Web authentication enhancement method and system based on user behavior analysis

Abstract

The invention relates to the technical field of network security, in particular to a Web authentication enhancement method and system based on user behavior analysis, and the method comprises the following steps: collecting multi-dimensional behavior data of a user, including login behavior data, access behavior data, operation behavior data and equipment fingerprint data; predefining a behavior rule base comprising a login time limit rule, an equipment fingerprint matching rule, an access frequency threshold rule and an operation path compliance rule; the method has the beneficial effects that the system can timely discover and prevent potential security threats, such as cross-site script attack, SQL injection attack, unauthorized access and the like, through predefined behavior rules and real-time comparison of user behaviors. The collection and analysis of the multi-dimensional behavior data enable the system to more comprehensively understand the behavior characteristics of the user, thereby improving the accuracy of authentication.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a web authentication enhancement method and system based on user behavior analysis. Background Technology

[0002] With the rapid development of internet technology, web applications have become an indispensable part of people's daily lives and work. However, web authentication, as the first line of defense in network security, faces numerous security threats, such as cross-site scripting (XSS) attacks, SQL injection attacks, and unauthorized access. Traditional web authentication methods mainly rely on static information such as usernames and passwords, which are easily cracked by attackers through brute-force attacks, phishing attacks, and other means, leading to the leakage of sensitive user information or malicious damage to the system.

[0003] To enhance security, existing technologies have introduced improved solutions such as two-factor authentication and role-based access control (RBAC). However, two-factor authentication requires additional user actions (such as SMS verification codes and biometric identification), significantly increasing operational complexity and reducing user experience; while RBAC can achieve hierarchical permission management, its static permission model is difficult to adapt to dynamically changing user behavior patterns (such as irregular operations and abnormal access times), and cannot effectively identify spoofing attacks or internal threats.

[0004] In recent years, behavioral analysis technology has been increasingly applied to the field of web authentication. Existing solutions, particularly machine learning-based methods, rely heavily on large amounts of labeled data to train models, leading to cold-start problems and a lack of transparency in the model's decision-making process (e.g., black-box algorithms struggle to explain the basis for anomaly detection). Furthermore, while traditional rule engines perform behavior matching through pre-defined rules, rule base updates depend on manual maintenance, making it difficult to respond promptly to the dynamic evolution of new attack methods or user behavior patterns.

[0005] The main shortcomings of existing technologies include: 1. Limitations of static protection mechanisms: relying on fixed credentials or permission configurations, they cannot resist continuous attacks after credential leakage; 2. Single behavioral feature analysis: lacking integrated analysis of multi-dimensional behavioral features such as user operating habits, device fingerprints, and access sequence; 3. Insufficient adaptive capabilities: rule updates lag behind threat changes, machine learning solutions require complex training and have a high false positive rate; 4. Conflict between security and efficiency: strengthening security measures (such as frequent two-factor authentication) leads to a significant decline in user experience.

[0006] The aforementioned issues make it difficult for existing technologies to balance security strength and system usability, necessitating a solution capable of dynamically sensing user behavior and adjusting authentication strategies in real time. This invention utilizes rule-based multi-dimensional behavior analysis technology to achieve high-precision anomaly detection and adaptive authentication strategy optimization without requiring complex model training, effectively overcoming the limitations of traditional methods. Summary of the Invention

[0007] The purpose of this invention is to provide a Web authentication enhancement method and system based on user behavior analysis to solve the problems mentioned in the background art.

[0008] To achieve the above objectives, the present invention provides the following technical solution: a Web authentication enhancement method based on user behavior analysis, comprising the following steps:

[0009] (a) Collect multi-dimensional user behavior data, including login behavior data, access behavior data, operation behavior data and device fingerprint data;

[0010] (b) A predefined behavioral rule library that includes login time restriction rules, device fingerprint matching rules, access frequency threshold rules, and operation path compliance rules;

[0011] (c) Compare the current user behavior data with the behavior rule base in real time to generate a behavior matching score;

[0012] (d) Execute authentication decisions based on the behavior matching score, the authentication decisions including: directly granting authentication, triggering secondary verification, or blocking access;

[0013] (e) Dynamically adjust the rule thresholds of the behavior rule base based on user historical behavior data, and optimize the rule weights through a self-learning mechanism.

[0014] Preferably, in step (a): login behavior data includes login timestamp and login geographic location information; device fingerprint data is collected through browser API, including browser version, operating system type and screen resolution.

[0015] Preferably, the behavior matching score in step (c) is generated by assigning a first weight to the device fingerprint matching result; assigning a second weight to the operation path compliance detection result; and calculating the final score by combining the weights.

[0016] Preferably, the dynamic adjustment in step (e) includes: relaxing the login time limit for users who log in continuously without any abnormalities; and correcting the rule thresholds in reverse based on the misjudgment logs.

[0017] A system for enhancing web authentication based on user behavior analysis includes:

[0018] The data acquisition module is used to collect behavioral data in step (a).

[0019] The rules management module is used to store and configure the behavioral rules library in step (b);

[0020] The behavior analysis engine is used to perform the behavior matching score calculation in step (c);

[0021] The certification decision unit is used to implement the certification decision in step (d);

[0022] The self-learning optimization module is used to dynamically adjust the rule base in step (e).

[0023] Preferably, the data acquisition module includes:

[0024] The front-end data collection unit uses JavaScript to collect device fingerprints and user behavior data.

[0025] The backend log parsing unit extracts access frequency and page dwell time from the server logs.

[0026] Preferably, the self-learning optimization module includes:

[0027] The rule weight calculation submodule dynamically adjusts the influence coefficient of each rule based on historical behavior data.

[0028] The whitelist management submodule automatically adds verified device fingerprints to the trusted list.

[0029] Compared with the prior art, the beneficial effects of the present invention are:

[0030] This invention proposes a web authentication enhancement method and system based on user behavior analysis. By introducing rule-based behavior analysis technology, the web authentication enhancement scheme of this invention significantly improves the security and reliability of authentication. Through predefined behavior rules and real-time comparison of user behavior, the system can promptly detect and prevent potential security threats, such as cross-site scripting attacks, SQL injection attacks, and unauthorized access. The collection and analysis of multi-dimensional behavior data enables the system to gain a more comprehensive understanding of user behavior characteristics, thereby improving authentication accuracy. The dynamic behavior rule adjustment mechanism and self-learning mechanism allow the system to adopt different authentication strategies according to different user behavior patterns and security needs, ensuring both security and improving user experience. The introduction of a rule update module allows the system to easily adapt to new security policies or changes in user behavior patterns, enhancing the system's maintainability and scalability. Attached Figure Description

[0031] Figure 1 This is a system block diagram of the present invention. Detailed Implementation

[0032] To make the objectives, technical solutions, and advantages of the present invention clear and complete, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only some, not all, embodiments of the present invention, and are merely illustrative of the embodiments of the present invention. They are not intended to limit the embodiments of the present invention. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0033] Example 1, please refer to Figure 1 This invention provides a technical solution: a web authentication enhancement method based on user behavior analysis, comprising the following steps:

[0034] (I) Data Acquisition

[0035] Data collection is responsible for comprehensively collecting multi-dimensional behavioral data such as user login, access, operation, and device fingerprints.

[0036] 1. Login behavior data collection

[0037] When a user logs into a web application, the system collects information such as the user's login time, login location (obtained through IP address, GPS location, or network operator information), and login device (such as device type, operating system version, browser type, etc.) through the front-end page or back-end server.

[0038] Content collected:

[0039] Login time: accurate to the second, recording the specific time of each user's login (e.g., 14:30:05 on October 25, 2023).

[0040] Login location: The city (e.g., Beijing) is resolved by the user's device IP address. Mobile devices also obtain GPS location (e.g., latitude and longitude coordinates).

[0041] Device information: Record the browser name (e.g., Chrome 116), operating system version (e.g., Windows 11), and device type (e.g., mobile phone / computer).

[0042] Implementation: When a user clicks the login button, the front end automatically records the above information and transmits it to the server in encryption.

[0043] 2. Access behavior data collection

[0044] During a user's access to a web application, the system collects information such as the user's access path, access frequency, and dwell time through the backend server's log recording function.

[0045] Content collected:

[0046] Access path: Records the order in which users browse pages (e.g., homepage → product page → payment page).

[0047] Access frequency: Counts the number of times a user visits the page per hour (e.g., refreshing the page 10 times within 5 minutes).

[0048] Dwell time: Calculates the length of time a user stays on each page (e.g., 2 minutes and 30 seconds on the payment page).

[0049] Implementation: Record the start time when the page loads, and calculate and upload the dwell time when leaving the page.

[0050] 3. Operational behavior data collection

[0051] Data on user actions such as clicks, form filling, and file uploads / downloads can be collected through JavaScript code on the front-end page or monitoring functions on the back-end server.

[0052] Content collected: Click operations: Record the order in which users clicked buttons (e.g., clicking "Search" first and then "Filter").

[0053] Input habits: Statistically analyze the speed at which users type their passwords (e.g., 2 characters per second) and the number of errors (e.g., 3 consecutive incorrect attempts).

[0054] File operations: Record the type (e.g., PDF document) and size (e.g., 10MB) of uploaded / downloaded files.

[0055] Implementation method: An embedded script in the page listens for user operations in real time and generates logs.

[0056] 4. Device fingerprint data collection

[0057] The system collects user device fingerprint information, such as browser type, operating system version, screen resolution, and font settings, through JavaScript code on the front-end page. This information can be used to identify the user's device identity and prevent device spoofing or impersonation attacks.

[0058] Data collected includes: Device characteristics such as screen resolution (e.g., 1920×1080), browser plugin list (e.g., AdBlock plugin installed), and system fonts (e.g., Microsoft YaHei).

[0059] Implementation: A unique device identifier is generated when a user logs in for the first time, and the identifier is compared with the device identifier for subsequent logins.

[0060] (II) Construction of Behavioral Rule Base

[0061] The behavior rule library is built to predefine and manage a set of detailed behavior rules to adapt to changes in security policies and user behavior patterns.

[0062] 1. Predefined behavioral rules

[0063] Based on security policies and user behavior patterns, the system predefines a series of detailed and specific behavioral rules. Here are some example rules:

[0064] Login time rules: Users can only log in to the web application during normal working hours (such as 9:00-18:00 from Monday to Friday).

[0065] Login location rules: The user's login IP address or GPS location must be within the preset frequently used location range.

[0066] Access frequency rule: The number of times a user accesses a service within a unit of time (e.g., per hour) cannot exceed a preset threshold.

[0067] Click operation rules: The order in which users click on a specific page or function must conform to a preset pattern.

[0068] Page dwell time rule: The time a user spends on each page must be within a preset range.

[0069] Input habit rules: Users' keyboard input speed, error rate, and specific input patterns (such as password input habits) must conform to preset standards.

[0070] Device fingerprint rules: The user's device fingerprint information must match the information in the preset device fingerprint database.

[0071] 2. Rule storage and management

[0072] Predefined behavioral rules are stored in a database, and a management interface for these rules is provided. Administrators can easily add, delete, modify, and query behavioral rules through this interface to adapt to new security policies or changes in user behavior patterns.

[0073] (III) Behavioral Analysis

[0074] Behavioral analysis performs feature extraction, pattern recognition, and abnormal behavior detection on the collected behavioral data.

[0075] 1. Behavioral Feature Extraction

[0076] Feature extraction is performed on the collected multi-dimensional behavioral data, transforming the raw data into feature vectors that can be used for behavioral analysis and authentication decisions.

[0077] 2. Behavioral Pattern Recognition

[0078] Behavioral analysis algorithms (such as rule-based matching algorithms and clustering algorithms) are used to perform pattern recognition on the extracted behavioral features to determine whether the user's behavioral patterns are normal.

[0079] 3. Abnormal behavior detection

[0080] If a user's behavior pattern does not conform to predefined behavior rules (e.g., occasional logins outside of working hours, unfamiliar devices, high-frequency operations, etc.), it is considered abnormal behavior. The system will record the abnormal behavior information and trigger the corresponding security response mechanism (e.g., alarms, blocking access, requiring the user to perform additional verification, etc.).

[0081] (iv) Certification

[0082] When a user initiates an authentication request, the system compares the user's current behavior with pre-stored behavior rules and makes an authentication decision, while also supporting dynamic rule adjustments.

[0083] 1. Behavioral comparison

[0084] When a user initiates an authentication request, the system compares the user's current behavior with pre-stored behavioral rules. The comparison process includes comprehensive analysis of multi-dimensional behavioral data.

[0085] 2. Certification Decision

[0086] Based on the comparison results, the system makes an authentication decision. If the user's current behavior conforms to all predefined behavior rules, it is considered normal behavior, and the user is allowed to log in; if it does not conform to any rule, it is considered abnormal behavior, and the authentication request is rejected or the user is required to perform additional verification.

[0087] 3. Dynamic rule adjustment

[0088] Based on users' historical behavior data and changes in security policies, the system dynamically adjusts behavior rules. For example, if a user frequently logs into the web application outside of working hours and behaves normally, the system can automatically adjust the login time rules to adapt to changes in user behavior.

[0089] (V) Self-learning

[0090] The self-learning mechanism continuously learns new patterns from user behavior data, automatically updates the behavior rule base, and optimizes behavior analysis algorithms and authentication models.

[0091] 1. Behavioral pattern learning

[0092] The system continuously learns new behavioral patterns from user behavior data and automatically updates its behavior rule base. For example, if a user frequently uses a new device or browser to access web applications, the system can automatically add the device or browser's fingerprint information to the device fingerprint rule base.

[0093] 2. Model Optimization

[0094] Based on user feedback and security incident statistics, the system continuously optimizes behavior analysis algorithms and authentication models to improve the accuracy and reliability of authentication. If a rule frequently misjudges (e.g., logins are always blocked on weekends), the system automatically lowers the priority of that rule.

[0095] (vi) Rule Update

[0096] 1. Manual update by administrator

[0097] Administrators can manually update behavior rules through the management interface. For example, when a company relocation causes a change in commonly used login locations, the administrator can update the login location rules to adapt to the new environment.

[0098] 2. Automatic update prompt

[0099] The system can automatically prompt administrators to update behavior rules based on users' historical behavior data and changes in security policies. For example, if a user's behavior pattern changes significantly (such as a sudden increase in access frequency outside of working hours), the system can prompt the administrator to check and update the corresponding behavior rules.

[0100] Example 2, based on Example 1, proposes a system for enhancing Web authentication based on user behavior analysis, comprising:

[0101] (I) Data Acquisition Module

[0102] The data acquisition module is responsible for comprehensively collecting multi-dimensional behavioral data such as user login, access, operation, and device fingerprints.

[0103] 1. Login behavior data collection

[0104] When a user logs into a web application, the system collects information such as the user's login time, login location (obtained through IP address, GPS location, or network operator information), and login device (such as device type, operating system version, browser type, etc.) through the front-end page or back-end server.

[0105] Content collected:

[0106] Login time: accurate to the second, recording the specific time of each user's login (e.g., 14:30:05 on October 25, 2023).

[0107] Login location: The city (e.g., Beijing) is resolved by the user's device IP address. Mobile devices also obtain GPS location (e.g., latitude and longitude coordinates).

[0108] Device information: Record the browser name (e.g., Chrome 116), operating system version (e.g., Windows 11), and device type (e.g., mobile phone / computer).

[0109] Implementation method:

[0110] When a user clicks the login button, the front end automatically records the above information and transmits it to the server in encryption.

[0111] 2. Access behavior data collection

[0112] During a user's access to a web application, the system collects information such as the user's access path, access frequency, and dwell time through the backend server's log recording function.

[0113] Content collected:

[0114] Access path: Records the order in which users browse pages (e.g., homepage → product page → payment page).

[0115] Access frequency: Counts the number of times a user visits the page per hour (e.g., refreshing the page 10 times within 5 minutes).

[0116] Dwell time: Calculates the length of time a user stays on each page (e.g., 2 minutes and 30 seconds on the payment page).

[0117] Implementation method:

[0118] Record the start time when the page loads, and calculate and upload the dwell time when leaving the page.

[0119] 3. Operational behavior data collection

[0120] Data on user actions such as clicks, form filling, and file uploads / downloads can be collected through JavaScript code on the front-end page or monitoring functions on the back-end server.

[0121] Content collected:

[0122] Click action: Record the order in which the user clicks the buttons (e.g., click "Search" first and then "Filter").

[0123] Input habits: Statistically analyze the speed at which users type their passwords (e.g., 2 characters per second) and the number of errors (e.g., 3 consecutive incorrect attempts).

[0124] File operations: Record the type (e.g., PDF document) and size (e.g., 10MB) of uploaded / downloaded files.

[0125] Implementation method:

[0126] The page embeds a script to monitor user actions in real time and generate logs.

[0127] 4. Device fingerprint data collection

[0128] The system collects user device fingerprint information, such as browser type, operating system version, screen resolution, and font settings, through JavaScript code on the front-end page. This information can be used to identify the user's device identity and prevent device spoofing or impersonation attacks.

[0129] Content collected:

[0130] Device characteristics: screen resolution (e.g., 1920×1080), browser plugin list (e.g., AdBlock plugin installed), system font (e.g., Microsoft YaHei).

[0131] Implementation method:

[0132] A unique device identifier is generated when a user logs in for the first time, and subsequent logins are compared to see if the identifier is consistent.

[0133] (II) Behavior Rule Base Construction Module

[0134] The behavior rule library building module is used to predefine and manage a set of detailed behavior rules to adapt to changes in security policies and user behavior patterns.

[0135] 1. Predefined behavioral rules

[0136] Based on security policies and user behavior patterns, the system predefines a series of detailed and specific behavioral rules. Here are some example rules:

[0137] Login time rules: Users can only log in to the web application during normal working hours (such as 9:00-18:00 from Monday to Friday).

[0138] Login location rules: The user's login IP address or GPS location must be within the preset frequently used location range.

[0139] Access frequency rule: The number of times a user accesses a service within a unit of time (e.g., per hour) cannot exceed a preset threshold.

[0140] Click operation rules: The order in which users click on a specific page or function must conform to a preset pattern.

[0141] Page dwell time rule: The time a user spends on each page must be within a preset range.

[0142] Input habit rules: Users' keyboard input speed, error rate, and specific input patterns (such as password input habits) must conform to preset standards.

[0143] Device fingerprint rules: The user's device fingerprint information must match the information in the preset device fingerprint database.

[0144] 2. Rule storage and management

[0145] Predefined behavioral rules are stored in a database, and a management interface for these rules is provided. Administrators can easily add, delete, modify, and query behavioral rules through this interface to adapt to new security policies or changes in user behavior patterns.

[0146] (III) Behavior Analysis Module

[0147] The behavior analysis module performs feature extraction, pattern recognition, and abnormal behavior detection on the collected behavior data.

[0148] 1. Behavioral Feature Extraction

[0149] Feature extraction is performed on the collected multi-dimensional behavioral data, transforming the raw data into feature vectors that can be used for behavioral analysis and authentication decisions.

[0150] 2. Behavioral Pattern Recognition

[0151] Behavioral analysis algorithms (such as rule-based matching algorithms and clustering algorithms) are used to perform pattern recognition on the extracted behavioral features to determine whether the user's behavioral patterns are normal.

[0152] 3. Abnormal behavior detection

[0153] If a user's behavior pattern does not conform to predefined behavior rules (e.g., occasional logins outside of working hours, unfamiliar devices, high-frequency operations, etc.), it is considered abnormal behavior. The system will record the abnormal behavior information and trigger the corresponding security response mechanism (e.g., alarms, blocking access, requiring the user to perform additional verification, etc.).

[0154] (iv) Authentication Module

[0155] When a user initiates an authentication request, the authentication module compares the user's current behavior with the pre-stored behavior rules and makes an authentication decision, while also supporting dynamic rule adjustments.

[0156] 1. Behavioral comparison

[0157] When a user initiates an authentication request, the system compares the user's current behavior with pre-stored behavioral rules. The comparison process includes comprehensive analysis of multi-dimensional behavioral data.

[0158] 2. Certification Decision

[0159] Based on the comparison results, the system makes an authentication decision. If the user's current behavior conforms to all predefined behavior rules, it is considered normal behavior, and the user is allowed to log in; if it does not conform to any rule, it is considered abnormal behavior, and the authentication request is rejected or the user is required to perform additional verification.

[0160] 3. Dynamic rule adjustment

[0161] Based on users' historical behavior data and changes in security policies, the system dynamically adjusts behavior rules. For example, if a user frequently logs into the web application outside of working hours and behaves normally, the system can automatically adjust the login time rules to adapt to changes in user behavior.

[0162] (V) Self-learning module

[0163] The self-learning module continuously learns new patterns from user behavior data, automatically updates the behavior rule base, and optimizes the behavior analysis algorithm and authentication model.

[0164] 1. Behavioral pattern learning

[0165] The system continuously learns new behavioral patterns from user behavior data and automatically updates its behavior rule base. For example, if a user frequently uses a new device or browser to access web applications, the system can automatically add the device or browser's fingerprint information to the device fingerprint rule base.

[0166] 2. Model Optimization

[0167] Based on user feedback and security incident statistics, the system continuously optimizes behavior analysis algorithms and authentication models to improve the accuracy and reliability of authentication. If a rule frequently misjudges (e.g., logins are always blocked on weekends), the system automatically lowers the priority of that rule.

[0168] (vi) Rule Update Module

[0169] 1. Manual update by administrator

[0170] Administrators can manually update behavior rules through the management interface. For example, when a company relocation causes a change in commonly used login locations, the administrator can update the login location rules to adapt to the new environment.

[0171] 2. Automatic update prompt

[0172] The system can automatically prompt administrators to update behavior rules based on users' historical behavior data and changes in security policies. For example, if a user's behavior pattern changes significantly (such as a sudden increase in access frequency outside of working hours), the system can prompt the administrator to check and update the corresponding behavior rules.

[0173] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A web authentication enhancement method based on user behavior analysis, characterized in that: Includes the following steps: (a) Collect multi-dimensional user behavior data, including login behavior data, access behavior data, operation behavior data and device fingerprint data; (b) A predefined behavioral rule library that includes login time restriction rules, device fingerprint matching rules, access frequency threshold rules, and operation path compliance rules; (c) Compare the current user behavior data with the behavior rule base in real time to generate a behavior matching score; (d) Execute authentication decisions based on the behavior matching score, the authentication decisions including: directly granting authentication, triggering secondary verification, or blocking access; (e) Dynamically adjust the rule thresholds of the behavior rule base based on user historical behavior data, and optimize the rule weights through a self-learning mechanism.

2. The Web authentication enhancement method based on user behavior analysis according to claim 1, characterized in that: In step (a): login behavior data includes login timestamp and login geolocation information; device fingerprint data is collected through browser API, including browser version, operating system type and screen resolution.

3. The Web authentication enhancement method based on user behavior analysis according to claim 2, characterized in that: The behavior matching score in step (c) is generated as follows: the device fingerprint matching result is assigned a first weight; the operation path compliance detection result is assigned a second weight; and the final score is obtained by comprehensive weighted calculation.

4. The Web authentication enhancement method based on user behavior analysis according to claim 3, characterized in that: The dynamic adjustments in step (e) include: relaxing the login time limit for users who log in continuously without any abnormalities; and correcting the rule thresholds in reverse based on the misjudgment logs.

5. A system for the Web authentication enhancement method based on user behavior analysis according to claim 4, characterized in that: include: The data acquisition module is used to collect behavioral data in step (a); The rules management module is used to store and configure the behavioral rule library in step (b); The behavior analysis engine is used to perform the behavior matching score calculation in step (c); The certification decision unit is used to implement the certification decision in step (d); The self-learning optimization module is used to dynamically adjust the rule base in step (e).

6. The system according to claim 5, characterized in that: The data acquisition module includes: a front-end data collection unit that collects device fingerprint and operation behavior data via JavaScript; The backend log parsing unit extracts access frequency and page dwell time from the server logs.

7. The system according to claim 6, characterized in that: The self-learning optimization module includes: a rule weight calculation submodule, which dynamically adjusts the influence coefficient of each rule based on historical behavior data; The whitelist management submodule automatically adds verified device fingerprints to the trusted list.

Images