Protection system for network security authentication

Abstract

The invention relates to the technical field of network security, and discloses a protection system for network security authentication. The system comprises an identity verification module, a behavior analysis module, a threat detection module, a dynamic encryption module and a response processing module. The identity verification module fuses the multi-modal biological characteristics and dynamic token verification to generate a data set; the behavior analysis module extracts behavior time sequence characteristics by using a space-time convolutional neural network; the threat detection module constructs a topological graph based on the graph attention network to detect abnormity; the dynamic encryption module encrypts communication data by adopting a quantum key distribution and chaos sequence algorithm; and the response processing module generates a response instruction set for safety protection according to reinforcement learning. According to the method, the identity verification accuracy is effectively improved, abnormal behaviors and threats are accurately detected, dynamic encryption and intelligent response are realized, and the network security protection level is remarkably improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a protection system for network security authentication. Background Art

[0002] With the rapid development of information technology, the internet has become deeply embedded in every aspect of social life. Whether it's the daily operations of businesses, the transactions of financial institutions, or personal online social interactions and information storage, all rely heavily on the security of the network environment. However, cybersecurity threats are also increasing, causing significant distress and losses.

[0003] When it comes to identity authentication, traditional methods, such as simple username and password combinations, are extremely weak in security. To make them easier to remember, users often set simple, easy-to-guess passwords, allowing hackers to easily obtain user account information through brute force or dictionary attacks. According to relevant data, online fraud cases caused by stolen passwords are rampant every year, resulting in the loss of personal information and financial assets of a large number of users. Even though some systems have introduced SMS verification codes as a secondary authentication method, their security remains problematic. SMS messages can be intercepted by criminals due to signal interception, rogue base station attacks, and other factors, leading to the leakage of authentication information. While multi-factor authentication is an effective way to improve security, existing multi-factor authentication methods are not yet mature enough in terms of biometric integration technology, unable to fully leverage their advantages and struggling to protect against increasingly sophisticated cyberattacks.

[0004] Behavioral analysis is a crucial component of network security, but current technology has numerous shortcomings. Traditional rule-based behavioral analysis methods are too rigid to adapt to the dynamic changes in the network environment and the emergence of new attack methods. With the continuous expansion of network applications, user behavior patterns are becoming increasingly complex and diverse, and new abnormal behaviors are constantly emerging. Traditional rule bases are unable to update and cover these new situations in a timely manner. Although there has been progress in the application of machine learning algorithms in behavioral analysis, existing models often struggle to effectively extract spatiotemporal features when processing high-dimensional and complex user behavior data. For example, on some large e-commerce platforms, user purchasing behavior is influenced by multiple factors, including time, product category, and price. Existing behavioral analysis models struggle to accurately capture the complex relationships between these factors, resulting in low accuracy in detecting abnormal behavior and an inability to promptly identify potential security threats.

[0005] Threat detection is a key line of defense in network security, but it currently faces severe challenges. Network attacks are becoming increasingly sophisticated and covert. Advanced persistent threat (APT) attacks can remain lurking in systems for extended periods, stealing sensitive information silently. Traditional signature-based threat detection technologies are powerless against these attacks. Because these technologies rely on known attack signatures, they lack the ability to effectively detect unknown attack methods. Zero-day vulnerability attacks are even more difficult to defend against. Once a zero-day vulnerability emerges, the system is completely exposed to attackers before security vendors release corresponding detection rules. As network scale continues to expand, network behavior topology becomes extremely complex. Traditional threat detection algorithms consume significant computing resources when processing large-scale, complex networks, resulting in low detection efficiency and an inability to meet real-time requirements.

[0006] Data encryption is a crucial tool for protecting network data security, but existing encryption technologies have limitations. Traditional symmetric and asymmetric encryption face challenges with key management. Symmetric encryption requires a secure channel for key distribution, otherwise the keys are vulnerable to theft. While asymmetric encryption addresses key distribution issues, it suffers from high computational complexity and slow encryption and decryption speeds, making it difficult to meet the demands of real-time data security. While quantum encryption offers high security, its current high cost and complex implementation when used alone hinder widespread adoption in large-scale network environments.

[0007] When a security threat is detected, a timely and effective response is crucial. However, existing response strategies often lack flexibility and intelligence. Traditional fixed response strategies cannot adapt to the varying types and severity of security threats. For example, in the case of a minor scanning attack, overly aggressive responses (such as directly severing all network connections) can unnecessarily impact normal business operations. In the face of a serious malicious attack, responses may not be timely or effective enough, leading to further losses. Manual intervention in response processing is not only inefficient but also prone to misjudgments, making it difficult to meet the real-time and accuracy requirements of network security. Summary of the Invention

[0008] The purpose of the present invention is to provide a protection system for network security authentication to solve the problems raised in the above background technology.

[0009] To achieve the above-mentioned object, the present invention provides the following technical solutions: a protection system for network security authentication, the system comprising an identity authentication module, a behavior analysis module, a threat detection module, a dynamic encryption module and a response processing module;

[0010] The identity verification module generates a user identity verification data set through multimodal biometric fusion authentication and dynamic token verification, and sends the user identity verification data set to the behavior analysis module; the multimodal biometric fusion authentication specifically includes weighted fusion of fingerprint features, iris features, and voiceprint features, and outputs identity verification confidence data through an adaptive threshold dynamic matching algorithm;

[0011] The behavior analysis module, based on the user identity authentication dataset, uses an abnormal behavior detection model based on a spatiotemporal convolutional neural network to extract user behavior temporal features, generate a behavior analysis feature dataset, and send the behavior analysis feature dataset to the threat detection module;

[0012] The threat detection module applies an abnormal node detection algorithm based on a graph attention network based on the behavior analysis feature dataset to construct a network behavior topology graph, generates a threat detection result dataset through node feature propagation and edge weight optimization, and sends the threat detection result dataset to the dynamic encryption module and the response processing module;

[0013] The dynamic encryption module generates a dynamic encryption key based on the threat detection result data set using a quantum key distribution protocol and a chaotic sequence dynamic obfuscation algorithm, performs segmented obfuscation encryption on the communication data stream, and outputs encrypted communication data;

[0014] The response processing module uses an adaptive strategy engine based on reinforcement learning to generate a multi-level response instruction set based on the threat detection result data set and the encrypted communication data, and performs automated security protection operations based on instruction priorities.

[0015] Preferably, in the identity authentication module, the user identity authentication data set specifically includes biometric matching data, dynamic token timeliness verification data and device environment fingerprint data; the device environment fingerprint data specifically includes the device hardware serial number hash value, network protocol stack feature data and geographic location verification data.

[0016] Preferably, in the behavior analysis module, the abnormal behavior detection model based on the spatiotemporal convolutional neural network specifically includes: constructing a three-dimensional convolution kernel, hierarchical aggregation of temporal features, attention weighted fusion and abnormality score calculation;

[0017] The three-dimensional convolution kernel is constructed to extract the spatiotemporal correlation features in the user operation behavior, specifically mapping the operation behavior data into a three-dimensional tensor and performing local spatiotemporal feature extraction through a sliding window convolution kernel;

[0018] The hierarchical aggregation of temporal features is specifically to perform hierarchical fusion of temporal features through a multi-layer convolutional network with residual connections to obtain an aggregated behavior feature vector;

[0019] The attention weighted fusion specifically uses a multi-head self-attention mechanism to assign weights to the aggregated behavior feature vectors to generate a weighted behavior feature dataset;

[0020] The abnormality score calculation is specifically to predict the abnormal probability of the weighted behavior feature data set through a fully connected layer and output abnormal behavior score data.

[0021] Preferably, in the threat detection module, the abnormal node detection algorithm based on the graph attention network specifically includes network behavior topology graph construction, node feature initialization, graph attention layer optimization and abnormal node classification;

[0022] The network behavior topology graph construction specifically maps user behavior data into nodes and builds edge connections through communication relationships to form a dynamic behavior topology graph;

[0023] The node feature initialization specifically involves fusing user behavior time series features, device environment fingerprint data, and identity authentication confidence data into a node feature vector;

[0024] The graph attention layer optimization is specifically to aggregate cross-node information of node features through a multi-head graph attention mechanism, and optimize edge weights to reflect the strength of behavioral associations;

[0025] The abnormal node classification specifically uses a graph convolutional network to classify the optimized node features and output abnormal node identification data.

[0026] Preferably, in the dynamic encryption module, the quantum key distribution protocol and the chaotic sequence dynamic obfuscation algorithm specifically include quantum key negotiation, chaotic sequence generation, key obfuscation and segmented encryption;

[0027] The quantum key negotiation specifically generates an initial quantum key based on the BB84 protocol and transmits it to both communicating parties via a quantum channel;

[0028] The chaotic sequence generation is specifically to generate the chaotic sequence using the Lorenz system model and dynamically adjust the chaotic parameters according to the threat detection results;

[0029] The key obfuscation is specifically to perform an XOR operation on the quantum key and the chaotic sequence to generate a dynamic obfuscated key;

[0030] The segmented encryption specifically involves segmenting the communication data stream into segments of preset lengths, and performing stream encryption on each segment of data based on a dynamic obfuscation key.

[0031] Preferably, in the response processing module, the adaptive strategy engine based on reinforcement learning specifically includes state space definition, action space construction, reward function design and strategy optimization;

[0032] The state space definition is specifically encoding threat detection results, encryption key state and network load data into a state vector;

[0033] The action space construction specifically defines multi-level response actions, including logging, traffic rate limiting, session termination, and system isolation;

[0034] The reward function is designed to calculate the immediate reward value based on the execution efficiency and safety loss of the response action;

[0035] The strategy optimization is specifically to iteratively optimize the strategy through a deep Q network to generate an optimal response instruction set.

[0036] Preferably, in the identity authentication module, the dynamic token verification is specifically based on a one-time password algorithm for time synchronization, combined with an elliptic curve encryption algorithm to generate a dynamic token, and the token validity is verified through a hash chain.

[0037] Preferably, in the behavior analysis module, the sliding window step size of the three-dimensional convolution kernel is set to be dynamically adjusted, and the convolution kernel parameters are adaptively matched according to the frequency and complexity of the user's operation behavior.

[0038] Preferably, in the threat detection module, the number of layers of the graph attention network is set to an extensible structure, and the number of attention layers is dynamically increased or decreased according to the node scale of the network behavior topology graph.

[0039] Preferably, in the dynamic encryption module, the obfuscation period of the chaotic sequence dynamic obfuscation algorithm is set to be synchronized with the segment length of the communication data stream, specifically, each segment of data is encrypted using an independent obfuscation key.

[0040] Compared with the prior art, the present invention has the following beneficial effects:

[0041] During the identity verification process, the combination of multimodal biometric fusion authentication and dynamic token verification significantly enhances authentication reliability. Multimodal biometric fusion combines fingerprint, iris, and voiceprint features through a weighted fusion process, utilizing an adaptive threshold dynamic matching algorithm to output authentication confidence data. This means that different biometric features complement each other, forming a multi-layered, highly accurate identity recognition system. For example, in a bank's remote account opening service, the system simultaneously collects fingerprint, iris, and voiceprint information during a customer's identity verification. Because each biometric feature is unique and stable, even if a criminal obtains even one biometric data point, authentication is virtually impossible, effectively preventing identity theft. Dynamic token verification, based on a time-synchronized one-time password algorithm and elliptic curve cryptography, combines hash chains to verify token validity, adding a further layer of security to authentication. In remote work scenarios, employees logging into internal systems generate unique and time-sensitive dynamic tokens each time they log in. Even if the token is intercepted during transmission, its time-limited nature prevents the attacker from using it for illegal login, ensuring secure access to internal enterprise systems.

[0042] The behavior analysis module utilizes an abnormal behavior detection model based on a spatiotemporal convolutional neural network, effectively improving its ability to detect abnormal user behavior. A three-dimensional convolutional kernel is constructed to extract spatiotemporal correlation features in user behavior. By mapping behavior data into a three-dimensional tensor and using a sliding window convolutional kernel to extract local spatiotemporal features, it can accurately capture abnormal patterns even in complex and changing user behavior. For example, in e-commerce platform transaction scenarios, this model can construct a spatiotemporal model based on multi-dimensional behavioral data such as purchase time, product type, and purchase frequency. If a user exhibits abnormal purchasing behavior, such as a large number of the same product category purchased in a short period of time that differs significantly from historical purchase behavior, the model can quickly detect and issue an alert, helping the e-commerce platform to promptly prevent malicious order manipulation and fraud, protecting the interests of both the platform and its users. The hierarchical aggregation of temporal features through a multi-layer convolutional network with residual connections effectively avoids the vanishing gradient problem, enabling the network to better learn long-term temporal features and more accurately analyze changing trends in user behavior. Weighted attention fusion utilizes a multi-head self-attention mechanism to assign weights to the aggregated behavior feature vectors, highlighting key features and further improving the accuracy of abnormal behavior detection. The anomaly score calculation predicts the anomaly probability through the fully connected layer, and the output abnormal behavior score data provides a reliable basis for subsequent threat detection and response processing.

[0043] The threat detection module applies an anomalous node detection algorithm based on a graph attention network to construct and optimize a network behavior topology map, enabling more accurate identification of potential threats. User behavior data is mapped to nodes, connected by edges through communication relationships, forming a dynamic behavior topology map that intuitively displays the behavioral connections between users in the network. Node feature initialization integrates temporal features of user behavior, device environment fingerprint data, and authentication confidence data to comprehensively describe node characteristics. For example, on social networking platforms, this algorithm can construct a topology map based on user interactions (such as likes, comments, and private messages). By analyzing node features, anomalous accounts can be promptly identified. If an account's interaction pattern differs from that of a large number of normal accounts and its node features indicate anomalies in its behavioral characteristics or device environment, it can be identified as an anomalous node and promptly banned, effectively preventing malicious accounts from spreading false information and engaging in online fraud, thereby maintaining the security and stability of the social networking platform. The graph attention layer optimization uses a multi-head graph attention mechanism to aggregate information across nodes, optimize edge weights, and more accurately reflect the strength of behavioral connections. Abnormal node classification uses a graph convolutional network, which can efficiently and accurately identify abnormal nodes and output abnormal node identification data, providing precise targets for subsequent security protection.

[0044] The dynamic encryption module utilizes the quantum key distribution protocol and a chaotic sequence dynamic obfuscation algorithm to provide high security for communication data. Quantum key distribution, based on the BB84 protocol, leverages the quantum non-cloning property to ensure key distribution security. For data transmission between financial institutions, keys generated through quantum key distribution provide extremely high security for data encryption. Even if an attacker attempts to eavesdrop on the key, the quantum state changes, preventing them from being detected, thus ensuring key security. Chaotic sequence generation utilizes the Lorenz system model and dynamically adjusts the chaotic parameters based on threat detection results, increasing the randomness and complexity of the key. Key obfuscation further enhances encryption security by performing an XOR operation on the quantum key and the chaotic sequence to generate a dynamic obfuscation key. Segmented encryption synchronizes the obfuscation cycle with the chaotic sequence dynamic obfuscation algorithm, with each data segment encrypted using a unique obfuscation key. This effectively prevents attackers from deciphering the entire communication content by analyzing a single encrypted segment. In cross-border enterprise data transmission scenarios, even if part of the data is intercepted during transmission, the unique encryption key for each segment makes it difficult for attackers to recover the original data, thus protecting the company's trade secrets and sensitive information.

[0045] The response processing module, based on an adaptive policy engine based on reinforcement learning, generates a multi-level response instruction set based on threat detection results and encrypted communication data, enabling intelligent security protection. The state space definition comprehensively considers threat detection results, encryption key status, and network load data, providing a comprehensive view of the network security status. The action space construction defines a variety of response actions, such as logging, traffic rate limiting, session termination, and system isolation, allowing for flexible selection based on different threat scenarios. When facing a DDoS attack, the system uses a reinforcement learning algorithm to determine the attack's intensity and scope, selecting the appropriate response action. If the attack is small, traffic rate limiting may be implemented to restrict the transmission of malicious traffic while also logging the attack. If the attack is large and severely impacts system operation, the relevant sessions may be immediately terminated, and even the affected systems may be isolated, ensuring the security and stability of the entire network. The reward function design calculates an immediate reward based on the execution efficiency and security loss of the response action, guiding policy optimization. Through iterative policy optimization using a deep Q-network, the generated optimal response instruction set automates security protection operations, improving the timeliness and accuracy of responses and minimizing the losses caused by security threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 A diagram showing the working principle of the protection system for network security authentication according to the present invention;

[0047] Figure 2 This is the step diagram of the abnormal node detection algorithm of the threat detection module;

[0048] Figure 3 A step diagram of the encryption algorithm for the dynamic encryption module;

[0049] Figure 4 Flowchart of the adaptive strategy engine for the response processing module. DETAILED DESCRIPTION

[0050] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0051] See also Figure 1-4 The present invention provides a protection system for network security authentication. The system mainly comprises an identity authentication module, a behavior analysis module, a threat detection module, a dynamic encryption module, and a response processing module, which work together to achieve comprehensive network security protection. The overall implementation scheme is as follows:

[0052] The authentication module generates a user authentication dataset through multimodal biometric fusion authentication and dynamic token verification. Multimodal biometric fusion authentication combines fingerprint, iris, and voiceprint features through a weighted fusion algorithm, then uses an adaptive threshold dynamic matching algorithm to output authentication confidence data. For example, in a real-world application scenario, when a user logs in, the system collects the user's fingerprint, iris, and voiceprint information and fuses them according to preset weights. If the fingerprint feature weight is 0.4, the iris feature weight is 0.3, and the voiceprint feature weight is 0.3, a series of calculations will produce a comprehensive feature value. This value is then compared with the user feature data stored in the system, and the authentication confidence level is determined using an adaptive threshold dynamic matching algorithm. Dynamic token verification generates and verifies a dynamic token based on a specific algorithm. After completing authentication operations, the user authentication dataset, including biometric matching data, dynamic token validity verification data, and device environment fingerprint data, is sent to the behavioral analysis module.

[0053] Based on the received user authentication dataset, the behavior analysis module employs an abnormal behavior detection model based on a spatiotemporal convolutional neural network to extract temporal features of user behavior. This process first constructs a three-dimensional convolution kernel to map user operation behavior data into a three-dimensional tensor. A sliding window convolution kernel is then used to extract local spatiotemporal features. For example, user operation records over a period of time, such as login time, page switching sequence, and click frequency, are converted into a three-dimensional tensor. A sliding window convolution kernel is then applied across this tensor to extract local spatiotemporal features. The temporal features are then hierarchically aggregated and fused using a multi-layer convolutional network with residual connections to generate an aggregated behavioral feature vector. A multi-head self-attention mechanism is then used to perform weighted fusion, assigning weights to the aggregated behavioral feature vector to generate a weighted behavioral feature dataset. Finally, a fully connected layer calculates an anomaly score, predicts anomaly probability, and outputs the abnormal behavior score data, forming a behavioral analysis feature dataset that is sent to the threat detection module.

[0054] The threat detection module applies an anomalous node detection algorithm based on a graph attention network based on a behavioral analysis feature dataset. First, a network behavior topology graph is constructed, mapping user behavior data to nodes. Edge connections are established based on communication relationships to form a dynamic behavior topology graph. For example, if there is frequent data transmission between users A and B, A and B are represented by two nodes in the topology graph, and an edge is established to connect them. The node feature vector is then initialized by integrating user behavior temporal features, device environment fingerprint data, and authentication confidence data. The graph attention layer is then optimized using a multi-head graph attention mechanism to aggregate cross-node information and optimize edge weights to reflect the strength of behavioral associations. Finally, a graph convolutional network is used to classify the optimized node features, outputting anomalous node identification data to generate a threat detection result dataset, which is then sent to the dynamic encryption module and the response processing module.

[0055] Based on the threat detection result dataset, the dynamic encryption module employs a quantum key distribution protocol and a chaotic sequence dynamic obfuscation algorithm. First, an initial quantum key is generated based on the BB84 protocol and transmitted to both communicating parties via a quantum channel. A chaotic sequence is then generated using the Lorenz system model, and the chaotic parameters are dynamically adjusted based on the threat detection results. The quantum key is then XORed with the chaotic sequence to generate a dynamic obfuscation key. Finally, the communication data stream is segmented into segments of a preset length, and each segment is stream encrypted using the dynamic obfuscation key, outputting the encrypted communication data.

[0056] The response processing module employs an adaptive policy engine based on reinforcement learning, based on threat detection result datasets and encrypted communication data. It first encodes threat detection results, encryption key status, and network load data into a state vector to define the state space. It then defines multi-level response actions, such as logging, traffic rate limiting, session termination, and system isolation, to construct the action space. It then calculates immediate rewards based on the execution efficiency and security loss of the response actions, and designs a reward function. Finally, it iteratively optimizes the policy using a deep Q-network to generate the optimal response instruction set and automatically implement security protection operations based on instruction priority.

[0057] The implementation of the present invention will be further described below with reference to Examples 1 to 5.

[0058] Example 1:

[0059] In practical application scenarios, taking an internal enterprise office network as an example, during user authentication, the dynamic token verification in the authentication module is based on a time-synchronized one-time password algorithm combined with elliptic curve cryptography to generate a dynamic token. Specifically, the system sets a time period that is strictly synchronized with the server clock, for example, every 60 seconds. At the beginning of each period, the server generates a one-time password using elliptic curve cryptography, combining the current time information with a pre-set private key for the user. This one-time password is the dynamic token. When the user logs in, their client device generates a corresponding dynamic token based on the same time period and pre-stored elliptic curve cryptographic parameters. The system then verifies the token's validity using a hash chain. A hash chain is a one-way hash function chain. The server hashes the dynamic token submitted by the user and compares the result with the value in the hash chain stored on the server. If the comparison is successful, the token is valid; otherwise, it is invalid.

[0060] When generating a user authentication dataset, the biometric matching data is obtained as follows: After the system collects the user's fingerprint, iris, and voiceprint information, it uses a specialized biometric recognition algorithm to extract and compare features. Assuming the user's fingerprint feature template stored in the system is T1 and the currently collected fingerprint feature is T2, the similarity score between the two is calculated. For example, using the Euclidean distance algorithm to calculate the distance between feature points, a similarity value between 0 and 1 is obtained. This value is the fingerprint feature matching data. The matching calculation principles for iris and voiceprint features are similar, but the feature extraction and comparison algorithms used are different.

[0061] The dynamic token validity verification data records the difference between the dynamic token generation time and the current time. If the difference is within the allowed time range, such as within 60 seconds, it is judged to be valid and recorded as a valid mark; if it exceeds the time range, it is recorded as an invalid mark.

[0062] The device hardware serial number hash value in the device environment fingerprint data is a fixed-length hash value generated by applying a hash function to the device's unique hardware serial number, such as a computer's motherboard serial number. This makes it difficult for an attacker to recover the original serial number even if the hardware serial number is compromised. Network protocol stack feature data collects information about the device's current network protocol stack, including the TCP / IP version and various network parameter configurations. This information reflects the device's network environment characteristics. Geographic location verification data obtains the device's IP address, queries the device's geographic location using an IP address database, and compares it with pre-set user locations. If the match is consistent, the geolocation verification passes; if not, an exception is recorded. Combining these biometric matching data, dynamic token validity verification data, and device environment fingerprint data forms a complete user authentication dataset. This multi-dimensional authentication approach significantly improves authentication accuracy and security, effectively preventing unauthorized users from accessing the enterprise's internal office network and protecting sensitive information and business systems.

[0063] Example 2:

[0064] Taking the cybersecurity protection of an online financial trading platform as an example, this paper describes in detail the implementation process of the behavior analysis module. In this module, the abnormal behavior detection model based on the spatiotemporal convolutional neural network plays a core role.

[0065] When constructing a three-dimensional convolution kernel, for online financial transaction scenarios, user operation data, such as transaction time, transaction amount, and transaction object, is mapped into a three-dimensional tensor in chronological order and along different operation dimensions. Assume that transaction time is one dimension, and transaction amount and transaction object are the other two dimensions. An appropriate sliding window convolution kernel is set, for example, with a window size of 3×3×3. The sliding window step size adaptively matches the kernel parameters based on the frequency and complexity of the user's operation. If a user's transactions are frequent and involve multiple complex transaction types, such as simultaneous stock, fund, and foreign exchange trading, the system automatically shortens the sliding window step size, for example, from the default of 1 to 0.5, to more precisely capture local spatiotemporal features. By sliding the sliding window convolution kernel across the three-dimensional tensor, the spatiotemporal correlation features of the user's operation are extracted.

[0066] Hierarchical aggregation of temporal features is achieved through a multi-layer convolutional network with residual connections. Residual connections effectively prevent the vanishing gradient problem, enabling the network to better learn long-term temporal features. Consider a three-layer convolutional network, where each layer extracts different levels of features from the input temporal features. The first convolutional layer extracts relatively basic features, such as the changing trend of transaction time intervals. The second convolutional layer builds on this foundation and further extracts more complex features, such as the temporal correlations between different transaction types. The third convolutional layer combines the features of the first two layers to produce a more advanced aggregated behavioral feature vector. Residual connections directly connect the input and output of each layer, allowing the network to more efficiently transmit information and improve feature extraction.

[0067] Weighted attention fusion utilizes a multi-head self-attention mechanism. This mechanism assigns weights to the aggregated behavioral feature vector from different perspectives. For example, an eight-head self-attention mechanism can focus on different parts of the aggregated behavioral feature vector. For example, the first head might focus more on the changing characteristics of the transaction amount, while the second head might focus more on the associated characteristics of the transaction objects. This multi-head self-attention mechanism assigns different weights to each element in the aggregated behavioral feature vector, generating a weighted behavioral feature dataset that highlights the features that are most critical for abnormal behavior detection.

[0068] Anomaly scores are calculated using a fully connected layer. This layer takes a weighted behavioral feature dataset as input and performs calculations using a series of weight matrices and bias vectors. Assume the fully connected layer has 10 neurons, each connected to all elements in the weighted behavioral feature dataset. After a series of matrix multiplications and nonlinear activation functions, such as the ReLU activation function, the output is an anomaly score. This score indicates the probability that the user's current behavior is abnormal. If the score exceeds a preset threshold, such as 0.6, the user's behavior is considered abnormal, and the system will take appropriate measures, such as issuing alerts and restricting trading operations, to ensure the safe and stable operation of the online financial trading platform.

[0069] Example 3:

[0070] Taking the network security protection of a large social networking platform as the background, the working process of the threat detection module is explained in detail.

[0071] In the threat detection module, the network behavior topology graph constructed using the graph attention network-based abnormal node detection algorithm is as follows: Each user's behavioral data on the social network platform is mapped as a node, with attributes such as each user's registration information, login time, posted content, and interactions with other users serving as node attributes. If users A and B frequently engage in private messaging, likes, and comments, these nodes are represented in the network behavior topology graph, with an edge connecting them. This creates a dynamic behavior topology graph that reflects the behavioral relationships between users in real time.

[0072] During node feature initialization, user behavior time series features, device environment fingerprint data, and identity verification confidence data are fused into a node feature vector. User behavior time series features include the time series of various user operations on the social networking platform, such as the interval between postings and login frequency; device environment fingerprint data includes device model, operating system version, and network IP address; and identity verification confidence data comes from the user authentication results of the identity verification module. These multi-dimensional data are fused to form a comprehensive node feature vector that fully describes the characteristics of each node.

[0073] The graph attention network is designed with a scalable structure, dynamically increasing or decreasing the number of attention layers based on the node size of the network's behavioral topology. When a social network platform has a small user base and a small node size (e.g., only a few thousand nodes), a smaller number of attention layers, such as two, can be used. Within these two attention layers, a multi-head graph attention mechanism aggregates cross-node information. Each attention layer focuses on node features from different perspectives, such as the first head focusing on the frequency of user interactions and the second head focusing on the similarity of user-posted content. This aggregates information from adjacent nodes and optimizes edge weights to reflect the strength of behavioral associations. When the number of users on a social network platform increases dramatically and the node size scales to millions or even tens of millions, the system automatically increases the number of attention layers, such as to five, to more accurately capture the complex relationships between nodes. Increasing the number of layers allows for deeper exploration of potential relationships between nodes, improving the accuracy of anomalous node detection.

[0074] Anomalous node classification utilizes a graph convolutional network (GCN). The GCN classifies optimized node features and outputs anomalous node identification data. For example, if a node's characteristics differ significantly from those of normal nodes, exceeding a preset threshold, the node is identified as an anomalous node. Based on this anomalous node identification data, social networking platforms can promptly identify potential security threats such as malicious users and fake accounts, and take measures such as account bans and access restrictions to protect platform security and user rights.

[0075] Embodiment 4:

[0076] The dynamic encryption module utilizes a quantum key distribution protocol and a chaotic sequence dynamic obfuscation algorithm. During the quantum key agreement phase, an initial quantum key is generated based on the BB84 protocol. For example, consider a multinational corporation's global data transmission network, assuming its headquarters is located in the United States and has multiple branches in Europe. A quantum channel is established between the headquarters and the European branches. Using the BB84 protocol, the headquarters randomly generates a series of qubits and selects two different measurement bases for measurement. The measurement results and the selected measurement base information are then sent to the European branches via a classical channel. Based on the received measurement base information, the European branches select the same measurement base to measure the received qubits and obtain the initial quantum key. Due to the quantum non-cloning property, even if an attacker eavesdrops on the quantum channel, they will still disrupt the quantum state, thereby being detected by both communicating parties, thus ensuring the security of key distribution.

[0077] Chaotic sequence generation utilizes the Lorenz system model. The Lorenz system model is a classic chaotic system, and its mathematical expression is:

[0078]

[0079] Here, x, y, and z are the system's state variables, and σ, ρ, and β are system parameters. The chaotic parameters are dynamically adjusted based on threat detection results. For example, if the threat detection module detects abnormal traffic in the network, which may be a sign of an attack, the system will automatically adjust the values of σ, ρ, and β to make the generated chaotic sequence more complex and random.

[0080] Key obfuscation performs XOR operation on the quantum key and the chaotic sequence to generate a dynamic obfuscated key. Assume that the quantum key is K q , the chaotic sequence is S c , dynamic obfuscation key K d The formula for generating in In this way, the security of quantum keys is combined with the randomness of chaotic sequences to improve the confidentiality of keys.

[0081] When segmented encryption is used, the communication data stream is segmented into segments of a preset length, assuming the preset length is 1024 bytes. The confusion period of the chaotic sequence dynamic obfuscation algorithm is set to be synchronized with the segment length of the communication data stream, that is, each segment of data is encrypted using an independent obfuscation key. For example, the first segment of data uses K d1 To encrypt, the second segment of data uses K d2During the encryption process, a stream cipher, such as RC4, is used to encrypt each segment of data and output the encrypted communication data. This way, even if an attacker obtains part of the encrypted data, it is difficult to decipher the entire communication data stream because each segment has a different encryption key. This effectively protects data security within the global data transmission network of multinational enterprises.

[0082] Example 5:

[0083] In a cloud computing service provider's network security protection system, the response processing module's adaptive policy engine based on reinforcement learning plays a key role.

[0084] When defining the state space, threat detection results, encryption key status, and network load data are encoded into a state vector. Threat detection results include information such as the number of detected abnormal nodes and the type of abnormal behavior. For example, if 10 abnormal nodes are detected, 5 of which are malicious scanning behaviors, 3 are brute force attacks, and 2 are data theft behaviors, this information is digitally encoded, such as [10, 5, 3, 2]. The encryption key status includes information such as the key generation time, number of uses, and expiration status. Assuming the key generation time is t1 and the number of uses is n, expiration is represented by 0 (not expired) or 1 (expired), encoded as [t1, n, 0]. Network load data includes the current server's CPU usage, memory usage, and network bandwidth utilization. For example, if the CPU usage is 60%, the memory usage is 70%, and the network bandwidth utilization is 50%, it is encoded as [0.6, 0.7, 0.5]. Integrate this information to form the state vector [10,5,3,2,t1,n,0,0.6,0.7,0.5].

[0085] The action space is constructed to define multi-level response actions, including logging, traffic rate limiting, session termination, and system isolation. The logging action is to record the threat detection results and related operation information in detail in the log file for subsequent analysis and auditing. The traffic rate limiting action can limit the network traffic of specific IP addresses or users based on the network load and threat level. For example, if a large number of abnormal requests are detected from a certain IP address, it may be a malicious attack behavior, and its traffic will be limited to 50% of the original. The session termination action is used to immediately terminate the session connection of the abnormal user to prevent further security threats. The system isolation action is to isolate the threatened server or service from the network to prevent the threat from spreading to other systems.

[0086] The reward function design calculates an immediate reward based on the response action's execution efficiency and security loss. For example, if a response action successfully prevents a malicious attack, avoids any data leakage or system failure, and executes quickly, a higher immediate reward value, such as 10 points, will be awarded based on the preset reward rules. If a response action prevents the attack but causes service interruption for some legitimate users, resulting in a certain security loss, a lower immediate reward value, such as -5 points, will be awarded based on the extent of the loss. By continuously adjusting the reward function's parameters and rules, the system can maximize the efficiency of response actions while ensuring security.

[0087] Policy optimization uses a deep Q-network to iteratively optimize the policy and generate an optimal set of response instructions. The deep Q-network is a neural network-based reinforcement learning algorithm that learns optimal policies through continuous interaction with the environment. Within the cloud computing service provider's network environment, the deep Q-network selects an action based on the current state vector and observes the new state and immediate reward value after executing that action. Through continuous iterative training and adjustment of the neural network's parameters, the deep Q-network learns the optimal policy, selecting the optimal response action based on different states and generating the optimal set of response instructions. For example, when a large-scale DDoS attack is detected on the network, the deep Q-network generates an optimal response instruction set based on the learned policy, including a series of actions such as traffic rate limiting, session termination, and system isolation. The cloud computing service provider's system then automatically performs security protection operations based on the priority of the instructions, ensuring the secure and stable operation of the cloud computing service.

[0088] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "includes," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus.

[0089] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A protection system for network security authentication, characterized by: It includes authentication module, behavior analysis module, threat detection module, dynamic encryption module and response processing module; The identity verification module generates a user identity verification data set through multimodal biometric fusion authentication and dynamic token verification, and sends the user identity verification data set to the behavior analysis module; the multimodal biometric fusion authentication specifically includes weighted fusion of fingerprint features, iris features, and voiceprint features, and outputs identity verification confidence data through an adaptive threshold dynamic matching algorithm; The behavior analysis module, based on the user identity authentication dataset, uses an abnormal behavior detection model based on a spatiotemporal convolutional neural network to extract user behavior temporal features, generate a behavior analysis feature dataset, and send the behavior analysis feature dataset to the threat detection module; The threat detection module applies an abnormal node detection algorithm based on a graph attention network based on the behavior analysis feature dataset to construct a network behavior topology graph, generates a threat detection result dataset through node feature propagation and edge weight optimization, and sends the threat detection result dataset to the dynamic encryption module and the response processing module; The dynamic encryption module generates a dynamic encryption key based on the threat detection result data set using a quantum key distribution protocol and a chaotic sequence dynamic obfuscation algorithm, performs segmented obfuscation encryption on the communication data stream, and outputs encrypted communication data; The response processing module uses an adaptive strategy engine based on reinforcement learning to generate a multi-level response instruction set based on the threat detection result data set and the encrypted communication data, and performs automated security protection operations based on instruction priorities.

2. A protection system for network security authentication according to claim 1, characterized in that: In the identity authentication module, the user identity authentication data set specifically includes biometric matching data, dynamic token timeliness verification data and device environment fingerprint data; the device environment fingerprint data specifically includes the device hardware serial number hash value, network protocol stack feature data and geographic location verification data.

3. A protection system for network security authentication according to claim 2, characterized in that: In the behavior analysis module, the abnormal behavior detection model based on spatiotemporal convolutional neural network specifically includes: constructing a three-dimensional convolution kernel, hierarchical aggregation of temporal features, attention weighted fusion and abnormality score calculation; The three-dimensional convolution kernel is constructed to extract the spatiotemporal correlation features in the user operation behavior, specifically mapping the operation behavior data into a three-dimensional tensor and performing local spatiotemporal feature extraction through a sliding window convolution kernel; The hierarchical aggregation of temporal features is specifically to perform hierarchical fusion of temporal features through a multi-layer convolutional network with residual connections to obtain an aggregated behavior feature vector; The attention weighted fusion specifically uses a multi-head self-attention mechanism to assign weights to the aggregated behavior feature vectors to generate a weighted behavior feature dataset; The abnormality score calculation is specifically to predict the abnormal probability of the weighted behavior feature data set through a fully connected layer and output abnormal behavior score data.

4. A protection system for network security authentication according to claim 3, characterized in that: In the threat detection module, the abnormal node detection algorithm based on the graph attention network specifically includes network behavior topology graph construction, node feature initialization, graph attention layer optimization and abnormal node classification; The network behavior topology graph construction specifically maps user behavior data into nodes and builds edge connections through communication relationships to form a dynamic behavior topology graph; The node feature initialization specifically involves fusing user behavior time series features, device environment fingerprint data, and identity authentication confidence data into a node feature vector; The graph attention layer optimization is specifically to aggregate cross-node information of node features through a multi-head graph attention mechanism, and optimize edge weights to reflect the strength of behavioral associations; The abnormal node classification specifically uses a graph convolutional network to classify the optimized node features and output abnormal node identification data.

5. A protection system for network security authentication according to claim 4, characterized in that: In the dynamic encryption module, the quantum key distribution protocol and the chaotic sequence dynamic obfuscation algorithm specifically include quantum key negotiation, chaotic sequence generation, key obfuscation and segmented encryption; The quantum key negotiation specifically generates an initial quantum key based on the BB84 protocol and transmits it to both communicating parties via a quantum channel; The chaotic sequence generation is specifically to generate the chaotic sequence using the Lorenz system model and dynamically adjust the chaotic parameters according to the threat detection results; The key obfuscation is specifically to perform an XOR operation on the quantum key and the chaotic sequence to generate a dynamic obfuscated key; The segmented encryption specifically involves segmenting the communication data stream into segments of preset lengths, and performing stream encryption on each segment of data based on a dynamic obfuscation key.

6. A protection system for network security authentication according to claim 5, characterized in that: In the response processing module, the adaptive strategy engine based on reinforcement learning specifically includes state space definition, action space construction, reward function design and strategy optimization; The state space definition is specifically encoding threat detection results, encryption key state and network load data into a state vector; The action space construction specifically defines multi-level response actions, including logging, traffic rate limiting, session termination, and system isolation; The reward function is designed to calculate the immediate reward value based on the execution efficiency and safety loss of the response action; The strategy optimization is specifically to iteratively optimize the strategy through a deep Q network to generate an optimal response instruction set.

7. A protection system for network security authentication according to claim 6, characterized in that: In the identity authentication module, the dynamic token verification is specifically based on a one-time password algorithm based on time synchronization, combined with an elliptic curve encryption algorithm to generate a dynamic token, and the token validity is verified through a hash chain.

8. A protection system for network security authentication according to claim 7, characterized in that: In the behavior analysis module, the sliding window step size of the three-dimensional convolution kernel is set to be dynamically adjusted, and the convolution kernel parameters are adaptively matched according to the frequency and complexity of the user's operation behavior.

9. A protection system for network security authentication according to claim 8, characterized in that: In the threat detection module, the number of layers of the graph attention network is set to an extensible structure, and the number of attention layers is dynamically increased or decreased according to the node scale of the network behavior topology graph.

10. A protection system for network security authentication according to claim 9, characterized in that: In the dynamic encryption module, the obfuscation period of the chaotic sequence dynamic obfuscation algorithm is set to be synchronized with the segment length of the communication data stream, and specifically, each segment of data is encrypted using an independent obfuscation key.

Images