User identification method and device, electronic equipment, storage medium and program product

Abstract

The invention discloses a user identification method and device, electronic equipment, a storage medium and a program product, and relates to the technical field of computers, and the method can solve the problem of low user identification accuracy. Specifically, the method comprises the following steps: obtaining an access request of a target user for a service system, and obtaining access information of the target user based on the access request; generating a user portrait corresponding to the target user based on the access information; a target feature and a target rule are compared to determine whether the target user is a real user, the target feature is a feature corresponding to the user portrait, the target rule is a rule corresponding to the target feature in a user access rule base, and the user access rule base is used for determining whether the target user is the real user; and under the condition that the target feature accords with the target rule, determining that the target user is a real user.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a user identification method, device, electronic device, storage medium, and program product. Background Technology

[0002] In today's network environment, business systems face increasingly complex security threats, such as malicious access by non-authentic users. In such cases, electronic devices need to identify legitimate users, allowing them to access the business system normally, while also blocking illegitimate users to ensure the security of the business system.

[0003] However, in related technologies, electronic devices use pre-set static rules to intercept non-real users. For example, if the same IP makes more than 10 requests within one minute, it will be automatically identified as a non-real user. However, this method is prone to misjudgment, resulting in low accuracy in identifying users. Summary of the Invention

[0004] This application provides a user identification method, device, electronic device, storage medium, and program product, which can effectively solve the problem of low accuracy in user identification.

[0005] In a first aspect, embodiments of this application provide a user identification method, including: Obtain the target user's access request to the business system, and obtain the target user's access information based on the access request; A user profile corresponding to the target user is generated based on the access information; The target features and target rules are compared to determine whether the target user is a real user. The target features are the features corresponding to the user profile, and the target rules are the rules corresponding to the target features in the user access rule base. The user access rule base is used to determine whether the target user is a real user. If the target characteristics match the target rules, the target user is determined to be a real user.

[0006] Optionally, the comparison target features and target rules include: Whether the target feature matches the feature corresponding to the real user is determined by comparing the similarity and / or conformity between the target feature and the target rule; The similarity is obtained based on the following formula: Sim(zi, ri)=(zi · ri) / (|zi| · |ri|) The compliance degree is obtained based on the following formula: Match(zi, ri) = 1 - |zi - ri| / max(zi, ri) Wherein, zi is the target feature, and ri is the target rule; The step of determining the target user as a real user when the target characteristics match the target rules includes: If the similarity is greater than a first preset threshold or the conformity is greater than a second preset threshold, the target feature conforms to the target rule, and the target user is determined to be the real user.

[0007] Optionally, before comparing the target features and target rules, the following steps are included: The target rule is generated based on historical user access information to the business system within a preset time period.

[0008] Optionally, generating the target rule based on historical user access information to the business system within a preset time period includes: The target rule is obtained based on the following formula: .

[0009] in, The access value of the target rule corresponding to time t; This represents the actual access value corresponding to time t-1; The access value of the target rule corresponding to time t-1; Represents a constant. .

[0010] Optionally, the method further includes: If the target user is determined to be a real user, the user access rule base is updated based on the target user's access information.

[0011] Optionally, the access information includes at least one of the following: device information, IP address, access timestamp, and access records; the user profile includes at least one of the following: the target user's access information, the target user's click behavior information, and the target user's page dwell time; the user access rule base includes: characteristics corresponding to non-real users, the attack patterns of the non-real users, and the method for determining whether a user is a real user. The step of generating a user profile corresponding to the user based on the access information includes: The access information is retrieved to obtain retrieval results, and the user profile is generated based on the retrieval results. The retrieval results include at least one of the target user's click behavior information and the target user's page dwell time.

[0012] Secondly, embodiments of this application also provide a user identification device, including: The acquisition module is used to acquire the access requests of the target user to the business system, and to acquire the access information of the target user based on the access requests; The first generation module is used to generate a user profile corresponding to the target user based on the access information; The comparison module is used to compare target features and target rules to determine whether the target user is a real user. The target features are the features corresponding to the user profile, and the target rules are the rules corresponding to the target features in the user access rule base. The user access rule base is used to determine whether the target user is a real user. The determination module is used to determine that the target user is a real user if the target characteristics match the target rules.

[0013] Thirdly, embodiments of this application provide an electronic device, including: a processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, it implements the steps of the user identification method as described in any one of the first aspects.

[0014] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the user identification method as described in any one of the first aspects.

[0015] Fifthly, embodiments of this application also provide a computer program product, which is stored in a storage medium and executed by at least one processor to implement the steps of the user identification method as described in any one of the first aspects.

[0016] In this embodiment, the user identification system acquires access requests from target users to the business system, obtains access information based on these requests, generates a user profile corresponding to the target user, and compares the features in the user profile with target rules. If the features match the target rules, the target user is identified as a real user. By comparing rules and features, real users can be identified accurately and flexibly, improving the accuracy of user identification. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart of a user identification method provided in an embodiment of this application; Figure 2 This is a functional diagram of a business system and a user identification system provided in an embodiment of this application; Figure 3 This is a flowchart illustrating the configuration of a user identification system in a business system, as provided in an embodiment of this application. Figure 4 This is a software schematic diagram of a user identification system provided in an embodiment of this application; Figure 5 This is a schematic diagram of the structure of a user identification device provided in an embodiment of this application; Figure 6 This is a structural diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0019] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0020] This application provides a user identification method, device, electronic device, storage medium, and program product. The embodiments of this application will be described in detail below with reference to the accompanying drawings and specific embodiments and application scenarios.

[0021] Please see Figure 1 , Figure 1 This is a flowchart of a user identification method provided in an embodiment of this application. The method is applied to a user identification system and specifically includes the following steps: Step 101: Obtain the target user's access request to the business system, and obtain the target user's access information based on the access request.

[0022] In some embodiments, the business system can be a system accessible to the outside world through a webpage, such as a company's management system or shopping system; no restrictions are placed on the business system here. The user identification system is used to identify whether a user is a real user or not. The user identification system and the business system can be two independent systems, or they can be integrated. The advantage of keeping the user identification system and the business system independent is that it minimizes the intrusion into the business system. That is, the business system only needs to write a small amount of interface code according to the user identification system's access specifications to redirect to the user identification system, efficiently completing user identification and verification, greatly reducing interference and modification requirements to the existing code structure. Furthermore, while achieving minimal intrusion cost into the business system, it strengthens the security protection capabilities of front-end service access, ultimately achieving the goal of accurate and efficient real user identification.

[0023] In the embodiments of this application, the user identification system and the business system are used as examples of two independent systems.

[0024] In some embodiments, when a user accesses a business system, the business system can identify the accessing user through a user identification system. Optionally, the business system can automatically redirect to the user identification system using an interpreted scripting language (JavaScript, JS) on the page. The user identification system can then obtain the user's access request to the business system and retrieve the target user's access information based on the access request.

[0025] Optionally, the functions of the business system and the user identification system can be as follows: Figure 2 As shown.

[0026] Function 1: The person in charge of the business system registers in the user identification system and sets the relevant configuration information of the business system.

[0027] Before a business system identifies users accessing the system through the user identification system, the person in charge of the business system must register in the user identification system and then log in to configure it. The configuration may include configuring a redirect address and configuring a blacklist. The redirect address refers to the address used by the business system to access the user identification system, and the blacklist stores the network protocol (Internet Protocol, IP) of users who are not allowed to access the business system.

[0028] like Figure 3 As shown, Figure 3 This is a flowchart of a business system configuration user identification system provided in an embodiment of this application.

[0029] Step 301: The person in charge of the business system registers in the user identification system.

[0030] Step 302: Is the registration successful?

[0031] If successful, proceed to step 303; otherwise, proceed to step 301.

[0032] Step 303: The person in charge of the business system logs into the user identification system.

[0033] Step 304: The person in charge of the business system creates an access instance corresponding to the business system.

[0034] Step 305: The person in charge of the business system determines the redirect address.

[0035] Step 306: Has the person in charge of the business system configured a blacklist?

[0036] If configured, proceed to step 307; otherwise, the process ends.

[0037] Step 307: The person in charge of the business system configures the blacklist.

[0038] The preliminary configuration of the business system can be completed through the above steps 301-307.

[0039] Function 2: Configure the business system based on the configuration information.

[0040] After the initial configuration is completed, a common method is built in the front-end service of the business system. For example, this common method can be built using JS so that when any page in the business system is accessed by a user, this common method will be triggered and redirected to the user identification system, enabling the user identification system to authenticate and identify the user in real time.

[0041] After the electronic device encapsulates the public method, it obtains the jump address and concatenates a callback address based on the jump address. This callback address is used to call back to the business system. That is, after the user identification system identifies the user, it can use the callback address to call back to a specific address in the business system that the user wants to access.

[0042] Function 3: The front-end service of the user identification system obtains user access requests to the business system and obtains the access information of the target user based on the access requests.

[0043] When a user requests access to any page of the business system, the business system can generate an access request for that user and send it to the front-end service of the user identification system. The front-end service of the user identification system receives the access request and obtains the user's access information based on it. This access information includes: device information, IP address, access timestamp, access records, and custom parameters defined by the business system.

[0044] Function 4: The front-end service of the user identification system sends access information to the back-end service of the user identification system.

[0045] In some embodiments, the front-end service of the user identification system may encapsulate access information into a form and send the form to the back-end service of the user identification system.

[0046] Function 5: The user identification system can determine whether a user is a risky user based on access information. If the user is a risky user, the front-end service of the user identification system can retrieve a verification code for the user to manually verify.

[0047] In some embodiments, the user identification system can determine whether a current user is a risky user based on access information; alternatively, it can verify the user's IP address. The user identification system can determine whether a user is a risky user by detecting whether the IP address corresponding to the current user frequently accesses the same callback address within a short period. For example, if an IP address frequently accesses the same callback address within a short period, the user corresponding to that IP address is recorded as a risky user. The risk label on the user is not immediately removed; if the user is not identified as a risky user by other rules within a preset time period (e.g., one week), the user's risk is automatically removed.

[0048] Optionally, the user identification system obtains the timestamp of the user's current access to the business system, then retrieves the user's last access record from the cache, checks the interval between user accesses and the number of user access requests. If the requirements for a risky user are met, then the user is a risky user; otherwise, the user is not a risky user.

[0049] Optionally, when the user identification system identifies a user, it can determine the user's code based on the user's access information. If the user is considered a high-risk user, the backend service of the user identification system sends the user's code to the frontend service. The frontend service then retrieves a verification code based on the returned code, requiring the user to perform manual verification. After triggering the verification code, the frontend service submits the user's manual verification result to the backend service for verification. If the verification code passes, the user can access the address corresponding to the callback address normally. If the verification fails, manual verification is required again.

[0050] Among them, the verification code type is random, such as: sliding puzzle verification code, text selection verification code, obstacle avoidance verification code, word order selection verification code, icon selection verification code, reasoning puzzle verification code, word order selection verification code, and spatial reasoning verification code, etc. There are no restrictions on the verification code type.

[0051] Function 6: The backend service of the user identification system can filter users in the blacklist.

[0052] In some embodiments, the backend service of the user identification system can filter users in the blacklist and display "Current IP is in the blacklist and cannot access the current address" in the frontend service of the user identification system.

[0053] Function 7: The backend service of the user identification system can identify users who access the system frequently.

[0054] In some embodiments, the backend service of the user identification system can record user access information to identify users with high frequency of access, thereby identifying high-risk users.

[0055] Function 8: The backend service of the user identification system can deeply identify the users who access the system.

[0056] The deep user identification function can identify crawler users, Virtual Private Network (VPN) users, and fingerprint browser users, offering flexibility in identification. This deep user identification function is described in detail in the following embodiments and will not be elaborated upon further here.

[0057] Step 102: Generate a user profile corresponding to the target user based on the access information.

[0058] In some embodiments, the user identification system organizes the device information, IP address, access timestamp, and access records in the user's access information, synchronizes this information to the artificial intelligence service, and uses the artificial intelligence service to perform a search based on the user's access information to obtain a user profile.

[0059] Optionally, the user profile includes at least one of the following: the target user's access information, the target user's click behavior information, and the target user's page dwell time; The step of generating a user profile corresponding to the user based on the access information includes: The access information is retrieved to obtain retrieval results, and the user profile is generated based on the retrieval results. The retrieval results include at least one of the target user's click behavior information and the target user's page dwell time.

[0060] Understandably, in this embodiment, the user identification system can better understand user information by generating user profiles, which makes it easier to more accurately determine whether a user is a real user. Furthermore, comprehensive and detailed user profiles provide richer judgment criteria for artificial intelligence, helping the user identification system to more accurately identify the authenticity and credibility of users and effectively distinguish between real users and malicious users.

[0061] Step 103: Compare the target features and target rules to determine whether the target user is a real user. The target features are the features corresponding to the user profile, and the target rules are the rules corresponding to the target features in the user access rule base. The user access rule base is used to determine whether the target user is a real user.

[0062] In some embodiments, the user access rule base is trained based on a large amount of real user behavior data and includes methods for identifying real user behavior. The user access rule base includes: features corresponding to non-real users, attack patterns of the non-real users, and methods for determining whether a user is a real user. For example, the user access rule base determines whether a user is a real user by using the behavioral characteristics of VPN users. The user access rule base also determines whether a user is a real user by using the fingerprint of the same user accessing through a browser. The user access rule base can also determine whether a user who frequently accesses the site within a short period of time is a real user. Furthermore, the user access rule base can also identify real users when multiple users perform the same operation at the same time.

[0063] One method for training the user access rule base is to use published attack data from non-real users as training data. This attack data contains rich attack patterns, behavioral characteristics, and related information of non-real users, providing a data foundation for learning the user access rule base.

[0064] A recurrent neural network (RNN) machine learning model is then used to deeply mine the training data. RNNs are particularly adept at capturing temporal and long-term dependencies in sequence data, making them an ideal choice for learning complex patterns and features from attack data. During training, the RNN not only automatically extracts new attack behavior rules from the training data but also references and integrates knowledge and rules from the initial user access rule base. This initial user access rule base contains predefined rules based on security domain knowledge, providing guidance and constraints for the RNN's learning.

[0065] Through training and learning within a recurrent neural network, the user access rule base is continuously expanded and improved. Newly extracted attack behavior rules complement the rules in the initial user access rule base, forming a more comprehensive, accurate, and efficient user access rule base. This user access rule base not only includes the characteristics of non-real users, their attack patterns, and methods for determining whether a user is a real user, but also contains rich domain knowledge and experience, enabling it to play a crucial role in network attack detection, analysis, and response. Furthermore, the user access rule base obtained by combining newly extracted attack behavior rules with those in the initial user access rule base can identify malicious access that is difficult to detect using traditional methods, improving the accuracy and flexibility of user identification, ensuring the security of business systems, and providing reliable access control for business systems.

[0066] Optionally, the comparison target features and target rules include: Whether the target feature matches the feature corresponding to the real user is determined by comparing the similarity and / or conformity between the target feature and the target rule; The similarity is obtained based on the following formula: Sim(zi, ri)=(zi · ri) / (|zi| · |ri|) The compliance degree is obtained based on the following formula: Match(zi, ri) = 1 - |zi - ri| / max(zi, ri) Wherein, zi is the target feature, and ri is the target rule; The step of determining the target user as a real user when the target characteristics match the target rules includes: If the similarity is greater than a first preset threshold or the conformity is greater than a second preset threshold, the target feature conforms to the target rule, and the target user is determined to be the real user.

[0067] The following is a specific example to illustrate this.

[0068] Suppose user A's characteristics (zi) are: using 3 different browser types within 24 hours, and accessing the same page 20 times within 24 hours.

[0069] The rule (ri) corresponding to the feature in the user access rule base is: a real user uses 2-4 browser types within 24 hours, and visits the same page an average of 15-25 times within 24 hours. To simplify the calculation, the user identification system can take the value corresponding to the rule as an intermediate value, that is, using 3 browser types within 24 hours, and visiting the same page an average of 20 times within 24 hours.

[0070] The similarity calculation is performed below: Since the similarity calculation formula requires the dot product and magnitude of vectors, the user identification system needs to convert features and rules into vectors. In this one-dimensional example, the user identification system can treat each feature as a vector component. For example, user A's feature vector (zi): [3, 20], rule vector (ri): [3, 20], the dot product of the vectors is: zi·ri = 3·3 + 20·20 = 9 + 400 = 409, and the magnitude of the vectors is: |zi| = sqrt(9 + 400) = sqrt(409)≈20.22, |ri| = sqrt(409) ≈ 20.22.

[0071] Therefore, the similarity is: Sim(zi, ri)=409 / (20.22 * 20.22) ≈ 1, which shows that the features of user A are very similar to the rules in the rule base.

[0072] Then perform a compliance calculation: The formula for calculating the conformity requires calculating the difference between the feature vector and the rule vector and dividing by the larger value. The difference is: |zi - ri| = |[3, 20] - [3, 20]| = [0, 0], and the larger value is: max(zi, ri) = max([3, 20], [3, 20]) = 20.

[0073] Therefore, the conformity is: Match(zi, ri)=1 - 0 / 20 = 1, which indicates that user A's characteristics completely conform to the rules in the rule base.

[0074] The user identification system, by combining the degree of conformity and similarity, determines that user A is a real user.

[0075] Understandably, in this embodiment, the degree of conformity and similarity can be used to accurately identify whether a user is a real user.

[0076] Optionally, before comparing the target features and target rules, the following steps are included: The target rule is generated based on historical user access information to the business system within a preset time period.

[0077] Understandably, in this embodiment, the rules in the user access rule base are determined based on the access information of real users in history. This ensures the accuracy of the rules and enables the accurate identification of real users through the rules.

[0078] Optionally, generating the target rule based on historical user access information to the business system within a preset time period includes: The target rule is obtained based on the following formula: .

[0079] in, The access value of the target rule corresponding to time t; This represents the actual access value corresponding to time t-1; The access value of the target rule corresponding to time t-1; Represents a constant. .

[0080] In this embodiment, The weights of the actual access value at time t-1 and the access value of the target rule at time t-1 within the total access value of the target rule at time t are determined. When the weights are close to 1, the access value of the target rule at time t depends more on the actual access value at time t-1; when the weights are close to 0, the access value of the target rule at time t depends more on the access value of the target rule at time t-1. In the embodiments of this application, The value can be 0.9.

[0081] The following is a specific example to illustrate this.

[0082] Suppose that the user identification system counts the following number of visits to the same page by the same normal user over the past six days: Day 1: 10 times; Day 2: 12 times; Day 3: 14 times; Day 4: 13 times; Day 5: 15 times; Day 6: 13 times. User identification systems can... The formula calculates the access value corresponding to the seventh day, which requires sequential derivation. , , , , , And then according to Sure That is, to determine the access value corresponding to the seventh day.

[0083] The user identification system first uses the average number of visits over the previous three days as... ,Right now, = (10 + 12 + 14) ÷ 3 = 12. Therefore, we can determine... =0.9×10+0.1×12=10.2, =0.9×12+0.1×10.2=11.82, =0.9×14+0.1×11.82=13.782, =0.9×13+0.1×13.782=13.0782, =0.9×15+0.1×13.0782=14.80782, =0.9×13+0.1×14.80782=13.180782. Therefore, 13.180782.

[0084] User identification system will The value is updated in the user access rule base to adapt to the dynamic changes in the current network environment.

[0085] The example above is just one rule in the user access rule base. There are other ways to calculate user access rule bases besides this one, so we will not impose too many restrictions here.

[0086] Optionally, if the target user is determined to be a real user, the user access rule base is updated based on the target user's access information.

[0087] In this embodiment, the user access rule base can be updated. When the user identification system identifies the current user as a real user, the user identification system determines that the user's access information is valid and can update the user access rule base based on this access information. For example, at a fixed time (such as early morning every day), the user identification system will collect statistics on the access information of real users (the statistics include, but are not limited to, access frequency, browser type, number of accesses, and the number of users allowed to have the same behavior), and then update the rules in the user access rule base based on the statistical data.

[0088] Understandably, in this embodiment, updating the user access rule base of the user identification system can greatly improve the probability of the system identifying genuine users. Furthermore, it stores the access information of genuine users, which can serve as training data for artificial intelligence (AI), automatically training the user access rule base. Even when the network environment is constantly changing, the AI-trained user access rule base can be automatically improved without manual intervention to adjust the user identification rules. This allows the user access rule base to adjust in real time according to changes in the network environment and user behavior, continuously identifying malicious access, enhancing the adaptability and security of the user identification system, and ensuring the accuracy of user identification.

[0089] Step 104: If the target characteristics match the target rules, determine that the target user is a real user.

[0090] Understandably, the user identification system acquires access requests from target users to the business system, obtains access information based on these requests, generates a user profile corresponding to the target user, and then compares the features in the user profile with target rules. If the features match the target rules, the target user is identified as a real user. By comparing rules and features, real users can be identified accurately and flexibly, improving the accuracy of user identification.

[0091] Combination Figure 4 The interaction process between the user identification system and the business system in the embodiments of this application is described in detail.

[0092] like Figure 4 As shown, Figure 4 The business system can be deployed on computers or mobile devices, and the business system can jump to the user identification system through JS in its reference layer. This jump can be done through the Hypertext Transfer Protocol (HTTP), such as HTTP / HTTPS.

[0093] The user identification system comprises a service layer and a storage layer. The service layer includes: a sub-module communication module, a business service module, a service management module, and an AI service module.

[0094] Submodule communication is used to enable communication between the user identification system and the business system. Submodule communication consists of representational state transfer (REST) ​​and remote procedure calls. Remote procedure calls are used to request services from remote computer programs over the network, so that the user identification system can obtain access requests from the business system.

[0095] The business service module provides services to the business system and includes: an access information collection module, a rule switch setting module, a general identification rule judgment module, an artificial intelligence (AI) service invocation module, a user identification and processing module, and an access blacklist configuration module. Specifically, the access information collection module collects access information; the rule switch setting module manages the user access rule base for checking in / closing; the general identification rule judgment module sets general rules for judging users; the AI ​​service invocation module invokes AI services; the user identification and processing module processes identified users; and the access blacklist configuration module configures blacklisted users.

[0096] The service management module manages the user identification system and includes: a service configuration module, a registration and discovery module, and a log monitoring module. The service configuration module configures the services of the user identification system, the registration and discovery module discovers the business systems registered in the user identification system, and the log monitoring module monitors the logs of the user identification system.

[0097] The AI ​​service module provides AI services for the user recognition system. It includes: a data acquisition module, a user recognition rule automatic adjustment module, a data mining module, and a data training module. The data acquisition module acquires training data used in the user access rule base training process; the user recognition rule automatic adjustment module adjusts the rules in the user access rule base in real time; the data mining module mines data that can be used as training data; and the data training module trains the user access rule base.

[0098] The storage layer includes: a file storage module, a Redis module, and a MySQL module. The Redis module is used to cache data, and the MySQL module is the database where data can be stored.

[0099] Understandably, the user identification method in this application heavily leverages artificial intelligence (AI) services for user identification. Optionally, some embodiments borrow from the information transmission pattern of a spider web, mimicking its structure. Based on a single information point, such as the IP address in the access information, the method searches the current spider web for all information related to that IP address and aggregates all information to obtain a user profile. This process deeply integrates the powerful capabilities of AI services. Furthermore, AI services can not only perform user identification tasks quickly and accurately, but also intelligently identify and evaluate the authenticity and credibility of users based on historical user access information, user profiles, and other multi-dimensional information. Moreover, AI services can use access information from identified real users as new training data to update the rules in the user access rule base, continuously improving the accuracy of the rule base and effectively addressing complex and ever-changing network environments and security challenges, ensuring the precision and efficiency of access control. In addition, AI services can automatically adapt to new threat patterns, promptly detect and block potential security risks, building a solid intelligent defense for the security of business systems and identifying real users for them.

[0100] Cybersecurity remains a significant security concern, with losses due to malicious website access alone reaching billions of yuan annually. For business systems widely deployed on the public internet, this application can quickly identify accessing users, effectively blocking fraudulent access, without requiring complex code modifications to existing systems. Understandably, in related technologies, business systems typically have their own security verification schemes, but even the most basic security verification requires at least a week to develop. For more complex identification rules, the development cycle will be further extended, and these rules also need constant updates. This application, by providing an efficient and flexible solution for identifying genuine users, effectively saves the manpower costs of developing and maintaining verification schemes, significantly optimizing resource investment and economic benefits while improving security.

[0101] Other electronic devices may have used the solution of this application if: the interaction process, data transmission, and processing logic between two independent business systems and a user identification system are the same as those in this application; or, if other electronic devices are tested by non-real users and their identification process and processing logic are the same as those in this application, then they have used the solution of this application.

[0102] Please refer to Figure 5 , Figure 5 This is a schematic diagram of a user identification device 500 provided in an embodiment of this application. The user identification device 500 is applied to a user identification system, and the device specifically includes: The acquisition module 501 is used to acquire the access request of the target user to the business system, and to acquire the access information of the target user based on the access request; The first generation module 502 is used to generate a user profile corresponding to the target user based on the access information; The comparison module 503 is used to compare target features and target rules to determine whether the target user is a real user. The target features are the features corresponding to the user profile, and the target rules are the rules corresponding to the target features in the user access rule base. The user access rule base is used to determine whether the target user is a real user. The determination module 504 is used to determine that the target user is a real user if the target characteristics meet the target rules.

[0103] Optionally, the comparison module 503 also includes: The comparison submodule is used to determine whether the target feature matches the feature corresponding to the real user by comparing the similarity and / or conformity between the target feature and the target rule. The similarity is obtained based on the following formula: Sim(zi, ri)=(zi · ri) / (|zi| · |ri|) The compliance degree is obtained based on the following formula: Match(zi, ri) = 1 - |zi - ri| / max(zi, ri) Wherein, zi is the target feature, and ri is the target rule; The determination submodule is used to determine that the target user is the real user when the similarity is greater than a first preset threshold or the conformity is greater than a second preset threshold, and the target feature conforms to the target rule.

[0104] Optionally, the user identification device 500 also includes: The second generation module is used to generate the target rule based on historical user access information to the business system within a preset time period.

[0105] Optionally, the second generation module also includes: The target rule is obtained based on the following formula: .

[0106] in, The access value of the target rule corresponding to time t; This represents the actual access value corresponding to time t-1; The access value of the target rule corresponding to time t-1; Represents a constant. .

[0107] Optionally, the user identification device 500 also includes: The update module is used to update the user access rule base based on the access information of the target user when it is determined that the target user is a real user.

[0108] Optionally, the first generation module 502 further includes: The access information includes at least one of the following: device information, IP address, access timestamp, and access record; the user profile includes at least one of the following: the target user's access information, the target user's click behavior information, and the target user's page dwell time; the user access rule base includes: characteristics corresponding to non-real users, the attack patterns of non-real users, and the method for determining whether a user is a real user. The retrieval submodule is used to retrieve the access information, obtain retrieval results, and generate the user profile based on the retrieval results. The retrieval results include at least one of the target user's click behavior information and the target user's page dwell time.

[0109] The user identification device 500 provided in this application embodiment can perform the above-described... Figure 1 The method embodiments shown are similar in principle and technical effect, and will not be described again here.

[0110] This application also provides an electronic device. Since the principle by which this electronic device solves the problem is similar to the user identification method in this application, the implementation of this electronic device can be found elsewhere. Figure 1 The implementation of the method shown will not be repeated here. Figure 6 As shown, the electronic device according to an embodiment of this application includes: a processor 610, configured to read a program from a memory 620 and execute the following processes: Obtain the target user's access request to the business system, and obtain the target user's access information based on the access request; A user profile corresponding to the target user is generated based on the access information; The target features and target rules are compared to determine whether the target user is a real user. The target features are the features corresponding to the user profile, and the target rules are the rules corresponding to the target features in the user access rule base. The user access rule base is used to determine whether the target user is a real user. If the target characteristics match the target rules, the target user is determined to be a real user.

[0111] Optionally, the processor 610 is also used to read the program from the memory 620 and perform the following steps: Whether the target feature matches the feature corresponding to the real user is determined by comparing the similarity and / or conformity between the target feature and the target rule; The similarity is obtained based on the following formula: Sim(zi, ri)=(zi · ri) / (|zi| · |ri|) The compliance degree is obtained based on the following formula: Match(zi, ri) = 1 - |zi - ri| / max(zi, ri) Wherein, zi is the target feature, and ri is the target rule; The step of determining the target user as a real user when the target characteristics match the target rules includes: If the similarity is greater than a first preset threshold or the conformity is greater than a second preset threshold, the target feature conforms to the target rule, and the target user is determined to be the real user.

[0112] Optionally, the processor 610 is also used to read the program from the memory 620 and perform the following steps: The target rule is generated based on historical user access information to the business system within a preset time period.

[0113] Optionally, the target rule is obtained based on the following formula: .

[0114] in, The access value of the target rule corresponding to time t; This represents the actual access value corresponding to time t-1; The access value of the target rule corresponding to time t-1; Represents a constant. .

[0115] Optionally, the processor 610 is also used to read the program from the memory 620 and perform the following steps: If the target user is determined to be a real user, the user access rule base is updated based on the target user's access information.

[0116] Optionally, the access information includes at least one of the following: device information, IP address, access timestamp, and access records; the user profile includes at least one of the following: the target user's access information, the target user's click behavior information, and the target user's page dwell time; the user access rule base includes: characteristics corresponding to non-real users, the attack patterns of the non-real users, and the method for determining whether a user is a real user. Processor 610 is also used to read the program from memory 620 and perform the following steps: The access information is retrieved to obtain retrieval results, and the user profile is generated based on the retrieval results. The retrieval results include at least one of the target user's click behavior information and the target user's page dwell time.

[0117] The electronic device provided in this application embodiment can perform the above-described functions. Figure 1 The method embodiments shown are similar in principle and technical effect, and will not be described again here.

[0118] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the above-described... Figure 1 The various processes in the user identification method embodiments are all identical and achieve the same technical effect, so they will not be described again here to avoid repetition. The computer-readable storage medium mentioned includes, for example, read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0119] This application embodiment also provides a computer program / program product, which is stored in a storage medium and executed by at least one processor to implement the above. Figure 1 The various processes of the user identification method embodiments described herein can achieve the same technical effect, and will not be repeated here to avoid duplication.

[0120] In the several embodiments provided in this application, it should be understood that the disclosed methods and apparatus can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0121] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can be physically included separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0122] The integrated units implemented as software functional units described above can be stored in a computer-readable storage medium. These software functional units, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute some steps of the transmission and reception methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0123] The above description is the preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principles described in this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A user identification method, characterized in that, Applications in user identification systems include: Obtain the target user's access request to the business system, and obtain the target user's access information based on the access request; A user profile corresponding to the target user is generated based on the access information; The target features and target rules are compared to determine whether the target user is a real user. The target features are the features corresponding to the user profile, and the target rules are the rules corresponding to the target features in the user access rule base. The user access rule base is used to determine whether the target user is a real user. If the target characteristics match the target rules, the target user is determined to be a real user.

2. The method according to claim 1, characterized in that, The comparison target features and target rules include: Whether the target feature matches the feature corresponding to the real user is determined by comparing the similarity and / or conformity between the target feature and the target rule; The similarity is obtained based on the following formula: Sim(zi, ri)=(zi · ri) / (|zi| · |ri|) The compliance degree is obtained based on the following formula: Match(zi, ri) = 1 - |zi - ri| / max(zi, ri) Wherein, zi is the target feature, and ri is the target rule; The step of determining the target user as a real user when the target characteristics match the target rules includes: If the similarity is greater than a first preset threshold or the conformity is greater than a second preset threshold, the target feature conforms to the target rule, and the target user is determined to be the real user.

3. The method according to claim 1, characterized in that, Before comparing the target features and target rules, the following steps are included: The target rule is generated based on historical user access information to the business system within a preset time period.

4. The method according to claim 3, characterized in that, The process of generating the target rule based on historical user access information to the business system within a preset time period includes: The target rule is obtained based on the following formula: ； in, The access value of the target rule corresponding to time t; This represents the actual access value corresponding to time t-1; The access value of the target rule corresponding to time t-1; Represents a constant. .

5. The method according to claim 1, characterized in that, The method further includes: If the target user is determined to be a real user, the user access rule base is updated based on the target user's access information.

6. The method according to claim 1, characterized in that, The access information includes at least one of the following: device information, IP address, access timestamp, and access records; the user profile includes at least one of the following: the target user's access information, the target user's click behavior information, and the target user's page dwell time. The user access rule base includes: characteristics of non-real users, attack patterns of non-real users, and methods for determining whether a user is a real user; The step of generating a user profile corresponding to the user based on the access information includes: The access information is retrieved to obtain retrieval results, and the user profile is generated based on the retrieval results. The retrieval results include at least one of the target user's click behavior information and the target user's page dwell time.

7. A user identification device, characterized in that, include: The acquisition module is used to acquire the access requests of the target user to the business system, and to acquire the access information of the target user based on the access requests; The first generation module is used to generate a user profile corresponding to the target user based on the access information; The comparison module is used to compare target features and target rules to determine whether the target user is a real user. The target features are the features corresponding to the user profile, and the target rules are the rules corresponding to the target features in the user access rule base. The user access rule base is used to determine whether the target user is a real user. The determination module is used to determine that the target user is a real user if the target characteristics match the target rules.

8. An electronic device, characterized in that, include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the user identification method as described in any one of claims 1 to 6.

9. A computer-readable storage medium for storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the user identification method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, It includes computer instructions that, when executed by a processor, implement the steps in the user identification method as described in any one of claims 1 to 6.

Images