A security authentication system, method, electronic device, and storage medium based on online business security.

Abstract

This disclosure provides a security authentication system, method, electronic device, and storage medium based on online business security. The system includes: an information authentication module that receives authentication requests from clients for online business and displays an authentication interface; an authentication behavior collection unit that acquires authentication behavior information; a business behavior collection unit that acquires business behavior information; a behavior authentication module that receives the authentication behavior information and business behavior information, extracts behavioral feature information based on the authentication behavior information and business behavior information; performs authentication processing on the behavioral feature information based on a target behavior baseline model to obtain a first authentication result. The information authentication module performs authentication processing based on the authentication information to obtain a second authentication result; and a comprehensive authentication module determines a target authentication result based on the first authentication result and the second authentication result. By adding seamless behavior authentication on top of information authentication, the security of online business is improved.

Description

Technical Field

[0001] This disclosure relates to the field of cybersecurity technology, and in particular to a security authentication system, method, electronic device, and storage medium based on online business security. Background Technology

[0002] With the continuous development of computer and network technologies, online businesses are booming, and the resulting security issues are becoming increasingly serious.

[0003] Current authentication processes generally fall into two categories: The first is a static authentication method with a relatively simple verification dimension, such as username / password + verification code. This method is simple to operate but carries a high security risk. The second is a multi-dimensional, highly interactive dynamic authentication method. This method offers high security but is complex to operate and provides a poor user experience. Summary of the Invention

[0004] This disclosure provides a security authentication system, method, electronic device, and storage medium based on online business security, which realizes multi-factor authentication for online business security, while taking into account the convenience of authentication operation, authentication accuracy, and the security of online business.

[0005] According to one aspect of this disclosure, a security authentication system based on online business security is provided, comprising: an information authentication module, a behavior collection module, a behavior authentication module, and a comprehensive authentication module, wherein the behavior collection module includes a business behavior collection unit and an authentication behavior collection unit;

[0006] The information authentication module receives authentication requests from clients for online services and displays the authentication interface;

[0007] The authentication behavior acquisition unit obtains the authentication behavior information of the client performing the current authentication on the authentication interface;

[0008] The business behavior collection unit acquires business behavior information of the client during the current response process to the online business;

[0009] The behavior authentication module receives the authentication behavior information and the business behavior information, extracts behavior feature information based on the authentication behavior information and the business behavior information; determines a target behavior baseline model from multiple pre-built behavior baseline models based on the application scenario to which the current response process of the online business belongs, and performs authentication processing on the behavior feature information based on the target behavior baseline model to obtain a first authentication result. The multiple behavior baseline models corresponding to the online business are constructed from historical behavior information corresponding to the online business in multiple application scenarios.

[0010] The information authentication module receives the authentication information input by the client, performs authentication processing based on the authentication information, and obtains a second authentication result;

[0011] The integrated authentication module determines the target authentication result based on the first authentication result and the second authentication result.

[0012] Optionally, the behavior authentication module is specifically used for:

[0013] Based on the authentication behavior information, feature extraction is performed to obtain the first feature information X. authentication Based on business behavior information, feature extraction is performed to obtain the second feature information X. business Wherein, the first feature information and the second feature information form the behavioral feature information X = (X authentication X business );

[0014] Similarity matching is performed between the target behavior baseline model M and the behavior feature information X, and authentication anomaly values ​​are determined based on the similarity data. The authentication anomaly value is 1-Similarity(M, X).

[0015] When the authentication anomaly value is greater than or equal to the first threshold, the first authentication result is determined to be authentication failure; when the authentication anomaly value is less than the first threshold, the first authentication result is determined to be authentication success.

[0016] Optionally, the target behavior baseline model includes a long-term behavior baseline model M1 and a short-term behavior baseline model M2; wherein, the long-term behavior baseline model M1 is constructed based on historical behavior information of a first time window corresponding to the business type of online business; the short-term behavior baseline model M2 is constructed based on historical behavior information of a second time window corresponding to the business type of online business; the duration of the first time window is greater than the duration of the second time window;

[0017] The behavior authentication module is specifically used to: perform similarity matching between the long-term behavior baseline model M1 and the short-term behavior baseline model M2 and the behavior feature information X respectively, to obtain first similarity data and second similarity data;

[0018] An authentication anomaly is determined based on the first similarity data and the second similarity data. The authentication anomaly is 1-(a*Similarity(M1,X)+b*Similarity(M2,X)); where a and b are the weights of the first similarity data and the second similarity data, respectively.

[0019] When the authentication anomaly value is greater than or equal to the first threshold, the first authentication result is determined to be authentication failure; when the authentication anomaly value is less than the first threshold, the first authentication result is determined to be authentication success.

[0020] Optionally, the behavioral feature information includes at least one of the following: operation timing features, mouse movement curvature features, response time features, input pressure sensitivity features, and keystroke frequency features.

[0021] Optionally, the behavior authentication module is further configured to: when the first authentication result is authentication failure and the authentication anomaly value is less than a second threshold, acquire behavior data from the pre-authentication stage, perform a consistency determination based on the behavior data from the pre-authentication stage and the behavior data from the authentication stage, and obtain a behavior consistency determination result; wherein, the behavior data from the authentication stage includes the authentication behavior information and the business behavior information; wherein, the second threshold is greater than the first threshold; and when the consistency determination result indicates consistency, update the first authentication result to authentication success.

[0022] Optionally, the behavior authentication module is further configured to: when the first authentication result is authentication failure and the authentication anomaly value is less than a second threshold, perform machine behavior authentication on the behavior feature information based on a trained machine behavior recognition model to obtain a machine behavior authentication result; wherein the second threshold is greater than the first threshold; and when the machine behavior authentication result is non-machine behavior, update the first authentication result to authentication success.

[0023] Optionally, the security authentication system further includes an authentication policy determination module, which is used to determine the authentication strength of the current authentication based on the risk intensity dimension and environmental security dimension of the online business; and to determine the authentication method combination for the current authentication based on the authentication strength of the current authentication, wherein the authentication method combination includes at least one of the following: CAPTCHA authentication, Turing authentication, biometric authentication, location authentication, operation path authentication, and blockchain authentication; wherein the biometric authentication includes at least one of the following: fingerprint authentication, facial authentication, iris authentication, and voiceprint authentication;

[0024] Each authentication method corresponds to an authentication strength value. The sum of the authentication strength values ​​of at least one authentication method in the combination of authentication methods is greater than the authentication strength of the current authentication. The at least one authentication method in the combination of authentication methods is obtained by random combination.

[0025] According to another aspect of this disclosure, a security authentication method based on online business security is provided, comprising:

[0026] Receive authentication requests from clients for online services and display the authentication interface;

[0027] Obtain the authentication behavior information of the client performing the current authentication on the authentication interface;

[0028] Obtain business behavior information of the client during the current response process to the online service;

[0029] The system receives the authentication behavior information and the business behavior information, extracts behavioral feature information based on the authentication behavior information and the business behavior information, determines a target behavioral baseline model from multiple pre-built behavioral baseline models based on the application scenario to which the current response process of the online business belongs, performs authentication processing on the behavioral feature information based on the target behavioral baseline model, and obtains a first authentication result. The multiple behavioral baseline models corresponding to the online business are constructed respectively from the historical behavioral information corresponding to the online business in multiple application scenarios.

[0030] The system receives authentication information input by the client through the authentication interface, performs authentication processing based on the authentication information, and obtains a second authentication result; and determines a target authentication result based on the first authentication result and the second authentication result.

[0031] According to another aspect of this disclosure, an electronic device is provided, the electronic device comprising:

[0032] At least one processor; and

[0033] A memory communicatively connected to the at least one processor; wherein,

[0034] The memory stores a computer program that can be executed by the at least one processor, which enables the at least one processor to perform the online business security-based security authentication method described in any embodiment of this disclosure.

[0035] According to another aspect of this disclosure, a computer-readable storage medium is provided that stores computer instructions for causing a processor to execute and implement the online business security-based security authentication method described in any embodiment of this disclosure.

[0036] The technical solution of this disclosure embodiment collects authentication behavior information and business behavior information during the current response process of the client to the online service by the behavior collection module while the information authentication module obtains authentication information through the authentication interface. Simultaneously, the behavior authentication module performs behavior authentication on the acquired business behavior information and authentication behavior information while the information authentication module processes the authentication information. The target authentication result is obtained by combining the second authentication result of the information authentication and the first authentication result of the behavior authentication. Based on information authentication, a seamless behavior authentication process is added, improving authentication accuracy and enhancing the authentication experience and security of online services.

[0037] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0038] To more clearly illustrate the technical solutions in the embodiments of this disclosure, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0039] Figure 1 This is a schematic diagram of the structure of a security authentication system based on online business security provided in an embodiment of this disclosure;

[0040] Figure 2 This is a flowchart of a security authentication method based on online business security provided in this embodiment of the disclosure;

[0041] Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure. Detailed Implementation

[0042] To enable those skilled in the art to better understand the present disclosure, the technical solutions of the present disclosure will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of the present disclosure, and not all embodiments. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present disclosure.

[0043] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0044] The acquisition, storage, and / or processing of data in the technical solutions involved in this application comply with the relevant provisions of national laws and regulations. It should be noted that certain software, components, models, and other existing solutions in the industry may be mentioned in the embodiments of this application. These should be considered as exemplary, and their purpose is only to illustrate the feasibility of implementing the technical solutions of this application, but does not mean that the applicant has used or necessarily used such solutions.

[0045] Online business can be understood as business activities and services conducted through internet platforms, which may include information exchange, service provision, and commercial transactions via the network. For example, online business may include, but is not limited to, online transaction business based on e-commerce platforms, online financial business, online multimedia content service business, online sharing business, online social business, online medical business, and online government affairs business. During the execution of the above-mentioned online business, there may be business activities involving network security, such as information querying, information interaction, and resource settlement. To improve the network security of online business, this disclosure provides a security authentication system based on online business security, providing security authentication for online business security, achieving a balance between the convenience of authentication operations and the security of online business.

[0046] Figure 1 This is a schematic diagram of the structure of a security authentication system based on online business security provided in this embodiment of the disclosure. The security authentication system may include: an information authentication module 110, a behavior collection module 120, a behavior authentication module 130, and a comprehensive authentication module 140. The behavior collection module 120 includes a business behavior collection unit 121 and an authentication behavior collection unit 122.

[0047] The system comprises the following modules: Information Authentication Module 110 receives authentication requests from clients for online services and displays the authentication interface; Authentication Behavior Acquisition Unit 122 acquires authentication behavior information of the client performing the current authentication on the authentication interface; Business Behavior Acquisition Unit 121 acquires business behavior information of the client during the current response process to the online service; Behavior Authentication Module 130 receives authentication behavior information and business behavior information, extracts behavioral feature information based on the authentication behavior information and business behavior information; Based on the application scenario to which the current response process of the online service belongs, it determines a target behavioral baseline model from multiple pre-built behavioral baseline models, performs authentication processing on the behavioral feature information based on the target behavioral baseline model, and obtains a first authentication result. The multiple behavioral baseline models corresponding to the online service are constructed from historical behavioral information corresponding to the business types of the online service in multiple application scenarios; Information Authentication Module 110 receives authentication information input by the client, performs authentication processing on the authentication information, and obtains a second authentication result; and Comprehensive Authentication Module 140 determines a target authentication result based on the first authentication result and the second authentication result.

[0048] The security authentication process in this embodiment can be understood as an authentication process triggered by a setting operation in the online business. This setting operation may include, but is not limited to, resource settlement operations, information reading operations, and information transmission operations. In some embodiments, a client accesses the online business system, and the user inputs an operation through the client. The client generates a processing request based on the user's input and sends it to the online business system, which then responds to the processing request. During the execution of the online business, when the user inputs a setting operation, the client generates an authentication request and sends it to the security authentication system. If authentication is successful, the client generates a processing request corresponding to the setting operation and sends it to the online business system to continue executing the online business; alternatively, the client sends a processing request corresponding to the setting operation to the online business system, the online business system generates an authentication request and sends it to the security authentication system, and if authentication is successful, the online business system continues to respond to the processing request corresponding to the setting operation.

[0049] The security authentication system receives authentication requests, determines the authentication method, and displays an interface to the client. This authentication interface is used to collect authentication information input by the client. The content displayed on the authentication interface and the authentication information collected through the authentication interface will differ depending on the authentication method.

[0050] In some embodiments of this disclosure, the security authentication system further includes an authentication policy determination module. This module determines the authentication strength of the current authentication based on the risk intensity dimension and environmental security dimension of the online business; and determines a combination of authentication methods for the current authentication based on the authentication strength of the current authentication. The combination of authentication methods may include one or more authentication methods. Each authentication method corresponds to an authentication strength value. Based on the authentication strength values ​​corresponding to each authentication method, at least one authentication method is determined to form the authentication method combination for the current authentication process. The sum of the authentication strength values ​​of at least one authentication method in the authentication method combination is greater than the authentication strength of the current authentication.

[0051] The environmental security dimension can be understood as the security dimension of the authentication environment information. This information includes device information and network information. Device information can be the device information corresponding to the client accessing the online service, such as the device's IP address. Network information can be the network information of the network the client is connected to. The authentication request can carry this device and network information, and an authentication factor for the environmental security dimension can be set based on this information. This authentication factor can be numerical. For example, device information can be either frequently used or unfamiliar devices used by the user's account, with authentication factors set separately for each. The authentication factor for unfamiliar devices is greater than that for frequently used devices. Network information can be secure network information such as home or company networks, or it can be public network information (such as public Wi-Fi). Different authentication factors are set for different types of network information, with the authentication factor for public network information being greater than that for secure network information.

[0052] The risk intensity dimension can be understood as a dimensionality for determining the security risks of online business operations. Authentication factors are pre-defined for each operation, and these factors are determined based on the operation type and content. For example, the risk intensity of a resource settlement operation is greater than that of an information reading operation; correspondingly, the authentication factor for a resource settlement operation is greater than that for an information reading operation. Specifically, the authentication factor for a resource settlement operation is positively correlated with the amount of resources involved, while the authentication factor for an information reading operation is positively correlated with the security level of the read content.

[0053] The authentication strength for the current authentication is determined based on authentication factors from both the environmental security and risk intensity dimensions. For example, the authentication strength can be determined by summing the authentication factors from both dimensions, or by weighting the authentication factors from these dimensions. A higher authentication strength indicates a greater security risk to the online business's settings and operations. Different combinations of authentication methods are then determined for different authentication strengths to meet the security authentication requirements of online businesses.

[0054] Optionally, the authentication method combination includes at least one of the following: verification code authentication, Turing authentication, biometric authentication, location authentication, operation path authentication, and blockchain authentication; the biometric authentication includes at least one of the following: fingerprint authentication, facial authentication, iris authentication, and voiceprint authentication. Operation path authentication can be understood as an authentication method for the legitimate path of the authentication process. The legitimate path of the authentication process can include pre-authentication operations, authentication triggering conditions, and the legitimate path formed by the authentication behavior. Taking online transaction business on an e-commerce platform as an example, the legitimate path of the authentication process can include product browsing operations, adding to cart operations, settlement operations, and payment authentication operations; or it can also be the selection operation, settlement operation, and payment authentication operation on the shopping cart page. If the operation path authentication includes a legitimate path, the operation path authentication can be determined to be successful. If there are no pre-authentication actions or authentication triggering conditions, and only the authentication behavior is included, the operation path authentication can be determined to be unsuccessful. Blockchain authentication can be understood as an authentication method that uses the distributed ledger and encryption technology of blockchain to store user identity information in a decentralized manner. Blockchain authentication can ensure that data is immutable, protect user privacy, and can be applied to cross-border identity authentication, decentralized finance (DeFi) platform authentication, etc. Location authentication can be understood as determining a user's location through IP address, GPS positioning, or base station information, comparing it with historically frequently used locations. This method can quickly identify abnormal behaviors such as cross-regional logins and is suitable for scenarios involving cross-border payment risk control and abnormal login alerts. Biometric authentication uses a user's unique biometric information for verification, offering high security. Turing authentication can be understood as an authentication method that distinguishes between human and machine through interactive means. CAPTCHA authentication can be understood as a one-time verification method using dynamically generated information in real time.

[0055] For different authentication methods, an authentication strength value is pre-set for each method, where a higher authentication strength value indicates a higher authentication confidence level. At least one authentication method is selected from the authentication method pool to form the authentication method combination for the current authentication, and the sum of the authentication strength values ​​of at least one authentication method in the combination is greater than the authentication strength of the current authentication.

[0056] In some embodiments of this disclosure, at least one authentication method in the authentication method combination is randomly combined. Specifically, an authentication method is randomly selected from the authentication method pool. If the authentication strength value of this authentication method is greater than the authentication strength of the current authentication, this authentication method is determined as the authentication method for the current authentication. If the authentication strength value of this authentication method is less than the authentication strength of the current authentication, another authentication method is randomly selected from the authentication method pool. If the sum of the authentication strength values ​​of the two selected authentication methods is greater than the authentication strength of the current authentication, the two selected authentication methods are determined to form the authentication method combination for the current authentication. If the sum of the authentication strength values ​​of the two selected authentication methods is less than the authentication strength of the current authentication, other authentication methods are selected again until the sum of the authentication strength values ​​of the authentication methods is greater than the authentication strength of the current authentication, thus forming the authentication method combination for the current authentication. By randomly determining the authentication method combination, the randomness of the authentication method is increased, thereby improving the authentication security level.

[0057] The authentication methods in the authentication method pool have different levels of interactivity. CAPTCHA authentication, Turing authentication, and biometric authentication are interactive authentication methods that require user interaction, and the interaction strength varies among these different interactive authentication methods. Location authentication, operation path authentication, and blockchain authentication are seamless authentication methods that do not require user interaction. In some embodiments of this disclosure, different authentication methods are selected based on the age range of the client user. When the client user's age is greater than an age threshold, the authentication method combination may include an authentication method with weak interaction strength and at least one seamless authentication method. The authentication method with weak interaction strength can be determined by comparing the interaction strength of the interactive authentication methods. By determining authentication methods with different interaction strengths according to different age ranges, especially for the elderly, the interaction strength and operational difficulty of the authentication process are reduced, improving the authentication experience.

[0058] In some embodiments of this disclosure, the authentication method combination includes at least one interactive authentication method, namely, the authentication method combination includes at least one of CAPTCHA authentication, Turing authentication, and biometric authentication. Accordingly, an interactive authentication method is selected (e.g., randomly selected or determined based on interaction strength comparison). If the authentication strength data of this interactive method is less than the authentication strength of the current authentication, at least one authentication paradigm is selected from the non-perceptible authentication methods until the sum of the authentication strength values ​​of the authentication methods is greater than the authentication strength of the current authentication, thus forming the authentication method combination for the current authentication. While ensuring the authentication strength of the authentication method combination for the current authentication, this reduces interactive behavior during the authentication process and improves the user experience of the authentication process.

[0059] In this embodiment of the disclosure, during the process of the information authentication module 110 collecting authentication information corresponding to the interactive authentication method through the authentication interface, the authentication behavior collection unit 122 acquires the authentication behavior information of the client performing the current authentication on the authentication interface, that is, the authentication behavior information generated during the authentication information input process. Specifically, when the interactive authentication method is CAPTCHA authentication, the user enters a CAPTCHA on the authentication interface. Correspondingly, the aforementioned authentication behavior information may include behavior information generated during the CAPTCHA input process, including but not limited to mouse movement trajectory information, input content corresponding to the input operation, time information, and pressure sensitivity information. When the interactive authentication method is Turing authentication, the user selects an image that matches specific characteristics on the authentication interface, or performs operations such as dragging a slider to complete a puzzle, sliding a CAPTCHA, or clicking icons in sequence. Correspondingly, the authentication behavior information may include, but is not limited to, time information and pressure sensitivity information corresponding to sliding or clicking operations. When the interactive authentication method is biometric authentication, the user enters biometric information on the authentication interface, such as fingerprint information, voice information, iris information, and facial information. Correspondingly, the authentication behavior information may include, but is not limited to, the time information and pressure sensitivity information of the fingerprint input operation; the response time of inputting voice information, iris information, and facial information; and the angle information and device location information of the client device.

[0060] Understandably, for different authentication methods, the type of authentication behavior information corresponding to each authentication method is pre-set. The client collects the corresponding type of authentication behavior information and transmits the collected authentication behavior information to the authentication behavior collection unit 122. The client can input authentication information through touch operation on the touch screen, or through input devices such as a keyboard and mouse. For different input devices, the type of authentication behavior information corresponding to each authentication method is set. The client collects the corresponding type of authentication behavior information and transmits the collected authentication behavior information to the authentication behavior collection unit 122.

[0061] In this embodiment, to avoid the limitations of authentication behavior information collected during the authentication process, the business behavior collection unit 121 also collects business behavior information from the client's current response to the online service. During the execution of the online service, the client maintains a set of business behavior information, which includes user behavior information related to the online service within a first set time window. If the client exits the online service, the set of business behavior information is cleared; if the client restarts the online service, the set is re-maintained. The behavior information in this set includes, but is not limited to, the time information, operation content information, and pressure sensitivity information of the user's operation related to the online service. When the client generates an authentication request, the behavior information in the set is transmitted to the business behavior collection unit 121. It is understood that the set of business behavior information can be empty if no business behavior information is collected.

[0062] The business behavior acquisition unit 121 transmits the acquired business behavior information to the behavior authentication module 130, and the authentication behavior acquisition unit 122 transmits the acquired authentication behavior information to the behavior authentication module 130. The behavior authentication module 130 performs behavior authentication on the business behavior information and the authentication behavior information. Specifically, the behavior authentication module 130 extracts features from the business behavior information and the authentication behavior information to obtain behavior feature information, and performs behavior authentication on the behavior feature information through the target behavior baseline model.

[0063] In some embodiments, the behavior authentication module 130 may extract features from business behavior information and authentication behavior information using a pre-set feature extraction model. This feature extraction model may be a machine learning model, such as a pre-trained neural network model with feature extraction capabilities. Optionally, the extracted behavior feature information includes at least one of the following: operation timing features, mouse movement curvature features, response duration features, input pressure sensitivity features, and keystroke frequency features. Operation timing features can be understood as features extracted from the operation content and time information during the online business execution process or authentication process, used to characterize the personalized characteristics of the user's order of operation content during the online business execution process or authentication process. Mouse movement curvature features can be understood as features extracted from the mouse movement trajectory during the online business execution process or authentication process, used to characterize the personalized characteristics of the user's mouse operation behavior. Response duration features can be understood as features extracted from the response duration between interface display and user response during the business execution process or authentication process, which can characterize the personalized characteristics of the user's response to the interface. Input pressure sensitivity features can be understood as features extracted from the operation pressure sensitivity information during the online business execution process or authentication process, characterizing the personalized characteristics of the user's pressing of the input device during the operation process. The frequency of keystrokes can be understood as the features extracted from the time and quantity information of input operations during the online business execution process or authentication process, representing the personalized characteristics of users in terms of input operation frequency and operation interval.

[0064] In this embodiment, multiple behavioral baseline models are pre-set. These behavioral baseline models can be understood as user behavior reference standards established through data modeling, serving as digital behavioral fingerprints for users. Specifically, these behavioral baseline models can use machine learning to statistically analyze users' historical operational behaviors, forming quantifiable behavioral model benchmarks used to detect abnormal behaviors that deviate from normal behavioral patterns.

[0065] The behavior authentication module 130 pre-sets multiple behavior baseline models for online business. Optionally, different behavior baseline models can be set for different online businesses; alternatively, multiple behavior baseline models applicable to different online businesses can be set simultaneously. These different behavior baseline models can be behavior baseline models applicable to different application scenarios. Optionally, application scenarios can be understood as time-based scenarios, such as weekday scenarios, holiday scenarios, daytime scenarios, and nighttime scenarios, etc., where users' different emotions in different time scenarios can lead to different operational characteristics. Optionally, application scenarios can be business type scenarios corresponding to different business types of online business, such as high-frequency business scenarios and low-frequency business scenarios; or high-risk business scenarios and low-risk business scenarios, etc., where different operational characteristics can result from the processing of different business types.

[0066] In some embodiments of this disclosure, historical behavior information corresponding to online services in each application scenario is collected, and a different behavior baseline model corresponding to each application scenario is constructed based on the historical behavior information corresponding to online services in each application scenario. Specifically, the behavior baseline model corresponding to the application scenario can be obtained by using a neural network model to process the historical behavior information corresponding to online services in the application scenario. The neural network model can be, for example, a transformer model or an LSTM model, and the specific structure or type of the neural network model is not limited here.

[0067] The behavior authentication module 130 determines the application scenario to which the current response process of the online service belongs. This application scenario may include a time-based scenario and / or a business type scenario. Based on the application scenario, a target behavior baseline model is determined. Accordingly, the target behavior baseline model may include a first behavior baseline model corresponding to the time-based scenario and / or a second behavior baseline model corresponding to the business type scenario. The behavior authentication module 130 performs authentication processing on the behavior feature information based on the target behavior baseline model to obtain a first authentication result.

[0068] Optionally, the behavior authentication module 130 is specifically used to: extract features based on the authentication behavior information to obtain first feature information X. authentication Based on business behavior information, feature extraction is performed to obtain the second feature information X. business Wherein, the first feature information and the second feature information form the behavioral feature information X = (X authentication X business The process involves: matching the target behavior baseline model M with the behavior feature information X based on similarity; determining authentication anomalies based on similarity data, where the authentication anomaly value is 1-Similarity(M, X); determining the first authentication result as authentication failure when the authentication anomaly value is greater than or equal to a first threshold; and determining the first authentication result as authentication success when the authentication anomaly value is less than the first threshold.

[0069] The similarity data Similarity(M, X) is determined by matching the target behavior baseline model M with the behavior feature information X. A higher similarity data indicates that the behavior feature information X in the current authentication process is closer to the target behavior baseline model M. In other words, this similarity data represents the confidence level that the authentication behavior information and business behavior information collected in the current authentication process belong to the normal behavior pattern. Correspondingly, the authentication anomaly value is 1 - Similarity(M, X), which represents the confidence level that the authentication behavior information and business behavior information collected in the current authentication process deviates from the normal behavior pattern. When the authentication anomaly value is less than a first threshold, it is confirmed that the authentication behavior information and business behavior information collected in the current authentication process belong to the normal behavior pattern, and the first authentication result is authentication success. When the authentication anomaly value is greater than the first threshold, it is confirmed that the authentication behavior information and business behavior information collected in the current authentication process deviates from the normal behavior pattern, and the first authentication result is authentication failure. Here, the similarity matching algorithm is not limited.

[0070] Optionally, the target behavior baseline model M includes a first behavior baseline model corresponding to a time scenario and a second behavior baseline model corresponding to a business type scenario. Similarity matching is performed between the first behavior baseline model and the behavior feature information X to obtain similarity data for the time scenario. Similarly, similarity matching is performed between the second behavior baseline model and the behavior feature information X to obtain similarity data for the business type scenario. A comprehensive similarity data is obtained based on the similarity data for the time scenario and the similarity data for the business type scenario. This comprehensive similarity data can be the sum of the similarity data for the time scenario and the similarity data for the business type scenario, or it can be a weighted average of the similarity data for the time scenario and the similarity data for the business type scenario. Authentication anomalies are determined based on the comprehensive similarity data, and a first authentication result is determined based on these anomalies.

[0071] In some embodiments of this disclosure, the target behavior baseline model includes a long-term behavior baseline model M1 and a short-term behavior baseline model M2. The long-term behavior baseline model M1 is constructed based on historical behavior information within a first time window corresponding to the business type of the online service. The short-term behavior baseline model M2 is constructed based on historical behavior information within a second time window corresponding to the business type of the online service. The length of the first time window is greater than the length of the second time window. For example, the length of the first time window can be one year or half a year, and the length of the second time window can be one month or one week, etc.

[0072] Understandably, some user behavior characteristics can change over time, while others can remain consistent over a long period. To improve the accuracy of behavior authentication, a long-term behavior baseline model M1 and a short-term behavior baseline model M2 are established. The long-term behavior baseline model M1 can be understood as a quantifiable long-term behavior benchmark based on the user's historical behavior within a first time window, and the short-term behavior baseline model M2 can be understood as a quantifiable short-term behavior benchmark based on the user's historical behavior within a second time window. By using both the long-term behavior baseline model M1 and the short-term behavior baseline model M2 to jointly process the extracted behavioral feature information, authentication accuracy is improved, and the matching of long-term and short-term behavioral features can be considered.

[0073] Optionally, the behavior authentication module 130 is specifically used for: performing similarity matching between the long-term behavior baseline model M1 and the short-term behavior baseline model M2 and the behavior feature information X respectively to obtain first similarity data and second similarity data; determining authentication anomaly values ​​based on the first similarity data and the second similarity data, wherein the authentication anomaly value is 1-(a*Similarity(M1,X)+b*Similarity(M2,X)); where a and b are the weights of the first similarity data and the second similarity data respectively; determining the first authentication result as authentication failure when the authentication anomaly value is greater than or equal to a first threshold; and determining the first authentication result as authentication success when the authentication anomaly value is less than the first threshold.

[0074] The long-term behavioral baseline model M1 and the short-term behavioral baseline model M2 are matched with the behavioral feature information X respectively. The similarity data obtained is weighted to obtain the long-term and short-term behavioral feature matching similarity data, and then the authentication anomaly value is obtained, thus obtaining the first authentication result.

[0075] When the target behavior baseline model M includes a first behavior baseline model corresponding to a time scenario and a second behavior baseline model corresponding to a business type scenario, the first behavior baseline model and the second behavior baseline model can respectively include a long-term behavior baseline model and a short-term behavior baseline model. Accordingly, based on the long-term behavior baseline model and the short-term behavior baseline model in the first behavior baseline model, similarity matching is performed with the behavior feature information X to obtain the first similarity data and the second similarity data in the time scenario. Based on the long-term behavior baseline model and the short-term behavior baseline model in the second behavior baseline model, similarity matching is performed with the behavior feature information X to obtain the first similarity data and the second similarity data in the business type scenario. The first similarity data and the second similarity data in the time scenario and the first similarity data and the second similarity data in the business type scenario are weighted and processed to obtain comprehensive similarity data. Based on the comprehensive similarity data, authentication anomalies are determined, and then the first authentication result is obtained.

[0076] In the above embodiments, the first authentication result can be authentication success or authentication failure, and the magnitude of the authentication anomaly value can characterize the degree of deviation of the authentication behavior information and business behavior information collected in the current authentication process from the normal behavior pattern. The reason for the first authentication result being authentication failure can be due to a sudden change in the user's operational behavior characteristics, or an external malicious attack. A sudden change in the user's operational behavior characteristics can be caused by changes in the user's emotions. It is understood that for different user operational behavior characteristics, such as the mouse movement trajectory changing speed under different emotions, but the path logic remaining basically consistent, but under malicious attacks, it is a completely different movement pattern; for example, the operation timing characteristics, the overall response becomes faster / slower under different emotions, but the distribution remains continuous, but under malicious attacks, such as robot behavior exhibiting fixed intervals of operation. Therefore, it can be seen that authentication failures caused by different reasons have different characteristics, and verification is performed on these different characteristics in the case of behavioral authentication failure.

[0077] Optionally, in the event of authentication failure, the degree of deviation from the normal behavior pattern in the current authentication process is determined by the authentication anomaly value. If the authentication anomaly value is less than a second threshold, it indicates that the deviation from the normal behavior pattern in the current authentication process is small, and the authentication result can be updated through verification. If the authentication anomaly value is greater than or less than the second threshold, it indicates that the deviation from the normal behavior pattern in the current authentication process is large, and no verification is required. The second threshold is greater than the first threshold.

[0078] In some embodiments of this disclosure, the behavior authentication module 130 is further configured to: when the first authentication result is authentication failure and the authentication anomaly value is less than a second threshold, acquire behavior data from the pre-authentication stage, perform consistency determination based on the behavior data from the pre-authentication stage and the behavior data from the authentication stage, and obtain a behavior consistency determination result; wherein, the behavior data from the authentication stage includes the authentication behavior information and the business behavior information; and when the consistency determination result indicates consistency, update the first authentication result to authentication success.

[0079] In this embodiment, a pre-authentication behavior data set is maintained. This pre-authentication behavior data set includes user operation behavior information within a second set time window. The operation behavior information included in this pre-authentication behavior data set is not limited to behavior information corresponding to online services, but may also include behavior information corresponding to other services outside of online services. To distinguish between the service behavior information set and the pre-authentication behavior data set, the duration of the first set time window can be shorter than the duration of the second set time window. For example, the duration of the first set time window can be one hour, and the duration of the second time window can be ten minutes.

[0080] By extracting features from behavioral data in the pre-authentication phase, behavioral feature information for that phase is obtained. This pre-authentication phase behavioral feature information (Y) is then compared with the authentication phase behavioral feature information (X) for consistency verification. The authentication phase behavioral feature information can be understood as X obtained through feature extraction from authentication and business behavior information. This can be achieved by performing similarity matching between the pre-authentication phase behavioral feature information (Y) and the authentication phase behavioral feature information (X). If the similarity exceeds a set threshold, it is determined that the pre-authentication and authentication phase behavioral data are consistent, and the authentication failure is due to user emotional changes rather than malicious attacks. If the similarity does not exceed the threshold, it is determined that the pre-authentication and authentication phase behavioral data are inconsistent, indicating a risk of malicious attacks.

[0081] In this embodiment, by verifying the consistency of behavioral data in the pre-authentication and authentication stages, updates are made for cases of behavioral authentication failure, thereby improving authentication accuracy and avoiding authentication failures caused by changes in user behavior characteristics due to user emotions.

[0082] In some embodiments of this disclosure, the behavior authentication module 130 is further configured to: perform machine behavior authentication on the behavior feature information based on a trained machine behavior recognition model when the first authentication result is authentication failure and the authentication anomaly value is less than a second threshold, thereby obtaining a machine behavior authentication result; and update the first authentication result to authentication success when the machine behavior authentication result is non-machine behavior.

[0083] This machine behavior recognition model can be understood as a classification model capable of distinguishing between human and machine behavior. It can be trained using machine behavior information and human behavior information as sample data. By inputting the behavioral feature information extracted from authentication information and business behavior information into the machine behavior recognition model, the model classifies the behavioral feature information to determine whether the authentication information and business behavior information belong to machine behavior. For example, the output of the machine behavior recognition model can be 0 or 1, where 0 indicates that the authentication information and business behavior information do not belong to machine behavior, and 1 indicates that the authentication information and business behavior information do belong to machine behavior.

[0084] If the machine behavior authentication result is not machine behavior, it indicates that the authentication failure was caused by changes in the user's emotions, and there was no external malicious attack. The first authentication result is then updated to successful authentication. By determining machine behavior, the authentication failure is updated to improve accuracy and avoid authentication failures caused by changes in user behavior characteristics due to emotions.

[0085] Based on the above embodiments, the information authentication module 110 performs authentication processing on the authentication information obtained through the authentication interface. The information authentication module 110 pre-stores authentication logic corresponding to different authentication methods. Based on the authentication logic corresponding to different authentication methods, it performs authentication processing on the obtained authentication information to obtain a second authentication result. It can be understood that the information authentication module 110 also obtains authentication information corresponding to non-intrusive authentication methods such as location authentication, operation path authentication, and blockchain authentication. It performs authentication processing on the obtained authentication information using the authentication logic corresponding to these non-intrusive authentication methods to obtain the corresponding third authentication result.

[0086] Optionally, the integrated authentication module 140 obtains the first authentication result and the second authentication result to determine the target authentication result. Alternatively, the integrated authentication module 140 obtains the first authentication result, the second authentication result, and the third authentication result to determine the target authentication result. The integrated authentication module 140 obtains the target authentication result by weighted fusion of multiple authentication results.

[0087] In some embodiments of this disclosure, the business behavior collection unit 122 periodically collects business behavior information during the execution of online business, and the behavior authentication module 130 performs authentication processing on the business behavior information during the execution of online business through the target behavior baseline model corresponding to the application scenario, thereby realizing imperceptible periodic authentication during the execution of online business and ensuring network security during the execution of online business.

[0088] The technical solution of this disclosure embodiment collects authentication behavior information and business behavior information during the current response process of the client to the online service by the behavior collection module while the information authentication module obtains authentication information through the authentication interface. Simultaneously, the behavior authentication module performs behavior authentication on the acquired business behavior information and authentication behavior information while the information authentication module processes the authentication information. The target authentication result is obtained by combining the second authentication result of the information authentication and the first authentication result of the behavior authentication. Based on information authentication, a seamless behavior authentication process is added, improving authentication accuracy and enhancing the authentication experience and security of online services.

[0089] Figure 2 This is a flowchart of a security authentication method based on online business security provided in this embodiment. This embodiment is applicable to situations where online business security authentication is performed. This method can be executed by a security authentication system based on online business security, which can be implemented in hardware and / or software and can be configured in a server or server cluster. Figure 2 As shown, the method includes:

[0090] S210: Receive authentication requests from clients for online services and display the authentication interface.

[0091] S220. Obtain the authentication behavior information of the client performing the current authentication on the authentication interface.

[0092] S230. Obtain the business behavior information of the client in the current response process to the online service.

[0093] S240. Receive the authentication behavior information and the business behavior information; extract behavioral feature information based on the authentication behavior information and the business behavior information; determine a target behavioral baseline model from multiple pre-built behavioral baseline models based on the application scenario to which the current response process of the online business belongs; perform authentication processing on the behavioral feature information based on the target behavioral baseline model to obtain a first authentication result, wherein the multiple behavioral baseline models corresponding to the online business are constructed respectively from the historical behavioral information corresponding to the online business in multiple application scenarios.

[0094] S250: Receive authentication information input by the client through the authentication interface, perform authentication processing based on the authentication information to obtain a second authentication result; determine the target authentication result based on the first authentication result and the second authentication result.

[0095] Optionally, the authentication process is performed on the behavioral feature information based on the target behavior baseline model to obtain a first authentication result, including: extracting features based on the authentication behavioral information to obtain first feature information X. authentication Based on business behavior information, feature extraction is performed to obtain the second feature information X. business Wherein, the first feature information and the second feature information form the behavioral feature information X = (X authentication X business The process involves: matching the target behavior baseline model M with the behavior feature information X based on similarity; determining authentication anomalies based on similarity data, where the authentication anomaly value is 1-Similarity(M, X); determining the first authentication result as authentication failure when the authentication anomaly value is greater than or equal to a first threshold; and determining the first authentication result as authentication success when the authentication anomaly value is less than the first threshold.

[0096] Optionally, the target behavior baseline model includes a long-term behavior baseline model M1 and a short-term behavior baseline model M2; wherein, the long-term behavior baseline model M1 is constructed based on historical behavior information of a first time window corresponding to the business type of online business; the short-term behavior baseline model M2 is constructed based on historical behavior information of a second time window corresponding to the business type of online business; the duration of the first time window is greater than the duration of the second time window;

[0097] Optionally, the method further includes: performing similarity matching between the long-term behavioral baseline model M1 and the short-term behavioral baseline model M2 and the behavioral feature information X respectively to obtain first similarity data and second similarity data; determining an authentication anomaly value based on the first similarity data and the second similarity data, wherein the authentication anomaly value is 1-a*Similarity(M1, X)+b*Similarity(M2, X); where a and b are the weights of the first similarity data and the second similarity data respectively; determining the first authentication result as authentication failure when the authentication anomaly value is greater than or equal to a first threshold; and determining the first authentication result as authentication success when the authentication anomaly value is less than the first threshold.

[0098] Based on the above embodiments, optionally, the behavioral feature information includes at least one of the following: operation timing features, mouse movement curvature features, response time features, input pressure sensitivity features, and tap frequency features.

[0099] Optionally, based on the above embodiments, the method further includes: when the first authentication result is authentication failure and the authentication anomaly value is less than a second threshold, acquiring behavioral data from the pre-authentication stage, performing a consistency determination based on the behavioral data from the pre-authentication stage and the behavioral data from the authentication stage, and obtaining a behavioral consistency determination result; wherein the behavioral data from the authentication stage includes the authentication behavior information and the business behavior information; wherein the second threshold is greater than the first threshold; and when the consistency determination result indicates consistency, updating the first authentication result to authentication success.

[0100] Optionally, based on the above embodiments, the method further includes: when the first authentication result is authentication failure and the authentication anomaly value is less than a second threshold, performing machine behavior authentication on the behavior feature information based on a trained machine behavior recognition model to obtain a machine behavior authentication result; wherein the second threshold is greater than the first threshold; and when the machine behavior authentication result is non-machine behavior, updating the first authentication result to authentication success.

[0101] Based on the above embodiments, optionally, the method further includes: determining the authentication strength of the current authentication based on the risk intensity dimension and environmental security dimension of the online business; determining the authentication method combination of the current authentication based on the authentication strength of the current authentication, wherein the authentication method combination includes at least one of the following: verification code authentication, Turing authentication, biometric authentication, location authentication, operation path authentication, and blockchain authentication; wherein the biometric authentication includes at least one of the following: fingerprint authentication, facial authentication, iris authentication, and voiceprint authentication;

[0102] Each authentication method corresponds to an authentication strength value. The sum of the authentication strength values ​​of at least one authentication method in the combination of authentication methods is greater than the authentication strength of the current authentication. The at least one authentication method in the combination of authentication methods is obtained by random combination.

[0103] The technical solution of this embodiment collects authentication behavior information and business behavior information during the current response process of the client to the online service while obtaining authentication information through the authentication interface. Simultaneously, it performs authentication on the acquired business behavior information and authentication behavior information. The target authentication result is obtained by combining the second authentication result of information authentication and the first authentication result of behavior authentication. Based on information authentication, a seamless behavior authentication process is added, improving authentication accuracy and enhancing the authentication experience and security of online services.

[0104] Figure 3This is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0105] like Figure 3 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0106] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0107] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as security authentication methods based on online business security.

[0108] In some embodiments, the online business security-based authentication method can be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on electronic device 10 via read-only memory (ROM) 12 and / or communication unit 19. When the computer program is loaded into random access memory (RAM) 13 and executed by processor 11, one or more steps of the online business security-based authentication method described above can be performed. Alternatively, in other embodiments, processor 11 can be configured to perform the online business security-based authentication method by any other suitable means (e.g., by means of firmware).

[0109] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0110] Computer programs used to implement the online business security authentication method disclosed herein can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The computer programs can be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0111] This disclosure also provides a computer-readable storage medium storing computer instructions for causing a processor to execute a security authentication method based on online business security, the method comprising:

[0112] The system receives authentication requests from clients for online services and displays an authentication interface; it acquires authentication behavior information of the client performing the current authentication on the authentication interface; it acquires business behavior information of the client during the current response process to the online service; it receives the authentication behavior information and the business behavior information, and extracts behavioral feature information based on the authentication behavior information and the business behavior information; based on the application scenario to which the current response process of the online service belongs, it determines a target behavioral baseline model from multiple pre-built behavioral baseline models, and performs authentication processing on the behavioral feature information based on the target behavioral baseline model to obtain a first authentication result, wherein the multiple behavioral baseline models corresponding to the online service are constructed respectively from historical behavioral information corresponding to the online service in multiple application scenarios; it receives authentication information input by the client through the authentication interface, performs authentication processing on the authentication information to obtain a second authentication result; and it determines a target authentication result based on the first authentication result and the second authentication result.

[0113] In the context of this disclosure, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0114] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0115] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0116] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0117] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this disclosure can be achieved, and this is not limited herein.

[0118] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A security authentication system based on online business security, characterized in that, include: The system includes an information authentication module, a behavior collection module, a behavior authentication module, and a comprehensive authentication module, wherein the behavior collection module comprises a business behavior collection unit and an authentication behavior collection unit. The information authentication module receives authentication requests from clients for online services and displays the authentication interface; The authentication behavior acquisition unit obtains the authentication behavior information of the client performing the current authentication on the authentication interface; The business behavior collection unit acquires business behavior information of the client during the current response process to the online business; The behavior authentication module receives the authentication behavior information and the business behavior information, extracts behavior feature information based on the authentication behavior information and the business behavior information; determines a target behavior baseline model from multiple pre-built behavior baseline models based on the application scenario to which the current response process of the online business belongs, and performs authentication processing on the behavior feature information based on the target behavior baseline model to obtain a first authentication result. The multiple behavior baseline models corresponding to the online business are constructed from historical behavior information corresponding to the online business in multiple application scenarios. The information authentication module receives the authentication information input by the client, performs authentication processing based on the authentication information, and obtains a second authentication result; The integrated authentication module determines the target authentication result based on the first authentication result and the second authentication result.

2. The security authentication system according to claim 1, characterized in that, The behavior authentication module is specifically used for: Based on the authentication behavior information, feature extraction is performed to obtain the first feature information X. authentication Based on business behavior information, feature extraction is performed to obtain the second feature information X. business Wherein, the first feature information and the second feature information form the behavioral feature information X = (X authentication X business ); Similarity matching is performed between the target behavior baseline model M and the behavior feature information X, and authentication anomaly values ​​are determined based on the similarity data. The authentication anomaly value is 1-Similarity(M, X). When the authentication anomaly value is greater than or equal to the first threshold, the first authentication result is determined to be authentication failure; when the authentication anomaly value is less than the first threshold, the first authentication result is determined to be authentication success.

3. The security authentication system according to claim 2, characterized in that, The target behavior baseline model includes a long-term behavior baseline model M1 and a short-term behavior baseline model M2; wherein, the long-term behavior baseline model M1 is constructed based on the historical behavior information of the first time window corresponding to the business type of online business; the short-term behavior baseline model M2 is constructed based on the historical behavior information of the second time window corresponding to the business type of online business; the time length of the first time window is greater than the time length of the second time window; The behavior authentication module is specifically used to: perform similarity matching between the long-term behavior baseline model M1 and the short-term behavior baseline model M2 and the behavior feature information X respectively, to obtain first similarity data and second similarity data; An authentication anomaly is determined based on the first similarity data and the second similarity data. The authentication anomaly is 1-(a*Similarity(M1,X)+b*Similarity(M2,X)); where a and b are the weights of the first similarity data and the second similarity data, respectively. When the authentication anomaly value is greater than or equal to the first threshold, the first authentication result is determined to be authentication failure; when the authentication anomaly value is less than the first threshold, the first authentication result is determined to be authentication success.

4. The system according to any one of claims 1-3, characterized in that, The behavioral feature information includes at least one of the following: operation timing features, mouse movement curvature features, response time features, input pressure sensitivity features, and keystroke frequency features.

5. The security authentication system according to claim 2, characterized in that, The behavior authentication module is also used for: If the first authentication result is authentication failure and the authentication anomaly value is less than the second threshold, the behavioral data of the pre-authentication stage is obtained, and a consistency judgment is made based on the behavioral data of the pre-authentication stage and the behavioral data of the authentication stage to obtain a behavioral consistency judgment result; wherein, the behavioral data of the authentication stage includes the authentication behavior information and the business behavior information; wherein, the second threshold is greater than the first threshold; If the consistency determination result indicates that there is consistency, the first authentication result is updated to indicate successful authentication.

6. The security authentication system according to claim 2, characterized in that, The behavior authentication module is also used for: If the first authentication result is authentication failure and the authentication anomaly value is less than the second threshold, machine behavior authentication is performed on the behavior feature information based on the trained machine behavior recognition model to obtain a machine behavior authentication result; wherein, the second threshold is greater than the first threshold. If the machine behavior authentication result is non-machine behavior, update the first authentication result to successful authentication.

7. The system according to claim 1, characterized in that, The security authentication system also includes an authentication policy determination module, which is used to determine the authentication strength of the current authentication based on the risk intensity dimension and environmental security dimension of the online business. The authentication method combination for the current authentication is determined based on the authentication strength of the current authentication. The authentication method combination includes at least one of the following: CAPTCHA authentication, Turing authentication, biometric authentication, location authentication, operation path authentication, and blockchain authentication; the biometric authentication includes at least one of the following: fingerprint authentication, facial authentication, iris authentication, and voiceprint authentication. Each authentication method corresponds to an authentication strength value. The sum of the authentication strength values ​​of at least one authentication method in the combination of authentication methods is greater than the authentication strength of the current authentication. The at least one authentication method in the combination of authentication methods is obtained by random combination.

8. A security authentication method based on online business security, characterized in that, include: Receive authentication requests from clients for online services and display the authentication interface; Obtain the authentication behavior information of the client performing the current authentication on the authentication interface; Obtain business behavior information of the client during the current response process to the online service; Receive the authentication behavior information and the business behavior information, and extract behavioral feature information based on the authentication behavior information and the business behavior information; Based on the application scenario to which the current response process of the online service belongs, a target behavior baseline model is determined from multiple pre-built behavior baseline models. The behavior feature information is then authenticated based on the target behavior baseline model to obtain a first authentication result. The multiple behavior baseline models corresponding to the online service are constructed from the historical behavior information of the online service in multiple application scenarios. The system receives authentication information input by the client through the authentication interface, performs authentication processing based on the authentication information, and obtains a second authentication result; and determines a target authentication result based on the first authentication result and the second authentication result.

9. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the security authentication method based on online business security as described in claim 8.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the security authentication method based on online business security as described in claim 8.

Images