Abnormal behavior detection method and device, electronic equipment and storage medium

Abstract

The invention provides an abnormal behavior detection method and device, electronic equipment and a storage medium, and the method comprises the steps: collecting equipment data, user image data and user operation data in real time in a set time period, and the set time period is a moment from the time when the equipment receives a verification request sent by a user to the time when the equipment receives a verification ending request sent by the user; performing feature extraction on the equipment data, the user image data and the user operation data to obtain feature data; and determining an abnormal behavior level of the user according to the feature data and a feature and behavior mapping rule base.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an abnormal behavior detection method, device, electronic device and storage medium. Background Art

[0002] With the widespread use of mobile devices in areas such as financial transactions, information verification technologies that rely on mobile device cameras, such as identity document recognition and face recognition, are becoming increasingly important. However, with the continuous development of hacker technology, malicious users can hijack the camera by controlling the device, thereby bypassing the system's identity document recognition and face recognition, and other information verification that relies on the camera, and conduct identity theft, false transactions, and other activities. Therefore, there is an urgent need for a technical means to effectively detect malicious users who hijack the camera by controlling the device to bypass information verification. Summary of the invention

[0003] The embodiments of the present application provide an abnormal behavior detection method, device, electronic device, and storage medium.

[0004] According to the first aspect of the present application, an abnormal behavior detection method is provided, the method comprising: collecting device data, user image data and user operation data in real time within a set time period, the set time period being the moment when the device receives a verification request sent by the user to the moment when the device receives an end verification request sent by the user; performing feature extraction on the device data, the user image data and the user operation data to obtain feature data; determining the abnormal behavior level of the user based on the feature data and a feature-behavior mapping rule library.

[0005] According to an embodiment of the present application, the feature and behavior mapping rule base includes a normal range of features, an abnormal behavior threshold range and level.

[0006] According to one embodiment of the present application, the feature data includes device feature data, image feature data and operation feature data; accordingly, the feature extraction of the device data, the user image data and the user operation data to obtain the feature data includes: based on multiple device parameter extraction dimensions, feature extraction of the device data to obtain the device feature data, the device feature data includes device parameters corresponding to each device parameter extraction dimension; based on multiple image parameter extraction dimensions, feature extraction of the image data to obtain the image feature data, the image feature data includes image parameters corresponding to each image parameter extraction dimension; based on multiple operation extraction dimensions, feature extraction of the user operation data to obtain the operation feature data, the operation feature data includes user operation actions corresponding to each operation extraction dimension.

[0007] According to one embodiment of the present application, determining the abnormal behavior data of the user based on the feature data and the feature-behavior mapping rule library includes: inputting the operation feature data and the feature-behavior mapping rule library into a first abnormal recognition model, so that the first abnormal recognition model matches multiple user operation actions in the operation feature data with the feature-behavior mapping rule library to obtain the first sub-abnormal behavior level of the user; inputting the image feature data and the device feature data into a second abnormal recognition model, so that the second abnormal recognition model identifies whether multiple image indicators of the image data are within a normal range based on the image feature data and the device feature data to obtain a recognition result, and determining the second sub-abnormal behavior level of the user based on the recognition result; determining the abnormal behavior level of the user based on the first sub-abnormal behavior level and the second sub-abnormal behavior level.

[0008] According to one embodiment of the present application, the multiple device parameter extraction dimensions include a device model extraction dimension and a system version extraction dimension, the multiple image parameter extraction dimensions include a content extraction dimension and an exchangeable image file extraction dimension, and the multiple operation extraction dimensions include a start action extraction dimension, a shooting action extraction dimension, a shooting angle extraction dimension, and an end action extraction dimension; accordingly, the multiple device parameters in the device feature data include a device model and an operating system version; the multiple image parameters in the image data include image content and exchangeable image file information; and the multiple user operation actions in the operation feature data include a start action, a shooting action, a shooting angle, and an end action.

[0009] According to an embodiment of the present application, the method further includes: executing corresponding safety measures operations according to the abnormal behavior level of the user, and the safety measures operations include verification passed, verification failed, and re-verification.

[0010] According to one embodiment of the present application, before performing feature extraction on the device data, the user image data, and the user operation data, the method further includes: encrypting the device data, user image data, and user operation data collected in real time within a set time period based on a set encryption algorithm; when it is necessary to perform feature extraction on the device data, user image data, and user operation data collected within the set time period, using the set encryption algorithm to decrypt the device data, user image data, and user operation data collected within the set time period.

[0011] According to the second aspect of the present application, an abnormal behavior detection device is provided, which includes: an acquisition module, which is used to collect device data, user image data and user operation data in real time within a set time period, and the set time period is the moment when the device receives a verification request sent by the user to the moment when the device receives an end verification request sent by the user; a feature extraction module, which is used to extract features from the device data, the user image data, and the user operation data to obtain feature data; and a determination module, which is used to determine the abnormal behavior level of the user based on the feature data and a feature-behavior mapping rule library.

[0012] According to a third aspect of the present application, an electronic device is provided, including:

[0013] at least one processor; and

[0014] a memory communicatively connected to the at least one processor; wherein,

[0015] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method described in the present application.

[0016] According to a fourth aspect of the present application, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute the method described in the present application.

[0017] The method of the embodiment of the present application collects device data, user image data and user operation data in real time within a set time period, and the set time period is the time from when the device receives the verification request sent by the user to when it receives the end verification request sent by the user; extracts features from the device data, the user image data and the user operation data to obtain feature data; and determines the abnormal behavior level of the user based on the feature data and the feature and behavior mapping rule base. By collecting device data, user operation data and user image data in real time, and combining the feature and behavior mapping rule base to detect the user's abnormal behavior, a timely response to abnormal behavior is guaranteed. At the same time, in order to effectively identify the situation where the camera is bypassed due to the control of the device, device data and user operation data are added on the basis of user image data, so as to combine the analysis of the device data and the user's operation data on the device to effectively identify the abnormal behavior caused by the hijacking of the camera, thereby avoiding the security risks caused by the hijacking of the camera.

[0018] It should be understood that the teachings of the present application are not required to achieve all of the beneficial effects described above, but specific technical solutions can achieve specific technical effects, and other embodiments of the present application can also achieve beneficial effects not mentioned above. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] By reading the detailed description below with reference to the accompanying drawings, the above and other purposes, features and advantages of the exemplary embodiments of the present application will become readily understood. In the accompanying drawings, several embodiments of the present application are shown in an exemplary and non-limiting manner, wherein:

[0020] In the drawings, the same or corresponding reference numerals represent the same or corresponding parts.

[0021] Figure 1 A schematic diagram of the implementation process of the abnormal behavior detection method provided in the embodiment of the present application is shown;

[0022] Figure 2 A schematic diagram of the implementation process of the feature extraction operation of the abnormal behavior detection method provided in the embodiment of the present application is shown;

[0023] Figure 3 A schematic diagram of the implementation flow of an abnormal behavior determination operation of the abnormal behavior detection method provided in an embodiment of the present application is shown;

[0024] Figure 4 A schematic diagram of the structure of an abnormal behavior detection device provided in an embodiment of the present application is shown;

[0025] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0026] In order to make the purpose, features, and advantages of the present application more obvious and easy to understand, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0027] Figure 1 A schematic diagram of the implementation process of the abnormal behavior detection method provided in an embodiment of the present application is shown.

[0028] refer to Figure 1 , an embodiment of the present application provides an abnormal behavior detection method, the method comprising:

[0029] Operation 101 : collecting device data, user image data and user operation data in real time within a set period of time, wherein the set period of time is the time from when the device receives a verification request sent by the user to when the device receives an end verification request sent by the user.

[0030] The executor of the embodiment of the present application is an electronic device, which may include but is not limited to terminal devices such as mobile phones, tablets, and computers. When the device receives a verification request sent by a user, it starts to collect its own device data, user image data, and user operation data in real time, and ends the real-time collection when it receives an end verification request sent by the user. Among them, the device receiving the verification request and ending the verification request can be regarded as the device receiving a specific operation performed by the user. For example, when a verification button is displayed on the device interface, the user's first click on the verification button is regarded as the device receiving the verification request, and the user clicking it again is regarded as receiving the end verification request.

[0031] In this embodiment of the present application, user image data is collected by the device based on its own camera, and the user image data can be regarded as the image taken by the camera. The device data and user operation data are collected by the device based on various internal sensors, controllers and recording modules. The device data can be regarded as the basic data and operation data of the device, and the user operation data can be regarded as the user's operation on the device.

[0032] Operation 102 : extracting features from the device data, the user image data, and the user operation data to obtain feature data.

[0033] After receiving the device data, image data, and user operation data, it is necessary to extract features from the data to retain the data that is needed and eliminate the data that is not needed.

[0034] In one embodiment of the present application, after feature extraction, integrity verification is performed on the data after feature extraction, and feature data is obtained when the integrity verification passes.

[0035] In order to ensure that the collected data is not missing, the data integrity is verified after feature extraction. If the integrity verification passes, the data after feature extraction is determined as feature data. If the integrity verification fails, data supplementation is required until the data integrity verification passes after supplementation.

[0036] Operation 103 : determining the abnormal behavior level of the user according to the feature data and the feature-behavior mapping rule base.

[0037] In one embodiment of the present application, the feature-behavior mapping rule base includes a normal range of features, an abnormal behavior threshold range and level.

[0038] Feature data includes various features extracted from device data, user operation data, and user image data. The feature and behavior mapping rule base is developed based on a deep understanding of normal and abnormal behaviors, which sets the normal range of various features, the threshold range of abnormal behaviors, and the classification of abnormal levels.

[0039] After obtaining the feature data, the deep learning model is used to analyze the feature data and the feature-behavior mapping rule base. By comparing the difference between the actual feature and the normal feature range, and whether it exceeds the threshold of abnormal behavior, it is determined whether the behavior is abnormal, and the corresponding abnormal behavior level can be obtained. The abnormal behavior level is used to show the degree of abnormality of the behavior, which can be divided into abnormal levels such as non-existent, mild, moderate and severe. The degree can also be divided according to the numerical range. For example, a specific value within 1 to 100 can also be used as the abnormality level. The higher the value, the higher the abnormality level.

[0040] Among them, the deep learning model can be a convolutional network model, and the model training process can refer to the conventional convolutional network model training process, which will not be repeated in this application.

[0041] Therefore, the embodiment of the present application ensures timely response to abnormal behavior by collecting device data, user operation data and user image data in real time, and detecting abnormal user behavior in combination with a feature and behavior mapping rule library. At the same time, in order to effectively identify situations where the camera is bypassed due to device control, device data and user operation data are added on the basis of user image data, so as to combine the analysis of device data and user operation data of the device to effectively identify abnormal behavior caused by camera hijacking, thereby avoiding security risks caused by camera hijacking.

[0042] Figure 2 A schematic diagram of the implementation flow of the feature extraction operation of the abnormal behavior detection method provided in an embodiment of the present application is shown.

[0043] refer to Figure 2 In one embodiment of the present application, the feature data includes device feature data, image feature data and operation feature data. The above operation 102 extracts features from the device data, user image data and user operation data to obtain feature data, including:

[0044] Operation 201, based on multiple device parameter extraction dimensions, feature extraction is performed on device data to obtain device feature data, where the device feature data includes device parameters corresponding to each device parameter extraction dimension;

[0045] Operation 202, performing feature extraction on the image data based on the multiple image parameter extraction dimensions to obtain image feature data, where the image feature data includes image parameters corresponding to each image parameter extraction dimension;

[0046] Operation 203 : performing feature extraction on the user operation data based on the multiple operation extraction dimensions to obtain operation feature data, where the operation feature data includes the user operation action corresponding to each operation extraction dimension.

[0047] In one embodiment of the present application, multiple device parameter extraction dimensions include a device model extraction dimension and a system version extraction dimension, multiple image parameter extraction dimensions include a content extraction dimension and an exchangeable image file extraction dimension, and multiple operation extraction dimensions include a start action extraction dimension, a shooting action extraction dimension, a shooting angle extraction dimension, and an end action extraction dimension; accordingly, the multiple device parameters in the device feature data include the device model and the operating system version; the multiple image parameters in the image data include image content and exchangeable image file information; and the multiple user operation actions in the operation feature data include a start action, a shooting action, a shooting angle, and an end action.

[0048] For device data, user image data, and user operation data, multiple feature extraction dimensions are configured in advance with reference to the needs of abnormal behavior detection.

[0049] For device data, taking into account the different requirements for abnormal behavior detection under different devices, the feature extraction dimensions of device data can include device model extraction dimension and system version extraction dimension. Accordingly, after receiving real-time device data, only the device model and operating system version need to be extracted from the device data.

[0050] For image data, the image data usually includes image content and EXIF ​​(Exchangeable Image FileFormat) information. Therefore, the image content extraction dimension and the EXIF ​​extraction dimension can be configured in advance. After receiving the data, the corresponding image content and exchangeable image file information can be extracted.

[0051] For the operation feature data, the operations involved in the verification process mainly include starting action, shooting action, shooting angle and ending action. Therefore, the starting action extraction dimension, shooting action extraction dimension, shooting angle extraction dimension and ending action extraction dimension can be configured in advance. After receiving the operation feature data, the corresponding starting action, shooting action, shooting angle and ending action are extracted.

[0052] Figure 3 A schematic diagram of the implementation flow of the abnormal behavior determination operation of the abnormal behavior detection method provided in an embodiment of the present application is shown.

[0053] refer to Figure 3 In one embodiment of the present application, the above operation 103, determining the abnormal behavior data of the user according to the feature data and the feature and behavior mapping rule library, includes:

[0054] Operation 301, inputting the operation feature data and the feature-behavior mapping rule base into the first abnormality recognition model, so that the first abnormality recognition model matches multiple user operation actions and features in the operation feature data with the behavior mapping rule base to obtain a first sub-abnormal behavior level of the user;

[0055] Operation 302, inputting the image feature data and the device feature data into a second abnormality recognition model, so that the second abnormality recognition model recognizes whether multiple image indicators of the image data meet a normal range according to the image feature data and the device feature data, obtains a recognition result, and determines a second sub-abnormal behavior level of the user according to the recognition result;

[0056] Operation 303: determining an abnormal behavior level of the user according to the first abnormal behavior sub-level and the second abnormal behavior sub-level.

[0057] In order to avoid the problem that the rule base may be cracked due to the use of the rule base for all data, the rule base may be used to detect only the user operation data, while other detection methods may be used for the user image data and device data.

[0058] In this embodiment of the present application, the feature and behavior mapping rule base only analyzes the normal range of user operation actions, the abnormal behavior threshold range and level for user operation actions based on historical data.

[0059] For the obtained operation feature data, the operation feature data and the feature and behavior mapping rule library are input into the first abnormality recognition model. The first abnormality recognition model determines whether the behavior is abnormal by identifying the difference between the user operation action and the normal range of the user operation action and whether it exceeds the threshold of abnormal behavior, and gives a corresponding abnormal behavior level.

[0060] For image data, it is not necessary to use the rule base for detection, and the second abnormal behavior recognition model can be used directly for detection. In order to consider the different requirements of different devices for image data, it is necessary to combine the image data and the device data for image data detection. Specifically, the image feature data and the device feature data are input into the second abnormal recognition model. The second abnormal recognition model identifies whether multiple image indicators of the image data are within the normal range based on the image feature data and the device feature data, obtains the recognition result, and determines the second sub-abnormal behavior level of the user based on the recognition result. Among them, the multiple image indicators can include indicators such as image quality, angle, and distance.

[0061] In one embodiment of the present application, the first abnormality recognition model and the second abnormality recognition model are both obtained through training based on a CNN (Convolutional Neural Network) model. For the specific training process, reference may be made to the conventional convolutional neural network training process, which will not be described in detail here.

[0062] After obtaining the first sub-abnormal behavior level and the second sub-abnormal behavior level, if one of the two is abnormal, the final abnormal behavior level is determined to be abnormal, and the final abnormal behavior level can be determined based on a random combination of the two, which will not be described in detail here. The level division of the first sub-abnormal behavior level and the second sub-abnormal behavior level can refer to the above-mentioned abnormal behavior level division method, which will not be described in detail here.

[0063] In one embodiment of the present application, corresponding safety measures operations are also performed according to the abnormal behavior level of the user, and the safety measures operations include verification passed, verification failed, and re-verification.

[0064] After obtaining the user's final abnormal behavior level, the user verification result needs to be fed back, that is, the corresponding safety measure operation is executed. Among them, the safety measure operation can be divided into verification passed, verification failed, and re-verification according to the abnormal behavior level. For example, if the abnormal behavior level shows that there is no abnormal behavior, the verification is passed; if the abnormal behavior level shows that it is mild, the verification is repeated; if the abnormal behavior level shows that it is moderate or severe, the verification is failed.

[0065] In one implementation of the present application, in order to optimize the feature-behavior mapping rule base and recognition model involved in the solution of the present application, each abnormal behavior detection process is also recorded.

[0066] In one embodiment of the present application, before feature extraction is performed on the device data, user image data, and user operation data, the method further includes: encrypting the device data, user image data, and user operation data collected in real time within a set time period based on a set encryption algorithm; when feature extraction is required for the device data, user image data, and user operation data collected within the set time period, decrypting the device data, user image data, and user operation data collected within the set time period using the set encryption algorithm.

[0067] In order to ensure the security of data collected by the device during data transmission within the device, the device also has a built-in encryption algorithm. After the device collects data, the built-in encryption algorithm is used to encrypt the collected data, and the encryption algorithm is used to decrypt the data when it needs to be used.

[0068] In one implementation of the present application, the encryption algorithm may be set to RSA (Rivest-Shamir-Adleman, an asymmetric encryption algorithm).

[0069] Figure 4 A schematic diagram of the structure of an abnormal behavior detection device provided in an embodiment of the present application is shown.

[0070] refer to Figure 4 Based on the above abnormal behavior detection method, the embodiment of the present application also provides an abnormal behavior detection device, which includes: a collection module 401, which is used to collect device data, user image data and user operation data in real time within a set time period, and the set time period is the moment when the device receives the verification request sent by the user to the moment when the device receives the end verification request sent by the user; a feature extraction module 402, which is used to extract features from the device data, user image data, and user operation data to obtain feature data; a determination module 403, which is used to determine the user's abnormal behavior level based on the feature data and the feature and behavior mapping rule library.

[0071] In one embodiment of the present application, feature data includes device feature data, image feature data and operation feature data; accordingly, feature extraction module 402 includes: a first feature extraction submodule, used to perform feature extraction on device data based on multiple device parameter extraction dimensions to obtain device feature data, the device feature data including device parameters corresponding to each device parameter extraction dimension; a second feature extraction submodule, used to perform feature extraction on image data based on multiple image parameter extraction dimensions to obtain image feature data, the image feature data including image parameters corresponding to each image parameter extraction dimension; a third feature extraction submodule, used to perform feature extraction on user operation data based on multiple operation extraction dimensions to obtain operation feature data, the operation feature data including user operation actions corresponding to each operation extraction dimension.

[0072] In one embodiment of the present application, the determination module 403 includes: a first input submodule, used to input the operation feature data and the feature and behavior mapping rule library into the first abnormal recognition model, so that the first abnormal recognition model matches the multiple user operation actions and features in the operation feature data with the behavior mapping rule library to obtain the user's first sub-abnormal behavior level; a second input submodule, used to input the image feature data and the device feature data into the second abnormal recognition model, so that the second abnormal recognition model identifies whether the multiple image indicators of the image data are within the normal range based on the image feature data and the device feature data, obtains the recognition result, and determines the user's second sub-abnormal behavior level based on the recognition result; a determination submodule, used to determine the user's abnormal behavior level based on the first sub-abnormal behavior level and the second sub-abnormal behavior level.

[0073] In one embodiment of the present application, the device further includes: an execution module, which is used to execute corresponding safety measures operations according to the abnormal behavior level of the user, and the safety measures operations include verification passed, verification failed, and re-verification.

[0074] In one embodiment of the present application, the device also includes: an encryption module, which is used to encrypt the device data, user image data and user operation data collected in real time within a set time period based on a set encryption algorithm; a decryption module, which is used to decrypt the device data, user image data and user operation data collected within the set time period using the set encryption algorithm when feature extraction of the device data, user image data and user operation data collected within the set time period is required.

[0075] It should be noted that the description of the device in the embodiment of the present application is similar to the description of the method embodiment above, and has similar beneficial effects as the method embodiment, so it will not be repeated. Figures 1 to 3 The present invention can be understood by referring to the description of any one of the accompanying drawings.

[0076] According to an embodiment of the present application, the present application also provides an electronic device and a non-transitory computer-readable storage medium.

[0077] Figure 5 A schematic block diagram of an example electronic device 50 that can be used to implement an embodiment of the present application is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or required herein.

[0078] like Figure 5 As shown, the electronic device 50 includes a computing unit 501, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 502 or a computer program loaded from a storage unit 508 into a random access memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the electronic device 50 can also be stored. The computing unit 501, the ROM 502, and the RAM 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0079] A number of components in the electronic device 50 are connected to the I / O interface 505, including: an input unit 506, such as a keyboard, a mouse, etc.; an output unit 507, such as various types of displays, speakers, etc.; a storage unit 508, such as a disk, an optical disk, etc.; and a communication unit 509, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 509 allows the electronic device 50 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0080] The computing unit 501 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 501 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 501 performs the various methods and processes described above, such as the abnormal behavior detection method. For example, in some embodiments, the abnormal behavior detection method may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 508. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 50 via the ROM 502 and / or the communication unit 509. When the computer program is loaded into the RAM 503 and executed by the computing unit 501, one or more steps of the abnormal behavior detection method described above may be performed. Alternatively, in other embodiments, the computing unit 501 may be configured to perform the abnormal behavior detection method in any other appropriate manner (e.g., by means of firmware).

[0081] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0082] The program code for implementing the method of the present application can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, implements the functions / operations specified in the flow chart and / or block diagram. The program code can be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0083] In the context of the present application, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0084] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0085] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0086] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0087] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this application can be executed in parallel, sequentially or in different orders, as long as the expected results of the technical solution disclosed in this application can be achieved, and this document is not limited here.

[0088] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for detecting abnormal behavior, characterized in that: The method comprises: Collect device data, user image data and user operation data in real time within a set period of time, wherein the set period of time is the time when the device receives a verification request sent by the user to the time when the device receives an end verification request sent by the user; Extracting features from the device data, the user image data, and the user operation data to obtain feature data; The abnormal behavior level of the user is determined according to the feature data and a feature-behavior mapping rule base.

2. The method according to claim 1, characterized in that The feature and behavior mapping rule base includes a normal range of features, an abnormal behavior threshold range and level.

3. The method according to claim 1, characterized in that The characteristic data includes device characteristic data, image characteristic data and operation characteristic data; accordingly, The extracting features of the device data, the user image data, and the user operation data to obtain feature data includes: Based on multiple device parameter extraction dimensions, feature extraction is performed on the device data to obtain the device feature data, where the device feature data includes device parameters corresponding to each device parameter extraction dimension; Based on a plurality of image parameter extraction dimensions, feature extraction is performed on the image data to obtain the image feature data, wherein the image feature data includes image parameters corresponding to each image parameter extraction dimension; Based on a plurality of operation extraction dimensions, feature extraction is performed on the user operation data to obtain the operation feature data, where the operation feature data includes a user operation action corresponding to each operation extraction dimension.

4. The method according to claim 3, characterized in that The determining the abnormal behavior data of the user according to the feature data and the feature-behavior mapping rule base includes: Inputting the operation feature data and the feature-behavior mapping rule base into a first abnormality recognition model, so that the first abnormality recognition model matches a plurality of user operation actions in the operation feature data with the feature-behavior mapping rule base to obtain a first sub-abnormal behavior level of the user; Inputting the image feature data and the device feature data into a second abnormality recognition model, so that the second abnormality recognition model recognizes whether multiple image indicators of the image data conform to a normal range according to the image feature data and the device feature data, obtains a recognition result, and determines a second sub-abnormal behavior level of the user according to the recognition result; The abnormal behavior level of the user is determined according to the first abnormal behavior sub-level and the second abnormal behavior sub-level.

5. The method according to claim 3, characterized in that: The multiple device parameter extraction dimensions include a device model extraction dimension and a system version extraction dimension, the multiple image parameter extraction dimensions include a content extraction dimension and an exchangeable image file extraction dimension, and the multiple operation extraction dimensions include a start action extraction dimension, a shooting action extraction dimension, a shooting angle extraction dimension, and an end action extraction dimension; accordingly, The multiple device parameters in the device characteristic data include device model and operating system version; The plurality of image parameters in the image data include image content and exchangeable image file information; The multiple user operation actions in the operation feature data include a start action, a shooting action, a shooting angle and an end action.

6. The method according to claim 1, characterized in that The method further comprises: According to the abnormal behavior level of the user, corresponding safety measures operations are performed, and the safety measures operations include verification passed, verification failed, and re-verification.

7. The method according to claim 1, characterized in that Before extracting features from the device data, the user image data, and the user operation data, the method further includes: Encrypt the device data, user image data and user operation data collected in real time within a set period of time based on a set encryption algorithm; When it is necessary to perform feature extraction on the device data, user image data and user operation data collected within the set time period, the set encryption algorithm is used to decrypt the device data, user image data and user operation data collected within the set time period.

8. An abnormal behavior detection device, characterized in that: The device comprises: A collection module, used to collect device data, user image data and user operation data in real time within a set period of time, wherein the set period of time is the time when the device receives a verification request sent by the user to the time when the device receives an end verification request sent by the user; A feature extraction module, used to extract features from the device data, the user image data, and the user operation data to obtain feature data; The determination module is used to determine the abnormal behavior level of the user according to the feature data and the feature-behavior mapping rule base.

9. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to make a computer execute the method according to any one of claims 1 to 7.

Images