shown below.

[0053] like Figure 4 As shown, in step S401, feature data D2 is obtained when the user device performs the image acquisition process P2, which is acquired based on multiple preset feature categories and at least includes sensor feature data corresponding to the target sensor in the user device, the target sensor is used to sense the movement of the user device, and the sensor feature data corresponds to the first feature category among the multiple feature categories.

[0054] For the explanation of step S401, please refer to the relevant description in the previous text, which will not be repeated here.

[0055] Next, in step S403, in response to the existence of a first strategy among the preset multiple data combination strategies, the first strategy is used to construct a data sequence V1 according to the feature data D2; wherein the multiple data combination strategies all include a first feature category, and the included feature categories are not completely the same, and correspond to different feature libraries, and the data sequences in the different feature libraries correspond to the image acquisition process P1 in which the injection behavior exists; the feature categories included in the first strategy are the same as the feature categories corresponding to the feature data D2.

[0056] Next, in step S405, the feature library corresponding to the first strategy is used as the first feature library.

[0057] Next, in step S407, it is determined whether there is a data sequence D3 matching the data sequence V1 in the first feature library.

[0058] Specifically, in one embodiment, each data sequence D3 in the first feature library can be matched with the data sequence V1 in turn until a data sequence D3 matching the data sequence V1 is determined, or it is determined that each data sequence D3 does not match the data sequence V1. In another embodiment, in order to effectively improve the matching efficiency, in the feature library construction stage, each data sequence in each constructed feature library can be clustered to divide the data sequence into multiple clusters; based on this, it can be determined whether there is a data sequence D3 matching the data sequence V1 in the data sequence D3 as the center point of each cluster of the first feature library.

[0059] It should be noted that when the data sequence D3 in the first feature library is matched with the data sequence V1, as a matching operation mode, the similarity S1 between the data sequence D3 and the data sequence V1 can be determined, and when the similarity S1 reaches the similarity threshold, the data sequence D3 and the data sequence V1 are determined to match. Further, if the data sequence D3 is a vector representation D3, the similarity S1 between the vector representation D3 and the vector representation of the data sequence V1 can be calculated.

[0060] In order to improve the matching accuracy, as another matching operation mode, when the first feature library involves multiple feature categories and is configured with weight values ​​corresponding to each of the multiple feature categories, the similarity S2 between the feature data corresponding to the same feature category in the data sequence D3 and the data sequence V1 can be determined, and the weighted sum of each similarity S2 is performed based on the weight value to obtain the similarity S3, and in response to the similarity S3 reaching the similarity threshold, it is determined that the data sequence D3 matches the data sequence V1. Further, when the data sequence D3 is specifically a vector representation sequence D3, each feature data in the data sequence V1 can be converted into a vector representation, thereby obtaining a vector representation sequence corresponding to the data sequence V1, and then the similarity S2 between the vector representation sequence D3 and the vector representation sequence corresponding to the data sequence V1 is calculated.

[0061] Next, in step S409, it is determined whether there is any injection behavior in the image acquisition process P2 according to the determination result.

[0062] For the explanation of step S409, please refer to the relevant description of step S305 in the previous text, which will not be repeated here.

[0063] Figure 4 The solution provided by the corresponding embodiment can use the first strategy to construct a data sequence V1 according to the feature data D2 when there is a first strategy in the preset multiple data combination strategies, and use the feature library corresponding to the first strategy as the first feature library, and then detect whether there is injection behavior in the image acquisition process P2 by matching the data sequence V1 with the data sequence D3 in the first feature library. This detection process can effectively improve the accuracy of the detection results and realize effective injection attack detection on image acquisition behavior.

[0064] In one embodiment, in order to expand the data sequences of the above-mentioned multiple feature libraries and realize continuous updating of the feature libraries, when it is determined that there is injection behavior in the image acquisition process P2, when the data sequence V1 as mentioned above and the data sequence D3 matched therewith are not completely the same, the data sequence V1 can be considered to be a new feature or a new variant of an existing feature, so that the data sequence V1 can be stored in the first feature library. For example, the vector representation of the data sequence V1 can be stored in the first feature library, or the vector representation sequence composed of the vector representations of each feature data in the data sequence V1 can be stored in the first feature library. Further, in order to ensure the validity of the data sequence in the feature library, before the data sequence V1 is stored in the first feature library, the audit information including the data sequence V1 can be provided to the auditor. Based on this, after receiving the audit result returned by the auditor to indicate that the data sequence V1 is added to the first feature library, the data sequence V1 can be stored in the first feature library.

[0065] Furthermore, in the case where the feature data D2 includes multiple feature data, when or after the data sequence V1 is stored in the first feature library, a data sequence V2 including sensor feature data can be constructed based on the feature data D2, which is not completely the same as the feature data included in the data sequence V1, and then the data sequence V2 is stored in the second feature library, wherein each data sequence in the second feature library has the same structure as the data sequence V2. For example, in the case where the data sequence V1 is constructed using the first strategy, the second strategy can be determined from the above-mentioned multiple data combination strategies, and the second strategy can be used to construct the data sequence V2 based on the feature data D2, and the feature library corresponding to the second strategy can be determined as the second feature library. Among them, each feature category included in the second strategy is a true subset of each feature category corresponding to the feature data D2.

[0066] Figure 5 Schematic diagram of the structure of the device for detecting injection attacks in the embodiment of this specification. The device can be applied to any device, platform or device cluster with computing and processing capabilities. The device can execute as follows Figure 3 , Figure 4 The method described herein comprises: an acquisition unit 501, configured to acquire first feature data when a user device performs a first image acquisition process, wherein the first feature data at least includes sensor feature data corresponding to a target sensor in the user device, and the target sensor is used to sense the movement of the user device; a first determination unit 502, configured to determine whether there is second feature data matching the first feature data in the first feature library, and the second feature data corresponds to a second image acquisition process in which an injection behavior exists; and a second determination unit 503, configured to determine whether there is an injection behavior in the first image acquisition process according to the determination result of the first determination unit 502.

[0067] The present specification also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute the following Figure 3 , Figure 4 Describe the method.

[0068] The embodiment of the present specification also provides a computing device, including a memory and a processor, wherein the memory stores an executable code, and when the processor executes the executable code, the following is implemented: Figure 3 , Figure 4 Describe the method.

[0069] The embodiments of the present specification also provide a computer program product, including a computer program / instruction, which is executed by a processor to implement the following Figure 3 , Figure 4 Describe the steps of the method.

[0070] In the 1990s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the method flow). However, with the development of technology, many improvements to the method flow today can be regarded as direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0071] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0072] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, the present application does not exclude that with the development of computer technology in the future, the computer that implements the functions of the above embodiments may be, for example, a personal computer, a laptop computer, a vehicle-mounted human-computer interaction device, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0073] Although one or more embodiments of the present specification provide method operation steps as described in the embodiments or flow charts, more or less operation steps may be included based on conventional or non-creative means. The order of steps listed in the embodiments is only one way of executing the order of many steps, and does not represent the only execution order. When the device or terminal product in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiments or the drawings (for example, a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment). The term "include", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, product or equipment including a series of elements includes not only those elements, but also includes other elements that are not explicitly listed, or also includes elements inherent to such a process, method, product or equipment. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or equipment including the elements. For example, if the words first, second, etc. are used to represent the name, they do not represent any specific order.

[0074] For the convenience of description, the above devices are described in various modules according to their functions. Of course, when implementing one or more of the present specification, the functions of each module can be implemented in the same or more software and / or hardware, or the module implementing the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0075] The present invention is described with reference to flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0076] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0077] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0078] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0079] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0080] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage, graphene storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0081] It should be understood by those skilled in the art that one or more embodiments of the present specification may be provided as a method, system or computer program product. Therefore, one or more embodiments of the present specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, one or more embodiments of the present specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0082] One or more embodiments of the present specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. One or more embodiments of the present specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0083] Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. In the description of this specification, the description of the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of this specification. In this specification, the schematic representation of the above terms does not necessarily target the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples without contradiction.

[0084] The above description is only an example of one or more embodiments of the present specification and is not intended to limit one or more embodiments of the present specification. For those skilled in the art, one or more embodiments of the present specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification shall be included in the scope of the claims.

Claims

1. A method for detecting an injection attack, comprising: Acquire first feature data when the user device performs a first image acquisition process, wherein the first feature data at least includes sensor feature data corresponding to a target sensor in the user device, where the target sensor is used to sense movement of the user device; Determine whether there is second feature data matching the first feature data in the first feature library, the second feature data corresponding to a second image acquisition process in which an injection behavior occurs; According to the determination result, it is determined whether there is injection behavior in the first image acquisition process.

2. The method according to claim 1, further comprising: constructing a first data sequence including the sensor characteristic data according to the first characteristic data; The determining whether there is second feature data matching the first feature data in the first feature library includes: Determine whether there is a second data sequence matching the first data sequence in the first feature library; wherein each second data sequence in the first feature library has the same structure as the first data sequence.

3. The method according to claim 2, wherein: The first feature data is collected based on a plurality of preset feature categories, and the sensor feature data corresponds to a first feature category among the plurality of feature categories; the first feature category is included in a plurality of preset data combination strategies, and the feature categories included in the plurality of data combination strategies are not completely the same and correspond to different feature libraries; The step of constructing a first data sequence including the sensor characteristic data according to the first characteristic data comprises: In response to the presence of a first strategy among the plurality of data combination strategies, constructing the first data sequence according to the first feature data using the first strategy; wherein each feature category included in the first strategy is the same as each feature category corresponding to the first feature data; The method further comprises: The feature library corresponding to the first strategy is used as the first feature library.

4. The method according to claim 2, wherein: The first feature library involves multiple feature categories and is configured with weight values ​​corresponding to the multiple feature categories respectively; The determining whether there is a second data sequence matching the first data sequence in the first feature library includes: For a second data sequence in the first feature library, a first similarity between the second data sequence and feature data corresponding to the same feature category in the first data sequence is determined, and a weighted sum of each first similarity is performed based on the weight value to obtain a second similarity, and in response to the second similarity reaching a similarity threshold, it is determined that the second data sequence matches the first data sequence.

5. The method according to claim 1 or 2, wherein: Each second feature data in the first feature library is divided into a plurality of clusters; The determining whether there is second feature data matching the first feature data in the first feature library includes: It is determined whether there is second feature data matching the first feature data in the second feature data as the center point of each of the plurality of clusters.

6. The method according to claim 2, wherein: In the case where it is determined that the first image acquisition process has an injection behavior, the method further includes: In response to the first data sequence being not completely identical to the matched second data sequence, the first data sequence is stored in the first feature library.

7. The method according to claim 6, wherein: The storing the first data sequence into the first feature library comprises: storing the vector representation of the first data sequence in the first feature library; or, A vector representation sequence composed of the vector representations of each feature data in the first data sequence is stored in the first feature library.

8. The method according to claim 6, wherein: The first characteristic data includes multiple characteristic data; When or after storing the first data sequence in the first feature library, the method further includes: constructing, according to the first characteristic data, a third data sequence including the characteristic data of the sensor, which is not completely the same as the characteristic data included in the first data sequence; The third data sequence is stored in a second feature library; wherein each fourth data sequence in the second feature library has the same structure as the third data sequence.

9. The method according to claim 6, wherein: Before storing the first data sequence in the first feature library, the method further includes: Providing audit information including the first data sequence to an auditor; Receive the audit result returned by the auditor, which is used to instruct to add the first data sequence to the first feature library.

10. The method according to claim 1, wherein: The sensor characteristic data includes at least one of the following: device posture information and device motion data.

11. The method according to claim 1, wherein: The first image acquisition process involves acquiring an image of a target certificate, the first feature data further includes certificate attribute feature data corresponding to the target certificate, and the acquisition process of the certificate attribute feature data includes: In the process of the user device capturing an image of the target certificate, in response to acquiring an image frame captured by the user device, performing certificate detection on the image frame using a certificate detection model to obtain a first detection result; In response to the first detection result indicating that the document exists in the image frame and includes an initial position of the document, extracting a document area from the image frame based on the initial position, and generating a document image based on the document area; Performing document attribute detection on the document image using a document attribute detection model to obtain a second detection result, which includes a plurality of document attribute features; After determining that the document image quality is qualified based on the second detection result, at least part of the document attribute features among the plurality of document attribute features are combined into the document attribute feature data.

12. The method according to claim 11, wherein: The document attribute feature data includes at least one of the following: document position, angle feature, clarity value, brightness value, integrity value, and the distance from the target document to the user device.

13. The method according to claim 1 or 11, wherein: The first characteristic data also includes at least one of the following items corresponding to the user equipment: GPS information and equipment model information.

14. A device for detecting injection attacks, comprising: an acquisition unit, configured to acquire first feature data when the user device performs a first image acquisition process, wherein the first feature data at least includes sensor feature data corresponding to a target sensor in the user device, wherein the target sensor is used to sense a movement of the user device; A first determining unit is configured to determine whether there is second feature data matching the first feature data in the first feature library, the second feature data corresponding to a second image acquisition process in which an injection behavior exists; The second determining unit is configured to determine whether there is injection behavior in the first image acquisition process according to the determination result of the first determining unit.

15. A computer program product, comprising a computer program / instruction, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 13.

16. A computing device, comprising a memory and a processor, wherein the memory stores executable codes, and when the processor executes the executable codes, the method according to any one of claims 1 to 13 is implemented.

Images