Internal user identity authentication method based on time-space characteristics of mouse

Abstract

The invention relates to the technical field of network and information security, in particular to an internal user identity authentication method based on mouse spatio-temporal characteristics, which comprises the following steps: acquiring mouse operation original data of an internal user, and preprocessing the original data to obtain processed data; based on the processed data, a feature extraction model is adopted to extract time sequence dynamic change features of mouse behaviors and space structure features in mouse tracks, feature fusion is carried out, and high-quality feature representation is obtained; the method comprises the steps of extracting feature representation, constructing an exclusive classifier for behavior differences of different users, dynamically adjusting an authentication threshold value through a behavior inertia quantification model, performing personalized authentication decision and realizing identity authentication, improves the security of identity authentication of internal users, enhances the sensitivity to behavior changes and potential threats, and improves the user experience. A safety protection barrier is provided for an information system, user identity management and behavior auditing are accurately carried out, the occurrence probability of internal threats is reduced, and the overall safety guarantee capability is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network and information security, and in particular to an internal user identity authentication method based on mouse spatiotemporal features. Background Art

[0002] In the existing field of internal threats, research generally focuses on the accuracy optimization of user abnormal behavior detection algorithms, but pays insufficient attention to the risk of internal threat users impersonating others by operating other people's devices or stealing other people's accounts, and does not fully consider the identity legitimacy issues during user operations.

[0003] In recent years, identity authentication technology based on mouse dynamic characteristics has shown good application prospects due to its advantages such as convenient data collection and high frequency of user behavior. However, it still faces the following two challenges: On the one hand, mouse behavior data often exhibits high-dimensional, nonlinear and strong time-dependent characteristics, and traditional feature extraction methods are difficult to effectively capture the complex nonlinear change patterns; on the other hand, there are significant individual differences in user behavior patterns, requiring the authentication system to have the ability to dynamically adjust the threshold to achieve accurate adaptation to different user behavior patterns.

[0004] Therefore, how to utilize the dynamic characteristics of the mouse to design a high-precision and highly adaptable internal user authentication method is an urgent problem to be solved. Summary of the Invention

[0005] The purpose of the present invention is to provide an internal user identity authentication method based on the spatiotemporal characteristics of the mouse, aiming to deeply model the user mouse behavior data from the two dimensions of time and space, and provide key features for the implementation of identity authentication.

[0006] To achieve the above object, the present invention provides an internal user identity authentication method based on mouse spatiotemporal characteristics, comprising the following steps:

[0007] Collecting raw mouse operation data of internal users and preprocessing the raw data to obtain processed data;

[0008] Based on the processed data, a feature extraction model is used to extract the temporal dynamic change features of the mouse behavior and the spatial structural features in the mouse trajectory, and feature fusion is performed to obtain a high-quality feature representation;

[0009] The feature representation is extracted, and exclusive classifiers are constructed separately according to the behavioral differences of different users. The authentication threshold is dynamically adjusted through the behavioral inertia quantification model to make personalized authentication decisions and realize identity authentication.

[0010] The preprocessing includes data cleaning, conversion and organization.

[0011] The purpose of pre-processing the original data is to remove invalid or abnormal data and to standardize the mouse operation data of different users.

[0012] Among them, the feature extraction model includes a switching long short-term memory module and a hybrid depth separation convolution module. The switching long short-term memory module is used to capture the temporal dynamic change characteristics in mouse behavior data, and is particularly good at extracting long-term dependencies. The hybrid depth separation convolution module is used to extract the spatial structural features in the mouse trajectory, and uses multi-scale convolution kernels to capture spatial information from different scales.

[0013] Among them, the identity authentication includes inputting the deep feature representation obtained through the feature extraction model into the lonely forest classifier for verification. If the feature is judged to be normal behavior, the current user identity authentication is considered to have passed; otherwise, if it is judged to be abnormal behavior, it is marked as identity authentication failure and a potential threat behavior is prompted.

[0014] The present invention discloses an internal user identity authentication method based on mouse spatiotemporal features. The method collects raw mouse operation data of internal users and preprocesses the raw data to obtain processed data. Based on the processed data, a feature extraction model is used to extract the temporal dynamic change characteristics of mouse behavior and the spatial structural characteristics of mouse trajectory, and these are fused to obtain a high-quality feature representation. The feature representation is extracted, and exclusive classifiers are constructed separately for the behavioral differences of different users. The authentication threshold is dynamically adjusted through a behavioral inertia quantification model to make personalized authentication decisions and realize identity authentication. The method can significantly improve the accuracy and robustness of identity authentication by deeply mining the spatiotemporal features of user mouse operations. First, by collecting and preprocessing user mouse operation data, a window partitioning strategy based on the number of mouse operations is adopted to ensure uniform input sample length. Second, a feature extraction model, sLSTM-MixConv, is constructed based on the PyTorch framework, and the preprocessed data is input into the model for training. Next, the mouse behavior data of all users is input into the sLSTM-MixConv feature extraction model to effectively extract the temporal information and spatial features of each user's mouse operation process, obtaining a deep feature representation corresponding to each user. Finally, for each user, the feature vector corresponding to their normal behavior data is used as input sample to train a dedicated IForest model, constructing a personalized anomaly detection mechanism to achieve identity authentication. Through these steps, identity authentication using internal user mouse operation data is achieved, which not only improves the security of internal user authentication but also enhances sensitivity to behavioral changes and potential threats, providing a more solid security barrier for information systems. This allows enterprises to more accurately manage user identities and conduct behavioral audits, reduce the probability of internal threats, and enhance overall security capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0016] Figure 1 This is the overall idea of ​​the internal user identity authentication method based on the mouse's spatiotemporal characteristics.

[0017] Figure 2 This is the architecture diagram of the internal user authentication method based on the mouse's spatiotemporal characteristics.

[0018] Figure 3 This is the sLSTM network structure diagram.

[0019] Figure 4 This is the MixConv network structure diagram.

[0020] Figure 5 This is a flow chart of an internal user authentication method based on mouse spatiotemporal features.

[0021] Figure 6 It is a cluster scatter plot of user mouse feature data, where (A) is the original feature cluster scatter plot and (B) is the original feature cluster scatter plot.

[0022] Figure 7 This is a comparison chart of the effects of sLSTM and LSTM models.

[0023] Figure 8 This is a flow chart of an internal user identity authentication method based on mouse spatiotemporal characteristics provided by the present invention. DETAILED DESCRIPTION

[0024] The following describes embodiments of the present invention in detail, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present invention, and are not to be construed as limiting the present invention.

[0025] See also Figures 1 to 8 The present invention provides an internal user identity authentication method based on the spatiotemporal characteristics of a mouse, comprising the following steps:

[0026] S1 collects raw data of mouse operations of internal users and pre-processes the raw data to obtain processed data;

[0027] In an embodiment of the present invention, first, the raw mouse behavior data needs to go through a series of data preprocessing steps to ensure the integrity and consistency of the data. Data cleaning, conversion and organization are the core tasks of this stage. In this process, data preprocessing can solve two problems: one is to remove invalid or abnormal data, and the other is to standardize the mouse operation data of different users. Since the number of mouse operations generated by different users in the same time interval may be different, in order to ensure the uniformity of the input data, a window division strategy based on the number of mouse operations is adopted rather than a division based on a fixed time length. Eliminate training instability caused by differences in behavior density and ensure that the operation data of each user has a consistent input sample length.

[0028] S2 extracts temporal dynamic change features of mouse behavior and spatial structural features in mouse trajectory using a feature extraction model based on the processed data, and performs feature fusion to obtain high-quality feature representation;

[0029] In an embodiment of the present invention, after data preprocessing is completed, the method constructs an sLSTM-MixConv feature extraction model based on the PyTorch framework. The model adopts a multi-branch feature extraction structure, including two core modules: sLSTM (switched long short-term memory) and MixConv (mixed depth separation convolution). Among them, the sLSTM module effectively alleviates the gradient information reflux blocking problem existing in traditional RNN when processing long sequence data by introducing a switching mechanism inside the LSTM unit. It is used to capture the temporal dynamic change characteristics in mouse behavior data and is particularly good at extracting long-term dependencies; while the MixConv module focuses on extracting spatial structural features in mouse trajectories and uses multi-scale convolution kernels to capture spatial information from different scales. The two modules work independently, but ultimately effectively fuse the features they extract to form a unified and rich user behavior feature representation, providing high-quality input vectors for subsequent identity authentication.

[0030] sLSTM is improved from LSTM. Although LSTM has shown strong capabilities in processing sequence data, it still has limitations in modeling long sequences. Specifically, LSTM often encounters the problem of gradient vanishing or gradient exploding when modeling long sequences. This is because the gradient will be continuously weakened by various gate functions and nonlinear activations during the layer-by-layer propagation process. Therefore, the present invention proposes a switching long short-term memory network sLSTM. By introducing a switching mechanism, sLSTM adds a "shortcut" between the input and output of each layer, so that when the network is back-propagating, part of the gradient can bypass the gate structure and be directly transmitted back, thereby effectively enhancing the fluidity and accessibility of the gradient information, and reducing the risk of gradient attenuation or explosion layer by layer in deep networks. Ultimately, the trainability and training efficiency of the model are improved. Its structure is as follows Figure 3 shown.

[0031] At time t, the output hidden state of LSTM is h t , while sLSTM adds a switching gate s t , and get the final output Where W s is the weight matrix, b s is a weight matrix. t represents the input at the current moment, σ(·) represents the activation function sigmoid, h t-1 Indicates the hidden state of the previous moment, h t Represents the hidden state of the current output. The calculation formula is as follows:

[0032] s t =σ(W s ·[h t-1 ,x t ]+b s ) (1)

[0033]

[0034] Although the improved sLSTM effectively solves the temporal modeling problem in mouse behavior features and captures the long-term dependencies of user behaviors, it still has limitations in extracting spatial features. Specifically, mouse operation data not only has significant temporal features, but also contains complex spatial structure information. These spatial features are an important part of user operation patterns. In order to comprehensively extract the spatiotemporal features of mouse behavior, the present invention further introduces the MixConv network. By combining multiple convolution kernels of different sizes in parallel in the deep convolution stage, the synchronous capture of small-scale and large-scale features is achieved, and the local and global spatial information in the mouse trajectory is extracted. Its network architecture is as follows: Figure 4 shown.

[0035] The mathematical expression of ordinary convolution is:

[0036]

[0037] where X (h,w,c) Represents the input feature map, h, w, c represent the height, width and number of channels of the feature map respectively. (k,c,m) Represents the depth of the convolution kernel, k represents the size of the convolution kernel. m·c represents the number of channels of the output feature map. In MixConv, the input feature map is divided into multiple feature maps according to the channel, that is, The height and width of all feature subgraphs are consistent, c i The sum is c. The corresponding convolution kernel W (k,c,m) Also split into Its mathematical expression is:

[0038]

[0039] In this step, the MixConv layer has 2 input channels (corresponding to the mouse coordinates x and y), and the output channels are set to 32. This layer uses three different convolution kernel sizes (1, 3, and 5) and an average partitioning strategy for convolution. Finally, the generated feature map is subjected to dimensionality reduction through adaptive average pooling.

[0040] S3 extracts the feature representation, builds a dedicated classifier based on the behavioral differences of different users, and dynamically adjusts the authentication threshold through a behavioral inertia quantification model to make personalized authentication decisions and achieve identity authentication.

[0041] In an embodiment of the present invention, after completing the training of the feature extraction model, the next step is to train the individual authentication model. First, the mouse behavior data of all users are input into the trained sLSTM-MixConv feature extraction model to obtain the deep feature representation corresponding to each user. Then, for each user, the present invention uses the feature vector of its normal behavior data as input to train a dedicated IForest model. The model identifies abnormal behaviors that are different from the user's normal behavior patterns through an anomaly detection mechanism. Specifically, the present invention uses the IsolationForest class in scikit-learn to train the model, and uses its efficient training and deployment capabilities to establish a personalized identity authentication mechanism for each user. When the user performs a mouse operation, the mouse behavior data collected in real time will be input into the trained sLSTM-MixConv feature extraction model to extract the deep feature representation of the current operation. Subsequently, the extracted feature vector will be sent to the personalized IForest model of the corresponding user for identity authentication. If the feature is judged to be normal behavior, the system considers that the current user identity authentication has passed; otherwise, if it is judged to be abnormal behavior, the system will mark it as an identity authentication failure and prompt potential threatening behavior. The specific process is as follows Figure 5 shown.

[0042] In order to verify the effectiveness of the sLSTM-MixConv feature extraction model in improving the expression of mouse behavior features, this paper compares the original mouse feature data with the mouse feature data after feature extraction through cluster analysis. Figure 6 As shown, Figure 6 (a) is the cluster distribution of the original feature data, Figure 6(b) shows the result after feature extraction using the sLSTM-MixConv model. Comparison reveals that after sLSTM-MixConv feature extraction, the data distribution in the new feature space is clearer, and the originally overlapping and ambiguous data becomes more hierarchical and structured in the feature space. The degree of data clustering for the same user is significantly improved, indicating that the model effectively captures the stable characteristics of user behavior and enhances intra-cluster cohesion. The spacing between data samples after feature extraction is significantly increased, and the boundaries between different users are clearer, improving the discriminative ability of clustering and contributing to the recognition performance of subsequent identity authentication models.

[0043] In order to verify the effectiveness of the sLSTM model after the introduction of the switching mechanism in the identity authentication task, this paper compares the performance of sLSTM and traditional LSTM in terms of AUC, EER, parameter quantity and recognition time. Figure 7 As shown, sLSTM achieves a 7.6% improvement in AUC and a more than 5-fold reduction in EER over LSTM, demonstrating significant advantages in recognition accuracy and robustness. This is due to the switching mechanism optimizing the gradient information return path, thereby enhancing its ability to extract long-sequence features. Regarding authentication time and parameter count, despite a 17% increase in parameters compared to LSTM, the authentication phase only takes less than one second longer than LSTM, a negligible difference. This indicates that the computational overhead of sLSTM during the actual authentication phase does not increase significantly, allowing it to complete authentication in a relatively short time.

[0044] We also conducted ablation experiments on the various modules of the proposed method, with the results shown in Table 1. Table 1 demonstrates the impact of different components on the performance of the authentication model. The internal user authentication method based on mouse spatiotemporal features consists of three key modules: the sLSTM module, the MixConv module, and the IForest module.

[0045] Table 1 Impact of each model component on performance

[0046]

[0047] The present invention provides an internal user identity authentication method based on the spatiotemporal characteristics of the mouse. By introducing a switching mechanism inside the LSTM unit, it effectively alleviates the gradient information backflow blocking problem existing in the traditional RNN when processing long sequence data, and significantly improves the model's ability to capture the contextual dependencies of long sequence data, thereby improving the extraction effect of the temporal characteristics of the mouse behavior; it adopts the sLSTM-MixConv dual-domain feature learning architecture, which combines the advantages of sLSTM in temporal data modeling with the ability of MixConv in multi-scale spatial feature extraction, and effectively overcomes the limitations of traditional models in capturing complex spatiotemporal behavior characteristics. In the time domain, the user's long-term mouse operation habits can be better captured by utilizing the improved sLSTM, while in the spatial domain, the MixConv convolutional network branch is good at extracting spatial structural information in the mouse trajectory. The combination of the two significantly improves the accuracy and stability of user behavior characteristics, laying a solid foundation for the subsequent identity authentication stage. This method uses the sLSTM-MixConv network to uniformly extract the deep spatiotemporal feature expression of mouse behavior, and then uses the IForest algorithm to build a unique classifier for each user. It also dynamically adjusts the authentication threshold through a behavioral inertia quantification model to achieve personalized authentication decisions, accurately identify the mouse operation patterns of different users, and effectively improve the accuracy and scenario applicability of the identity authentication method.

[0048] What is disclosed above is only a preferred embodiment of the internal user identity authentication method based on the spatiotemporal characteristics of the mouse of the present invention. Of course, this cannot be used to limit the scope of rights of the present invention. Ordinary technicians in this field can understand that implementing all or part of the processes of the above embodiment and making equivalent changes in accordance with the claims of the present invention still fall within the scope of the invention.

Claims

1. An internal user identity authentication method based on mouse spatiotemporal characteristics, characterized in that: The following steps are involved: Collecting raw mouse operation data of internal users and preprocessing the raw data to obtain processed data; Based on the processed data, a feature extraction model is used to extract the temporal dynamic change features of the mouse behavior and the spatial structural features in the mouse trajectory, and feature fusion is performed to obtain a high-quality feature representation; The feature representation is extracted, and exclusive classifiers are constructed separately according to the behavioral differences of different users. The authentication threshold is dynamically adjusted through the behavioral inertia quantification model to make personalized authentication decisions and realize identity authentication.

2. The internal user identity authentication method based on mouse spatiotemporal characteristics as claimed in claim 1, characterized in that ； The preprocessing includes data cleaning, conversion and organization.

3. The internal user identity authentication method based on the mouse spatiotemporal characteristics as claimed in claim 1, It is characterized by: The purpose of pre-processing the raw data is to remove invalid or abnormal data and to standardize the mouse operation data of different users.

4. The internal user identity authentication method based on mouse spatiotemporal characteristics as claimed in claim 1, It is characterized by: The feature extraction model includes a switching long short-term memory module and a hybrid depth separation convolution module. The switching long short-term memory module is used to capture the temporal dynamic change characteristics in mouse behavior data, and is particularly good at extracting long-term dependencies. The hybrid depth separation convolution module is used to extract the spatial structural features in the mouse trajectory and uses multi-scale convolution kernels to capture spatial information from different scales.

5. The internal user identity authentication method based on mouse spatiotemporal characteristics as claimed in claim 1, characterized in that ； The identity authentication includes inputting the deep feature representation obtained by the feature extraction model into the lonely forest classifier for verification. If the feature is judged to be normal behavior, the current user identity authentication is considered to have passed; otherwise, if it is judged to be abnormal behavior, it is marked as identity authentication failure and a potential threat behavior is prompted.

Images